Basware App Privacy Policy

Last Updated: June 9, 2025

This Privacy Policy explains how Basware Corporation and its worldwide affiliated companies ("Basware", "we", "us", or "our") collect, use, and share personal and sensitive user data through our mobile application (the "Basware App") listed on the Google Play Store. We are committed to protecting your privacy in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR). This policy, together with in-app disclosures, comprehensively describes our data practices.

1. Personal and Sensitive User Data We Collect

We collect the following types of personal and sensitive user data through the Basware App:

• Personal Information You Provide: Data such as your name, email address, and phone number when you create an account, submit forms, or interact with app features (e.g., invoice processing). We do not collect or process payment-related information, such as credit card details, through the Basware App.
• Location Data: With your explicit consent, we collect precise or approximate location data from your device to provide location-based services, such as identifying nearby suppliers or verifying transaction locations. You can enable or disable location access via your device settings.
• Camera Access: With your consent, we access your device’s camera to allow you to capture images, such as scanning invoices or documents for processing within the app. You can manage camera permissions through your device settings.
• Usage and Device Information: We automatically collect data about your interactions with the app, including IP address, device type, operating system, app usage data (e.g., features used), and browsing behavior. This may involve cookies or similar technologies to enhance functionality and user experience.
• Third-Party Data: We may receive data from third-party services (e.g., business partners or analytics providers) when you use integrated features in the Basware App.

2. How We Use Your Data

We use the collected data for the following purposes:

• To provide and maintain the Basware App’s functionality, including location-based services and document scanning features.
• To process and manage invoices or other transactions (excluding payment information) based on user inputs and scanned documents.
• To personalize your experience, such as offering supplier recommendations based on your location.
• To communicate with you, including responding to inquiries and sending service-related notifications.
• To analyze usage patterns to improve app performance, security, and user experience.
• To comply with legal obligations, such as responding to regulatory requirements, or to protect our legal rights.

3. How We Share Your Data

We may share your personal and sensitive user data in the following circumstances:

• With Affiliates: We share data, with Basware’s worldwide affiliated companies to provide consistent services across our organization.
• With Service Providers: We engage trusted third-party providers (e.g., cloud hosting, analytics, or document processing services) to perform functions on our behalf. These providers may process user or usage data and are bound by data protection agreements to safeguard your information.
• For Legal Reasons: We may disclose data, to comply with applicable laws, regulations, or legal processes, or to protect our rights, safety, or property.
• Business Transfers: In the event of a merger, acquisition, or sale of assets, your data may be transferred as part of the transaction, with appropriate safeguards in place.

We do not sell your personal or sensitive user data to third parties.

4. Secure Data Handling Procedures

We implement and maintain reasonable and appropriate technical and organizational security measures to protect the personal data we process, from unauthorized access, alteration, disclosure, loss or destruction. Our security measures are summarized on our business data webpage.

We regularly audit the application of our security measures and we ask third party experts to review our security controls against international standards. These audits help us to further improve our security level.

Should despite of our security measures, a security breach occur that is likely to result in a risk to the data privacy of Users, we will inform the relevant Users and other affected parties, as well as relevant authorities when required by applicable data protection law, about the security breach as soon as reasonably possible.

5. Data Retention and Deletion Policy

We retain personal and sensitive user data, including location and camera data, only for as long as necessary to fulfill the purposes outlined in this policy (e.g., providing services, complying with legal obligations). When data is no longer needed, we securely delete or anonymize it. For example:

• Account data is retained while your account is active and for a reasonable period thereafter to comply with legal or audit requirements.
• Location data is retained only for the duration of the session or transaction requiring it, unless otherwise required by law.
• Images captured via camera (e.g., scanned invoices) are retained only as long as needed for processing or as required by applicable regulations.

You may request deletion of your data by contacting us (see Section 6), subject to legal disconcert obligations.

6. Your Choices and Rights

You have the following rights regarding your personal and sensitive user data, subject to applicable laws:

• Access and Correction: Request access to or correction of your data, including location data and images.
• Deletion: Request deletion of your data, subject to legal retention requirements.
• Opt-Out: Disable location access or revoke camera permissions via your device settings, or opt out of marketing communications and cookies by contacting us.
• Data Portability: Request a copy of your data in a structured, commonly used format.
• Objection or Restriction: Object to or restrict certain data processing activities, where applicable.

To exercise these rights or submit inquiries, contact us at the details provided in Section 7.

7. Contact Us

For questions, concerns, or to exercise your data protection rights, please contact our privacy team:

Email: privacy@basware.com

Address: Basware Corporation, Linnoitustie 2, FI-02600 Espoo, Finland

You may also submit inquiries via our website at https://www.basware.com/en/contact.

For more details about our data practices, please refer to our full privacy notice at https://www.basware.com/en/footer/privacy-notice.