Privacy statement

SMURFIT KAPPA GROUP DATA PROTECTION STATEMENT

1. PURPOSE AND SCOPE STATEMENT

The purpose of this statement is to explain to you how your personal data is processed by Smurfit Kappa Corrugated Benelux B.V. (the “Group”, “we”, “us”) and what data, including the personal information about you (“personal data”) in connection with your relations with us, is collected and processed by the Group and/or for it by external service providers.

For the purposes of this statement, the controller of your personal data Smurfit Kappa Corrugated Benelux B.V. de Warandelaan 2, 4904 PC Oosterhout, The Netherlands, is part of the Group. In general, your personal data is the responsibility of the Group. Click here for more information about the Group and a full list of the group’s components. The components of the Group have put in place procedures to ensure the protection of your personal data.

If you have any questions or are concerned about this statement, please contact our marketing department by sending an email to the Group Legal Department on [email protected].

2. APPLICABILITY OF THIS DECLARATION

IMPORTANTly, we have sought completeness and accuracy in this statement, to the extent reasonably possible, but we point out that it is not exhaustive and can be amended periodically in accordance with Article 11 of this Declaration.

This statement is divided into a number of articles that may be all or part of your relevance to you, depending on the nature of your relationship with the Group. In any case, you have certain rights under the data protection laws. These are set out in Article 10. You are entitled to object to the processing of your personal data at any time if we process it on the basis of the legal basis of our legitimate interests.

Marketing & business contacts: if you have signed up to receive marketing communications from us, you can read how we use your personal data for this purpose in Article 4 or by clicking here.

Website users: if you use our website [www .smurfitkappa.com/nl] and , [www .smurfitkappa.com/nl/be] (the “website”), you can read in Article 5A how we use your personal data as a user of our website. We also recommend that users of the website read our Cookie Policy.

Social media users: if you use our social media accounts (Twitter and LinkedIn), article 5B can read how we use your personal data as a social media user.

Existing customers:if you are already a smurfit corrugated Benelux B.V. customer, you can read in Article 6 how we process your personal data for administrative and business purposes.

3. WHAT PERSONAL DATA DO WE PROCESS?

Depending on your relationship with us, we process the following categories of personal data from you:

If you are a marketing/ business contact: your name, job name, contact details, your business activities and interest and information about your registration for the receipt of or interest in our mailing lists or newsletters.
When you visit the website: information about your visits to the website, your location and IP address, the browser software you use, and the date and time you visit the website.
If you interact with our social media accounts, we collect personal information about you such as name, location, country, function, company, areas of interest, in the event that these types of personal data are publicly visible on your social media accounts.
If you are a customer: your name, employer data, billing information, information about your visits and correspondence and communication with our employees and any information provided to us by or for you.

4. MARKETING AND BUSINESS CONTACTS

If you are a marketing or business contact, we may obtain, collect and process your personal data for the following purposes:

Promotion of the Group’s business activities;
Invitations to events;
Developing and continuing relations with you;
Managing and managing our relationship with our business contacts and customers;
Transmission of marketing materials, newsletters and other information;
Monitoring and analysis of your interest in the material we send you;
Transmission of marketing information by post, unless you have objected to it; And
Creating, collecting, storing and posting photos during Group events.

In these cases, we generally rely on your permission to provide you with information about our products and services through direct marketing. In all other cases, even if we are already in contact with you, we rely on our legitimate interest in continuing to approach you about products that we believe may be of interest to you.

You always have the option to stop the transmission of marketing communications. You can opt out of receiving communication by post through the contact details in Article 11. You can always opt out of our email marketing by clicking on the “unsubscribe” link at the bottom of the marketing emails we send you.

5A. WEBSITE USERS

If you visit our website, we may collect, collect and process your personal data for the following purposes:

Showing, improving and monitoring the effectiveness of the website;
Monitoring data such as total number of visitors, traffic data, and demographic patterns;
Ensure that the website is presented for you in the most effective way and improve your use of the website; And
Notify you of any changes to our website and/or our services.

We obtain, collect and process this personal data on the basis of our legitimate interest to ensure that our website functions properly and to analyse which content is most interesting to visitors. This helps us ensure that the website remains available and improve your experience when you visit the website.

5B. SOCIAL MEDIA USERS

If you visit, obtain, collect and process your personal data for the following purposes, we may visit, obtain, collect and process your personal data for the following purposes:

Understanding the demographics, preferences and interests of our audience, to enable us to show our audience more relevant information and news through our social media accounts (profiling).
Optimizing our audience and targeting.

6. EXISTING CUSTOMERS

If you are an existing customer, we may obtain, collect and process your personal data for the following purposes:

Implementation of administrative, billing and operational processes;
Review and reply to correspondence or requests you send us;
Monitoring sales levels and assessment of patterns in sales;
Carrying out due diligence investigations;
Execute orders and comply with our obligations under purchase agreements that we may have concluded with you;
Payment processing and customer account management;
Enter into contractual relations with the organisation to which you belong;
Transmission of marketing material. See Article 4 of this statement for further information.
Compliance with the law in force for companies of the Member State and the EU;

We obtain, collect and process your personal data for the purposes listed above on the basis of the following legal grounds:

our legitimate interest in ensuring the business of our company and maintaining our customer relationship with you;
a need to conclude and execute an agreement with you;
a need to process your personal data in order to fulfil a legal obligation that rests on us under the applicable law of an EU Member State or EU law.

If you are not prepared to provide your personal data so that we can process it for the above purposes, we are not able to provide services or products to you.

7.PROVISION OF YOUR PERSONAL DATA

Depending on your relationship with us, we may provide and obtained personal data from and about you to the following parties: parts and shareholders of the Group, service providers providing support services, IT & website service providers, marketing companies, PR offices, printers, advertising agencies and other suppliers, other people in your organisation, third parties involved in hosting or organising events or trade shows , professional advisers, such as tax or legal advisers, consultants and accountants, supervisory authorities (e.g. law enforcement agencies and government agencies) and third parties in connection with the purchase or sale of the Group or assets owned by the Group.

8. TRANSFERS OF YOUR PERSONAL DATA BY THE GROUP

We may pass on your personal data to parts of the Group or other recipients outside the European Economic Area (“EEA”). Certain recipients (our third-party service providers and other companies within the Smurfit Kappa Group who process your personal data for us, may pass on your personal data to a country outside the EEA that does not provide appropriate protection of your personal data. When such transfers take place, we apply the following policy: (a) these do not take place without our written prior consent; And (b) an appropriate transfer agreement is applied to protect your personal data.

9. RETENTION OF YOUR PERSONAL DATA

In general, we expect to retain your personal data for a reasonable period of time after the contact is made for marketing purposes. Once we have determined that we no longer need to keep your personal data, we delete it in our systems. We would like to point out that under certain circumstances we may retain your data for longer, for example if we are in the process of handling a claim or believe in good faith that the law or a competent supervisor can reasonably expect or impose longer retention of your personal data.

10. YOUR RIGHTS AND HOW YOU CAN EXERCISE THEM

You have a number of rights with regard to your personal data that are explained in this Article 10. These include in particular the right to object to the processing of your personal data when this processing is carried out for our legitimate interests. We point out that these rights are not absolute under certain circumstances.

Right	Notes
Right to objection	You are entitled at any time to object to the processing of your personal data if we process it on the basis of the legal basis that we pursue our legitimate interests. When we process your personal data on the basis of our legitimate interests, we ensure careful consideration of the possible consequences for you and your data protection rights. We do not use your personal data for activities where our interests are less important than the consequences for you (unless we have your consent or are otherwise obliged or empowered under the law of the Member State or the EU).
Right of access	You have the right to request a copy of the personal data we have about you and to access it. We will only charge you for such a request for access if we believe that your request is unfounded or excessive.
Right to rectification	You have the right to request the adjustment or rectification of incorrect personal data that we have of you.
Right to erasure	Under certain circumstances, you may also request the erasure of your personal data, for example if you exercise the right to object (see below) and we do not have a more serious reason to process your personal data or if we no longer need your personal data for the purposes specified in this statement.
Right to restrict processing	In certain cases, you have the right to ask us to restrict the processing of your personal data, even if you believe that the personal data we have of you is incorrect or our use of your data is unlawful. If you rightly invoke this right, we will store your personal data and not process it until the matter is resolved.
Right to transferability	You can ask us to provide the personal data you have given to us in a structured, common and machine-readable form and you can ask us to pass on your personal data directly to another controller, provided that this is technically feasible. This right applies only if: (1) we process your personal data with your consent or when necessary for the implementation of the agreement with you; and (2) processing is automated.

You can exercise all these rights by submitting a written request to our legal team at Smurfit Kappa Group Legal Department, Beech Hill Drive, Clonskeagh, Dublin 4, Ireland.

We will let you know as soon as possible, but no later than one month after receiving your request, what actions we have taken in response to your request in connection with one of these rights. If necessary, we may extend this period to two months, but we will inform you if this is the case. Please note that we may ask you to prove your identity when you invoke one of your data protection rights.

You also have the right to file a complaint with the Dutch Dutch Dutch Data Protection Authority. For an explanation, see https://autoriteitpersoonsgegevens.nl/. In Belgium, this is possible with the Data Protection Authority. For notes, see https://www.gegevensbeschermingsautoriteit.be/

11. AMENDMENTS TO THIS STATEMENT

We reserve the right to make a partial or complete in whole or in part of this statement. Any changes will take effect immediately from the moment the revised statement is sent to you.

If at any time we decide to use your personal data in a significantly different way than indicated in this statement or otherwise disclosed to you at the time it was collected, we will notify you by e-mail. You can then decide whether we can use your personal data in the new way.

If you have any concerns or any concerns about how your personal data is used or processed by the company, please contact our data protection representative on [email protected] or by post to Group Legal Department, Smurfit Kappa Group, Beech Hill, Clonskeagh, Dublin 4, Ireland.