Information about Holmen’s processing of personal data
Here we provide information on the general aspects that apply for all processing of personal data at Holmen.
In addition, a more specific description is provided for the categories marketing, contractual parties and business relations, forest owners, job applicants and also employees (see all below) in which the purpose of processing your personal data, the legal basis and the erasure of data varies.
The type of data processed
Personal data means all information that can be used in any way to identify or be linked to a specific individual. The personal data we process may vary depending on the purpose for which it is processed. In largely all cases, however, it covers contact details, such as name, address, phone number and e-mail address.
Where the registered person is our contractual party we also process matter related information and data necessary to manage payments. In some cases information regarding the data subject's customer and/or supplier segment is processed. We may also process property related data.
How we collect personal data
We collect personal data that is provided voluntarily by the data subject. This may occur in contact in the form of meetings, e-mail, phone calls or in other ways. We also collect data if you use our web forms and through our websites using cookies that collect data on and from your browser, see further at www.holmen.com/cookies.
Data may also be added and updated with information from publicly accessible sources, such as public registers, e.g. the SPAR register of persons resident in Sweden and the Real Property Register (Fastighetsregistret). In some cases, information is purchased from companies that compile registers.
Purpose, legal basis and erasure
The purpose of processing is always to be stated and is crucial to several aspects; for determining the legal basis for processing, but also for assessing which data is to be processed, who is authorised to access data and when data is to be erased. The purposes for which we process your personal data, the legal basis on which we do this, and how long we retain your data for are described separately for the various relationships that the Holmen Group has with you as a data subject, see the menu on the left.
Your personal data will be erased when it is no longer relevant for the purposes for which it was collected. Exceptions may be made to erasure if Holmen needs the data to comply with statutory requirements or to protect Holmen's legal interests.
Protection and safety
Holmen takes the appropriate organisational and technical security measures to protect your personal data from unauthorised access, change and erasure. All data is stored in databases protected by authorisation and access controls and by firewalls. Internal documents set out how personal data is to be processed. The safeguards are examined and tested regularly.
Holmen-companies that are data controllers
Depending on which business operation a data processing of your personal data is assignable to, the responsibility may rest with different companies within the Group. Decisive for the responsibility is which company or companies that choose the purpose of processing data and the way in which the data is to be processed as data controllers. In numerous cases there is a joint responsibility for Holmen-companies, why these companies have entered into an arrangement in respect of protecting personal data. Holmen has a joint management for issues relating to processing pf personal data, see below.
Sharing of personal data
The Holmen-group has several Group-wide functions and your personal data may be shared with other companies within the Group. Your personal data will only be processed by a limited number of people with specific authoritisation who need the data for the purposes described.
The data may also be shared with suppliers that we use for different services. This mainly refers to suppliers we use to conduct operation and maintenance of our IT systems. We only share your data with external suppliers if, and to the extent, necessary. Where we hire others to process personal data on our behalf (data processors), we enter into agreements to ensure that your personal data is processed securely and legally.
If Holmen's processing of your personal data means that personal data is transferred to countries outside the EU/EEA, measures are put in place to ensure a high level of security and legal processing.
Holmen may share your personal data to the police or another authority if required to do so by law or by the decision of a authority, in order to protect Holmen's legal interests or to investigate, uncover or prevent fraud, other crime or security problems.
You have the right to be given information on the personal data we process about you. You have the right to correct incorrect data and, in some cases, the right to have your data erased. You can request limits on the data processed and you can object to certain types of processing. In respect of personal data you provided yourself, you may be entitled to demand that his data is transferred from one data controller to another.
A request for information about which of your personal data we hold must be made in writing and be signed by you. Please specify the categories of data to which you want access or your relationship with Holmen, such as customer contact, job applicant or forest owner. We may need to request additional documentation and information to establish the identity of the person making the request.
You are welcome to contact us with any inquiries, requests for information or objections regarding processing of personal data you may have. may be made by post or by e-mail. you may have. Contact details are set forth below. Your matter will be swiftly passed on to the right part of the Group.
Who to contact
Communication regarding our processing of personal data is to be made to:
Holmen AB Box 5407, 114 84 Stockholm, Sweden phone: +46 8 666 21 00 GDPR@holmen.com
Holmen in UK In UK, Holmen has local management of GDPR matters and communication is to be made to:
You always have the right to make a complaint regarding the processing of personal data to the relevant supervisory authority. As a data subject you can choose which country’s supervisory authority you wish to contact.
We process personal data in order to market our products and send relevant offers directly to our existing and potential customers. This kind of marketing may include information, newsletters and invitations regarding campaigns and events. The data may also be used as a basis for analysis and monitoring to measure the marketing for the purpose of improvement, and generally to develop our operations.
Besides marketing to existing or potential contractual parties, information and invitations may also be sent to other business contacts, for example, market players with significance or impact on our business or to financial analysts and other stakeholders.
Our legal basis for this processing are legitimate interest, where our contractual parties' and business relations' interests or fundamental rights and freedoms are not afforded greater weight than our legitimate interest in direct marketing, including maintaining business contacts and communicating with business contacts regarding our operations, and developing, optimising and managing our operations in the long term. In respect of marketing this legal basis applies regardless of whether the data subject receives marketing in the role of a representative for a company or personally in the role of the owner of a business run as a sole trader or a single forest owner.
You always have an opportunity to request deregistration of your data used for marketing. If you want to unsubscribe and there is no legal requirement that prevents erasure, our processing will cease and your data will be removed, which also means that we cannot continue to send you information or invitations. If you no longer wish to receive information and invitations from Holmen, you can unsubscribe. Click here for more information on how to unsubscribe for each company.
Contractual parties and business relations
We process your personal data in order to ensure performance of a contract, including ensuring execution, administration and payment and also making or handling complaints. Personal data is also needed for various business-related contacts before, during and after the performance of a contract.
Contract refers to numerous types of contract, for example, purchasing contracts, sales contracts, and contracts on collaboration and property-related issues as well as sponsorship and hunting. Contracts with forest owners have several distinctive features and processing under these contracts is therefore described separately here.
In the most common situation, processing is linked to performance of a contract in which the contractual party is a company, but the data is needed for the representative of the company. Our legal basis for this processing is legitimitate interest where our business contacts’ interests or fundamental rights and freedoms are not afforded greater weight than our legitimate interest in executing a contract where the data subject is a representative of our contractual party.
In some situations the data subject is personally our contractual party, for example a business that is run as a sole trader. Our legal basis for this processing is performance of a contract in which the data subject is a party.
Holmen processes personal data regarding shareholders and other persons in connection to share related issues.
In connection to a general meeting is held in Holmen AB (publ), data regarding shareholders are being processed to carry out the general meeting and associated issues such as information, voting and dividends. If requested by a shareholder, the data regarding a proxy or guest may be processed.
Since Holmen AB (publ) is a listed company specific rules applies in respect of handling insider information. Persons that due to shareholding, position or relation is deemed to be a insider must be registered with the Swedish supervisory authority and persons that at a certain time has access to insider information must be registered in a specific log kept by the company. This implies a need for processing such persons' personal data.
Processing connected to general meetings and to the insider rules are made to fulfill legal requirements.
The legal basis for processing in connection to a general meeting is to some extent also legitimate interest where the shareholders' interests or fundamental rights and freedoms are not afforded greater weight than Holmen's legitimate interest in carrying out a general meeting in a safe and proper way.
In respect of a forest ownership, parties may have more than one role against each other. We process personal data about forest owners in their role as suppliers of wood, as customer of forest management services and also as owners of forest properties covered by forest management plans and other questions relating to forestry. The purpose is to handle all questions and undertakings that might arise in relation to the relation between us and forest owners. Our legal basis for this processing is the performance of a contract to which the data subject is party.
In some situations, a forest owner's personal data is processed even though there are no contractual relation to Holmen, for instance data of an owner of owner of property adjacent to the property covered by Holmen's contract relation. We have a need to communicate with these property owners in both our and their interest in order to ensure adequate and efficient forestry. Our legal basis for this processing is legitimitate interest where our the data subjects' interests or fundamental rights and freedoms are not afforded greater weight than our legitimate interest in being able to communicate and plan our business.
An additional distinguishing feature in respect of the relation to forest owners comes from the fact that owning and managing the forest is a long-term commitment, often including several generations. Forest management implies that many issues need to be weighed in to ensure that adequate measures are taken in both short and long term. Holmen considers it necessary to have a long-term relationship with forest owners in order to create the best conditions, which results in a longer term for retaining data in these relations compared to other business relations.
You always have an opportunity to request deregistration of your data used for marketing. If you want to unsubscribe and there is no legal requirement that prevents erasure, our processing will cease and your data will be removed, which also means that we cannot continue to send you information or invitations. If you no longer wish to receive information and invitations from Holmen Skog click here for more information on how to unsubscribe.
We process personal data about job applicants to be able to carry out talent management through recruitment necessary for the running of the business.
The data we process is partly data the job applicant provide to us himself/herself, e.g. when submitting an application or at interview, and partly data we compile ourselves, by contacting references or by tests during the recruitment procedure.
The data comprises name, date of birth or personal ID number, address, e-mail address and phone number as well as information on grades, education an d work experience and in some cases photos.
When receiving CV or personal letters other types of data may be included depending on the choosing of the job applicant. In some case the personal data also comprise test results from skills and personality tests carried out during the recruitment procedure.
Our processing is supported by balancing of interests which the job applicant’s interests or fundamental rights and freedoms are not afforded greater weight than Holmen’s legitimate interest to run the business including implementing recruitment procedure as a basis for decisions on employment.
We process personal data to implement a specific recruitment procedure and not as a general basis for future recruitment.
Your personal data in the capacity of an employee at Holmen is processed for several purposes, such as fulfilling employment contracts and collective agreements, providing company health service and rehabilitation and also to run a effective, relevant and proper business.
The processing concerning employees mainly takes place by virtue of the legal basis for the performance of a contract in which you (the data subject) are a contracting party, that it the employment contract.
Processing also takes place in order to comply with legal obligations, for instance work environment legislation.
In some case processing is supported by legitimate interest in which your interests or fundamental rights and freedoms are not afforded greater weight than Holmen's legitimate interests to run a cost effective and relevant business and to plan, lead and managing the work of our operations, to enable the performing of tasks and also to monitor the compliance of internal rules.
This is a brief and incomplete summary of the information available on Holmen's intranet concerning processing of the personal data of employees.
Production units and offices
Holmen processes personal data regarding employees and visitors at our production sites and office premises for several purposes.
At Holmen's areas processing of personal data may be carried out by use of entrance systems, visiting logs and bookings as well as security related monitoring. At all production sites there are also production related monitoring.
Where camera surveillance is permanently conducted there are signs to point out the cameras. At the entrance of such areas more information is available regarding the camera surveillance, including who to contact, when data are removed and a specific statement if sound are being recorded. Data that are recorded by camera surveillance are often removed instantly (inter alia, data is not retained at all) or with short and frequent removal periods. This applies, provided that no burglary, accident or other circumstance motivates a retention of data for investigative purposes. The data will not be transferred to another recipient except for police authorities to investigate criminal offense. The data will not be used for automated decision making.
In several cases, processing takes place to comply with legal obligations, foremost work environment legislation.
In many cases, processing is supported by legitimate interest in which the data subject's interests or fundamental rights and freedoms are not afforded greater weight than Holmen's legitimate interests to ensure physical safety for person and property and to enable the performance of work tasks (i.e. scheduling meetings).