What you can report using the whistleblowing system

If you suspect that a person in a leading position or a key position within SCA is guilty of serious misconduct, you can report this using an alternative channel: our whistleblowing system. Such serious irregularities may involve, for example:

  • book-keeping, internal book-keeping control and/or auditing;
  • giving and taking of bribes;
  • other serious misconduct, such as environmental crimes, major safety shortcomings in the workplace and very serious forms of discrimination and harassment.

We encourage you to be open with your identity, but you can also choose to report your suspicion completely anonymously. You submit your report via an external site that belongs to an independent party. The case is then handled by specially appointed investigators within SCA. All communication between the person submitting the report and the investigators is encrypted and you can remain anonymous if you so wish.

Anyone can submit a report

Anyone who has a genuine suspicion that a person in a senior position or a key person within SCA has committed serious fraud can report this using the whistleblowing system. You do not need to be employed by SCA to submit a report.

How to submit a report

You can submit your report using the following link: https://report.whistleb.com/sca

To ensure your anonymity, we recommend that you submit your report using a device that is not connected to SCA's networks.

How will your report be managed?

Your message can only be read by specially appointed investigators within SCA and the processing of the case is strictly confidential. When your report is received, the investigators determine whether it is covered by the whistleblowing system or not.

  • If your message is covered by the whistleblowing system, it is investigated in accordance with SCA's procedures for the processing of whistleblowing cases. In certain instances, there may be a need to put follow-up questions to you. You will then receive a message about this via the whistleblowing system.
  • If the case is not covered by the whistleblowing system, the investigators will take action in accordance with SCA's procedures for processing other violations of the Code of Conduct.

You can expect a response from SCA on your case within ten days of your report being submitted. All messages are sent in encrypted form and you can remain anonymous if you so wish.

Information regarding the processing of personal data within the framework of the whistleblowing system

Personal data is only processed to the extent that it is necessary to assess and investigate reports of such serious misconduct as the whistleblowing system comprises. Processing may include, for example, such information as names, position and suspected violations. It is voluntary for you to submit a report in the whistleblowing system.

All processing of personal data is conducted in accordance with applicable data protection legislation and other relevant legislation and national guidelines. If you want to have more information about how we process your personal data in such cases, you can read our privacy information that is available at www.sca.com, or contact us in one of the ways described below.

SCA is personal data controller for the processing of personal data. The processing is conducted in Sweden.

The lawful basis for processing your personal data is so-called legitimate interests, meaning that it is necessary for SCA's legitimate interest of counteracting and, where necessary, prosecuting, persons in key or senior positions within SCA for serious misconduct, for example, in relation to book-keeping, internal book-keeping control, auditing, combatting bribery or other serious irregularities relating to SCA's vital interests.

Only specially appointed persons within SCA or external parties appointed by SCA for the specific purpose have access to the personal data processed within the framework of the whistleblowing system and processing is strictly confidential.

If you are reported, you will be informed regarding the specific circumstances of the report as soon as possible subject to the course of the investigation. However, SCA will never reveal the identity of the person who made the report. If crime is suspected, the information will be submitted to the law enforcement authorities, such as a police authority.

Personal data processed within the whistleblowing system is erased not later than 30 days after completion of the investigation, except for cases in which we are obliged to save these as a result of other applicable legislation or if it is necessary for taking legal action. Data that is stored is rendered anonymous and does not contain any personal data by which persons can be identified directly or indirectly.

Personal data not covered by the whistleblowing system is erased immediately.

Your rights

You are entitled, without cost, to request in writing information regarding what personal data we process in relation to you. You can request at any time that we correct any information about you that is incorrect. You are also entitled to object to our processing, to ask us to erase or restrict the personal data we have on you and that we provide you with a copy of these personal data. We are entitled to refuse your request of it entails an obstruction of the investigation or a risk that material evidence could be destroyed.

If you are dissatisfied with how we process your personal data, we ask that you contact data protection management group by e-mail gdpr@sca.com or by the channel given on the website. You are also entitled to submit a complaint to the supervisory authority responsible for monitoring the application of the General Data Protection Regulation(GDPR).

The Swedish supervisory authority is the Swedish Data Protection Authority/Integrity Protection Authority [Integritetsskyddsmyndigheten] (the authority is to change its name to the Integrity Protection Authority [Integritetsskyddsmyndigheten] in 2018).

PO Box 8114

SE-104 20 Stockholm

datainspektionen@datainspektionen.se