Privacy notice

• Managing and developing customer relationships
• Provision, sales and delivery of services and products
• Payment and payment control
• Development of business and customer service
• Processing reclamations and defending against claims
• Accounting, KYC obligations and other legal obligations
• Other purposes related to for example ensuring security of Huhtamaki’s premises

• Contact information, such as name, phone number, email address, title
• Information on the company the data subject is representing as well as its location
• Information on whether the data subject is the main contact person for the company the data subject is representing
• Language preferences
• Status of the data subject (either active or inactive)
• Information related to managing orders and taking care of customer relationships (e.g. arranged meetings and visits to Huhtamaki’s premises)
• Information submitted by the data subject in sign-up forms for Huhtamaki’s events or campaigns

• From data subjects concerned
• In some cases, we may also collect personal data from the market research engines and external sources

Legitimate interest (Art. 6.1 (f) GDPR). The processing is necessary in order to fulfil our legitimate interests in the management of the business relationship.

Legal obligation (Art. 6.1 (c) GDPR). The processing is necessary in order to fulfil our legal obligations related to e.g. accounting obligations.

Storage period: We retain customer data for the duration of the customer relationship or until you no longer represent our customer. After the customer relationship has ended, we retain the data for as long as the personal data is necessary for Huhtamaki’s genuine needs and legal and regulatory requirements Huhtamaki is subject to.

Recipients: We may disclose customer data within Huhtamaki group companies based on our legitimate interest and, where we have a legal obligation to do so, to authorities. We may also transfer data to our service providers, who process the data on our behalf and in accordance with our instructions.

Is it necessary to provide this data? If you do not provide us with the personal data, we may not be able to serve you or the company you represent.

• Sending newsletters
• Marketing activities
• Communications about our business
• Conducting surveys

• Contact information, such as name, phone number, email address, title
• Information on the company the data subject is representing as well as its location
• Language preferences
• Information on marketing prohibitions and consents
• Information submitted by the data subject in sign-up forms for Huhtamaki’s events or campaigns

• From data subjects concerned
• In some cases, we may also collect personal data from the market research engines and external sources

Legitimate interest (Art. 6.1 (f) GDPR). When you subscribe to communications that are not electronic direct marketing, for example, when you subscribe to one-off content, the processing of personal data is necessary for us to pursue our legitimate interests in relation to the delivery of the content or communications you subscribe to.

Storage period: Your personal data will be stored until your subscription is active. Your personal data will be deleted once you have cancelled your subscription (you can withdraw your consent by following the cancellation link or by contacting us in accordance with this Privacy Policy).

Recipients: We may disclose customer data within Huhtamaki group companies based on our legitimate interest and, where we have a legal obligation to do so, to authorities. We may also transfer data to our service providers, who process the data on our behalf and in accordance with our instructions.

Is it necessary to provide this data? Providing your personal data for marketing purposes is optional, and you may withdraw your consent to receive marketing communications at any time. Please note that if you choose to opt out of receiving communications from us, we will be unable to send you updates such as newsletters or invitations to our events.

• Respond to your questions or comments
• Share special information
• Contact you to ask for your opinion or willingness to participate in certain events
• Send you updates and information on Huhtamaki’s products and services
• To deliver the subscribed releases

• Contact information, such as name, phone number, email address, street address
• Name of the company the data subject is representing
• Other identifiers
• Information on release subscribers (stock exchange releases, press releases, managers’ transactions releases)
  • Name, email address, country (optional), represented company (optional), classification of subscriber (e.g. customer, analyst, investor etc.)

Storage period: Data on release subscribers is retained as long as the subscription is valid. Other type of data on website visitors is retained for as long as the data is necessary for Huhtamaki’s genuine needs and legal and regulatory requirements Huhtamaki is subject to.

Recipients: We may disclose customer data within Huhtamaki group companies based on our legitimate interest and, where we have a legal obligation to do so, to authorities. We may also transfer data to our service providers, who process the data on our behalf and in accordance with our instructions.

Is it necessary to provide this data? If you do not provide the personal data to us, we may not be able to offer you some of our services.

• Ensure and improve the functionality, design and security of our website
• Monitor how users navigate our website
• Identify popular content and technical issues
• Support our digital strategy and content planning

• IP address
• Cookie data

When you visit our website, it will automatically collect some personal data about you and your visit. Only essential cookies are always active, as these are necessary for our website to function properly. For other types of cookies, you may select which cookies to allow by category (analytics, functional, marketing and social media).

Consent (Art. 6.1(a) GDPR). You are asked for your consent to allow the use of cookies when you first visit our website and when your previous consent has expired. You may select which cookies you allow by category.

Storage period: For most essential and non-essential cookies, the expiry duration is less than a day. In some cases, the expiry duration is a few months and, at maximum, one year. The expiry duration of each cookie can be found in the ‘Cookie Preferences’ section on the Huhtamaki website.

Recipients: We may disclose personal data within Huhtamaki group companies and, where we have a legal obligation to do so, to authorities. We may also transfer analytics data to our service providers, including e.g. Google Ireland Ltd., Google LLC and Hotjar, who only process the data on our behalf and in accordance with our instructions. Our service providers only process this data on our behalf to provide insights into website usage and performance. These providers may collect:

• Device and browser information
• Anonymized IP addresses
• Clickstream data (pages visited, session duration, etc.)

Is it necessary to provide this data? We will only use cookies to the degree that you have authorized their use in our cookie banner when entering our website, with the exception of essential cookies. You may also refuse the use of cookies by selecting the appropriate settings in your browser. Please keep in mind that if you disable the use of all cookies, you may not be able to view all parts of our website. You can prevent Google’s collection and use of data, including the IP address, by downloading and installing the browser plug-in available under https://tools.google.com/dlpage/gaoptout?hl=en.

• Fulfilling contracts
• Organising Huhtamaki’s business functions
• Delivery management
• Co-operation and business relationship management
• Developing Huhtamaki’s business
• Accounting and other legal obligations
• Other purposes related to for example ensuring security of Huhtamaki’s premises.

• Contact information, such as name, phone number, email address, title
• Information on the company the data subject is representing and the data subject’s area of responsibility

From supplier and stakeholder representatives

Legitimate interest (Art. 6.1 (f) GDPR). We process data of our supplier and stakeholder representatives to fulfil our legitimate interests arising from the contract and co-operation relationship we have with the company the person is representing.

Storage period: We retain the personal data for the duration of the co-operation relationship or until you no longer represent our supplier or other stakeholder. After the co-operation relationship has ended, we retain the data as long as the personal data is necessary for Huhtamaki’s genuine needs and legal and regulatory requirements Huhtamaki is subject to.

Recipients: We may disclose customer data within Huhtamaki group companies based on our legitimate interest and, where we have a legal obligation to do so, to authorities. We may also transfer data to our service providers, who process the data on our behalf and in accordance with our instructions.

Is it necessary to provide this data? If you do not provide us with the personal data, we may not be able to engage in or continue co-operation with the company you represent.

• Maintain a shareholders’ register
• Verify shareholders’ identity and right to participate in general meetings and to be able to communicate with them.
• Provide information to the public as a company listed on Nasdaq Helsinki Ltd.
• Ensuring security of Huhtamaki’s premises.

• Contact information, such as name, street address, phone number, email address
• Other information:
  • Personal identity number, to the extent necessary to check your IDs when you enter our annual general meetings, or other identifying information, nationality, number of shares and voting rights, book-entry account number
• Other information concerning shareholders’ participation in the general meetings (including information on power of attorneys)
• We also collect personal data of proxy representatives and of assistants representing / assisting shareholders in general meetings
• We receive information provided to us in notifications of major shareholdings (flagging notifications)

• From the shareholders
• From Euroclear Finland (national central securities depository)
• From other investors and analysts or companies they are representing

Legal obligation (Art. 6.1 (c) GDPR). The processing is necessary in order to fulfil our legal obligations as a company listed on Nasdaq Helsinki Ltd.

Legitimate interest (Art. 6.1 (f) GDPR). The processing is necessary in order to fulfil our legitimate interests to disclose information to the public and to communicate with and to maintain good relationships with our shareholders, investors and analysts.

Storage period: Data will be retained as long as needed under Huhtamaki’s legal obligations as a company listed on Nasdaq Helsinki Ltd. In addition, data can be retained as long as it is necessary for Huhtamaki’s genuine interests and needs.

Recipients:

• Information regarding major shareholders, flagging notifications and list of analysts following Huhtamaki can be found on Huhtamaki corporate website www.huhtamaki.com.
• We are required to disclose the list of shareholders to anyone requesting based on applicable laws and regulations (publicity of shareholders’ register).
• We may disclose certain data to authorities where we have a legal obligation to do so.

Is it necessary to provide this data?

• Shareholders have a legal obligation to provide this data to us.

• Investigating and resolving the suspected violation

• Contact information
• Date of the report and reporting category
• Description of the alleged misconduct or violation
• Actions taken during the investigation
• Outcome of the investigation and the possible disciplinary and/or corrective actions

• Person reporting the suspected violation by using the channel or via other mean
• Persons (internally and/or externally) involved in the investigation of the suspected violation.
• Information can be also collected from Huhtamaki’s internal systems, as applicable

Legal obligation (Art. 6.1 (c) GDPR). The processing is necessary in order to fulfil our legal obligations related to whistleblowing legislation.

Legitimate interest (Art. 6.1 (f) GDPR). The processing is necessary in order to fulfil our legitimate interests regarding other incidents reported to us.

Storage period: Personal data related to the channel will be retained as long as the data is necessary for Huhtamaki’s genuine needs and legal and regulatory requirements Huhtamaki is subject to. Personal data relating to reports that are investigated will be deleted as soon as possible. In general, such personal data is deleted within 5 years after the report was received, unless storing the personal data is necessary to protect Huhtamaki's legal rights, comply with legal obligations or prepare for a court proceeding.

Recipients: All reports made will be forwarded to Huhtamaki Global Compliance who will coordinate the channel and support the respective business segment and/or function in the investigation of the suspected violations.

Huhtamaki Speak Up channel is operated by an external service provider, SpeakUp, PeopleInTouch B.V. Huhtamaki has contractually ensured that SpeakUp, as a data processor, processes personal data in accordance with the applicable laws and regulations. In addition, Huhtamaki may use other service providers (such as law firms, translation agencies, external investigators) to conduct and/or help with the investigation.

Information may be also disclosed to the external parties, such as to the competent authorities in accordance with the applicable laws and regulations or if required for the purposes of the investigation.

Is it necessary to provide this data? Data subjects may voluntarily use Huhtamaki Speak Up channel if they are willing to make a report about any suspected violation.