Oilon privacy policy

Oilon Group Oy and the Oilon Group

Version 3.2Effective 14 October 2026OILON-ICT-PRIV-2026-03-EN

Print or save as PDF

1. Introduction and scope

This privacy policy explains how Oilon Group Oy and the companies of the Oilon Group (hereafter "Oilon" or "we") collect, process and use your personal data when you use our websites, our webshops, the Oilon ONE service platform, our applications, our products and related services.

This is a consolidated document: the general part (sections 1–16) applies to all of the services listed below, and the service-specific annexes (A–F) set out exactly what happens in each service. Annex F applies only to internal Oilon users. Annexes G and H contain the statutory supplements required in Mainland China and the United States. If the general part and an annex conflict, the annex prevails.

1.1 Services covered by this policy

1.2 Applicable law

We process personal data in accordance with the EU General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Finnish Data Protection Act (1050/2018) and sections 200, 202 and 205 of the Finnish Act on Electronic Communications Services (917/2014). We also comply with the Personal Information Protection Law of the People’s Republic of China (个人信息保护法, "PIPL") and with applicable US state consumer privacy laws to the extent they apply to our operations. A complete list of the regulations, directives, national laws, authority guidelines and standards on which this policy is based is set out in Annex I.

2. Data controller and contact details

Within the Oilon Group, the data controller is Oilon Group Oy and/or the Oilon Group company with which you have a business relationship. When you buy from an Oilon webshop, the controller is the group company named as the seller on your order confirmation.

If you have questions or comments, or if you need further information about this policy and the use of your personal data, please contact us at datasecurity@oilon.com.

3. Personal data we process

We process only the personal data necessary for the purposes described below. We do not collect special categories of personal data (Article 9 GDPR), such as health data or data on beliefs.

3.1 Data you provide to us

• Name, customer number, postal address, e-mail address and telephone number
• Information about the company you represent, such as company name, address, business ID, VAT number and contact persons
• Professional details such as job title and area of responsibility
• Order, delivery and payment transaction data, and information related to invoicing and collection
• General information about your customer relationship with us
• Your answers to our customer surveys and the feedback you provide
• Consents and prohibitions, for example those related to direct marketing
• The content of enquiries and support requests and the communication between us, including chat conversations
• Recruitment-related information if you apply for a job with us

3.2 Data generated by your use of our services

• Credentials, username and security information used for authentication (passwords are always stored as a salted hash and are not visible to us)
• Demographic data such as your country and preferred language
• Information related to your product: serial number, installation information, system settings and status, environmental data, technical measurement and performance data, and network identification data (IP address, online status)
• Usage data on how you and/or your device interact with us or with our products
• Device data: operating system, browser and browser version, IP address, device identifiers, screen size, regional and language settings and temperature settings
• Error reports and performance data related to our products, services and applications
• Location data at low precision, for example a city- or country-level location derived from your IP address
• Cookie and advertising identifiers and the browsing and click data linked to them (see section 12 and annexes A–E)

Some of this data is anonymous on its own but constitutes personal data when combined with other information. In that case we process it as personal data.

4. Where we collect your data from

• Directly from you, when you register as a user, place an order, complete a form, subscribe to a newsletter, take part in a customer survey or contact us
• Automatically when you use our websites, webshops, applications or the Oilon ONE service, by means of cookies and similar technologies (see section 12)
• From your Oilon products, when the device is connected to the Oilon ONE service
• From the company you represent or from our distributor, as part of a sales or delivery relationship
• From publicly available sources and public registers held by authorities, such as trade and credit registers
• From other companies within the Oilon Group

5. Purposes and legal bases of processing

We process your personal data only where we have a legal basis under the GDPR. The table below sets out the purposes, data categories, legal bases and retention periods.

5.1 Legitimate interest

For processing based on legitimate interest, we have assessed that it is necessary for our business and does not override your rights. Such purposes include processing the data of contact persons at business customers, developing our services, securing our online services, and establishing and defending legal claims. You may request further information about the assessment and object to the processing (section 11).

5.2 Consent

You may withdraw your consent at any time; withdrawal does not affect the lawfulness of processing carried out before it. Cookie consent is withdrawn in the cookie settings on the site, marketing consent using the link at the end of every marketing message, or by writing to datasecurity@oilon.com.

6. Profiling and automated decision-making

We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

We do, however, use light profiling in marketing: our marketing system may group recipients by, for example, industry, country, areas of interest or the pages visited on our website, so that our communication is more relevant. This is based on your consent or on our legitimate interest, and you may object to it at any time. Advertising targeting on third-party platforms (for example Google, LinkedIn and Meta) always takes place only on the basis of the consent you have given for marketing cookies.

7. Recipients of your data

Companies within the Oilon Group may use your personal data for the purposes defined in this policy. In addition, we use carefully selected service providers who process data on our behalf. A data processing agreement under Article 28 GDPR is in place with every processor.

We may also disclose personal data to competent authorities where required or permitted by law, and, in connection with a business reorganisation, to a prospective buyer and its advisers.

8. Transfers outside the EU and the EEA

Some of the service providers we use, or their parent companies, operate outside the EU and the EEA. In such cases we ensure that the transfer has a basis under Chapter V of the GDPR:

• An adequacy decision issued by the European Commission. For US service providers we rely on the EU–US Data Privacy Framework (adequacy decision of 10 July 2023) where the recipient is certified under the programme.
• Standard contractual clauses (SCCs) approved by the European Commission, together with a transfer impact assessment and any necessary supplementary measures. We use these as a parallel basis for all transfers to the United States.
• Other safeguards or derogations under Articles 46 and 49 GDPR where the above are not available.

We actively monitor the legal status of the EU–US Data Privacy Framework. On 3 September 2025 the General Court dismissed the action for annulment of the adequacy decision (Case T-553/23, Latombe v Commission), and that judgment has been appealed to the Court of Justice. We maintain standard contractual clauses as a parallel transfer basis so that transfers remain lawful even if the adequacy decision were to be annulled.

Transfers to and from Mainland China are additionally subject to the requirements of the PIPL, described in Annex G.

You may request a copy of the safeguards we use by writing to datasecurity@oilon.com.

9. Retention periods

We retain personal data only for as long as is necessary for the purpose for which it was collected, or for as long as the law requires. The specific retention periods are set out in the table in section 5 and, for cookies, in the tables in annexes A–E. Once the retention period ends, the data is deleted or anonymised so that it can no longer be linked to you.

10. Information security

Oilon is committed to keeping your personal data safe. We protect it against loss, destruction, falsification, manipulation, unauthorised access and unauthorised disclosure by appropriate physical, technical and organisational measures. These include:

• Access control: only authorised persons who need the data to perform their duties have access to it
• Encryption: personal data is protected by encryption in transit (TLS) and at rest where necessary
• Strong authentication in the Oilon ONE service, including passwordless sign-in (passkeys)
• Firewalls, malware protection and network monitoring to prevent unauthorised access
• Regular backups and testing of recovery procedures
• Regular information security and data protection training for our personnel, and confidentiality undertakings
• Regular reviews and assessments of the effectiveness of our security practices and measures
• Data processing agreements and security requirements with all subcontractors

We recommend using a strong and unique password. Although we do our best, no transmission of information over the internet can be guaranteed to be completely secure.

If we detect a personal data breach, we will notify the supervisory authority within 72 hours and inform you without undue delay where the breach is likely to result in a high risk to your rights and freedoms (Articles 33 and 34 GDPR).

11. Your rights

You have the following rights in relation to the processing of your personal data. You can exercise them by contacting datasecurity@oilon.com.

11.1 How your request is handled

We respond within one month at the latest. For complex or multiple requests we may extend the deadline by up to two further months and will inform you within one month. Exercising your rights is free of charge. We may ask you to verify your identity so that data is not disclosed to the wrong person.

12. Cookies and similar technologies

Cookies are small text files stored on your device when you visit a website. Similar technologies include browser local storage (localStorage and sessionStorage), tracking pixels and device identifiers. In this policy, the word "cookie" refers to all of these technologies.

12.1 Cookie categories

12.2 How consent is requested and managed

We ask for your consent to non-essential cookies via a cookie banner on your first visit. Giving and refusing consent are equally easy and equally prominent, as required by the Finnish Transport and Communications Agency Traficom. You can also select categories individually.

Non-essential cookies are not set and third-party tracking scripts are not loaded before you have given your consent. We use Google Consent Mode v2, which communicates your consent status to Google services; signals sent without consent are cookieless and aggregated.

You can change or withdraw your consent at any time via the "Cookie settings" link in the site footer. Consent is valid for a maximum of 12 months, after which we ask for it again. You can also block or delete cookies in your browser settings; blocking strictly necessary cookies may prevent the site from working. Refusing cookies does not restrict your access to the content of the site.

12.3 Service-specific cookie information

The cookies used by each service are listed in annexes A–E. The lists are based on a technical audit carried out on 21–24 September 2026. Cookie lifetimes are the defaults stated by the supplier; browsers may shorten them (for example, Chrome limits script-set cookies to 400 days).

13. Other websites and social media plug-ins

Our websites may contain links to third-party sites, social media plug-ins and embedded content such as videos. This privacy policy applies only to our own services and no longer applies once you leave our site. We do not control other sites, and their content and privacy practices come directly from the provider in question – we recommend reviewing them. Embedded content is loaded only after you have given consent for the relevant cookie category.

14. Children’s personal data

Our services are directed at businesses and professional users. We do not knowingly collect personal data from persons under 16 (under 14 in Mainland China, under 13 in the United States). If we become aware that we have collected such data without the consent of a guardian, we will delete it without delay. If you believe that a child has provided us with personal data, please contact datasecurity@oilon.com.

15. Changes to this policy

Oilon reserves the right to update or amend this privacy policy. Changes take effect when they are published on our website. If a change is material – for example a new processing purpose or a new category of recipient – we will notify you separately on the website or by e-mail and, where necessary, ask for renewed consent.

The version and effective date of the policy are shown at the beginning of this document. This version was prepared on 14 October 2026 and supersedes the version dated 1 October 2026. If you need earlier versions of this policy, they are available on request using the contact details given in this policy.

16. Contact and right to lodge a complaint

If you have questions about this privacy policy or about the processing of your personal data, please contact us:

We aim to resolve any concerns directly with you. You always have the right to lodge a complaint with a supervisory authority:

This privacy policy has been drawn up in Finnish, in English and in Chinese. The Chinese version is published on oilon.cn and supersedes the previous Chinese privacy policy that took effect on 11 October 2023. In the event of any discrepancy between the language versions, the Finnish version prevails.

Annex A – oilon.com

Oilon’s global, multilingual website at oilon.com (WordPress). There is no sign-in for ordinary visitors and no webshop functionality; orders are directed to the webshops (Annexes D and E).

A.1 Data collected and why

• Data from contact, quotation request and material download forms (name, company, e-mail, telephone, message content) in order to respond to your enquiry and for sales purposes
• Contact details from newsletter subscriptions, for marketing communication based on your consent
• Data from partner applications and training registrations, in order to process the application or the registration
• Data from warranty notifications (contact details, address, product type and serial number, date of purchase, order number and a description of the fault), in order to handle the warranty matter
• The content of chat conversations, for customer service purposes
• Visitor analytics and advertising measurement data, in accordance with your cookie consent

Two separate routes for form data

Form submissions on this site travel by two different routes, with different recipients and different retention periods.

The technical copy kept by the website

The website keeps a technical copy of form submissions in its own database. The copy is used solely to establish whether a form has worked correctly. It is not used for marketing, for sales or for customer communication, and it is not disclosed to anyone. The technical copy of warranty notifications is kept for 10 years and that of all other form submissions for no more than 90 days, after which it is deleted automatically.

A.2 Measurement and marketing tools in use

A.3 Cookies

Strictly necessary cookies

Statistics cookies

Marketing cookies

Discontinued cookies

The following cookies are no longer set, but may still be present in your browser from earlier visits. They are not updated, the data in them is not processed, and they expire on their own. You can delete them in your browser settings.

Annex B – oilon.cn

Oilon’s website for the Chinese market at oilon.cn (WordPress), aimed at Chinese-language visitors. The site has no third-party tracking, analytics or advertising tools whatsoever: no services from Google, Meta, LinkedIn, HubSpot, Leadfeeder or Baidu. Visitor statistics are produced solely by the WP Statistics extension running on Oilon’s own server, which uses no cookies and transfers no data to third parties. The site is operated by 奥林燃烧器（无锡）有限公司 / Oilon Burners (Wuxi) Co., Ltd., which is the personal information handler for this site (see Annex G).

B.1 Data collected and why

• Server logs and visitor statistics (IP address, timestamp, page requested, referring page, browser and device data), to ensure information security, investigate technical faults and compile visitor statistics
• Data from the partner application form (company name and website, contact person name, e-mail and telephone, address, the partnership role applied for, products of interest and market area), in order to process the application
• Contact details of those who have given marketing consent, for marketing communication on the basis of that consent
• Your cookie choice and the time at which it was made

B.2 Tools in use

WP Statistics collects data on the site’s own server without cookies. The site has no third-party visitor analytics, no advertising tracking, no chat tool and no other external tracking scripts. The only external service the site loads is the cookie consent platform.

Forms on the site

The site has one form: the partner application form on the page 加入奥林集团. It is used to apply to become an Oilon sales representative, dealer or service partner. Applications are sent by e-mail to china-marketing@oilon.com and are handled by Oilon Burners (Wuxi) Co., Ltd. in Mainland China. The mailbox is located in Oilon’s Microsoft 365 environment within the European Union, so the application is stored outside Mainland China. That transfer, and the separate consent requested for it, are described in Annex G.

The two contact forms on the site, the general enquiry form and the quotation request form for industrial heat pumps, were withdrawn on 1 October 2026. Enquiries are made to the telephone numbers and e-mail addresses shown on the site. Some of these belong to Oilon Burners (Wuxi) Co., Ltd. and some to dealers and service partners. An enquiry sent to a dealer is handled according to that company’s own practices.

The website does not keep a copy of form submissions in its own database. Storing submissions in the database was discontinued on 1 October 2026 and the material that had accumulated was deleted.

B.3 Cookies

Strictly necessary cookies

Discontinued cookies

The following cookies are no longer set. They may still be present in your browser from earlier visits, but they are not updated, the data in them is not processed, and they expire on their own. You can delete them in your browser settings.

B.4 Authority filings for the site in China

A website operated in China must be registered with the authorities. The filing numbers are shown in the site footer and can be verified in the authorities’ public registers.

Annex C – Oilon ONE service platform

Oilon ONE is a service platform for Oilon customers through which Oilon devices can be monitored and managed remotely. The service comprises the following addresses:

C.1 Data collected and why

• User account data: name, e-mail address, organisation, role and language setting – to provide the service and manage access rights
• Authentication data: password hash, public key for passwordless sign-in (passkey), session identifiers and sign-in logs – to secure the service
• Device data: serial number, installation information, system settings and status, measurement, performance and environmental data, alarms and fault messages – to provide remote monitoring, maintenance and support
• Usage logs: sign-ins, actions performed and timestamps – for information security, prevention of misuse and troubleshooting

Measurement data collected from a device is in principle product data, but it constitutes personal data where it can be linked to an identified user or customer. In that case we process it in accordance with this policy.

C.2 Authentication

Oilon ONE uses a Keycloak identity solution (OpenID Connect) operated under Oilon’s own control. The service supports password sign-in and passwordless passkey sign-in. Authentication cookies are strictly necessary and the service cannot be used without them.

C.3 Cookies

Authentication cookies (Keycloak) – strictly necessary

Device portal and reporting cookies – strictly necessary

Information and registration page cookies

The information and registration pages at info.oilon.com and the Oilon ONE sign-in page additionally use the statistics and marketing cookies described in Annex A (Google Analytics 4, Google Ads, LinkedIn Insight Tag, Meta Pixel and HubSpot), in accordance with your cookie consent. Once you are signed in, only strictly necessary cookies are used in the service itself.

Annex D – shop.eu.oilon.com (EU webshop)

Oilon’s webshop for the EU market at shop.eu.oilon.com. The shop is built on the WordPress and WooCommerce platform.

D.1 Data collected and why

• Customer and order details: name, company, business ID and VAT number, billing and delivery address, e-mail and telephone number – to process, deliver and invoice orders
• Order and purchase history and order status – for customer service, returns and warranty matters
• Payment data: payment method, payment status and the payment provider’s transaction identifier. We do not process or store payment card numbers; these are handled directly in the secure environment of the payment provider (Stripe)
• User account data if you create an account in the shop
• Order source data (the channel through which you arrived at the shop), to measure marketing performance
• Visitor analytics and advertising measurement data, in accordance with your cookie consent

D.2 Measurement and marketing tools in use

D.3 Cookies

Strictly necessary cookies

Functional and statistics cookies

Marketing cookies

Annex E – shop.us.oilon.com (US webshop)

Oilon’s webshop for the US market at shop.us.oilon.com. The shop is built on the same WordPress and WooCommerce platform as the EU shop and uses the same data categories, processing purposes and cookie categories as described in Annex D, with the following exceptions.

E.1 Differences from the EU webshop

In all other respects the descriptions in Annex D apply. The rights and choices available to consumers resident in the United States are described in Annex H.

Annex F – Origo intranet

Origo is Oilon’s internal intranet, in use at all Oilon locations. It is built on the SharePoint Online service within the Microsoft 365 environment, and users sign in with their Oilon work credentials through Microsoft Entra ID single sign-on. The intranet comprises the shared Oilon Group site and country- and unit-specific sites.

F.1 Personal data processed and purposes

F.2 Privacy in working life

The data processed in the intranet is employment-related personal data. In addition to the GDPR, its processing is governed by the Finnish Act on the Protection of Privacy in Working Life (759/2004). In accordance with the necessity requirement in section 3 of that Act, we process only data that is directly necessary for the employment relationship; this cannot be derogated from even with the employee’s consent.

Usage log data is not used to assess an individual employee’s performance, efficiency or use of time. Log data is examined at an individual level only for a justified reason, such as investigating an information security incident or suspected misuse, and such examination is recorded in writing.

The purpose, introduction and methods of technical monitoring of employees, and the principles governing the use of e-mail and the data network, are addressed in the dialogue required by the Co-operation Act (1333/2021) before they are introduced, as required by section 21 of the Act on the Protection of Privacy in Working Life.

F.3 Cookies

Origo is an internal tool behind a sign-in. All of the cookies it uses relate to authentication, session management, load balancing, security or user interface settings, and are therefore strictly necessary to provide the service the user has explicitly requested. For this reason no separate consent is requested for them (section 205(2) of the Act on Electronic Communications Services) and there is no cookie banner in the intranet. The intranet does not use cookies for advertising or cross-site tracking.

The cookies are set by Microsoft as part of the service; Oilon cannot change their names or lifetimes. The information below is based on Microsoft’s public documentation and on observations made on the sign-in page on 21 September 2026. Microsoft states that cookie names and definitions may change without notice.

Authentication and session – SharePoint Online (*.sharepoint.com)

Authentication – Microsoft Entra ID (login.microsoftonline.com)

Telemetry and diagnostics

F.4 Usage logs and monitoring

Log data is available to Oilon’s IT administration and to those responsible for information security. It is processed subject to the limitations described in section F.2.

F.5 Data location and transfers

Microsoft Ireland Operations Limited and Microsoft Corporation act as processors on behalf of Oilon under the Microsoft Products and Services Data Protection Addendum (DPA). Oilon is the controller for the intranet content and user data.

Microsoft has announced that it completed the EU Data Boundary in February 2025. Under it, customer data, pseudonymised personal data and data generated in connection with technical support for an environment registered in the EU or EFTA are stored within the EU and EFTA. The exception is limited security situations that require a coordinated global response. Any remaining transfers are subject to the European Commission’s standard contractual clauses, and Microsoft is additionally certified under the EU–US Data Privacy Framework. Microsoft’s current subprocessor list is available from the Microsoft Service Trust Portal.

F.6 Your rights as an internal user

You have the rights described in section 11 in relation to your data processed in the intranet as well. Note, however, that the right to erasure and the right to object are limited to the extent that the processing is based on the employment contract or on a legal obligation. For example, we cannot delete usage log data or work-related content on request alone.

You can exercise your rights by contacting datasecurity@oilon.com. You may also contact your line manager or human resources.

Annex G – Regional supplement: Mainland China

This annex applies to persons located in Mainland China and supplements the general part of this policy. It is based on the Personal Information Protection Law of the People’s Republic of China (中华人民共和国个人信息保护法, PIPL) and related regulations. If the general part and this annex conflict, this annex prevails for persons located in Mainland China.

G.1 Personal information handler

oilon.cn is operated by 奥林燃烧器（无锡）有限公司 / Oilon Burners (Wuxi) Co., Ltd., a company registered in the People’s Republic of China. It determines what personal information is collected on the site and for what purposes, and is therefore the personal information handler (个人信息处理者) within the meaning of the PIPL for this site. The other services described in this policy are the responsibility of Oilon Group Oy.

Because the personal information handler is established in Mainland China, no representative in China under Article 53 of the PIPL is required. We have appointed a dedicated personal information protection team and a person in charge.

G.2 Data processed, purposes and retention (Art. 17 PIPL)

The site has one form, the partner application form. Other processing is limited to what arises automatically from use of the site.

We do not collect sensitive personal information (敏感个人信息) within the meaning of the PIPL on oilon.cn. The site has no third-party visitor analytics, no advertising tracking and no chat tool, and we do not make significant decisions based on automated decision-making.

G.3 Recipients

We do not provide data collected on oilon.cn to any other third party. We disclose data to the authorities only where the law requires it.

G.4 Separate consent and transfers outside Mainland China

The server logs and the visitor statistics collected by the WP Statistics extension remain on a server located in Mainland China and are not transferred outside China.

The cookie consent platform is a European service. Your cookie choice, the time it was made and the consent identifier are stored on its servers outside Mainland China. This happens whether you accept or refuse non-essential cookies, because the choice has to be remembered and evidenced afterwards.

The data you provide in the partner application form is sent by e-mail to china-marketing@oilon.com, and the application is handled by Oilon Burners (Wuxi) Co., Ltd. in Mainland China. The mailbox is located in Oilon’s Microsoft 365 environment within the European Union, so the data is stored outside Mainland China. This is a transfer within the meaning of Article 39 of the PIPL, and we ask for a separate consent to it on the form before the application is sent. No other transfer of personal information outside Mainland China takes place on the site.

We ask for your separate consent (单独同意) if we provide personal information to a third party (Art. 23 PIPL) or transfer it outside Mainland China (Art. 39 PIPL). In that case we state the recipient’s name and contact details, the purpose and method of processing, the types of data concerned, and how you can exercise your rights against the recipient. Giving consent is voluntary, and you may withdraw it at any time as easily as you gave it. We will not refuse to provide the content of the site on the ground that you decline non-essential processing (Art. 16 PIPL).

Transfers are subject to the Chinese rules on cross-border data transfers, including the Provisions on Promoting and Regulating Cross-Border Data Flows issued in March 2024. The volume of personal information transferred is well below the thresholds that would require filing of a standard contract, personal information protection certification, or a security assessment by the Cyberspace Administration. We monitor the volume and will put in place the appropriate transfer mechanism should a threshold be exceeded.

G.5 Your rights under the PIPL

You can exercise your rights by sending a request to datasecurity@oilon.com. We will respond without delay and in any event within 30 days; for requests made through oilon.cn we respond within 15 working days. We may ask you to verify your identity. We do not, in principle, charge a fee for reasonable requests.

G.6 Persons under 14

Our site is directed at business customers and is not intended for persons under 14. Under the PIPL, the personal information of a person under 14 is sensitive personal information, and processing it requires the consent of a guardian and dedicated processing rules. We do not knowingly collect personal information from persons under 14. If we become aware that we have collected such data, we will delete it without delay.

G.7 Supervisory authority

If you consider that we have infringed the PIPL, you may lodge a complaint with the Cyberspace Administration of China (国家互联网信息办公室) or its local office, or with another competent authority. If you are not satisfied with our response and consider that our processing of personal information has harmed your lawful rights, you may in addition bring an action before the People’s Court of the district in which our representative in Mainland China is located (无锡市新吴区, Xinwu District, Wuxi).

Annex H – Regional supplement: United States

This annex applies to persons resident in the United States and supplements the general part of this policy. It is based on US state consumer privacy laws, including the California Consumer Privacy Act as amended by the CPRA, and the corresponding laws of Colorado, Connecticut, Texas, Virginia and other states. We apply these practices to all visitors resident in the United States, regardless of whether an individual law applies to us.

H.1 Categories of personal information collected in the preceding 12 months

Retention periods are set out in section 5 of this policy and in annexes A–E. We do not collect biometric data, health data, precise geolocation, or data on race, religion, union membership or sexual orientation within the meaning of US state privacy laws.

H.2 "Sale" and "sharing" of personal information

We do not sell your personal information for money. Under the laws of California and certain other states, however, the terms "sale" and "sharing" are defined broadly: disclosing identifiers to an advertising partner through advertising and analytics cookies may fall within their scope. Because we use Google Ads, LinkedIn Insight Tag and Meta Pixel cookies to target advertising across sites, we treat this activity as "sharing" within the meaning of those laws as a precautionary measure.

H.3 Your rights and how to exercise them

H.4 Universal opt-out signals (Global Privacy Control)

We recognise and honour the Global Privacy Control (GPC) signal sent by your browser or browser extension as a binding opt-out of the sale and sharing of personal information and of targeted advertising. The signal applies to the browser and device from which it is sent. If you are signed in to your account, we also apply the opt-out to your account.

H.5 Submitting and handling requests

• Send your request by e-mail to datasecurity@oilon.com or use the contact form on our website.
• We verify your identity before processing the request. We ask only for the information necessary for verification and do not use it for any other purpose.
• You may authorise an agent to submit a request on your behalf. In that case we ask for proof of authorisation and may ask you to confirm the authorisation directly with us.
• We respond to requests within 45 days. We may extend the deadline by a further 45 days where the request is complex, and will notify you if we do.
• Handling requests is free of charge.

H.6 Minors

We do not knowingly collect personal information from persons under 13, and we do not sell or share the personal information of persons under 16 without express authorisation. If we become aware that we have collected such information, we will delete it without delay.

H.7 Nevada residents

Under Nevada law (NRS 603A), Nevada residents may opt out of the sale of certain personal information. We do not sell personal information within the meaning of Nevada law, but you may submit an opt-out request to datasecurity@oilon.com.

Annex I – Regulatory basis

This annex lists the regulations, directives, national laws, authority guidelines and standards on which this privacy policy is based, and states what has been applied from each. The list reflects the legislation in force on 24 September 2026.

I.1 European Union regulations and directives

I.2 National legislation in Finland

I.3 Authority guidance and interpretation

I.4 International standards

I.5 Third-country legislation

I.6 Legislation under monitoring

We actively monitor the progress of the following and will update this policy as necessary:

• The European Commission’s Digital Omnibus package, which contains a proposal to move the cookie consent provisions from the ePrivacy Directive into the General Data Protection Regulation. The proposal is under negotiation and is not in force. If adopted, it may change how consent is requested and the status of browser-based consent signals.
• The appeal pending before the Court of Justice in Case T-553/23 (Latombe v Commission) concerning the adequacy decision on the EU–US Data Privacy Framework.
• The entry into force of new US state consumer privacy laws and California’s new regulations on automated decision-making technology.
• China’s measures on personal information protection certification, which entered into force on 1 January 2026.

Annex J – Definitions and version history

J.1 Key definitions

J.2 Document version history

Oilon Group Oy · VAT number FI02131514 · Data protection: datasecurity@oilon.com