Privacy notice – GDPR

Download as pdf

Background and purpose

Svenska Cellulosa Aktiebolaget SCA and its group companies, which we refer to here as "SCA" or "we", collect and use personal data in their operations. We protect the privacy of our employees, customers and other business contacts and are committed to complying with applicable data protection regulations, including the General Data Protection Regulation (GDPR), in all countries in which SCA operates.

SCA takes the necessary measures on an ongoing basis to ensure that the processing of your personal data takes place in accordance with applicable data protection legislation and good market practice.

As a starting point, each company within the SCA Group is the data controller for its processing of personal data. Depending on the business to which a personal data processing is attributable, the personal data controller may thus lie with different companies within the SCA Group.

The purpose of this general privacy notice is to describe in a general way how SCA handles personal data according to GDPR.

What processing of personal data is 

Personal data is any kind of information that can be directly or indirectly, independently or in combination with other data, linked to a living person. It can be name, address and social security number. Photos of people are also classified as personal data. Sound recordings stored digitally may also be personal data even if no names are mentioned in the recording. An organization number is usually not personal information but can be if it is a one-man company.

Processing of personal data is "any operation that is taken with the personal data", such as collection, storage, processing, use for various purposes, alteration or destruction of personal data.

This means that the processing of personal data occurs in all companies' operations. SCA would not have been able to conduct its business without processing personal data. In many cases, there are even obligations that require SCA to process personal data. What is important is that the processing of the personal data is always legal and complies with the rules that exist, such as GDPR. In this information, you can read more about how SCA ensures this in its operations.

Basic principles that are always followed by SCA

The basic principles that are always observed by SCA when processing personal data are as follows:

• Legality, fairness, transparency
  Personal data must be processed lawfully, fairly and transparently in relation to the data subject (i.e. the individual). This means, among other things, that SCA bases all processing on a valid legal basis, such as that the processing is necessary for the performance of an agreement with the individual or the fulfilment of a legal obligation.
  
  The requirement for transparency means that SCA must provide clear and transparent information about the processing of personal data to the persons concerned. SCA does this by publishing and informing about documents with privacy protection information.
• Purpose limitation
  Personal data may only be collected and used for specific and explicitly stated purposes (purposes) and may not subsequently be processed in a manner that is incompatible with those purposes. SCA ensures this by identifying and documenting the purposes for which the business uses various personal data.
• Data minimisation
  Personal data that is processed must be adequate, relevant and not too extensive in relation to the purposes. SCA ensures that the data collected is really needed. SCA does not ask for information just because it might be useful to have. SCA also does not use personal data for a purpose other than that for which it was originally collected.
• Correctness
  Personal data processed shall be accurate and, if necessary, up to date. SCA takes appropriate measures to ensure that incorrect or incomplete information is removed or corrected. SCA avoids storing copies of the information in many different systems so that sources of error and un-updated information are not saved and used in the business.
• Storage Limitation
  Personal data may only be processed for the time necessary for the purpose of the processing to be fulfilled. SCA does not store or use data for longer than is necessary regarding the purposes of the processing. The same task can be used for different purposes for different lengths of time. For example, information can remain in SCA's accounting for a long time but not be used for marketing.
  
  When the data is no longer needed, SCA deletes it in stages, which means that it is either deleted or de-identified.
• Accountability
  The principle of accountability means that SCA must be able to demonstrate compliance with the General Data Protection Regulation (GDPR). SCA therefore documents implemented and planned processes and measures relating to data protection issues.
• Register list
  SCA documents and maintains records of the processing of personal data carried out in its operations.
• Sensitive personal data
  Some personal data is by its nature particularly sensitive and therefore has stronger protection, so-called sensitive personal data. As a rule, it is forbidden to process sensitive personal data, but there are exceptions. SCA takes special technical and organizational security measures regarding sensitive personal data. Processing of sensitive personal data may include data relating to health, which is primarily handled by SCA's HR function and SCA Health.

4. Legal basis

All personal data processing must be supported by a legal basis to be permitted. The legal bases under the General Data Protection Regulation (GDPR) that are relevant to SCA are: 

• Performance of a contract, i.e. that the processing is necessary for SCA to be able to perform a contract to which the data subject is a party or to take steps at the request of the data subject prior to entering into such an agreement. An example is SCA's agreements with employees and customers who are private individuals.
• Comply with a legal obligation, i.e. that the processing is necessary for compliance with a legal obligation that is subject to SCA by law. For example, SCA must store accounting information for a period of at least seven years to meet legal requirements under the Accounting Act.
• Legitimate interest (balancing of interests),e. that the processing is necessary for purposes relating to SCA's or a third party's interest, unless the data subject's interest in privacy or fundamental rights and freedoms outweighs and requires the protection of personal data. If SCA uses a balancing of interests as a legal basis for a personal data processing, SCA will document the assessment made. As an example, SCA processes contact information for potential business contacts based on a balancing of interests.
• Consent, i.e. the individual has given consent to the processing of the personal data for one or more specific purposes. There are special requirements for consent that must be met for consent to be valid as a legal basis, e.g. that the consent has been given on a voluntary basis. Since a given consent can be withdrawn at any time, SCA has minimized the use of consent as a legal basis.

Information for data subjects

The requirement for transparency means, among other things, that individuals (so-called data subjects) have the right to receive information when personal data is processed. The information must include, among other things, the contact details of the data controller, the legal basis for the processing and the purpose of the processing.

SCA ensures appropriate procedures to comply with the disclosure obligation and SCA has adopted several internal and external disclosure documents. SCA typically provides information about SCA's processing of personal data by providing or referring to documents with privacy information.

Data Subject Rights

As an individual, you have certain rights towards SCA when SCA processes your personal data. SCA has established internal procedures and guidelines as well as an internal organization to ensure that individuals can exercise their rights under the GDPR.

• Right to information when personal data is collected
  The information must be provided to the individual in an easily accessible written form and in clear and unambiguous language. The General Data Protection Regulation (GDPR) has several clear requirements that must be met. The requirements vary depending on whether the information has been collected from the data subject himself or from a third party.
• Right of access
  The data subject has the right to receive confirmation as to whether personal data belonging to him or her is being processed, and if so, to receive a copy of the personal data, so-called register extracts. The right applies regardless of the place or system where the personal data is processed.
• Right to rectification
  If the personal data processed is incorrect or incomplete, the data subject may demand rectification. If the data subject demonstrates that the purpose for which the personal data is processed is no longer lawful, necessary or reasonable in the circumstances, the personal data in question shall be erased, unless there are any legal provisions stating otherwise.
• Right to erasure ('right to be forgotten')
  In certain cases, the data subject has the right to request the erasure of their personal data (the "right to be forgotten"). An example is when consent is the legal basis for the processing and the data subject withdraws their consent.
• Right to restriction of processing
  In certain cases, the data subject has the right to demand that SCA restricts the processing of his or her personal data, i.e. restricts the processing to certain limited purposes. The right to restriction applies, for example, when the data subject believes that the data is incorrect and has requested that the personal data be corrected. The data subject can then request that the processing of the personal data be restricted while the accuracy of the data is investigated by the responsible function. When the restriction ends, the individual must be informed of this.
• Right to data portability
  The data subject has the right to transfer personal data that he or she has provided to SCA to another data controller if the processing is based on (i) the performance of a contract or (ii) consent as a legal basis. The personal data must be provided to the data subject in a structured, commonly used and machine-readable format. If technically possible, the data subject can request that the data be transferred directly to another controller. The right only applies to the personal data that the data subject has provided to SCA.
• Right to object
  The data subject has the right to object to the processing of personal data that is based on a balancing of interests as a legal basis. In the event of an objection, SCA shall cease processing unless it can demonstrate compelling legitimate interests for the processing that outweigh the interests, rights and freedoms of the data subject or if the processing of personal data is carried out for the establishment, exercise or defence of legal claims.
• Right to object to direct marketing
  When personal data is processed for direct marketing purposes, the data subject has the right to object to the processing of personal data concerning him or her at any time. If a data subject objects to the processing of personal data for direct marketing purposes, the processing for such purposes shall cease.
• Continued treatment in some cases
  The data subject's rights are not absolute in all cases, which means that situations may arise where SCA may continue to have the right to process the data subject's personal data. Regardless, SCA must ensure that it is possible to handle the data subject's request.

Safety Precautions

SCA processes personal data in a manner that ensures appropriate security of the personal data, including for the purpose of preventing so-called personal data breaches. This is done through technical and organizational measures within the SCA Group. The level of security measures is assessed in relation to the risks and type of personal data processing. Organizational security measures may include, for example, that SCA uses access control and logging systems for the IT systems that contain personal data, as well as perimeter protection for entry and exit into SCA's premises. Technical security measures may include, for example, that SCA has adequately protected wireless networks, password protection for mobile devices and encryption of e-mail when necessary.

Disclosure of personal data

SCA engages partners and service providers who perform services on SCA's behalf, such as providing IT services, marketing services, etc. In performing such services, the service provider/partner may gain access to personal data. These companies may only process personal data in accordance with the data processing agreement signed with us and in accordance with the specific instructions they receive in connection with the signing of such an agreement. They are not allowed to use your personal data for their own purposes, and they are obliged by law and contract to protect your personal data.

SCA may disclose personal data to third parties, such as the police or other authorities, if we are required by law or government order to do so to safeguard SCA's legal interests or to investigate, detect or prevent fraud, other crimes or security issues. SCA may also disclose personal data to legal advisors, auditors and business consultants.

In connection with a legal dispute, it may also be relevant to transfer information that may contain personal data to the other parties to the dispute.

SCA only discloses personal data to a third party when there is a legal basis for the transfer, and it is justified by internal business purposes or otherwise well-founded.

SCA has entered into agreements with its data processors, including data processors within the SCA Group.

Transfer to third countries

As a rule, SCA only processes personal data within the EU/EEA. The General Data Protection Regulation (GDPR) means that all EU member states have equal protection for personal data and personal privacy, which is why personal data can be transferred freely within the EU/EEA without restrictions.

For a country outside the EU/EEA, so-called third country, there is no corresponding protection for personal data and personal privacy. If SCA transfers (or provides access to) personal data to a third country, such as the United States, SCA takes measures to ensure that the personal data continues to be equally protected and the measures necessary to lawfully transfer personal data to countries outside the EU/EEA. This can be done by entering EU standard contractual clauses with the recipient or by further measures that are mentioned in such cases in connection with the respective processing.

Risk analysis and impact assessment

SCA is responsible for identifying and classifying privacy risks associated with each planned personal data processing. SCA is therefore conducting a risk analysis of planned personal data processing. Privacy risks to the rights and freedoms of individuals may occur, for example, when processing sensitive personal data or if the processing takes place on a large scale.

If personal data processing is likely to entail a high risk to an individual's rights and freedoms, an assessment is made of the effects of the planned processing on the protection of personal data.

SCA employees are trained in GDPR issues

At SCA, we believe that all employees have a responsibility to understand applicable data protection rules, including the General Data Protection Regulation (GDPR). SCA supports its employees by continuously holding training courses adapted to the employees' actual needs in relation to the employee's position at SCA and the personal data processing in question.

Management organisation GDPR

SCA has a dedicated management organization for issues related to GDPR. In addition, the concrete work is largely carried out within the business units in accordance with the management organisation's directives, e.g. updating internal special procedures and documentation.

Audits and compliance

Audits of SCA's compliance with data protection regulations are conducted on a regular basis and in a structured manner. SCA has established procedures for how the GDPR Management Organization, with the help of an external party, shall perform thorough, independent and regular evaluations of SCA's regulatory compliance. SCA has also established procedures for performing gap analyses and for monitoring and remedying any identified deficiencies. SCA has also adopted procedures for how the results of an audit are to be reported.

Processing of personal data

SCA collects personal data that you provide to us voluntarily in connection with your contact with us, e.g. by emailing us or entering into an agreement with SCA. We also collect personal data during an ongoing business relationship with you.

Personal data may also be generated on an ongoing basis during our business relationship with you because of your activities, such as your participation in events at SCA, or when we comply with legal obligations that are incumbent on us as a company.

SCA also collects information if you use our web forms and using cookies on our websites that collect information on and from your browser. More information about this can be found in the cookie information on the relevant website.

We may also supplement information from publicly available sources such as public registers, especially SPAR and Lantmäteriet's property register, as well as from the websites of companies and organisations. In some cases, SCA purchases data from companies that compile registers.

Special documents with more detailed privacy protection information, which may be relevant to you depending on the role and context in which you meet SCA, are published on sca.com/gdpr and internally on SCA's intranet.

What personal data we process about you

We may process the following personal data about you in connection with the processing of personal data regarding external visitors.

• Name,
• company,
• registration number for parking permits, if any.

In cases where we do not receive the above-mentioned personal data directly from you, we access it through other business contacts or public sources, such as websites and the like.

Why we process your personal data

SCA processes personal data about external visitors to have knowledge of which people are in the area in question in the event of any incidents from a security perspective.

The legal basis for our processing is a balancing of interests, where our legitimate interest is to know which persons are in the factory area in the event of an incident from a safety perspective (e.g. in the event of evacuation due to various reasons).

The personal data is registered in connection with your visit and is deleted on an ongoing basis.  

What personal data we process about you

We may process the following personal data about you in connection with the processing of personal data regarding camera surveillance.

• Images, and
• sound.

Why we process your personal data

SCA uses camera surveillance at our facilities and buildings. This is done to prevent, detect and investigate criminal activities and accidents, as well as to maintain a safe and secure environment for our employees and visitors. At our production facilities, there is also production-related camera surveillance, with the aim of preventing and preventing accidents.

In the places that are under camera surveillance, there are signs with more information.

The legal basis for our processing is a balancing of interests, where our legitimate interest in being able to ensure the safety of persons and property is deemed to outweigh the individual's interest in the data not being processed.

If sound is recorded, this must be particularly evident from the signage at the site. Recorded material is normally only stored for a few days and is discarded continuously. However, material may be stored for longer if it is needed to comply with specific legal requirements or if it is necessary to investigate burglary, an accident or the like.

What personal data we process about you

We may process the following personal data about you in connection with the processing of personal data in relation to complaints from the public.

• Name,
• contact details (such as address, email address, telephone number);
• registration number of car (linked to car wash),
• bank account details (linked to any compensation) and
• Information about the complaint

The personal data is collected directly from you in connection with the registration of the complaint. Information about bank accounts is collected in the event of an agreement on compensation.

Why we process your personal data

SCA processes personal data for the purpose of handling complaints from the public related to our operations, such as any emissions of gases, odors, fiber deposition or other impacts. Once we have received a complaint, we need to save that person's contact details to be able to document the complaint and to be able to get back to that person if necessary.

The legal basis for our processing is a balancing of interests, where our legitimate interest is to be able to handle the complaint. If the case results in financial compensation, the legal basis for our processing is also linked to a legal obligation (the Accounting Act).

The personal data is normally stored for two years from the registered complaint and is then deleted from our registers. For cases where the legal basis is a legal obligation, the case is stored for seven years (the Accounting Act) from the time payment is made.

What personal data we process about you

We may process the following personal data about you in connection with personal data processing in marketing.

• Name,
• contact details (such as address, email address, telephone number);
• information about participation in events,
• information about your relationship with SCA,
• professional role;
• company and industry,
• language of communication, and
• IP address.

In cases where we do not receive the above-mentioned personal data directly from you, we access it through other business contacts or public sources, such as websites and the like.

Why we process your personal data

Communicate news about our business and market our products and services

SCA processes personal data for the purpose of communicating news about our business and marketing our products and services to both existing customers and potential customers, including to provide relevant offers. Such communication or marketing may be, for example, an annual report, a newsletter with information about SCA's operations, products and services, or invitations to events and similar activities. We will adapt our marketing based on your professional role, the company/organization you belong to and your and the business's demonstrated interest in relation to SCA's operations, products and services, in order to ensure that the marketing is relevant to you.

The legal basis for our processing in this part is a balancing of interests, i.e. the processing is necessary for our legitimate interest in being able to market SCA's products and services to potential and existing contact persons at the customer/supplier.

For existing customers/suppliers, the personal data is stored for the duration of the customer/supplier relationship and for one year thereafter. For potential customers/suppliers/other stakeholders, the personal data is stored for three months from the time of collection, unless the individual has agreed to further mailings.

Analysis and follow-up of our marketing activities

SCA processes personal data to be used for analysis and follow-up of our marketing activities, either by SCA directly or through third parties on our behalf, to improve our offerings and generally to develop our businesses. To be able to do this, we use tools on our website. The information collected is used to maintain and improve the website, measure the effectiveness of advertising, protect against fraud, abuse and personalise the content and advertisements that you see on our website and other websites. To ensure that your data is adequately protected, we have taken protective measures in the form of de-identification and pseudonymization measures.

The legal basis for our processing in this part is a balancing of interests, i.e. the processing is necessary for our legitimate interest in being able to analyse and follow up our marketing activities and to develop, optimise and manage our businesses. The legal basis for our processing related to cookies on our website is your consent. For more information about how your personal data is processed when you visit our websites, read more about Cookie information on SCA's website sca.com.

For existing customers/suppliers, the personal data is stored for the duration of the customer/supplier relationship and for one year thereafter. For potential customers/suppliers/other stakeholders, the personal data is stored for three months from the time of collection, unless the individual has agreed to further mailings. Marketing activities may also be directed towards business contacts other than existing customers and potential customers if we believe that the business contact is of importance to SCA in some way, e.g. a marketing organization or group of companies.

Deregistration

You always have the option to request deregistration regarding your data used for marketing. Such deregistration means that, unless there are legal requirements preventing such deletion, your data will be deleted and no longer used for marketing purposes. If you no longer wish to receive marketing measures from an SCA company, you can unsubscribe via the contact form at sca.com/gdpr or directly via the links provided in the newsletters, for example.

What personal data we process about you

We may process the following personal data about you in connection with the processing of personal data regarding views in wind power planning.

• Name,
• contact information (such as address, email address, telephone number), and
• submitted comments.

In cases where we do not receive the above-mentioned personal data directly from you, we access it through other business contacts or public sources, such as websites and the like.

Why we process your personal data

SCA collects data if you, as a stakeholder, submit comments regarding SCA's development of wind power on SCA Group land that is subject to so-called early dialogue to be able to provide your views to wind power developers and to be able to respond to your views in a correct manner. In cases where planning begins, we also need to be able to provide a summary of all comments received from stakeholders to the wind power developer in question.

The legal basis for our processing is a balancing of interests, where our legitimate interest is to be able to provide your views to the wind power developer to subsequently be able to respond to your views in a correct manner, as well as to be able to compile views from stakeholders. More detailed information will be provided on the relevant website when you submit your comments.

The personal data is stored for the duration of SCA's participation in the project and for a maximum of three months thereafter.

Download as pdf

1. Introduction

In the framework of its business operations, SCA processes personal data relating to its customers and potential customers as well as other business contacts. We always take care to process personal data in a responsible and correct manner in accordance with applicable laws and regulations, such as the EU General Data Protection Regulation (GDPR).

In this information concerning personal data processing (the “Information”), you can read more about how we process personal data relating to our customer contacts (corporate customers, private forest owners and consumers).

2. Data controller

The SCA Group consist of several companies and operations. Each SCA company is the controller in relation to the processing of personal data within the framework of the business relationship between the SCA company and the company for which you are the contact person or representative, or between the SCA company and you as a private forest owner or consumer. The company that you have contact with within the SCA Group is thus the sender of this Information to you.

The designations “we”, “our” and “us” below pertain to the specific company within the SCA Group.

3. For what customer contacts do we process personal data?

We process personal data in relation to the following categories of customers, all of whom come into contact with our marketing and sales organization at SCA:

1. Contact person at a potential corporate customer, meaning we process personal data regarding the contact person or representative of a company that could be interested in buying products and services from SCA. See further details of our processing of personal data in relation to corporate customers in Section 4.
2. Contact person at a corporate customer, meaning we process personal data regarding the contact person or representative of a company that has an ongoing business relationship with SCA. See further details of our processing of personal data in relation to corporate customers in Section 5.
3. Private forest owner, meaning that you have a business relationship with us in your capacity as a private forest owner. See further details of our processing of forest owners’ personal data in Section 6.
4. Consumer, meaning you are a customer of ours in your capacity as a private individual. See further details of our processing of consumers’ personal data in Section 7.
   In this Information, you can read all about our personal data processing in relation to the above categories of customer contacts. To enable you to easily find information regarding the processing of your personal data, we have divided the information below into each customer category and it is thus sufficient that you read the section stated above for each customer category. If, for example, you are a contact person for an active corporate customer and want to know more about our processing of your personal data, it is sufficient for you to read Section 5 below.

4. Our processing of your personal data as a contact person at a potential corporate customer

4.1. Which personal data do we process about you?

We may process the following personal data about you as a contact person or representative of a potential corporate customer:

• name, 
• contact information (such as address, e-mail address and telephone number),
• role/title, 
• information on the company you work for, and
• information that you provide to us (via our contact form, e-mail correspondence, registration for an event, etc.).

In the event that we do not receive the above mentioned personal data directly from you, we gain access to such data through other business contacts or public sources, such as websites or similar.

4.2. Why and on what legal basis do we process your personal data?

For marketing and campaigns

We process your name and contact information for the purpose of contacting you and offering and marketing our goods and services to you using various methods of direct marketing by e-mail and post, including newsletters, our newspapers, invitations to events and price offers.

The legal basis for processing your personal data in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to market the products and services that we believe your company may be interested in. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your privacy on the basis of the potential benefits that the marketing offers for our customer contacts. If you have nonetheless declined marketing from us, we will not send any marketing to you.

To be able to conduct customer events

We process your name, contact information, information about the company you represent and any information on food preferences and other requirements that you submit to us when registering with the aim of being able to conduct various customer events, such as meetings, training courses, dinners, conferences and similar customer activities. The legal basis for processing your personal data in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to conduct customer events with your participation. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your privacy on the basis of the potential benefits that customer events offer for our business contacts.

To administer the contact form on www.sca.com

We process your name, contact information and information about the company you work for with the aim of being able to manage inquiries that are submitted using the contact form on SCA’s website and to be able to follow up on inquiries over time. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to administer or follow up on inquiries from our potential corporate customers regarding the performance of services in one of the SCA Group’s areas.

To follow up contacts and establish new business relationships

We process your name, contact information and information about the company you work for in a customer register with the aim of being able to follow up our contacts with you during a relevant period. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to follow up contacts with potential corporate customers and thereby establish new business relationships.

5. Our processing of your personal data as a contact person at a corporate customer

5.1. Which personal data do we process about you?

We may process the following personal data about you as a contact person or representative of a corporate customer:

• name, 
• contact information (such as address, delivery address, e-mail address and telephone number),
• role/title, 
• information on the company you work for,
• details of agreed content (meaning your customer agreement), orders and other information related to your potential contacts with SCA,
• details of your evaluation or assessment of SCA from customer surveys,
• information that you provide to us (via our contact form, e-mail correspondence, etc.), and
• accounting information.

In the event that we do not receive the above mentioned personal data directly from you, we gain access to such data through the company you work for, other business contacts or public sources, such as websites or similar.

5.2. Why and on what legal basis do we process your personal data?

For marketing and campaigns

We process your name and contact information for the purpose of contacting you and offering and marketing our goods and services to you using various methods of direct marketing by e-mail and post, including newsletters, our newspapers, invitations to customer events and price offers.

The legal basis for processing your personal data in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to market products and services to the company that you represent. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your privacy on the basis of the potential benefits that the marketing offers for our customer contacts. If you have nonetheless declined marketing from us, we will obviously not send any marketing to you.

To be able to conduct customer events

We process your name, contact information, information about the company you represent and any information on food preferences and other requirements that you submit to us when registering with the aim of being able to conduct various customer events, such as meetings, training courses, dinners, conferences and similar customer activities. The legal basis for processing your personal data in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to conduct customer events with your participation. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your privacy on the basis of the potential benefits that customer events offer for our customer contacts.

To administer the contact form on www.sca.com

We process your name, contact information and information about the company you represent with the aim of being able to manage inquiries that are submitted using the contact form on SCA’s website and to be able to follow up on inquiries over time. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to administer or follow up on inquiries from our customer contacts regarding the performance of services in one of the SCA Group’s areas.

To be able to maintain contacts, enter into and manage agreements, and otherwise manage the customer relationship

We process your name, contact information and information about the company you work for in a customer register with the aim of being able to maintain contact with you as the contact person for a corporate customer and manage measures relating to the customer relationship and agreements entered into.

We also process your name, contact information and information about the company you work for in order to establish agreement documentation regarding what has been agreed between the company you represent and SCA. Such personal data is also processed to be able to send an order confirmation and manage information and invoicing in connection with the sale.

To the extent that e-mail correspondence contains personal data, we process this data to maintain or establish business relationships and to enable internal and external communication.

The legal basis for processing your personal data in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to manage an existing business relationship with the company you represent.

For managing claims on goods and services

We process your name, contact information, information on your orders, your payment history and other details related to your contacts with SCA for the purpose of addressing any eventual complaints about goods and services. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to manage complaints about goods and services.

To be able to investigate customer satisfaction and improve our operations

We process your name, contact information, information about the company you represent and details of your evaluation or assessment of SCA for the purpose of surveying customer satisfaction among our corporate customers. Our customers’ evaluation and assessment of SCA is also a key factor in enabling us to continuously improve our business. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to survey customer satisfaction and develop and improve our operations.

For accounting purposes

For accounting purposes, we process details about the transaction that has occurred between us and the corporate customers for the orders made. For this reason, we may process the name and contact details that appear on the invoice or in other accounting documentation. The legal basis for our processing of your personal data for this purpose is that it is necessary to complete SCA’s legal obligation.

6. Our processing of your personal data as a private forest owner

6.1. Which personal data do we process about you?

We may process the following personal data about you as a forest owner:

• name, 
• contact information (such as address, delivery address, e-mail address and telephone number), 
• personal identity number,
• information about your forest holding and your property (such as property designation, county, product (ha), quality, total production capacity, status regarding any felling needs and similar information with a direct connection to your property and forest holding), details of agreed content (meaning the customer agreement between you and SCA),
• information on your orders, payment history and other details related to your contacts with SCA,
• details of your evaluation or assessment of SCA from customer surveys, also categorized based on gender,
• information that you provide to us (via our contact form, e-mail correspondence, etc.), and
• accounting information.

In the event that we do not receive the above mentioned personal data directly from you, we gain access to such data through public registers, particularly the Real Property Register (Sw: Lantmäteriet). 

6.2. Why and on what legal basis do we process your personal data?

For marketing and campaigns

We process your name, contact information and, in certain cases, information about your forest holding for the purpose of being able to market relevant forest products and services to you as a private forest owner through, for example, invitations and other targeted mailings. We may also use Facebook and Google Ads to advertise to the target group of private forest owners that we believe could be interested in our marketing offering. The legal basis for processing your personal data in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to market products and services to you. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your privacy on the basis of the potential benefits that marketing offers for our customer contacts. If you have nonetheless declined marketing from us, we will obviously not send any marketing to you.

To be able to conduct customer events

We process your name, contact information and, in certain cases, details of your forest holding as well as any information on food preferences and other requirements that you submitted to us when registering with the aim of being able to conduct various customer events, such as meetings, training courses, dinners, conferences and similar customer activities. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to conduct customer events with you as a private forest owner. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your privacy on the basis of the potential benefits that customer events offer for our customer contacts.

To administer the contact form on www.sca.com

We process your name, contact information and information about you as a private forest owner with the aim of being able to manage inquiries that are submitted using the contact form on SCA’s website and to be able to follow up on inquiries over time. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to administer or follow up on inquiries from our customer contacts regarding the performance of services in one of the SCA Group’s areas.

To be able to maintain contacts, enter into and manage agreements, and otherwise manage our business relationship,  as well as for follow-up purposes 

We process your name, contact information and information about you as a private forest owner in a customer register with the aim of being able to maintain contact with you as a private forest owner and manage measures relating to our business relationship.

We also process your name, contact information and information about you as a private forest owner as well as information about your forest holding for the purpose of establishing agreement documentation regarding what has been agreed between you and SCA, entering into agreements and managing the fulfillment of agreements with you (also online). Such personal data is also processed to be able to send an order confirmation and manage information and invoicing in connection with the delivery of our forest products and services to you, as well as for otherwise administering our business relationship and for follow-up purposes.

To the extent that e-mail correspondence contains personal data, we process this data to maintain or establish business relationships and to enable internal and external communication.

The legal basis for processing your personal data in this case is to enable the agreement with you to be entered into and fulfilled as well as a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to manage an existing business relationship with you.

To meet requirements linked to land balance and application for an acquisition permit in accordance with the Land Acquisition Act (1979:230)

SCA processes information linked to our agreement with you and your property in order to maintain and maintain SCA's list of SCA's so-called market balance. This list is also included in the documentation that we submit to the County Administrative Board with an application for an acquisition permit in accordance with the Land Acquisition Act prior to new acquisitions of forest properties. The personal data covered by this processing are: name, address, date of agreement, county, municipality, property designation, product (ha), quality, total production capacity.

The legal basis for our processing of personal data in this part is that we must have the opportunity to fulfill a legal obligation incumbent on SCA according to the Land Acquisition Act (1979: 230) to apply for an acquisition permit with the County Administrative Board, and a balance of interests, where SCA assesses that the processing is necessary to enable SCA to have continuously updated documentation to prove the soil balance.

For managing claims on goods and services

We process your name, contact information, information on your orders, your payment history and other details related to your contacts with SCA for the purpose of addressing any complaints about goods and services. The legal basis for processing your personal data in this case is that it is necessary to enable us to fulfill our agreement with you as a private forest owner.

To be able to investigate customer satisfaction and improve our operations

We process your name, contact information, information about you as a private forest owner and details of your evaluation or assessment of SCA for the purpose of surveying customer satisfaction among our customer contacts. Our customers’ evaluation and assessment of SCA is also a key factor in enabling us to continuously improve our business. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to survey customer satisfaction and develop and improve our operations.

Skogsvinge

We process details of your forest holding based on information from public registers (such as information on the property, mortgages, owner, rights and associations, etc.) for the purpose of being able to analyze your forest holding, but also to be able to offer you as a private forest owner access to our analyses and collated information about your forest holding by logging in to our digital service, Skogsvinge. When you are logging in, using BankID, we will handle your personal identity number for the purpose of identifying you in a safe way. If you turn to us with a support request we will also handle these personal data in order to handle your request in our case management system. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in identifying you, analyzing your forest holding based on public registers (Sw: Lantmäteriet), offering you access to our analyses and compiled information about your forest holding, and handling potential support requests.

7. Our processing of your personal data as a consumer (private individual)

7.1. Which personal data do we process about you?

We may process the following personal data about you as a consumer (private individual):

• name, 
• contact information, such as address, e-mail address and telephone number,
• personal identity number,
• information on any contacts with SCA by, for example, telephone,
• details of your evaluation or assessment of SCA from customer surveys, also categorized based on gender,
• information on your orders and our agreements with you, 
• information on your potential belonging to any of our hunting teams, 
• information on you included in potential interview notes when in contact with SCA,
• accounting information, and
• information on your credit status, such as creditworthiness and any payment defaults.

In the event that we do not receive the above mentioned personal data directly from you, we gain access to such data through public registers and when conducting credit checks.

7.2. Why and on what legal basis do we process your personal data?

For marketing and campaigns

We process your name and contact information for the purpose of contacting you and offering and marketing our goods and services to you using various methods of direct marketing by e-mail and post, including newsletters, our newspapers, invitations to events and price offers. We send marketing mailings to consumers that have an existing customer relationship with SCA and to private individuals that we believe could be interested in buying goods and services from SCA.

The legal basis for processing your personal data in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to market products and services to you. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your privacy on the basis of the potential benefits that marketing offers for our customer contacts. If you have nonetheless declined marketing from us, we will obviously not send any marketing to you.

To be able to conduct customer events

We process your name, contact information and any information on food preferences and other requirements that you submitted to us when registering with the aim of being able to conduct various customer events, such as meetings, training courses, dinners, conferences and similar customer activities. We invite consumers that have an existing customer relationship with SCA and consumers that we believe could be interested in participating in our customer events. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to conduct customer events with you as a participant. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your privacy on the basis of the potential benefits that customer events offer for our customer contacts. If you have nonetheless declined marketing from us, we will obviously not send any marketing to you.

To administer the contact form on www.sca.com

We process your name and contact information with the aim of being able to manage inquiries that are submitted using the contact form on SCA’s website and to be able to follow up on inquiries over time. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to administer or follow up on inquiries from our customer contacts regarding the performance of services in one of the SCA Group’s areas.

For the management of customer relationships, managing orders, credit checks and agreements, etc.

We process your name, contact information, personal identity number and information on your orders and agreements with us for the purpose of managing your orders (including preparing and sending order confirmations and issuing notices regarding order status and delivery problems as well as providing support and answering questions from you), conducting credit checks to find out whether or not we can sell to you on invoice, and otherwise fulfilling our obligations to you as a consumer, and to optimize our business based on our customers geographical area and buying patterns.

To the extent that e-mail correspondence contains personal data, we process this data to maintain or establish business relationships and to enable internal and external communication.

The legal basis for processing your personal data in this case is to enable the agreement with you to be entered into and fulfilled as well as a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to manage an existing business relationship with you, and to optimize and make our business more effective.

For managing claims, returns, etc.

We process your name, contact information and information on your orders and agreements with us for the purpose of managing any request to return products or to exercise your consumer rights to claim an error and delay on our part. The legal basis for processing in this case is that it is necessary to enable us to fulfill our agreement and to complete our legal obligations in accordance with applicable consumer legislation.

To be able to investigate customer satisfaction and improve our operations

We process your name, contact information, information about you as a consumer and details of your evaluation or assessment of SCA for the purpose of surveying customer satisfaction among our customer contacts. Our customers’ evaluation and assessment of SCA is also a key factor in enabling us to continuously improve our business. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to survey customer satisfaction and develop and improve our operations.

Hunting and fishing

We process your name and contact information for you as a consumer for the purpose of being able to offer the purchase of a one-day permit for small game hunting and fishing on our land. The legal basis for processing in this case is that it is necessary to enable us to fulfill our agreement with you as a consumer or to take measures before such an agreement is entered into.

Mapping and assessment of hunting teams

We process your name, what hunting team you belong to, and potential interview notes on you as consumer, when belonging to one of SCA’s hunting teams, with the aim of being able to map and assess the gender distribution in our hunting teams. The compiled result enables internal training within Equality, Gender and Management (“EGM”), and to work with business improvements related to EGM-questions. No personal data appears from such result or summary.

Lögdö Wild

We process your name and contact information for you as a consumer for the purpose of offering the booking of cottages and campsites in the wilderness. Bookings are managed on the website https://logdowild.se/. The legal basis for processing in this case is that it is necessary to enable us to fulfill our agreement with you as a consumer or to take measures before such an agreement is entered into.

Customer Club for pellets

We process your name and contact information for the purpose of administering your membership in our Customer Club for pellets, and to be able to contact you to provide and to market our products and services within the scope of the Customer Club through membership benefits and price offerings.

The legal basis for processing your personal data in this case is party to enable the conclusion and fulfillment of the agreement with you for the membership in the Customer Club, and partly a legitimate interest, i.e. the processing is necessary for our legitimate interest of being able to handle an ongoing business relationship with you and to provide and to market our products and services within the scope of the Customer Club.

For accounting purposes

For accounting purposes, we process details about the transaction that has occurred between us and you. For this reason, we will process the personal data that needs to be included in invoices and other accounting documentation. The legal basis for processing in this case is that it is necessary to complete SCA’s legal obligation.

8. Deliveries of pellets

SCA makes deliveries of pellets on behalf of distributors. In these cases, it is the distributor from whom you bought the pellets that is the data controller and is able to respond to any questions you may have concerning the processing of your personal data.

9. To whom do we forward personal data and where do we process personal data geographically?

We may give out your personal data if the need arises in conjunction with one of the following situations:

a) We may disclose your personal data to other companies in the SCA Group. Your personal data may also be disclosed to and processed by third parties outside the SCA Group, such as to our auditors and cooperative partners, as well as to our service providers who process personal data on our behalf, so-called processors. We have contracts with our processors that ensure that they process your personal data in accordance with this Information and our instructions. Examples of third parties to whom we may disclose your personal data include transport companies in connection with the delivery of goods, media agencies for the distribution of marketing mailings and legal advisors, as well as auditors.

b) We may disclose your personal data to authorities, such as the National Land Survey, the County Administrative Board and the Swedish Tax Agency, to fulfill a legal obligation incumbent on us or to enable an application for a permit or deduction in which information containing personal data linked to you must be submitted. An example of such a situation is when we apply for an acquisition permit with the County Administrative Board in accordance with the Land Acquisition Act (1979: 230).

c) We may also share your personal data with third parties to permit a merger, an acquisition or a sale of all or part of SCA’s assets.

As a general rule, SCA and SCA’s cooperative partners process your personal data only within the EU and EEA. If personal data is processed outside the EU and EEA, SCA will take measures to ensure that the data remains equally secure and also take the measures required to legally transfer personal data to countries outside the EU and EEA.

10. How long do we process your personal data for the different purposes?

SCA will not keep your personal data for longer than necessary, taking into account the purpose for they were was collected. Therefore, we regularly delete personal data that is no longer needed.

Personal data processed by SCA to ensure that we can offer our goods and services to our customer contacts, or that we process to manage customer relationships and sales, is processed as long as you or the company for which you are a contact person are customers of SCA.

Some personal data ceases to be necessary for SCA during the ongoing customer relationship and some in direct connection with the customer relationship ending, while SCA must store other information for a shorter or longer time period if required in order to fulfill legal or tax requirements, official decisions, accounting requirements, etc. 
The time period for which we process your personal data for marketing purposes depends on whether you have given your consent for processing or if such processing is carried out on the basis of a legitimate interest (which is usually the case). If you have consented to receive direct marketing, newsletters and catalogues from us, we will process your personal data until you deregister, withdraw the consent you have given (see Section 11.6 below) or otherwise ask us to stop contacting you for this purpose.

In the vast majority of cases in which we process data for marketing purposes on the basis of a legitimate interest, we will, in as far as you have an existing business relationship with SCA, process your personal data for marketing purposes for a year after your customer relationship with us ceases. However, you can always request that we stop processing personal data for this purpose earlier than this. If you do not have an existing business relationship with SCA and have not expressed that you want to receive marketing from us, we will process your personal data for three months from the time of obtaining your contact information. However, we may obtain the data again and then send further marketing mailings to you.

If you want more information about the period during which we process your data, please contact us for additional information, see the contact details to SCA in Section 12 below.

11. Your rights

When we process your personal data, you have certain legal rights. Note that the exercise of these rights is subject to certain requirements and conditions as specified in the General Data Protection Regulation (GDPR).

11.1. Your right to information and access

You are entitled, without cost, to request in writing information about the personal data we process in relation to you. If your request is unfounded or excessive, for example if you often request extracts or erasure and at frequent intervals, we may either reject your request, or charge a fee that covers the administrative costs arising for us from your request.

11.2. Your right to rectification and erasure

If your personal data is inaccurate or incomplete, you have the right to request that we rectify or supplement such personal data.

You have the right to request erasure of your personal data in certain circumstances that are described in the General Data Protection Regulation (GDPR). Provided that your request falls within one of these circumstances, we will erase your data.

11.3. Your right to request restrictions

Under certain circumstances as specified in the General Data Protection Regulation (GDPR), you have the right to request restriction of processing. Where you have this right, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

11.4. Your right to data portability

You have the right in a structured, commonly used and machine-readable format to receive the personal data about you that you have provided and have the right to transmit this data to another controller when such a transfer is technically possible.

11.5. Your right to object to direct marketing

You can object at any time to your personal data being processed for direct marketing. If you do not want us to process your personal data for this purpose, we ask that you inform using the contact information presented below, see Section 12. We will then stop processing your personal data for this purpose and remove the data, provided that we do not need to process the data for any other purpose according to this Information.

11.6. Your right to withdraw your consent 

If we process your personal data based on your consent, you may at any time, fully or partially, withdraw your consent by contacting us, see our contact information in Section 12. If you withdraw your consent, we ask you to note that this does not affect the legality of the processing that took place earlier on the basis of the consent before it was withdrawn. SCA may also have another legal basis for processing your personal data (see our statement above under each purpose) and we may therefore be entitled to continue processing your personal data.

11.7. Your right to lodge a complaint

If you are dissatisfied with how we have processed your personal data, we ask that you contact us, see our contact details in Section 12. You also have the right to submit a complaint about our personal data processing to:

The Swedish Authority for Privacy Protection, PO Box 8114, SE-104 20 Stockholm, Sweden, or by e-mail: imy@imy.se.

12. Contact SCA

You can contact us in the following way:

• by the contact form at https://www.sca.com/gdpr (or e-mail gdpr@sca.com)
• by telephone on +46 60 19 33 30 (Switchboard). ask for Head of Administration GDPR or Legal Counsel.

Download as pdf

1. Data controller 

Svenska Cellulosa Aktiebolaget SCA, corporate identity number 556012-6293, processes personal data regarding its shareholders and representatives for companies that are shareholders. We are always careful to process personal data in a responsible and correct manner in accordance with applicable laws and regulations, such as the EU General Data Protection Regulation (GDPR).

In this information about privacy protection (the “Information”), you can read more about how we process personal data relating to our shareholders.

The designations “we”, “our” and “us” below pertain to Svenska Cellulosa Aktiebolaget SCA.

2. Categories of persons about whom SCA processes personal data

We process personal data about the following categories of persons covered by this Information:

1. Shareholders (private person). See further details of our processing of personal data in relation to you as shareholder in Section 3.
2. Representatives for legal persons who are shareholders, which means we process personal data about the representative or contact person for the legal person who is a shareholder in SCA and other persons who contact SCA in connection with general meetings of shareholders. See further details of our processing of personal data in relation to representatives of legal persons who are shareholders in Section 4.

In this Information, you can read all about our personal data processing for the above categories of persons. To enable you to easily find information regarding the processing of your personal data, we have divided the information below into each category of person and it is thus sufficient that you read the section stated above for each category of persons. If, for example, you are a representative for a legal person who is a shareholder and want to know more about our processing of your personal data, it is sufficient for you to read Section 4 below.

3. Our processing of your personal data as a shareholder (private person)

3.1. Which personal data do we process about you?

We may process the following personal data about you as a shareholder:

• name,
• contact information (such as address, e-mail address and telephone number),
• personal identity number,
• shareholdings,
• number of votes, voting rights and other rights connected to your shareholding
• shareholder assistant,
• shareholder representative,
• notes in minutes of general meeting,
• visual material and/or audio recordings (such as recordings during a general meeting)
• other information you make available to us (such as via e-mail, notifications to a general meeting, request to address a specific matter at a general meeting and other communication)

If we do not collect the personal data listed above from you directly, we can obtain it through Euroclear Sweden AB, which manages our shareholders’ register. Euroclear Sweden AB is responsible for the personal data processing that occurs in conjunction with managing SCA’s shareholders’ register. Otherwise, we can obtain access to your personal data from the person who is your agent or from public registers and sources.

3.2. Why and on what legal basis do we process your personal data?

Managing the shareholders’ register

To the extent that Euroclear Sweden AB provides us with information from the shareholders’ register, which applies ahead of an annual general meeting, for example, we process name, contact details, personal identity number, shareholding and number of votes to take measures related to the management of the shareholders’ register, for instance that we receive a request from a shareholder to present certain information from the shareholders’ register. The legal basis for processing in this case is a legal obligation, i.e. we must process your personal data to meet our legal obligations.

Preparing and publishing information ahead of a general meeting

We process name, shareholding, number of votes and in certain cases visual material in order to show our ten largest shareholders on SCA’s website. We do this to fulfill our contractual obligations toward the marketplaces where our shares are traded. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to publish information related to shareholdings in SCA. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your personal privacy.

Managing and conducting general meetings and related issues

We process all personal data listed above under Section 3.1 to manage and conduct general meetings (scheduled, extended or extraordinary), including the administration connected with the general meeting and related issues, such as voting, dividends and whether you are a direct or nominee-registered shareholder. The legal basis for processing in this case is a legal obligation, i.e. we must process your personal data to meet our legal obligations.

In advance of a general meeting of SCA, you will receive additional information about how we process your personal data in conjunction with the general meeting. Such additional information is a supplement to this Information.

Holding events

We process name, contact information and any information on food preferences and other requirements that you submitted to us when registering with the aim of being able to conduct various events and similar activities with shareholders. The legal basis for processing your personal data in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to conduct events with you as shareholder. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your personal privacy on the basis of the potential benefits that events offer for our shareholders.

Communicating news about SCA’s operations, etc.

We process name and contact details in order to communicate news about our operations, including interim reports, annual reports and mailings, such as newsletters. We may also process name and contact details in order to manage other communication with you as shareholder. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to communicate news about SCA’s operations to you as shareholder. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your personal privacy.

Managing inside regulations

We process name, contact details, personal identity number, shareholding and number of votes about shareholders discharging managerial responsibilities at SCA and/or with access to inside information in order to maintain an insider logbook. The legal basis for processing in this case is a legal obligation, i.e. we must process your personal data to meet our legal obligations.

4. Our processing of your personal data as representative of a legal person who is a shareholder

4.1. Which personal data do we process about you?

We may process the following personal data about you as representative or contact person for the legal person who is a shareholder and you who otherwise contacts SCA in connection with general meetings of shareholders:

• name,
• contact information (such as address, e-mail address and telephone number),
• personal identity number,
• notes in minutes of general meeting,
• visual material and/or audio recordings (such as recordings during a general meeting)
• other information you make available to us (such as via e-mail, notifications to a general meeting, request to address a specific matter at a general meeting and other communication)

If we do not collect the personal data listed above from you directly, we can obtain it through Euroclear Sweden AB, which manages our shareholders’ register. Euroclear Sweden AB is responsible for the personal data processing that occurs in conjunction with managing SCA’s shareholders’ register. Otherwise, we can obtain access to your personal data from public registers and sources.

4.2. Why and on what legal basis do we process your personal data?

Managing and conducting general meetings and related issues

We process all personal data listed above under Section 4.1 to manage and conduct general meetings (scheduled, extended and extraordinary), including the administration connected with the general meeting and related issues, such as voting, dividends and whether the shareholder you represent or are contact person for is a direct or nominee-registered shareholder. The legal basis for processing in this case is a legal obligation, i.e. we must process your personal data to meet our legal obligations.

In advance of a general meeting of SCA, you will receive additional information about how we process your personal data in conjunction with the general meeting. Such additional information is a supplement to this Information.

Holding events

We process name, contact information and any information on food preferences and other requirements that you submitted to us when registering with the aim of being able to conduct various events and similar activities with shareholders. The legal basis for processing your personal data in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to conduct events with you as contact person or representative for a shareholder. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your personal privacy on the basis of the potential benefits that events offer for our shareholders.

Communicating news about SCA’s operations, etc.

We process name and contact details in order to communicate news about our operations, including mailings, such as newsletters. We may also process name and contact details in order to manage other communication with you as representative or contact person for a legal person who is a shareholder. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to communicate news about SCA’s operations to you as contact person or representative for a shareholder. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your personal privacy.

5. To whom do we forward personal data and where do we process personal data geographically?

We may supply your personal data to other companies in the SCA Group. Your personal data may also be supplied to and processed by third parties outside the SCA Group, such as to our cooperative partners and to our service providers who process personal data on our behalf, so-called personal data processors. We have contracts with our processors that ensure that they process your personal data in accordance with this Information and our instructions. Examples of third parties to whom we distribute your personal data are legal advisors and public authorities.

We may also share your personal data to permit a merger, an acquisition or a sale of all or part of SCA’s assets.

As a general rule, SCA and SCA’s cooperative partners process your personal data only within the EU and EEA. If personal data is processed outside the EU and EEA, SCA will take measures to ensure that the data remains equally secure and also take the measures required to legally transfer personal data to countries outside the EU and EEA.

6. For how long do we process your personal data for the different purposes?

SCA will not retain your personal data for longer than necessary, taking into account the purpose for which they were collected. Therefore, we regularly delete personal data that is no longer needed.

Personal data processed by SCA to complete its legal obligations, for example to comply with legal requirements in accordance with the Swedish Companies Act (2005:551) and Accounting Act (1999:1078), are processed for the time we have these legal obligations and commitments to you.

Personal data processed by SCA for the purpose of distributing newsletters about our operations are processed for as long as you wish to receive such a newsletter.

If you want more information about the period during which we process your data, please contact us for additional information, see the contact details to SCA in Section 8 below.

7. Your rights

When we process your personal data, you have certain legal rights. Note that the exercise of these rights is subject to certain requirements and conditions as specified in the General Data Protection Regulation (GDPR).

7.1. Your right to information and access

You are entitled, without cost, to request in writing information about the personal data we process in relation to you. If your request is unfounded or excessive, for example if you often request extracts or erasure and at frequent intervals, we may either reject your request, or charge a fee that covers the administrative costs arising for us from your request.

7.2. Your right to rectification and erasure

If your personal data is inaccurate or incomplete, you have the right to request that we rectify or supplement such personal data.

You have the right to request erasure of your personal data in certain circumstances that are described in the General Data Protection Regulation (GDPR). Provided that your request falls within one of these circumstances, we will erase your data.

7.3. Your right to request restrictions

Under certain circumstances as specified in the General Data Protection Regulation (GDPR), you have the right to request restriction of processing. Where you have this right, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

7.4. Your right to data portability

You have the right in a structured, commonly used and machine-readable format to receive the personal data about you that you have provided and have the right to transmit this data to another controller when such a transfer is technically possible.

7.5. Your right to lodge a complaint

If you are dissatisfied with how we have processed your personal data, we ask that you contact us, refer to our contact details in Section 8. You also have the right to submit a complaint about our personal data processing to:

Integritetsskyddsmyndigheten
Box 8114
SE-104 20 Stockholm
E-mail: imy@imy.se

8. Contact SCA

You can contact us in the following way:

• by the contact form at https://www.sca.com/gdpr (or by e-mail gdpr@sca.com)
• by telephone: +46 (0)60 19 33 30 (switchboard), ask for Head of Administration GDPR or Legal Counsel

Download as pdf

1. Introduction

In the framework of its business operations, SCA processes personal data relating to, among others, its suppliers and potential suppliers as well as other business contacts. We always take care to process personal data in a responsible and correct manner in accordance with applicable laws and regulations, such as the EU General Data Protection Regulation (GDPR).

In this information concerning personal data processing (the “Information”), you can read more about how we process personal data relating to our suppliers.

2.  Data controller

The SCA Group consists of several companies and operations. Each SCA company is the controller in relation to the processing of personal data within the framework of the business relationship between the SCA company and the company for which you are the contact person or representative. The company that you have contact with within the SCA Group is thus the sender of this Information to you.

The designations “we”, “our” and “us” below pertain to the specific company within the SCA Group.

3. What categories of persons do we process personal data about?

We process personal data in relation to the following categories of suppliers, all of whom meet our purchasing organization at SCA:

1. Contact person at a potential supplier, meaning we process personal data about the contact person or representative of a supplier who could be interested in supplying products and/or services to SCA. See further details of our processing of personal data in relation to potential suppliers in Section 4.
2. Contact person at a supplier, meaning we process personal data about the contact person or representative of a supplier who has an ongoing business relationship with SCA. See further details of our processing of personal data in relation to suppliers in Section 5.

In this Information, you can read all about our personal data processing in relation to the above categories of supplier. To enable you to easily find information regarding the processing of your personal data, we have divided the information below into each supplier category and it is thus sufficient that you read the section stated above for each supplier category. If, for example, you are a contact person for an active supplier and want to know more about our processing of your personal data, it is sufficient for you to read Section 5 below.

4. Our processing of your personal data as a contact person at a potential supplier

4.1. Which personal data do we process about you?

We may process the following personal data about you as a contact person or representative of a potential supplier:

• name, 
• contact information (such as address, e-mail address and telephone number),
• role/title,
• information on the company you work for,
• information in the offer, and
• information that we receive during communication, such as e-mail correspondence or similar.

If we do not receive the above-mentioned personal data directly from you, we gain access to such data through other business contacts or public sources, such as websites or similar.

4.2. Why and on what legal basis do we process your personal data?

To obtain offers

We process your name and contact information for the purpose of obtaining offers from the supplier you work for and thereby to be able to evaluate the business offering. The legal basis for processing your personal data in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to determine the terms of the transaction, such as price and delivery terms.

To maintain contact and establish new business relationships

We process your name, contact information and information about the supplier you work for in a supplier register with the aim of being able to follow up our contacts with you during a relevant period. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to follow up contacts with potential suppliers and thereby establish new business relationships.

To communicate by e-mail

To the extent that e-mail correspondence contains personal data, we process this data to maintain or establish business relationships and to enable internal and external communication. The legal basis for the processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in maintaining or establishing business relationships and communicating by e-mail internally and externally.

5. Our processing of your personal data as a contact person at a supplier

5.1. Which personal data do we process about you?

We may process the following personal data about you as a contact person or representative of a supplier:

• name,
• contact information (such as address, e-mail address and telephone number),
• social security number,
• role/title,
• information on the company you work for,
• information in the offer,
• information in the supplier agreement,
• information that we receive during communication, such as in e-mail correspondence or similar.,
• nationality, username and access rights (needed when you log in to our systems, such as Sharepoint), and
• accounting information.

If we do not receive the above-mentioned personal data directly from you, we gain access to such data through other business contacts or public sources, such as websites or similar.

5.2. Why and on what legal basis do we process your personal data?

To obtain offers

We process your name and contact information for the purpose of obtaining offers from the supplier you work for and thereby to be able to evaluate the business offering. The legal basis for processing your personal data in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to determine the terms of the transaction, such as price and delivery terms.

To maintain contact and manage the business relationship

We process your name, contact information and information about the supplier you work for in a supplier register to be able to maintain contact with you as a supplier and manage measures relating to the business relationship. The legal basis for processing in this case is a legitimate interest, meaning that the processing is necessary for our legitimate interest in maintaining contact with our suppliers and otherwise maintaining order in the business relationship.

To be able to enter into supplier agreements

We process your name, contact information and information about the supplier you work for to establish agreement documentation regarding what has been agreed between the supplier you represent and SCA. Such personal data is also processed to be able to manage orders, information, and invoicing in connection with the purchase. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to manage the conclusion of agreements, establish documentation regarding the agreement we have with a supplier and implementing relevant measures in connection with the fulfillment the purchase.

To communicate by e-mail

To the extent that e-mail correspondence contains personal data, we process this personal data to maintain or establish business relationships and to enable internal and external communication. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in maintaining or establishing business relationships and communicating by e-mail internally and externally.

To be able to provide our suppliers with system access

We process your name, contact information, nationality, username and information on access rights for the purpose of giving you, as a contact person for the supplier, access to our systems and work tools. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to maintain tools and functions to enable cooperation with our suppliers.

To provide our suppliers with access to workplace areas and to document entry and exit during construction projects

We process names, social security numbers, supplier names, project ID and check-in and check-out dates in relation to construction projects to give you access to our workplace areas and to be able to report entries and exits to the Swedish Tax Agency if necessary. The legal basis for our processing to report to the Swedish Tax Agency is a legal obligation, i.e. the processing is necessary to be able to report to the Swedish Tax Agency who has been in the workplace area in connection with construction projects. The legal basis for our processing of stored personal data in connection with the distribution of access cards is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to ensure that only authorized persons can enter and move around the premises.

To enter into confidentiality and cooperation agreements

We process your name, title and information about the supplier for the purpose of entering into a confidentiality agreement and/or a cooperation agreement with you as a contact person or representative of the supplier, or if you work as an independent consultant. The legal basis for our processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to secure a personal commitment regarding cooperation or confidentiality ahead of signing supplier agreements, etc.

6. To whom do we forward personal data and where do we process personal data geographically?

We may give out your personal data if the need arises in conjunction with one of the following situations:

a) We may disclose your personal data to other companies in the SCA Group. Your personal data may also be disclosed to and processed by third parties outside the SCA Group, such as to our cooperative partners and to our service providers who process personal data on our behalf, so-called processors. We have contracts with our processors that ensure that they process your personal data in accordance with this Information and our instructions. Examples of third parties to whom we disclose your personal data are legal advisors and public authorities.

b) We may also share your personal data to permit a merger, acquisition, or sale of all or part of SCA’s assets.

As a general rule, SCA and SCA’s cooperative partners process your personal data only within the EU and EEA. If personal data is processed outside the EU and EEA, SCA will take measures to ensure that the data remains equally secure and take the measures required to legally transfer personal data to countries outside the EU and EEA.

7. How long do we process your personal data for the different purposes?

SCA will not keep your personal data for longer than necessary, taking into account the purpose for which they were collected. Therefore, we regularly delete personal data that is no longer needed.

Personal data processed by SCA to ensure that we can buy relevant goods and services from our supplier contacts, or that we process to manage business relationships and purchasing, is processed if you or the supplier you work for are suppliers to SCA.

Some personal data ceases to be necessary for SCA during the ongoing business relationship and some in direct connection with the business relationship ending, while SCA must store other information for a shorter or longer period if required to fulfill legal or tax requirements, official decisions, accounting requirements, etc.

If you want more information about the period during which we process your data, please contact us for additional information. See the contact details for SCA in Section 9 below.

8. Your rights

When we process your personal data, you have certain legal rights. Note that the exercise of these rights is subject to certain requirements and conditions as specified in the General Data Protection Regulation (GDPR).

8.1. Your right to information and access

You are entitled, without cost, to request in writing information about the personal data we process in relation to you. If your request is unfounded or excessive, for example if you often request extracts or erasure and at frequent intervals, we may either reject your request or charge a fee that covers the administrative costs arising from your request.

8.2. Your right to rectification and erasure

If your personal data is inaccurate or incomplete, you have the right to request that we rectify or supplement such personal data.

You have the right to request erasure of your personal data in certain circumstances that are described in the General Data Protection Regulation (GDPR). Provided that your request falls within one of these circumstances, we will erase your data.

8.3. Your right to request restrictions

Under certain circumstances as specified in the General Data Protection Regulation (GDPR), you have the right to request restrictions on processing. Where you have this right, such personal data shall, except for storage, only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

8.4. Your right to data portability

You have the right in a structured, commonly used and machine-readable format to receive the personal data about you that you have provided and have the right to transmit this data to another controller when such a transfer is technically possible.

8.5. Your right to lodge a complaint

If you are dissatisfied with how we processed your personal data, please contact us. Refer to our contact details in Section 9. You also have the right to submit a complaint about our personal data processing to:

Integritetsskyddsmyndigheten, PO Box 8114, SE-104 20 Stockholm, Sweden, or by e-mail: imy@imy.se.

9. Contact SCA

You can contact us in the following way:

• by the contact form at https://www.sca.com/gdpr (or by e-mail gdpr@sca.com)
• by telephone on +46 60 19 33 30 (Switchboard). ask for Head of Administration GDPR or Legal Counsel.

Ladda ner denna text som pdf

1. Introduktion

Syftet med denna integritetsinstruktion (”Instruktion”) är att informera dig som vårdtagare (nedan ”du”, dig” och ”din(a)”) om den behandling av dina personuppgifter som sker inom ramen för SCA Hälsans (”SCA Hälsan”, ”vi”, ”oss” och ”vår”) verksamhet.

SCA Hälsan är en del av SCA Forest Products AB, org. nr 556379-3586. När vi i denna Instruktion refererar till SCA Hälsan omfattar det därför SCA Forest Products AB. Anställda i SCA Forest Products AB, och i övriga SCA bolag, har möjlighet att vända sig till SCA Hälsan för att ta del av den företagshälsovård som erbjuds den anställde i SCA koncernen som en förmån. SCA Hälsan tar även emot externa patienter. SCA Hälsan är i båda fall personuppgiftsansvarig för dina personuppgifter.

SCA Hälsan behandlar dina personuppgifter i enlighet med vid var tid gällande dataskyddslagstiftning vid all behandling av personuppgifter. Om du har frågor om hur vi samlar in, lagrar och använder dina personuppgifter eller om du vill utöva någon av dina rättigheter enligt gällande dataskyddslagstiftning ber vi dig att ta kontakt med oss, se kontaktuppgifter till SCA Hälsan i punkt 7.

Som privat vårdgivare följer vi både Dataskyddsförordningen (GDPR) och nationell hälso- och sjukvårdslagstiftning som t.ex. Patientdatalagen. Patientdatalagen kompletterar Dataskyddsförordningen (GDPR) och innehåller särskilda bestämmelser för personuppgiftsbehandling och journalföring i hälso- och sjukvården.

2. Vad, varför, och hur länge behandlar vi dina personuppgifter?

2.1. Vad är en personuppgift?

Personuppgifter är all slags information som kan knytas till en levande person. Det kan röra sig om namn, adress, personnummer, testresultat, symtom, diagnoser m.m.

SCA Hälsan behandlar framförallt personuppgifter om hälsa. Personuppgifter om hälsa faller inom den särskilda kategorin ”känsliga personuppgifter”. Att uppgifter om hälsa är känsliga personuppgifter innebär att det gäller särskilt höga krav för behandlingen av dem.

2.2. Vilka personuppgifter behandlar vi och varför?

Vi behandlar följande personuppgifter om dig:

• Namn
• Personnummer
• Adress
• Telefonnummer
• Hälsoinformation (men även information som du väljer att uppge av skäl som hör samman med förebyggande hälso- och sjukvård)
• För dig som är anställd inom SCA koncernen behandlar vi även uppgift om vilken arbetsplats/arbetsenhet du tillhör, din närmaste chef m.m.

Vi behöver spara och behandla dina personuppgifter för att vi ska kunna ge dig en god och säker vård i vår funktion som företagshälsovård, samt för verksamhets- och kvalitetsuppföljning. De närmare skäl till varför vi behandlar dina personuppgifter kan brytas ner i följande:

• utföra drog- och alkoholkontroll i samband med nyanställning och under pågående anställning,
• utföra förebyggande hälsovård och yrkesmedicin,
• utföra hälso- och sjukvård eller behandling,
• tillhandahålla behandlingar i samband med sjukgymnastik, psykoterapi, sjukskrivning och rehabilitering,
• föra journal,
• ställa medicinska diagnoser,
• förskriva och förnya recept på läkemedel, 
• skicka remisser till andra vårdgivare vid behov

2.3. Laglig grund

Vi behandlar dina personuppgifter (inklusive känsliga personuppgifter) med stöd av bestämmelser i Dataskyddsförordningen (GDPR) och Patientdatalagen. Aktuella bestämmelser i Dataskyddsförordningen är allmänt intresse (artikel 6.1 e), alternativt intresseavvägning (artikel 6.1 f), dvs. att behandlingen är nödvändig för vårt berättigade intresse av att kunna tillhandahålla hälso-och sjukvård på ett ändamålsenligt sätt och i enlighet med dina förväntningar som vårdtagare, samt hälso- och sjukvård (artikel 9.1 h och 9.3).

2.4. Hur länge uppgifterna sparas

SCA Hälsan kommer inte att spara dina personuppgifter längre än vad som nödvändigt med hänsyn till de ändamål för vilka de samlats in.

• Som vårdgivare är vi skyldiga att spara uppgifter i patientjournal i minst 10 år efter det att sista uppgiften fördes in i journalen. 
• Räkenskapsmaterial som enligt Bokföringslagen (1999:1078) ska sparas i minst 7 år, sparar vi under denna tid.
• Journaler sparas i pappersform för forskningsändamål i Merlo arkiv. Görs tillgängliga tidigast 50 år efter en persons död.

Vi genomför regelbundna gallringar genom vilka personuppgifter som inte längre är nödvändiga för ändamålet gallras bort.

3. Vilka delar vi dina personuppgifter med?

3.1. Sekretess

Inom hälso- och sjukvården gäller sträng sekretess och tystnadsplikt för uppgifter om hälsotillstånd eller om personliga förhållanden. SCA Hälsan kommer inte att lämna ut dina personuppgifter till obehöriga såvida vi inte har fått ditt uttryckliga samtycke till sådant utlämnande. Om vi skulle behöva överföra eller dela information om din hälsa eller andra personliga förhållanden kommer vi först att be om ditt samtycke.

3.2. Uppgiftsskyldighet

I vissa fall kan vi som vårdgivare vara skyldiga enligt lag eller förordning att lämna ut uppgifter till myndigheter. De författningar som reglerar sådan skyldighet är följande: Patientsäkerhetslagen (2010:659 6 kap § 15).

Utöver vad som annars följer av lag eller förordning är hälso- och sjukvårdspersonalen skyldig att lämna ut sådan uppgift som;

a) gäller huruvida någon vistas på en sjukvårdsinrättning om uppgifterna i ett särskilt fall begärs av en domstol, en åklagarmyndighet, Polismyndigheten, Säkerhetspolisen, Kronofogdemyndigheten eller Skatteverket,

b) behövs i verksamhet för personskydd av riksdagens ledamöter, statschefen och övriga medlemmar av kungahuset, statsråd, statssekreterare och kabinettssekreterare, om uppgifterna i ett enskilt fall begärs av Säkerhetspolisen,

c) behövs för rättsmedicinsk undersökning,

d) Socialstyrelsens råd för vissa rättsliga, sociala eller medicinska frågor behöver för som verksamhet,

e) behövs för prövning av ett ärende om att avskilja en studerande från högskoleutbildning eller polisprogrammet, eller

f) behövs för prövning av någons lämplighet att ha körkort, traktorkort eller taxiförarlegitimation enligt taxitrafiklagen (2012:211, Lag (2014:768)

3.3. Personuppgiftsbiträden

Vad som sägs ovan utesluter inte att en leverantör till oss, så som exempelvis en leverantör av IT-system, kan komma att ha tillgång till dina personuppgifter. Sådan tillgång kommer att begränsas till vad som är nödvändigt och vi har avtal med våra personuppgiftsbiträden som säkerställer att de behandlar dina personuppgifter i enlighet med denna Instruktion och våra instruktioner.

4. Hur skyddar vi dina uppgifter?

Inom hälso- och sjukvården gäller sträng sekretess och tystnadsplikt för uppgifter om hälsotillstånd eller om personliga förhållanden. Vi följer de regler om tystnadsplikt som finns i Patientsäkerhetslagen (2010:659).

Bara den som behöver dina uppgifter i sitt arbete på SCA Hälsan får ta del av dina patientuppgifter. Detta innebär att endast den personal som är inblandad i din vård och behandling, eller som av annat skäl behöver uppgifterna för att fullgöra sitt arbete inom hälso- och sjukvården, får ta del av uppgifter om dina patientuppgifter (s.k. inre sekretess).

Den inre sekretessen på SCA Hälsan upprätthålls genom tekniska lösningar för behörighetstilldelning, åtkomstkontroll och organisatoriska åtgärder.

Vi strävar alltid efter att behandlingen av dina personuppgifter ska ske inom EU/EES. Vi och våra personuppgiftsbiträden behandlar, som huvudregel, dina personuppgifter endast inom EU/EES. Skulle personuppgifter behandlas utanför EU/EES kommer vi att vidta åtgärder för att se till att personuppgifterna fortsätter att vara lika skyddade och även vidta de åtgärder som krävs för att på lagligt sätt överföra personuppgifter till länder utanför EU/EES.

4.1. Automatiserat beslutsfattande

Dina personuppgifter kommer inte bli föremål för beslut som grundar sig på automatiserat individuellt beslutsfattande (inklusive profilering).

5. Du kan påverka hur vi behandlar dina personuppgifter

5.1. Allmänt

Personuppgiftsansvarig är SCA Hälsan, se mer i punkt 1. Du har rätt att kontakta oss om du vill ha ut information om de uppgifter vi har om dig, för att begära rättelse, överföring (dataportabilitet) eller för att begära att vi begränsar behandlingen, för att göra invändningar eller begära radering av dina uppgifter. Detta gör du enklast genom att kontakta oss på de uppgifter som framgår under punkt 7.

I det fall vår personuppgiftsbehandling av dina uppgifter görs med stöd av ditt samtycke har du rätt att när som helst återkalla ditt samtycke.

6. Rättigheter gällande din journal enligt Patientdatalagen

Du har rätt att på din begäran och så snart som möjligt att ta del av uppgifter som finns i din patientjournal, om inte annat följer av 6 kap. 12 § eller 13 § första stycket Patientsäkerhetslagen. Du har även rätt att få en kopia av hela eller delar av patientjournalen.

Du kan i vissa fall ha rätt att få din patientjournal förstörd. Anmälan om förstörelse av patientjournal ska göras till Inspektionen för vård och omsorg.

Om SCA Hälsan skulle vilja göra en journaluppgift tillgänglig för annan vårdgivare genom s.k. sammanhållen journalföring kommer SCA Hälsan först att informera dig om vad det innebär. Sammanhållen journalföring förutsätter ditt samtycke. Om du inte vill att dina journaluppgifter ska vara elektroniskt tillgängliga för en annan vårdgivare, kan du i vissa fall begära att dina uppgifter spärras helt eller delvis för elektronisk åtkomst. Väljer du att spärra dina uppgifter från elektronisk åtkomst kan det få konsekvenser för din vård, exempelvis att du själv kommer få berätta för annan vårdpersonal vad de behöver veta för att ge dig en god och säker vård. Observera att spärr endast kan göras i en elektronisk journal (och inte en pappersburen).

Du har rätt att på din begäran få ta del av information om den direkt- och elektroniska åtkomst som förekommit till din patientjournal, dvs. åtkomsthistoriken.

Om personuppgifter om dig har behandlats i strid med Patientdatalagen och/eller Dataskyddsförordningen (GDPR) kan du ha rätt till skadestånd.

Du har rätt till information om vad som gäller i fråga om sökbegrepp, direktåtkomst och utlämnande av uppgifter på medium för automatiserad behandling.

Du har rätt att skicka in en begäran om radering av journal till IVO – Inspektionen för vård och omsorg. Kontaktuppgifter finns att hitta på deras webbplats www.ivo.se eller via telefon 010-788 50 00. SCA Hälsan agerar sedan utifrån IVOs beslut.

7. Kontaktuppgifter

Du kan kontakta SCA Hälsan via följande kontaktvägar

• telefon: 060-19 41 00, fråga efter Verksamhetschef SCA Hälsan 
• SCA Hälsan, Box 846, SE-851 23 SUNDSVALL, att Verksamhetschef 

Du är också välkommen att besöka oss på SCA Hälsan för mer information.

Om du är missnöjd med hur vi behandlat dina personuppgifter ber vi dig att kontakta oss i första hand, se våra kontaktuppgifter ovan.

Du har även rätt att ge in ett klagomål till:

Integritetsskyddsmyndigheten, Box 8114, 104 20 Stockholm eller via imy@imy.se

Ladda ner denna text som pdf

1. introduktion

Svenska Cellulosa Aktiebolaget SCA och dess koncernbolag samlar in och använder personuppgifter i sin verksamhet. Vi värnar om våra anställdas, kunders och andra affärskontakters integritet och är måna om att följa gällande dataskyddsregler, däribland Dataskyddsförordningen (GDPR).

Detta dokument (”Integritetsskyddsinformationen”) är tillämpligt när du använder den webbaserade plattformen tillgänglig på jaktrapport.se (”Jaktrapport”) och beskriver hur SCA Skog AB, organisationsnummer 556048-2852 med adress 851 88 Sundsvall (”SCA” “vi” eller “oss”) behandlar dina personuppgifter vid din användning av Jaktrapport. Vänligen notera att SCA inte är personuppgiftsansvarig om du använder Jaktrapport via ett annat skogsbolag än SCA.

2. Behandling av personuppgifter och ändamål

Vi behandlar personuppgifter om dig i form av namn, adress, e-postadress, telefonnummer, jaktlagstillhörighet och roll i jaktlag och i förekommande fall, personnummer samt information och material som du laddar upp och/eller bidrar med i Jaktrapport. Vi behandlar dina personuppgifter i syfte att:

• tillhandahålla dig tjänsterna i Jaktrapport,
• kommunicera relevant information (t.ex. allmän eller specifik information kopplad till jakträttsupplåtelsen, såsom avlysande av jakt och/eller andra nödvändiga meddelanden),
• administrera jakträttsupplåtelse samt
• för faktureringsändamål.

Behandlingen av personuppgifter avser kategorierna älgskötselområdesansvarig (ÄSO), jaktlagsmedlemmar och jaktlagsledare och i den mån uppgifterna inte inhämtats direkt av dig har de tillhandahållits oss av jaktlagsledaren i det jaktlag du tillhör. I förekommande fall kan även andra administrativa eller liknande roller komma att anges.

Vänligen notera att vi inte kan tillhandahålla tjänsterna i Jaktrapport till dig samt utföra fakturering utan att behandla personuppgifterna om dig.

3. Rättslig grund

Vår rättsliga grund för att behandla dina personuppgifter är för att uppfylla vårt avtal med dig eller med stöd av genomförd intresseavvägning i enlighet med de ändamål som har angetts under punkten 2.1 ovan.

4. Överföring av personuppgifter

Vi kan komma att lämna ut dina personuppgifter till andra bolag inom SCA-koncernen. Vi kommer också att ge tillgång till dina personuppgifter till de tjänsteleverantörer som vi anlitat för att bistå oss med att tillhandahålla och sköta driften av Jaktrapport. Vidare kommer vi att ge tillgång till dina personuppgifter till älgskötselområdesansvarig. Dina personuppgifter kan även komma att delas med andra jaktlag i den mån det är nödvändigt för att upprätthålla en säker jakt. Dina personuppgifter kommer att behandlas inom EU/EES i enlighet med denna Integritetsskyddsinformation och gällande dataskyddslagstiftning. Om vi överför dina uppgifter till länder utanför EU/EES kommer vi att se till att lämpliga säkerhetsåtgärder vidtas, till exempel genom att inkludera EU-kommissionens standardavtalsklausuler för dataöverföring i våra avtal med tjänsteleverantörer som behandlar dina personuppgifter. Du kan få ytterligare information om detta genom att kontakta oss på följande adress: gdpr@sca.com.

När du använder Jaktrapport kan du komma att hänvisas till andra skogsbolags hemsidor och tjänster för vilka SCA ej ansvarar och vänligen notera att dessa hemsidor och tjänster regleras av separata villkor och Integritetsskyddsinformationer/notiser.

5. Legala förfrågningar och förebyggande av skada

Vi kan komma att behandla dina personuppgifter vid legala förfrågningar eller när det är nödvändigt för att upptäcka, förhindra eller adressera bedrägeri/kriminell aktivitet, för att skydda oss, Jaktrapport samt dig och andra användare.

6. Lagring

Vi lagrar dina personuppgifter så länge du är medlem i ett aktivt jaktlag i Jaktrapport. Personuppgifter avseende medlemmar i ett jaktlag som upphört i Jaktrapport gallras.

7. Dina rättigheter

Du har rätt att begära tillgång till och ytterligare information om behandlingen av dina personuppgifter, eller begära att vi korrigerar, rättar, kompletterar, raderar eller begränsar behandlingen av dina personuppgifter. Du har rätt att få en kopia av de personuppgifter som vi behandlar om dig utan kostnad i skälig utsträckning. Vill du begära ut ytterligare kopior därutöver kan vi komma att ta ut en rimlig avgift baserad på de administrativa kostnaderna.

Om behandlingen är baserad på den legala grunden samtycke eller fullgörande av avtal har du rätt till dataportabilitet. Dataportabilitet innebär att du kan få de personuppgifter vi behandlar om dig, i ett strukturerat, allmänt använt och maskinläsbart format och har rätt att överföra sådana personuppgifter till en annan personuppgiftsansvarig.

8. Kontaktinformation

För att utöva dina rättigheter eller om du har frågor om vår behandling av dina personuppgifter, vänligen kontakta oss på följande sätt:

• via kontaktformuläret på sca.com/gdpr (eller via e-post gdpr@sca.com).
• via telefon 060-19 33 30 (växel). Fråga efter Förvaltningsansvarig GDPR eller Bolagsjurist.

Om du har några klagomål gällande vår behandling av dina personuppgifter, kan du skicka ett klagomål till SCA eller tillsynsmyndigheten för dataskydd, Integritetsskyddsmyndigheten (IMY). IMY kan nås på:

Integritetsskyddsmyndigheten
Box 8114, 104 20 Stockholm

Epost: imy@imy.se
Telefon: 08-657 61 00

Webbplats: www.imy.se

9. Förändring i ägande

Om ägandet av vår verksamhet förändras, kan vi komma att överföra dina personuppgifter till de nya ägarna. De nya ägarna ska fortsatt iaktta de åtaganden vi lämnat i denna Integritetsskyddsinformation. Vid sådan ändring i ägarförhållanden kommer vi att meddela dig.

10. Meddelande om ändringar

Om vi gör ändringar i denna Integritetsskyddsinformation kommer vi att meddela dig genom kungörande på www.jaktrapport.se. Om ändringarna är väsentliga, kommer vi i tillägg därtill lämna dig meddelande därom efter vad som är lämpligt, och om det erfordras enligt tillämplig lag, be om ditt samtycke.

______________________