Whistleblowing Channel Privacy Notice

1. General

Skanska is committed to ethical business conduct. We want to receive information about suspected misconduct so that we can respond to it in time. The Whistleblower Protection Act requires Skanska to ensure that possible misconduct can be reported safely and in a way that protects the identity of both the reporter and the subject of the report in the reporting procedure.

In this Privacy Notice, we describe how we process your personal data in connection with the handling of reports made to Skanska’s whistleblowing channel. The processing of personal data concerns the reporter, other persons who are the subject of the report, and other persons related to the report or its handling.

2. Data Controller

The controller for the processing activities described in this Privacy Notice is Skanska Oy and each of its subsidiaries, as well as Skanska CDF Oy (“Skanska” or “we”), in relation to their own operations. Skanska Oy’s subsidiaries are Skanska Talonrakennus Oy, Skanska Infra Oy and Skanska Rakennuskone Oy.

In respect of Skanska Group’s common Hotline reporting channel, the data controller is Skanska AB.

3. From which sources do we collect your personal data

The data are mainly collected from the data subjects themselves when the data subject submits a report to the whistleblowing channel, and from the subjects of reports in connection with the report and during possible additional clarification.

Data are collected from persons other than the data subjects only to the extent necessary to determine the correctness of the report and the necessary follow-up measures.

4. What data do we process

We typically process the following data:

the name of the person making the report (it is also possible to make a report anonymously, in which case it must be submitted through the Hotline channel)
the name of the subject of the report and any contact or identifying details

other data necessary for determining the correctness of the report
any other personal data contained in the report
additional information collected during internal investigations related to the report

5. Why and what grounds do we process your personal data

The processing of personal data in connection with the whistleblowing channel is based on:

Compliance with legal obligations

The maintenance of the whistleblowing channel and the handling of reports are governed by the Whistleblower protection legislation. Personal data are processed to comply with these legal obligations.

Legitimate interest

Skanska has a legitimate interest in investigating suspected misconduct brought to its attention.

Preparation, presentation or defence of legal claims

Skanska also processes personal data, where necessary, for the preparation, presentation or defence of legal claims related to the reporting procedure.

Consent

In exceptional cases, the processing of personal data may also be based on your consent.

6. To whom do we disclose your data

As a rule, the data are not disclosed to third parties. However, we may disclose your personal data in situations required and permitted by applicable law:

to other companies belonging to the Skanska Group. Depending on the case, our group companies may process information related to the report for the purposes defined in this Privacy Notice
in connection with legal proceedings or at the request of an authority, on the basis of applicable law or by order of a court in connection with judicial or administrative proceedings. Based on a court decision or a request by an authority, personal data may be disclosed to competent authorities

based on your consent, we may also disclose your data to other parties.

Information related to reports made through the Hotline reporting channel is processed by a service provider called People Intouch B.V., which forwards reports made to the Hotline service to Skanska in accordance with Skanska’s instructions. The place of processing and storage of the data is the Netherlands, and appropriate agreements have been concluded for the processing.

7. How long do we retain your data

Information received through whistleblowing channels is deleted five years after the date the report is received, unless retention is necessary for the exercise of rights or fulfilment of obligations laid down by law, or for the preparation, presentation or defence of legal claims.

Personal data for which there is no basis for processing and retention in connection with the handling of the report are deleted without undue delay.

To the extent that personal data are processed on the basis of consent, the personal data are deleted when the data subject withdraws the consent given. Otherwise, the above five-year retention period applies.

8. Your rights

In accordance with current data protection legislation, you have the rights specified below. We process your personal data to the extent necessary to exercise your rights.

Right of access to your data

You have the right to obtain confirmation from the controller whether your personal data is being processed or not. If your personal data is being processed, you have the right of access to the personal data we process about you. We may refuse to provide information if there is a legal basis for doing so.

Right to rectification, erasure or restriction of processing

You have the right to request us to rectify any incorrect information about you. In addition, you can request us to delete some information about you or request the restriction of processing on legal grounds.

Right to object to the processing of your data

You have the right to object processing on grounds relating to your particular personal situation, provided that we are processing your personal data on the basis of legitimate interest. You can submit your objection request to us by contacting tietosuoja[at]skanska.fi. You must specify the specific situation on the basis of which you object to the processing. Skanska has the right to refuse your request if the processing is necessary for the purposes of Skanska's or a third party's legitimate interests.

Right to withdraw your consent

You have the right to withdraw your consent to the processing of your personal data to the extent that the processing is based on your consent.

Right to data portability

To the extent that we process your data on the basis of a contract and the processing is carried out by automated means, you have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format and the right to transmit such data to another data controller.

Right to lodge a complaint before a competent supervisory authority

If you consider that the processing of your personal data has not complied with the requirements of the applicable data protection legislation, you can always contact Skanska. You can also refer your case to the supervisory authority. In Finland, the supervisory authority responsible for data protection matters is the Data Protection Ombudsman (TSV).

9. Contact information

If you would like to know more about how we process your personal data at Skanska, or if you wish to exercise your rights as a data subject under data protection legislation, please contact us as follows:

Tarmo Nikkilä
P.O. Box 114, FI-00101 HELSINKI
Nauvontie 18, FI-00280 HELSINKI
tietosuoja[at]skanska.fi / tarmo.nikkila[at]skanska.fi

10. Changes and updates to this privacy notice

We regularly review our personal data processing practices and possible update needs, and we may also make changes to this Privacy Notice from time to time. The current version is available on Skanska’s website.

Last updated: 9 June 2026