Privacy Policy

Tooly Oy – Privacy Policy Prepared: 02.04.2026 Version: 1.0 This privacy policy describes how Tooly Oy collects, processes and protects your personal data when you use our website, app and rental service. The policy complies with the General Data Protection Regulation (GDPR) and the Finnish Personal Data Act (523/1999), including sections 10 and 24 that govern the description of personal data files.

1. Data controller Tooly Oy Business ID: 3581455‑7 Address: Aleksis Kiven katu 45 A 7, Helsinki 00510, Finland

2. Person responsible for the register and contact Nikolai Savushkin, Founder Phone: +358 41 3155 938 Email: nikolai.savushkin@tooly.rent

3. Name of the register Tooly Oy’s customer register

4. Purpose of the processing of personal data Tooly Oy and its partners process personal data to: Manage rentals (bookings, access codes, locker access, returns). Identify and verify users, including credit checks. Prevent fraud and unauthorised use of the service. Provide, maintain and develop the service, including usage analytics. Conduct direct marketing and communications (with your consent). Manage customer relationships and service history. All processing is carried out in accordance with GDPR and the Personal Data Act.

5. Legal basis for the processing (GDPR Art. 6) Processing is based on the following legal bases: Contract performance (Art. 6(1)(b)): Necessary to perform or initiate the rental agreement and provide the service (e.g., bookings, access, returns). Legitimate interests (Art. 6(1)(f)): Service security, fraud prevention, system development, analytics and service improvements, balanced against your rights. Consent (Art. 6(1)(a)): For direct marketing and other optional communications; you may withdraw consent at any time without affecting prior processing. Legal obligation (Art. 6(1)(c)): For accounting, taxation, and compliance with statutory consumer‑protection and other obligations.

6. Information content of the register The following personal data may be processed: Your basic information Name and (where applicable) personal identity code (hetu) Postal address Phone number Email address Position in the company (if applicable) Company information Customer relationship and service history Rental history (tools rented, periods, locker IDs) Service history and usage patterns Credit and payment information Credit rating (via Intrum and other credit agencies) Payment information (e.g., last four digits of card number, payment processor references) Marketing and consents Consent to direct marketing Marketing preferences Technical and device data IP address Identifying information for the device (e.g., device ID, fingerprint where applicable) Location information (approximate location for service access and analytics) Advertising ID (if used) Browser type User interface and device information Access logs (timestamps, locker accesses, failed login attempts)

7. Regular sources of information Personal data is collected: Directly from you (via the website, app, forms, customer portal and in‑locker use). From Intrum credit management service and other credit‑rating or risk‑assessment services. From public sources (e.g., business registers or authority‑maintained business data). From third‑party service providers (e.g., payment processors, analysis tools, marketing platforms).

8. Regular disclosure and transfer of data Personal data is not disclosed to parties outside the EU or the European Economic Area, except where such transfers are safeguarded by appropriate mechanisms (e.g., standard contractual clauses) as required by GDPR. If Tooly begins using providers established outside the EU/EEA, this section will be updated accordingly.

9. Use of cookies and similar technologies We use cookies and similar technologies in our online service. A cookie is a small text file placed on your device to enable a safe, efficient and user‑friendly use of the service (e.g., login, basket, access code handling). We use: Essential cookies required for core service functions (cannot be disabled without affecting functionality). Analytics and marketing cookies (with your consent via the cookie banner). You can manage or disable cookies via your browser settings. For detailed information, see our Cookie Policy (separate page on Tooly’s website).

10. Principles of data protection Personal data in the register is always processed in a confidential, secure and lawful manner. Internal instructions and procedures govern how personal data is processed. The data processing system is protected by technical and organisational measures, including firewalls and access‑control systems. Data transmitted on the website and between systems is protected by an SSL‑encrypted connection. Only authorised personnel and service providers have access to personal data, under strict contractual obligations.

11. Data retention periods Customer data is retained for as long as necessary: To perform the rental agreement and provide the service. To comply with statutory obligations (e.g., accounting and tax records, typically 6–10 years). To defend or enforce claims. Marketing‑related data is retained only for as long as consent is valid or until withdrawn, and in any case for no longer than 2 years from the last direct marketing action. Inactive accounts (no bookings for 3 years) are deleted or anonymised, unless a statutory obligation requires retention.

12. Data subject rights (GDPR) You have the following rights regarding your personal data: Right to access (inspection) – You may request a copy of your data and information about how it is processed. Right to rectification – You may request correction of inaccurate or incomplete data. Right to erasure (“right to be forgotten”) – You may request deletion of your data where there is no longer a legal basis for processing. Right to restriction – You may request that processing be limited under certain conditions. Right to data portability – You may request your data in a structured, commonly used format. Right to object – You may object to processing based on legitimate interests or direct marketing. Right to withdraw consent – You may withdraw consent at any time for marketing and other consent‑based processing. You always have the right to lodge a complaint with the Data Protection Ombudsman (tietosuoja.fi) regarding the processing of your personal data.

13. Right to prohibit processing for direct marketing You have the right to prohibit the processing of your data for the purposes of direct advertising, distance selling, direct marketing, market or opinion surveys, public registers and genealogical studies. The prohibition can be submitted via: Email to nikolai.savushkin@tooly.rent (from an email address registered to you).

14. Right to inspect your data You have the right to inspect the personal data that is stored about you in the register and receive a copy of it once per calendar year free of charge. Requests must be submitted by email from an email address listed in the register as belonging to you. Tooly will respond within one month, or up to two months in complex cases, and will inform you of the reasons for any delay.

15. Rectification of errors and deletion The data controller will rectify, delete or complete personal data that is inaccurate, unnecessary, incomplete or outdated for the processing purposes. Rectification or deletion will be carried out either on our own initiative or at your request. Data may be deleted if the data subject misuses the service or uses it for unlawful or otherwise prohibited purposes.

16. Automated decision‑making and profiling As of this version, Tooly does not make decisions that significantly affect you based solely on automated processing or profiling. If this changes in the future, you will be informed and obtain the appropriate rights (e.g., human review, explanation).

17. Changes to this policy Tooly may update this privacy policy to reflect changes in our services, technical environment, or legal requirements. Changes will be published on the Tooly website with a new version number and effective date. We recommend that you check this page periodically. Material changes affecting your rights or the way we process your data will be communicated to you via email.