Privacy notice

Huhtamäki Oyj and its subsidiaries and other affiliates (later referred to as “Huhtamaki”) respects the privacy of its customers, suppliers and other stakeholders. This privacy notice (“Privacy Notice”) describes how Huhtamaki is processing personal data and what are the measures Huhtamaki takes to ensure the privacy and security of information collected and processed by Huhtamaki.

 

1. Data controller

In respect of each data subject’s personal data, the data controller is regarded to be the Huhtamaki group company which has a contractual relationship or other co-operation relationship with the data subject or with the organisation the data subject is representing. The data controller may, thus, be either Huhtamäki Oyj (business ID 0140879-6) or any of its subsidiaries or other affiliates. For avoidance of doubt, in this Privacy Notice “we” or “Huhtamaki” shall refer to any Huhtamaki group company acting as the data controller in each individual case.

 

2. Contact details for Huhtamaki in matters concerning this Privacy Notice

Where the data subject has questions regarding this Privacy Notice or he/she wishes to exercise his/her rights, the data subject should contact the Huhtamaki group company which has a contractual relationship or other co-operation relationship with the data subject or the organisation the data subject is representing.

Contact details for all Huhtamaki group companies can be found on Huhtamaki’s website at www.huhtamaki.com/contact-us/locations.

 

3. What personal data we process?

Customers add_circle_outline

Purposes and legal basis for processing

 

  • We process customer data for following purposes:
    • Managing and developing customer relationship
    • Provision, sales and delivery of services and products
    • Sending newsletters
    • Payment and payment control
    • Development of business and customer service
    • Processing reclamations and defending against claims
    • Accounting and other legal obligations
    • Other purposes related to for example ensuring security of Huhtamaki’s premises.
  • We process data of our customers to fulfil our legitimate interests arising from the contract and customer relationship we have with the company the person is representing.
  • In some cases, we may also process personal data of the representatives of our potential customers with whom we have not yet concluded a contract or established a customer relationship. The processing of said data is based on our legitimate interest to explore and understand potential customers, to communicate with them and to develop our customer and market intelligence.

Categories of personal data we collect

 

  • Contact information, such as
    • name, phone number, email address, title
  • Information on the company the data subject is representing as well as its location
  • Information on whether the data subject is the main contact person for the company the data subject is representing
  • Language preferences
  • Status of the data subject (either active or inactive)
  • Information related to managing orders and taking care of customer relationship (e.g. arranged meetings and visits to Huhtamaki’s premises)
  • Information on marketing prohibitions and consents
  • Information submitted by the data subject in sign-up forms for Huhtamaki’s events or campaigns

Where we collect the personal data from

 

  • From data subjects concerned
  • In some cases, we may also collect personal data from the market research engines and external sources

Retention time

 

  • We retain customer data for the duration of the customer relationship or until you no longer represent our customer. After the customer relationship has ended, we retain the data for as long as the personal data is necessary for Huhtamaki’s genuine needs and legal and regulatory requirements Huhtamaki is subject to.
  • We retain data on our potential customers and their representatives for as long as the data is necessary for Huhtamaki’s genuine needs and legal and regulatory requirements Huhtamaki is subject to.

Disclosure of personal data and categories of recipients of the data

 

  • We may disclose customer data within Huhtamaki group companies and, where we have a legal obligation to do so, to authorities.
  • We may also transfer data to our service providers, who process the data on our behalf and in accordance with our instructions.

Transfer of personal data outside EU/EEA

 

  • Personal data can be transferred outside the EU/EEA in accordance with applicable data privacy laws and regulations and subject to the restrictions set in said laws and regulations.
    • The locations of Huhtamaki group companies (also outside the EU/EEA) can be found on Huhtamaki’s website at http://www.huhtamaki.com/contact-us/locations.
    • Some of Huhtamaki’s service providers may also be located outside the EU/EEA, including the United States.
    • When personal data is transferred outside the EU/EEA to a country, which does not guarantee adequate level of data protection, we will use appropriate safeguards, such as EU Commission’s standard contractual clauses or Privacy Shield Framework, in accordance with applicable data privacy laws and regulations. You can obtain information of these safeguards by contacting us. Our contact information can be found from section 2 of this Privacy Notice.

Do we conduct profiling?

 

  • We do not use your personal data for profiling.

Do I have to provide this data?

 

  • If you do not provide us with the personal data, we may not be able to serve you or the company you represent.

 

Website visitors add_circle_outline

Purposes and legal basis for processing

 

  • Unless we specifically tell you otherwise before you submit personal information, we will only use it to:
    • Respond to your questions or comments
    • Better understand your viewing patterns and needs
    • Help us understand how we can improve our products, services and website
    • Share special information
    • Contact you to ask for your opinion or willingness to participate in certain events
    • Send you updates and information on Huhtamaki’s products and services
    • To deliver the subscribed releases
  • The processing of your data is based on a legitimate interest to provide you with the releases you have subscribed to, to answer your enquiries, to ensure the functionality and security of our website and to develop our website.

Categories of personal data we collect

 

  • Contact information, such as
    • name, phone number, email address, street address
  • Name of the company the data subject is representing
  • Other identifiers
    • IP address
    • cookie data
  • Information on release subscribers (stock exchange releases, press releases, managers’ transactions releases)
    • Name, email address, country (optional), represented company (optional), classification of subscriber (e.g. customer, analyst, investor etc.)

Where we collect the personal data from

 

  • We only collect personal data that you voluntarily submit through our website. We do not automatically collect personal information without your knowledge.

Retention time

 

  • Data on release subscribers is retained as long as subscription is valid.
  • Other type of data on website visitors is retained for as long as the data is necessary for Huhtamaki’s genuine needs and legal and regulatory requirements Huhtamaki is subject to.

Disclosure of personal data and categories of recipients of the data

 

  • We may disclose personal data within Huhtamaki group companies and, where we have a legal obligation to do so, to authorities.
  • We may also transfer data to our service providers, who process the data on our behalf and in accordance with our instructions.

Use of cookies

 

 

  • To improve your visits to our site, we may use "cookies" or other automatically collected data to obtain non-personal information (cookies are text information files that your browser places on your computer when you visit a website). We do not use cookies to collect and store personally identifiable information. You may refuse the use of cookies by selecting the appropriate settings in your browser. Please keep in mind that if you do not allow the use of cookies, you may not be able to view all parts of our website.
  • Our website uses analytics tools, such as Google Analytics, a web analytics service provided by Google Inc. Google utilizes the information collected by a cookie to track and examine the use of our site, to prepare reports on its activities and share them with other Google services. Our analytics account anonymizes the user’s IP address as soon as technically feasible at the earliest possible stage of the collection network. Read more about Google Analytics https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage
  • You can prevent Google’s collection and use of data, including the IP address, by downloading and installing the browser plug-in available under https://tools.google.com/dlpage/gaoptout?hl=en

Transfer of personal data outside EU/EEA

 

  • Personal data can be transferred outside the EU/EEA in accordance with applicable data privacy laws and regulations and subject to the restrictions set in said laws and regulations.
    • The locations of Huhtamaki group companies (also outside the EU/EEA) can be found on Huhtamaki’s website at http://www.huhtamaki.com/contact-us/locations.
    • Some of Huhtamaki’s service providers may also be located outside the EU/EEA.
    • When personal data is transferred outside the EU/EEA to a country, which does not guarantee adequate level of data protection, we will use appropriate safeguards, such as EU Commission’s standard contractual clauses or Privacy Shield Framework, in accordance with applicable data privacy laws and regulations. You can obtain information of these safeguards by contacting us. Our contact information can be found from section 2 of this Privacy Notice.

Do we conduct profiling?

 

  • We do not use your personal data for profiling.

Do I have to provide this data?

 

  • If you do not provide us with the personal data, we may not be able to offer you some of our services.

 

Suppliers and other stakeholders add_circle_outline

Purposes and legal basis for processing

 

  • We process supplier and other stakeholder data for following purposes:
    • Fulfilling contracts
    • Organising Huhtamaki’s business functions
    • Delivery management
    • Co-operation and business relationship management
    • Developing Huhtamaki’s business
    • Accounting and other legal obligations
    • Other purposes related to for example ensuring security of Huhtamaki’s premises.
  • We process data of our supplier and stakeholder representatives to fulfil our legitimate interests arising from the contract and co-operation relationship we have with the company the person is representing.

Categories of personal data we collect

 

  • Contact information, such as
    • name, phone number, email address, facsimile, title
  • Information on the company the data subject is representing and the data subject’s area of responsibility
  • Information related to managing the co-operation (e.g. arranged meetings)

Where we collect the personal data from

 

  • From supplier and stakeholder representatives

Retention time

 

  • We retain the personal data for the duration of the co-operation relationship or until you no longer represent our supplier or other stakeholder. After the co-operation relationship has ended, we retain the data as long as the personal data is necessary for Huhtamaki’s genuine needs and legal and regulatory requirements Huhtamaki is subject to.

Disclosure of personal data and categories of recipients of the data

 

  • We may disclose supplier and stakeholder data within Huhtamaki group companies and, where we have a legal obligation to do so, to authorities.
  • We may also transfer data to our service providers, who process the data on our behalf and in accordance with our instructions.

Transfer of personal data outside EU/EEA

 

  • Personal data can be transferred outside the EU/EEA in accordance with ap-plicable data privacy laws and regulations and subject to the restrictions set in said laws and regulations.
    • The locations of Huhtamaki group companies (also outside the EU/EEA) can be found on Huhtamaki’s website at http://www.huhtamaki.com/contact-us/locations.
    • Some of Huhtamaki’s service providers may also be located outside the EU/EEA, including the United States.
    • When personal data is transferred outside the EU/EEA to a country, which does not guarantee adequate level of data protection, we will use appropriate safeguards, such as EU Commission’s standard contractual clauses or Privacy Shield Framework, in accordance with applicable data privacy laws and regulations. You can obtain information of these safeguards by contacting us. Our contact infor-mation can be found from section 2 of this Privacy Notice.

Do we conduct profiling?

 

  • We do not use your personal data for profiling.

Do I have to provide this data?

 

  • If you do not provide us with the personal data, we may not be able to engage in or continue co-operation with the company you represent.

 

Shareholders, other investors and analysts add_circle_outline

Data controller

 

  • Huhtamäki Oyj, Revontulenkuja 1, 02100 Espoo, Finland

Purposes and legal basis for processing

 

  • We need to process personal data of shareholders and their representatives to maintain a shareholders’ register, to be able to verify shareholders’ identity and right to participate in general meetings and to be able to communicate with them. We need to process personal data of other investors and analysts to fulfil our legitimate interests and to communicate with them.
  • We need to process personal data of shareholders and their representatives, other investors and analysts to be able to provide information to the public as a company listed on Nasdaq Helsinki Ltd.
  • We process shareholders’, other investors’ and analysts’ personal data to fulfil our legal obligations. We may also process the data in order to fulfil our legitimate interests to disclose information to the public and to communicate with and to maintain good relationships with our shareholders, investors and analysts. In addition, data can be processed for other purposes related to for example ensuring security of Huhtamaki’s premises.

Categories of personal data we collect

 

  • Contact information, such as
    • name, street address, phone number, email address
  • Other information
    • personal identity number or other identifying information, nationality, number of shares and voting rights, book-entry account number
  • Other information concerning shareholders’ participation in the general meetings (including information on power of attorneys)
  • We also collect personal data of proxy representatives and of assistants representing / assisting shareholders in general meetings
  • We receive information provided to us in notifications of major shareholdings (flagging notifications)

Where we collect the personal data from

 

  • From the shareholders
  • From Euroclear Finland (national central securities depository)
  • From other investors and analysts or companies they are representing.

Retention time

 

  • Data will be retained as long as needed under Huhtamaki’s legal obligations as a company listed on Nasdaq Helsinki Ltd. In addition, data can be retained as long as it is necessary for Huhtamaki’s genuine interests and needs.

Disclosure of personal data and categories of recipients of the data

 

  • Information regarding major shareholders, flagging notifications and list of analysts following Huhtamaki can be found on Huhtamaki corporate website www.huhtamaki.com.
  • We are required to disclose the list of shareholders to anyone requesting based on applicable laws and regulations (publicity of shareholders’ register)
  • We may disclose certain data to authorities where we have a legal obligation to do so.
  • We may also transfer data to our service providers, who process the data on our behalf and in accordance with our instructions.

Transfer of personal data outside EU/EEA

 

  • Public data disclosed on Huhtamaki corporate website is available for anyone also outside EU/EEA.
  • In some cases, personal data can be transferred outside the EU/EEA (e.g. in case of service providers) in accordance with applicable data privacy laws and regulations and subject to the restrictions set in said laws and regulations.
    • When personal data is transferred outside the EU/EEA to a country, which does not guarantee adequate level of data protection, we will use appropriate safeguards, such as EU Commission’s standard contractual clauses or Privacy Shield Framework, in accordance with applicable data privacy laws and regulations. You can obtain information of these safeguards by contacting us. Our contact information can be found from section 2 of this Privacy Notice.

Do we conduct profiling?

 

  • We do not use your personal data for profiling.

Do I have to provide this data?

 

  • Shareholders have a legal obligation to provide this data to us.
  • To be able to exercise your rights and interests as other investors and analysts you are required to provide this data to us.

 

4.    Security measures

Manual material

Possible manual material is stored in locked spaces, access to which is only granted to people with a valid need to access the data.

Data processed electronically

Huhtamaki’s IT systems are protected against unauthorised access with various data protection functions, including technical measures to prevent and detect any safety breaches that may threaten the personal data. Huhtamaki applies customary authorisation processes, e.g. individual access rights and passwords related to its systems. Access is allowed only for such persons who have a legitimate need to access the personal data. In case of outsourced data processing activities, Huhtamaki protects the data security by applying appropriate confidentiality and other clauses in the outsourcing agreements.

 

5.    What rights you have


Right to object to direct marketing

You have the right to object to direct marketing at any time, free of charge. You may use the right by contacting Huhtamaki in accordance with section 6 of this Privacy Notice.

Other rights

You also have other rights with regards your personal data, including:

  • Right of access – you are entitled to have information concerning your personal data that is processed as well as a copy of such data.
  • Right to rectification – you have a right to have inaccuracies related to your personal data corrected.
  • Right to erasure – you have the right to require the data controller to delete your personal data if the continued processing of that data is not justified.
  • Right to withdraw consent (when processing is based on consent) – in order for a consent to be valid, it needs to be withdrawable, and you have the right for such withdrawal at any time.
  • Right to data portability – under certain conditions, you may require your data to be ported to yourself or to another company in a commonly used machine-readable format.
  • Right to object – In certain situations you have the right to object to processing of your personal data, upon which the processing shall cease. You have the right, on grounds relating to your particular situation, to object to processing if the processing is based on legitimate interest. When data is processed for the purposes of direct marketing, you always have the right to object to such processing, including profiling.
  • Right to restrict processing – you have, in some situations, the right to limit the processing of your data to some purposes. This means that we must refrain from using the data during the period for which the right applies. This right may be used e.g. if you contest the lawfulness of the processing or the accuracy of the data, and we are in the process of verifying the accuracy of the data.
  • Right to lodge a complaint with the supervisory authority – you have the right to lodge a complaint with the competent supervisory authority as described in the local laws and regulations.


6.    How you can contact us and exercise your rights


You can contact us regarding all questions concerning protection of your personal data in our data processing activities. You can find our contact information from section 2 of this Privacy Notice.  

You can also exercise your rights, free of charge, by contacting us. We will answer your request within one (1) month of receipt of your request, unless there are justified causes to extend this time by two (2) further months. If we cannot fulfil your request, e.g. due to legal obligations, we will inform you in writing within the same time period stated above and provide you the reasons due to which we are unable to fulfil your request. In this case, you can always lodge a complaint with the supervisory authority, if you disagree with our decision.

 

7.    Changes to Privacy Notice


Huhtamaki may amend this Privacy Notice from time to time. While we will aspire to inform you of any significant changes to this Privacy Notice, you are encouraged to regularly visit our website and review the notice for updates.


Last updated May 24, 2018