Local Regulations / Requirements

1. Introduction 1.1 Welcome to Wolt Courier Privacy Statement At Wolt we take data protection seriously. Privacy and information security are at the heart of Wolt. This privacy statement (hereinafter the “Courier Privacy Statement”) describes the key principles and practices we abide in order to ensure your privacy is respected while using Wolt’s services and applications (“Wolt Services”) and providing delivery services on our platform while partnering with us as directly as 1) an independent courier partner (“Courier Partner”) or 2) a delivery service provider (“Fleet Partner”) or alternatively while 3) being engaged by the aforesaid (“Fleet Courier”). Courier Partners, Fleet Partners and Fleet Couriers all jointly referred to as couriers (“Couriers”). Wolt Enterprises Oy, local country-specific Wolt companies and DoorDash Inc. belonging to the same group of companies (hereinafter jointly “Wolt” or “we”) process personal data of Couriers (hereinafter also “you”). This Courier Privacy Statement also applies to Courier’s substitutes. You must ensure that your substitute has read this Courier Privacy Statement before performing services as your substitute. You and your substitute may have access to each other's information including details on performed deliveries through the Wolt Partner application. This Courier Privacy Statement may be updated from time to time in order to reflect the changes in Wolt’s data processing practices or otherwise. You can find the current version on Wolt's website or Partner application. We will not make substantial changes to this Courier Privacy Statement or reduce the rights of the Courier under this Courier Privacy Statement without providing a notice thereof. 1.2 Data controllers within Wolt This Courier Privacy Statement applies to processing of personal data carried out by Wolt. Wolt is part of DoorDash, Inc., a technology company with an official address at 303 2nd St, Suite 800, San Francisco, CA 94107, USA. We form one team and sometimes we can decide together on processing of personal data. When processing your personal data all local Wolt companies listed below are acting as joint controllers. However, for practical reasons Wolt Enterprises Oy (Company ID 2646674-9, Pohjoinen Rautatiekatu 21, 00100 Helsinki, Finland, email: support@wolt.com) has been appointed responsible for handling all data subject requests and questions relating to the personal data processing of the Wolt group on behalf of the local joint controllers. This means that in relation to processing your personal data, both Wolt Enterprises Oy and the local Wolt group company in the country you provide services in, together determine the purposes and means by which personal data is processed. When processing personal data of Couriers providing courier partner services to Wolt Enterprises Oy, Wolt Enterprises Oy acts as the sole data controller. 1.3 How can you contact us?

For any questions that relate to personal data in existing, past or future courier partnerships, contact Support through the application or email support@wolt.com. Data Protection Officer Wolt has appointed a data protection officer whom you can reach through the above contact details or by sending an e-mail to privacy@wolt.com. 2. Personal data processing principles 2.1 The purposes and grounds for processing We process personal data only to the extent necessary and appropriate for the specific processing purposes. Please note that one or more of the following purposes and legal grounds may apply simultaneously. 2.1.1. Contractual obligations Firstly, we process your personal data in order to comply with our contractual obligations, for example, to the extent necessary to: Pay remuneration to and fulfill our other obligations under the service agreement between you and Wolt; Provide services to Wolt’s users, for example, in order to provide Wolt’s users with the information necessary for the delivery of their orders; Communicate with you about changes to the service agreement, privacy policies or other important changes related to our cooperation as well as answer your questions and solve support cases if you or our user contacts us; and Ensure compliance with the service agreement between you and Wolt. For example, we may process your location data and other strictly necessary personal data if we have legitimate reason to do so for verifying your compliance with the service agreement. 2.1.2. Legitimate interest Secondly, we may process your personal data if there is an appropriate and justifiable interest for processing (that is, legitimate interest) to run, maintain and develop our business or to create and maintain Courier relationships. When choosing to use your data on the basis of our legitimate interests, we weigh our own interests against your right to privacy and, for example, provide you with an easy to use opt-out possibility and use pseudonymized or non-personally identifiable data when possible. You have the right to object processing of your data on the basis of legitimate interest. However, Wolt can refuse such an objection in accordance with applicable legislation, for example, if the processing is necessary for preparing, exercising or defending legal claims. We process your personal data to the extent necessary and based on legitimate interest, for example, to: Contact you regarding the service agreement and/or Wolt Services, to inform you of changes relating to them or asking your review or feedback on us and/or Wolt Services; Claims handling, debt collection and/or other legal processes; Prevention of fraud, misuse of our services and for information, system and network security and safety purposes. For example, based on our legitimate interest limited amount of and necessary personal data may be retained also after the contractual relationship if required to prevent misuse of our services or for security and safety reasons; Solve user complaints and investigate and respond to incidents that relate to a breach of the service agreement between you and us; Record your communication with Wolt support (for example, phone recording); Develop our business, services and products, our cooperation with Couriers as well as improve the quality of Wolt Services, for example, by analyzing any trends and/or Courier behavior in the use of the Wolt Services. When possible, Wolt will do this by using only aggregated, non-personally identifiable data; and Process your data within the Wolt group of companies in accordance with this Courier Privacy Statement. 2.1.3. Consent In some parts of the Wolt Services you may be requested for your consent for processing your personal data. When performing services as a Courier, Wolt needs your permission to access location services through the permission system used by your mobile operating system or browser. We may collect the precise location of your device when the Wolt Courier Partner application is running in the foreground or background of your device. You can enable the location tracking feature through the settings on your device or when prompted by your mobile app. We may also collect route information when you conduct a delivery for Wolt and/or derive your approximate location from your IP address. If you choose to disable the location feature through the settings on your device, we will not receive precise location information from your device, which will prevent you from being able to go online and receive delivery tasks. Upon your consent we may also process your facial id or video recording containing a facial image for the identification purposes. 2.1.4. Legal obligation We also need to process your personal data to administer and fulfill our obligations under law. This includes data processed for complying with our bookkeeping and other legal obligations as well as providing information to relevant authorities such as tax authorities and law enforcement authorities in accordance with mandatory legal provisions. Wolt holds a payment institution license through its subsidiary Wolt License Services Oy, and is as such an obliged entity to collect certain personal data in the European Economic Area. User identifiers and other personal data may be used for the prevention, detection and investigation of money laundering and terrorist financing, and for the purposes of investigation of money laundering, terrorist financing, or offenses to obtain property or proceeds used for money laundering or terrorist financing as specified in the Anti Money Laundering Act (444/2017) of Finland and the European Union Directive on the prevention of the use of the financial system for the purposes of money laundering or terrorist financing (849/2015). 2.1.5. Automated decision-making While processing your personal data for the purposes of providing Wolt Services to you as well as other purposes stated above we may use automated means in processing that may also include automated decision-making. For example, to fulfill our contractual obligations as well as based on our legitimate interest we may process personal data to make automated decisions for matching available Couriers with the deliveries placed by users as well as to pay agreed fees in accordance with the service agreement with us. Tasks are offered to a Courier by finding routes which are valid (for example vehicle capabilities, age restrictions and chosen offline time) and which are the most optimal, in terms of least distance driven per task, and delivery time best within a predefined time range. The Courier’s personal attributes or past performance does not affect the offering of deliveries. The Couriers are anonymized in connection to the automated delivery task offering which is based solely on the location of a Courier and delivery destination locations, vehicle type, the courier's chosen offline time, and the capabilities of the Courier and delivery. For example, if you have chosen a certain offline time, you will be excluded from the task offering during that time. Moreover, if the task concerns age restricted products, underaged Couriers will not be offered such tasks. The capabilities of the Courier (vehicle size, age restriction, location details) are matched against those of the delivery destination to define most suitable task offers. The Courier and delivery coordinates, as well as the Courier's vehicle type, are used to calculate distances and time durations between the Courier and delivery locations. Our courier algorithm identifies the Courier and delivery assignment pairs which keep a city's overall driven distance and lateness from the delivery time frame as low as possible. You can always contact us if you have any questions related to the offered tasks or you wish our support team representative to be involved in verifying the correctness of the automated task offering. 2.2 Personal data processed We process personal data only to the extent necessary and appropriate for the specific processing purpose in accordance with this Courier Privacy Statement. We may collect and process the following information about Couriers: Identification and account information

• Full legal name

• Identification documents

• Facial images or videos

• Company name and company ID

• Address

• Hometown

• Phone number

• Email address

• Personal ID Number / Social Security Code

• Courier ID / Courier Bag ID (When applicable)

• Language

• Date of birth

• Nationality

Permits and licenses

• Driving license

• Local work permit

• Licenses / Permits related to food safety (if applicable)

• Business license (if applicable)

Contractual obligations

• Personal bank account

• Information on remuneration payable to Courier and relevant payment information

• Tax card

• VAT / Tax ID

Communication

• Feedback and service level data

• Communication (incl. phone recordings) between you, Wolt, and/or users and other Wolt partners

• Information related to the provision and usage of services

• Location data

• Access and usage data of Wolt’s services/applications (including location and availability when providing courier services to Wolt)

• Delivery equipment identification number

• Data provided by you when using Wolt’s services/applications

• Video camera surveillance data on Wolt premises

When you use Wolt Services for providing courier services to Wolt, we may collect, use and share data on either your exact or approximate location, including real-time geographic location of your mobile phone. The data is collected for purposes of providing services to Wolt’s users, for example, in order to provide Wolt’s users with the information on the delivery of the order and for performance of the agreement between the Courier and Wolt. Location data is also required, for example, to estimate accurate delivery times and to confirm payments. Further, Wolt may process your location data including dropoff location collected during your performance of deliveries for solving user complaints and responding to incidents that relate to a breach of the service agreement between you and us. We will not process such pickup and/or drop off locations without weighing our own interests against your right to privacy and, for example, use pseudonymized or non-personally identifiable data when possible. As to camera surveillance in our premises we may process such data to monitor the safety of our premises, employees and people visiting them as well as to investigate any security or other similar incidents in accordance with applicable laws. As to visiting or interacting with the Wolt Services we may automatically collect certain technical data including: Information that describes your device or browser and Wolt’s application, their versions, features, capabilities, and settings Information about your operator, Internet service provider and network connection type, including your IP address Identifiers provided by your device or third parties for application vendors or advertisers, or identifiers we create ourselves Country, locale, time zone and geo-IP level location information Where you followed a link to Wolt Services, and links you followed from Wolt Services Details of your interactions with, and usage of, Wolt Services. This includes, for example, usage patterns, which features you use, advertisement, participating into a specific campaign and offer impressions and interactions, and information on orders. Data for tracking and reporting transactions initiated by our advertising partners, including timestamps, and identifiers mentioned above. For details on how to control advertising and analytics identifiers on your device, see below under the section “Cookies and other technologies”. 2.3 Cookies and other technologies We use various technologies to collect and store usage and analytics data and other information when our users and other users visit the Wolt Services, including cookies, storing website data, and using web and application telemetry. Cookies and other website data saved on your device allow us to identify visitors of the Wolt Services and facilitate the use of the Wolt Services and to create aggregate information of our visitors. This helps us to improve the Wolt Services and better serve our users. The cookies and other website data will not harm your device or files. We use cookies and other website data to tailor the Wolt Services and the information we provide in accordance with the individual interests of our users. Please note that the retention time of different cookies is limited and varies from less than a minute till indefinitely and when a specific cookie is deleted. You can manage the cookie preferences you have submitted earlier concerning Wolt websites by clicking here. The user of Wolt Services may choose to set their web browser to refuse cookies. For example, the following links provide information on how to adjust the cookie and other web data settings on some popular browsers: Apple Safari Google Chrome Microsoft Edge Mozilla Firefox Please note that some parts of the Wolt Services may not function properly if use of cookies is refused.The Wolt Services use pseudonymized identifiers to track and predict your app and service usage and preferences. Wolt also uses session-only 3rd-party tracking technologies to verify and report transactions initiated by our advertising partners. You can also manage your cookie preferences through the cookie banner on our websites. Wolt visitor identifiers can be disabled on iOS and Android mobile devices by changing your settings (for iOS: Settings → Wolt → Wolt settings → Limit Tracking, and for Android: Wolt application → Profile tab → Settings icon in the top-right corner). Generally, advertising identifiers can be disabled on iOS mobile devices by turning on the Limit Ad Tracking tab (Settings → Privacy → Advertising → Limit Ad Tracking). For an overview and more information on the advertising identifier, please see Apple Advertising and Privacy site. Wolt uses different third party analytics and telemetry providers, marketing or affiliate partners, and other services integrated into our user software listed below: Google Analytics - Google - Visitor and usage analytics - Link to Policy Google AdWords - Google - Ad targeting - Link Google Tag Manager- Google - Analytics and reporting - Link Google Geocoding API - Google - Geocoding data within maps- Link Upwave - Upwave -Analytics, marketing and reporting on Wolt app - Link AppsFlyer - Appsflyer - Analytics, marketing and reporting on Wolt app - Link Captcha - Intuition Machines, Inc. - Bot detection and avoidance and reporting - Link Bugsnag - SmartBear Software Inc. - Error event and performance tracking on websites and apps - Link Facebook Graph API - Meta - Ads management - Link Facebook Pixel - Meta - Advertising/ conversion tracking - Link Firebase - Firebase - Mobile and web application development platform - Link Intercom - Intercom - Chat - Link Ravelin - Ravelin - Anti-fraud - Link Riskified - Riskified - Payment fraud prevention - Link Adform - Adform - Managing and delivering online ads - Link Appsflyer - Appsflyer Campaign usage - Link Floodlight Floodlight - Advertising/ conversion tracking - Link Microsoft Clarity - Microsoft - User heatmaps analysis - Link Interspace - Interspace (Accesstrade) - Affiliate marketing platform - Link Microsoft Bing - Microsoft - Search engine - Link Iterable - Iterable - Marketing automation - Link LinkedIn InsightTag - LinkedIn Marketing Solutions - Advertising/ conversion tracking - Link Taboola Pixel - Taboola - Advertising/ conversion tracking - Link TradeDoubler - TradeDoubler - Advertising/ conversion tracking - Link Twitter Universal Website Tag - Twitter Ads - Advertising/ conversion tracking - Link Yahoo - Yahoo - Advertising/ conversion tracking - Link Reddit Pixel - Reddit Ads - Advertising/ conversion tracking - Link Sentry - Sentry.io - Functional software - Link Please note that not all of the above vendors are necessarily being used at any given time, or in all market areas. 2.4 Sources of data We typically collect personal data directly from you. We may also collect your personal data from tax and other relevant authorities as well as our users, partners and service providers when we have legitimate grounds to do so. Wolt may also offer a referral program where Couriers can invite friends and family to sign up for the Wolt Service and become a Courier providing services on Wolt’s platform. You can send an SMS with a referral link to your contacts. 2.5 Storage period Wolt does not store your personal data longer than is legally permitted and necessary for the purposes for which the data were collected. The storage period depends on the nature of the information and the purposes of processing. The maximum period may therefore vary per use. Wolt takes reasonable steps to keep the personal data accurate and to delete incorrect or unnecessary personal data. After termination of the service agreement, personal data relating to you may be stored only as long as such processing is required by law or is reasonably necessary for our legal obligations or legitimate interests such as claims handling, bookkeeping, internal reporting and reconciliation purposes. We assess regularly the storage period for personal data to ensure the data is stored only for the necessary time period. 2.6 The recipients of personal data We do not share your personal data with third parties outside of our group companies unless one of the following circumstances apply: For legal reasons We may share personal data with third parties outside our organization if access to the personal data is reasonably necessary to (i) meet taxation, any applicable law, regulation, and/or court order; or (ii) detect, prevent or otherwise address crime and/or security issues. When possible, we will inform you about such processing. To authorized service providers and third parties We may share personal data to authorized service providers who perform services for us to enable them to meet their legal and contractual obligations relating to, for example, safety of their employees/subcontractors and/or to manage other personnel related obligations, such as, for example, performance management and personnel evaluation of their own employees/subcontractors. Such service providers are, for example, our internet service providers, accounting companies and fleet companies providing delivery services. Our agreements with the service providers include commitments that the service providers agree to limit their use of personal data and to comply with privacy and security standards at least as stringent as the terms of this Courier Privacy Statement. We may share personal data to third parties that need access to your personal data in order for us or such third parties to perform services to Wolt’s users and fulfill the purposes set out in this Courier Privacy Statement. For example, partners who offer their products through the Wolt Services receive details of your estimated time of arrival and distance from the pickup location to estimate your arrival time. You may be covered by certain personal accident and/or third-party liability insurance that Wolt has taken on behalf of the courier partners in case you have not opted out from the insurance. The insurance provides cover for incidents that happen during the courier partner’s provision of services to Wolt under the service agreement. In case of an incident, Wolt will share the location of the courier partner in question to the insurance company in order for the insurance company to confirm that the courier partner was performing a service under the service agreement at the time of the incident. If you are covered by the insurance taken by Wolt on your behalf, the insurance company or a third party on behalf of insurance company will also share certain personal data about you to Wolt in order for the third party company to provide the insurance coverage and for Wolt to verify that the incident is such that you are eligible for the coverage. The insurance company may receive the following data about you for claims workflow and validation as well as insurance onboarding and offboarding purposes: Courier ID; First Name; Last Name; Phone Number; Email Address; Courier Country; Time First Delivery Date; Time Last Delivery Date; Vehicle Type; and Other possible information that is considered necessary. The insurance is voluntary for courier partners and Wolt will share the described data only if the courier partner has not opted out from the insurance coverage provided by Wolt. Processing the insurance claim is a matter strictly between the courier partner and the insurance company. Wolt is not involved in the processing of the insurance claim in any way. With your explicit consent We may share personal data with third parties outside of our group companies for other reasons than the ones mentioned above, when we have your explicit consent to do so. You have a right to withdraw such consent at any time. For other legitimate reasons If Wolt is involved in a merger, acquisition or asset sale, we may transfer your personal data to the third party involved. However, we will continue to ensure the confidentiality of all personal data. We will give notice to all Couriers concerned when the personal data are transferred or become subject to a different privacy policy. 2.7 Data transfers to countries outside of European Union Wolt stores your personal data primarily within the European Economic Area. However, we have service providers, operations and group companies in several geographical locations. As such, we and our service providers may transfer your personal data to, or process it in, jurisdictions outside the European Economic Area or your domicile. We will take steps to ensure that personal data receives an adequate level of protection in the jurisdictions in which they are processed. We provide adequate protection for the transfers of personal data to and from countries outside of the European Economic Area through a series of agreements with our service providers based on the Standard Contractual Clauses or through other appropriate safeguards. More information regarding the transfers of personal data may be obtained by contacting us on any of the addresses indicated above. 3. Your rights 3.1 How can you access, change or delete your personal data? Right to access You have the right to request access to the personal data we process about you. This means that you may contact us using the contact details above and we will inform you what personal data we have collected and processed regarding you and the purposes such data are used for. You also have the right to request disclosure of the purposes for which Wolt processes your personal data and of records regarding the provision of personal data to authorized service providers and third parties. Right to withdraw consent In case the processing is based on a consent granted by you, you may withdraw the consent at any time. Right to correct You have the right to have incorrect/unprecise, incomplete, outdated, or unnecessary personal data we have stored about you corrected or completed by contacting us. You have the right to update for example your contact information or your other personal data. Right to deletion You may also ask us to delete your personal data from our systems. We will comply with such a request unless we have a legitimate ground to not delete the data. After the data has been deleted, we may not immediately be able to delete all residual copies from our active servers and backup systems. Please note that prohibiting us from processing data concerning you may result in not being able to act as a Courier on Wolt’s platform. Right to restriction of processing You may request us to suspend processing of personal data for example when your data deletion, rectification or objection requests are pending and/or when we do not have legitimate grounds to process your data. When the processing has been suspended, your data will only be stored and not processed further. For example, if you contest the accuracy of your data, such data will be restricted from processing until it is ensured that the data is accurate. Please note that prohibiting us from processing data concerning you may result in not being able to act as a Courier on Wolt’s platform. Right to object You may have the right to object on grounds relating to your particular situation to the processing of your personal data based on our legitimate interest. We will comply with such objections unless we have a legitimate ground not to. Please note that prohibiting us from processing data concerning you may result in not being able to act as a Courier on Wolt’s platform. Right to data portability You have the right to receive the personal data you have provided us with in a structured and commonly used format. 3.2 How to use your rights? You may use these rights by contacting Wolt support or sending a letter or an e-mail to us on the address set out above. If you have a Wolt account we recommend you contacting us through Wolt support as that allows us to identify you more easily. We may request the provision of additional information necessary to confirm your identity. We may reject requests that are unreasonably excessive or manifestly unfounded. 4. Information security We use administrative, organizational, technical, and physical safeguards to protect the personal data we collect and process. Measures include for example, where appropriate, encryption, pseudonymization, firewalls, secure facilities and access right systems. Our security controls are designed to maintain an appropriate level of data confidentiality, integrity, availability, resilience and ability to restore the data. We regularly test the Wolt Services, systems, and other assets for security vulnerabilities. Furthermore, access to personal data by employees of Wolt is restricted and access is subject to what is necessary for purposes of the employee’s work assignments. 5. Direct marketing You have the right to prohibit us from using your personal data for direct marketing purposes, market research and profiling made for direct marketing purposes by contacting us on the addresses indicated above or by using the unsubscribe possibility offered in connection with any direct marketing messages. 6. Lodging a complaint In case you consider our processing activities of your personal data to be inconsistent with the applicable data protection laws, you may lodge a complaint with the local supervisory authority for data protection.

This Third Party Liability is a protection if you are legally liable for causing an injury or damage to other people (known as “third parties”, hence the name of the insurance).

What is it?

This is an insurance coverage for you as a Wolt courier partner. Wolt is the policyholder and it covers the legal liabilities if you cause bodily injury or property damage to third parties while making deliveries or acting in the interest of Wolt on bicycle or away from your vehicle.

What is covered?

• Making deliveries or acting in the interest of Wolt

• Accidental damages you cause to property that belongs to a third party

• Accidental bodily injury you cause to a third party

What is not covered?

• When not acting in the interest of Wolt

• When causing damage or injury to third party, while driving a motor vehicle

• Injury to yourself and/or damage to property owned by yourself

• Damage to and/or loss of delivery items

What should I do in case of an incident?

• At the scene, avoid saying “It’s my fault.” Leave that for the insurance to determine!

• Safety first, if there is anyone injured contact emergency services

• Get the name, address, phone number & license plate of the other person involved in the incident

• Take pictures of the damage, if possible

• Give the third party the contact details of tpl.claims@wolt.com

As soon as you are home; report the incident via the Collective Benefits app at https://app.collectivebenefits.com/claims.