External privacy notice
1. Introduction and scope
This External Privacy Notice has been adopted by Billerud AB and its subsidiary companies (each company is individually referred to as "Billerud", "we" or "us"). The External Privacy Notice has been adopted to describe how we process your personal data in the situations described below and how we use cookies on our public websites.
Billerud AB or one of its subsidiary companies is the data controller in respect of the processing of your data, as indicated in Section 4.1 below.
The External Privacy Notice applies to our processing of personal data relating to you:
(i) as representative/contact person of our business customers, suppliers, contractors and distributors including where you are using customer portals that we may provide;
(ii) as visitor of our public websites or social media profiles/pages or subscriber to our newsletter or other information from us;
(iii) as visitor at our offices where camera surveillance is conducted in accordance with the Camera Surveillance Act (SFS 2018:1200), or
(iv) being specifically referred to this External Privacy Notice, e.g. by an agreement, a notice or similar.
We appreciate your interest in our company and your visit to our website. We are committed to your privacy and have a duty to fulfil the provisions of the EU Regulation 2016/679 (General Data Protection Regulation). Please read the following information regarding how we process your personal data.
If you have any questions about this information, or if you wish to exercise any of your rights as set out below, please contact Billerud via the contact information listed under Section 4.2 below.
2. Collection and processing of personal data, including legal grounds
2.1 General
The term "personal data" means any information which, either directly or indirectly via other data, can be linked to a natural individual, such as name, address, telephone number, e-mail address, personal identification number, IP address and logs from a web browser.
The term "processing of personal data" means any operation performed on personal data, such as the collection, storage, adaptation, disclosure or compilation of personal data.
2.2 Collection, processing and deletion of personal data, including legal grounds
2.2.1 Contact persons or other representatives at our business customers/supplier, incl forest owners
Data and purpose: We process personal data that you or your employer (i.e. our business customer or supplier) have provided to us for the purpose of (a) administering the relationship with you in your capacity as contact person, signatory or other representative of an entity being a registered or potential business customer or supplier with us and (b) sending relevant marketing, invitations and information to the business customer or supplier that you represent. For example, this may concern name, contact details, personal identification number (if the customer/supplier is a sole trader), preferences/interests as well as the history of purchased products and services (for the purpose of providing relevant marketing, invitations and information for our business customers). If you have been granted access to a customer portal that we provide, we will process your log in details in order to provide the customer portal.
We also process name and address about you who is a forest owner, collected from external sources such as public and private registers, for the purpose of informing you, as a trader, about our business.
Retention and erasure: The data will be kept until we have been notified of a new person that shall be the contact person and/or representative or, if you are a user of a customer portal, until you have deleted your account at the customer portal. The data about forest owners will be stored until the purpose of the processing has been completed or earlier if the forest owner objects against further information from us.
Legal ground: We base the processing on our legitimate interest of maintaining, and establishing, the relation with our business partners (business customers/supplier), including to provide customer portals (where applicable). We base the processing of forest owners' personal data on our legitimate interest of providing information about the forest industry to prospect clients in their capacity as traders.
2.2.2 Websites and social media
Data and purpose: Billerud collect personal data such as name, e-mail address and other information which you voluntarily provide. Billerud also receives and stores information from your web browser, such as IP address, cookie information and the pages you visit, to log files on our server. For more information regarding cookies, please refer to section 3 and 6 below.
Billerud uses the information collected to respond to your requests regarding products and services, to improve the content on our website and the services we provide and to develop anonymous usage statistics.
We also use personal data for direct marketing in accordance with law and market practice. We use the information we collect with regard to how you, as a user, use of the website so that we can analyse search behavior and be able to provide you with personalised content. Personal data may also be processed indirectly in connection with the development and administration of Billerud's IT systems.
Personal data that we request from you and indicated as mandatory is required to be provided in order for us to fulfil your request, e.g. to send news letters that you subscribe to. Please note that Billerud is not responsible for your privacy or the content on external websites to which we may provide links on this website.
Retention and erasure: Billerud erases collected personal data when the purpose of the processing has been completed.
Legal ground: We will process your personal data when it is necessary to fulfil a request from you or otherwise when it is necessary for the purposes of a legitimate interests for Billerud, inter alia, for improving the website. If a certain data process requires your prior consent, we will collect such consent before carrying out the processing in question.
2.2.3 Camera surveillance
Purpose and data: As a part of Billerud's safety work, Billerud is using camera surveillance with the purpose of conducting surveillance of our office premises. The personal data we collect when conducting such surveillance includes image and video of you when you are located in and around our office premises.
Retention and erasure: Billerud erase personal data when the purpose of the processing has been fulfilled. This means that the data will normally be erased within 90 days unless the data needs to be retained for a longer period of time in order to investigate or take any other measure within the course of our safety work.
Legal ground: We carry out the processing taking place via camera surveillance on the basis of our legitimate interest in maintaining a proper security, which we consider outweighing the visitor's interest of not being subject to camera surveillance.
2.2.4 Other processing when you have been specifically referred here
If you have been referred to this External Privacy Policy from any other document (e.g. an agreement), it means that the purpose and retention of, and the legal ground for, the current processing as well as the data being processed are specified in the document that referred you here.
2.3 Disclosure of personal data to a third party
Billerud will not sell your personal data to a third party. We only share personal data with other companies in the Billerud Group of Companies, with business partners and/or Billerud’s suppliers who process personal data on Billerud's behalf, and when we are required to do so in accordance with law or decisions by public authorities. Where personal data is transferred to Group companies and partners outside the EU/EEA, it is Billerud's responsibility to ensure that such personal data is protected in the same way as in the EU/EEA, for example by putting data transfer agreements in place.
2.4 Your rights in relation to your personal data
According to the General Data Protection Regulation, you are entitled to certain rights. If you want to exercise any of these rights, please contact us at the address specified in section 6 below.
As specified in the General Data Protection Regulation you have the right to:
- Request access (record demonstrating the personal data undergoing processing) to your personal data;
- request rectification of the personal data we process in relation to you;
- request erasure of your personal data;
- request that we restrict the processing of your personal data;
- object to the processing of your personal data and, in respect of processing based on your consent, to withdraw your consent at any time; and
- receive personal data about you that you have provided to us (data portability).
You are also entitled, at any time, to submit complaints to the relevant supervisory authority if you think that your personal data is being processed in violation of applicable legislation.
3. Billerud's use of cookies
On our website we use cookies in order to give you the best possible experience when you visit the site.
3.1 What is a cookie and what is it used for?
A cookie is a small text file that the website you visit stores on your computer (or a similar device, such as a tablet or mobile phone).
There are two types of cookies - persistent cookies and session cookies. This website uses both types of cookies. Persistent cookies are stored as a file on your computer for a certain period of time until they are deleted by the visitor to the website or the server that sent them. Session cookies are stored temporarily while the visitor is browsing on a webpage and disappear when the visitor closes their web browser.
Cookies are either first party cookies or third party cookies. First party cookies are placed by the website that you visit, whilst third party cookies are placed by another party/website than the website you are visiting. Third party cookies are for example often used by advertising networks to identify a certain user and to use information about how such user has consumed content on the various websites and provide (customized) marketing on the various websites included in the network.
3.2 Consent to the use of cookies
According to the Swedish Act on Electronic Communication (SFS 2003:389), everyone who visits a website with cookies shall have access to information that the website contains cookies and the purpose of using these cookies. The visitor must also consent to the use of cookies. You consent by allowing cookies or categories of cookies in the cookie message that appears when you visit the website.
You can, at any time, change your cookie settings in the cookie message.
If you, now or in the future, wants to say no to cookies or delete cookies, you can also do so by changing your web browser settings, please refer to the next section.
3.3 If you want to avoid cookies
You can choose to block cookies via your browser settings so that it automatically denies the placement of cookies or informs you every time a website requests to place a cookie. You can also delete cookies already stored in your browser. Exactly how this may be done varies between different browsers and you can read more about this in your browser instructions or in the help function included in most browsers. Some service providers, e.g. Google, also provides its own opt out tools that you can read more about on their websites.
Please visit www.aboutcookies.org for more information about how to manage and remove cookies.
Please note that blocking cookies may result in you not having full access to all pages and functions on our website. It may also adversely affect your user experience.
4. Data controller and contact
4.1 Data controller
Websites, social media and newsletters: The Billerud Group company that provides the specific website, social media profile/page or the newsletter is the data controller. Billerud AB is the data controller in respect of the corporate site of Billerud Group.
Business customers/suppliers: The Billerud Group company that has entered into an agreement with the business customer or supplier is the data controller.
Camera surveillance: The Billerud Group company that is specified in the information text located at each location where camera surveillance is conducted is the personal data controller, or if not specified therein, Billerud AB.
When you, in other cases, have otherwise been referred to this External Integrity Notice: The Billerud Group company that is specified in the document that refers you here is the personal data controller, or if not stated therein, Billerud AB.
4.2 Contact details
If you have any questions regarding this External Privacy Notice or on how we process your personal data or if you further contact details to the data controllers above, please contact us by e-mail, post or telephone.
Billerud AB
PO Box 703
SE-169 27 Solna, Sweden
Tel: +46 (0)8 553 335 00
For general questions: info@billerud.com
For questions or requests relating to Section 2.4: privacy@billerud.com
5. Updates of the external privacy notice
Billerud may, at any time, revise this External Privacy Notice by posting an updated version on the website.
This External Privacy Notice was last updated on 22 December 2020.