This statement supplements HMD Global Privacy Policy for products and services. It describes how your personal data is processed for credit score checks.

If you wish to subscribe to our products, your credit score must be verified by an independent country-specific service provider to determine if the credit can be granted. The country-specific terms on credit score checks have been listed below. Your basic information and subscription information are collected by us from you when you fill the form to subscribe to a product. The credit score check process requires that your personal data is disclosed to the credit score service provider and combined with its credit information.

Your personal data is processed to determine your credit score as a prerequisite for granting the credit for you to subscribe to our products. In case you do not provide us the necessary data, subscription cannot be granted. If you choose to purchase our products instead of subscribing them, your credit score is not determined.

Why are we processing your data?

1. Determining credit score:

We use credit score to determine if HMD’s products can be subscribed to. What data are we processing?

• Basic information: Name, title, date of birth, gender, address, phone number, and email address.

  o What is the basis for processing data? Your consent: Your credit score is determined based on your one-time consent, and your right to withdraw your consent is applied automatically when your consent expires after your credit score is determined.

• Subscription information: Products subscribed to.

  o What is the basis for processing data? Your consent: Your credit score is determined based on your one-time consent, and your right to withdraw your consent is applied automatically when your consent expires after your credit score is determined.

• Credit information: Outstanding balance of purchases, fees, and interests, and purchase and payment history including possible defaults.

  o What is the basis for processing data? Your consent: Your credit score is determined based on your one-time consent, and your right to withdraw your consent is applied automatically when your consent expires after your credit score is determined.

2. Providing your data to the credit score service provider:

Your data is disclosed to the credit score service provider for calculating your credit score by automated means as described below. Credit score service providers process your data as independent controllers, and they have been listed below.

What data are we processing?

• Basic information: Name, title, date of birth, gender, address, phone number, and email address.

  o What is the basis for processing data? Your consent: Your credit score is determined based on your one-time consent, and your right to withdraw your consent is applied automatically when your consent expires after your credit score is determined.

• Subscription information: Products subscribed to.

  o What is the basis for processing data? Your consent: Your credit score is determined based on your one-time consent, and your right to withdraw your consent is applied automatically when your consent expires after your credit score is determined.

3. Providing payment details to the credit score service provider:

We will disclose the status of your account to the credit score service provider when our contract with you requires to do so. This may affect your future credit score positively or negatively.

What data are we processing?

• Credit information: Outstanding balance of purchases, fees, and interests, and purchase and payment history including possible defaults.

  o What is the basis for processing data? Contract between us: If positive credit reporting is relevant in your country, it is necessary for your subscription that the score remains accurate throughout the subscription period.

• Changes in subscriber status: Any unanticipated change in your account status such as payment plan updates, settlements, complaints, or changes of residency, which might affect your credit score.

  o What is the basis for processing data? Contract between us: If positive credit reporting is relevant in your country, it is necessary for your subscription that the score remains accurate throughout the subscription period.

4. Complying with legal obligations:

When you have a long-term agreement with us, we need to verify periodically that you are not subject to sanctions.

What data are we processing?

• Basic information: Name, date of birth, gender, and address.

  o What is the basis for processing data? Legal requirement to comply with sanctions and our legitimate interests of preventing money-laundering, terrorist financing and other offenses.

5. Developing products and services:

We compare accepted credit scores and their default rates to determine the acceptable credit score level and improve our products and services.

What data are we processing?

• Credit score.

  o What is the basis for processing data? Legitimate interest of developing our products and services.

• Credit information: Outstanding balance of purchases, fees, and interests, and purchase and payment history including possible defaults.

  o What is the basis for processing data? Legitimate interest of developing our products and services.

How long is the data retained?

Basic information, subscription information, credit information, and credit score are retained for 6 years after the subscription.

Automated decision-making for determining the credit score

An acceptable credit score is necessary for entering into a contract with us. The assessment of your credit score and the consequent decision-making of approving the credit has been automated in order to make fast and accurate decisions without human errors. If you wish to request human intervention for the credit decision, express your points of view, or contest the credit decision, please contact us at https://www.hmdglobal.com/support#contact-us. If you ask us to review the decision, please be prepared to provide supporting evidence for your views. We recommend that you obtain a credit report in order to verify its accuracy and, if relevant in your country, check if your electoral register address is up to date.

We ensure that the scorecards used to calculate your credit score are validated and tested regularly to ensure that the scores are calculated accurately. The scoring methods are based on objective, consistent and fair criteria in accordance with international standards.

Automated decision-making is used to review that you:

• are known in the given address (and, depending on the country, that it matches the electoral register),
• have a credit score which is accepted by us, and
• are not on known sanction lists.

The credit score also takes into consideration the number of your good and delinquent accounts (or no accounts at all) as well as the time you have been registered in the official records. The credit score may also consider the sums of your accounts and the time passed since payments and defaults. The decision-making is never based on your characteristics such as religion, race, political beliefs, sexual orientation, disability, or criminal record.

Country-specific information on service providers

Your information is disclosed to a credit score service provider which processes your personal data as an independent controller. Country-specific credit score service providers are listed below:

Germany

• For the purpose of the credit rating/solvency check, Creditreform Boniversum GmbH, Hellersbergstr. 11, 41460 Neuss, Germany, sends us your personal address data and solvency data saved in its database, including score values calculated using actuarial techniques, insofar as we have credibly demonstrated our legitimate interest therein. The calculation of the score value also uses address data amongst other things.

United Kingdom

• TransUnion International UK Limited, One Park Lane, Leeds, West Yorkshire, LS3 1EP, United Kingdom acts as the credit reference agency when products are hired in the United Kingdom. We disclose information from your credit application and about your financial situation and financial history to TransUnion. TransUnion will supply to us both public and shared credit, financial situation and financial history information and fraud prevention information. We will continue to exchange information about you with TransUnion while you have a relationship with us. This information may affect your credit score which is supplied to other organisations by TransUnion. When TransUnion receives a search from us, they will place a search footprint on your credit file that may be seen by other lenders. TransUnion provides a Credit Reference Agency Information Notice known as CRAIN which describes how data is obtained, processed, and shared by TransUnion. CRAIN is available at https://www.transunion.co.uk/crain. Privacy Notice is available at https://www.transunion.co.uk/legal-information/bureau-privacy-notice.
• Your payment details, including credit information and changes in subscriber status, are disclosed to the credit score service provider in accordance with your contract with us. This may affect your future credit score positively or negatively.