Information about Holmen’s processing of personal data

Here we provide information on the general aspects that apply for all processing of personal data at Holmen.

In addition, a more specific description is provided for the categories marketing, contractual parties and business relations, forest owners, job applicants and also employees (see all below) in which the purpose of processing your personal data, the legal basis and the erasure of data varies.

The type of data processed

Personal data means all information that can be used in any way to identify or be linked to a specific individual. The personal data we process may vary depending on the purpose for which it is processed. In largely all cases, however, it covers contact details, such as name, address, phone number and e-mail address.

Where the registered person is our contractual party we also process matter related information and data necessary to manage payments. In some cases information regarding the data subject's customer and/or supplier segment is processed. We may also process property related data.

How we collect personal data

We collect personal data that is provided voluntarily by the data subject. This may occur in contact in the form of meetings, e-mail, phone calls or in other ways. We also collect data if you use our web forms and through our websites using cookies that collect data on and from your browser, see further at www.holmen.com/cookies.

Data may also be added and updated with information from publicly accessible sources, such as public registers, e.g. the SPAR register of persons resident in Sweden and the Real Property Register (Fastighetsregistret). In some cases, information is purchased from companies that compile registers.

Purpose, legal basis and erasure

The purpose of processing is always to be stated and is crucial to several aspects; for determining the legal basis for processing, but also for assessing which data is to be processed, who is authorised to access data and when data is to be erased. The purposes for which we process your personal data, the legal basis on which we do this, and how long we retain your data for are described separately for the various relationships that the Holmen Group has with you as a data subject, see the menu on the left.

Your personal data will be erased when it is no longer relevant for the purposes for which it was collected. Exceptions may be made to erasure if Holmen needs the data to comply with statutory requirements or to protect Holmen's legal interests.

Protection and safety

Holmen takes the appropriate organisational and technical security measures to protect your personal data from unauthorised access, change and erasure. All data is stored in databases protected by authorisation and access controls and by firewalls. Internal documents set out how personal data is to be processed. The safeguards are examined and tested regularly.

Holmen-companies that are data controllers

Depending on which business operation a data processing of your personal data is assignable to, the responsibility may rest with different companies within the Group. Decisive for the responsibility is which company or companies that choose the purpose of processing data and the way in which the data is to be processed as data controllers. In numerous cases there is a joint responsibility for Holmen-companies, why these companies have entered into an arrangement in respect of protecting personal data. Holmen has a joint management for issues relating to processing pf personal data, see below.

We process personal data in order to market our products and send relevant offers directly to our existing and potential customers. This kind of marketing may include information, newsletters and invitations regarding campaigns and events. The data may also be used as a basis for analysis and monitoring to measure the marketing for the purpose of improvement, and generally to develop our operations.

Besides marketing to existing or potential contractual parties, information and invitations may also be sent to other business contacts, for example, market players with significance or impact on our business or to financial analysts and other stakeholders.

We process your personal data in order to ensure performance of a contract, including ensuring execution, administration and payment and also making or handling complaints. Personal data is also needed for various business-related contacts before, during and after the performance of a contract.

Contract refers to numerous types of contract, for example, purchasing contracts, sales contracts, and contracts on collaboration and property-related issues as well as sponsorship and hunting. Contracts with forest owners have several distinctive features and processing under these contracts is therefore described separately here.

Holmen processes personal data regarding shareholders and other persons in connection to share related issues.

In connection to a general meeting is held in Holmen AB (publ), data regarding shareholders are being processed to carry out the general meeting and associated issues such as information, voting and dividends. If requested by a shareholder, the data regarding a proxy or guest may be processed.

Since Holmen AB (publ) is a listed company specific rules applies in respect of handling insider information. Persons that due to shareholding, position or relation is deemed to be a insider must be registered with the Swedish supervisory authority and persons that at a certain time has access to insider information must be registered in a specific log kept by the company. This implies a need for processing such persons' personal data.

In respect of a forest ownership, parties may have more than one role against each other. We process personal data about forest owners in their role as suppliers of wood, as customer of forest management services and also as owners of forest properties covered by forest management plans and other questions relating to forestry. The purpose is to handle all questions and undertakings that might arise in relation to the relation between us and forest owners. Our legal basis for this processing is the performance of a contract to which the data subject is party.

In some situations, a forest owner's personal data is processed even though there are no contractual relation to Holmen, for instance data of an owner of owner of property adjacent to the property covered by Holmen's contract relation. We have a need to communicate with these property owners in both our and their interest in order to ensure adequate and efficient forestry. Our legal basis for this processing is legitimitate interest where our the data subjects' interests or fundamental rights and freedoms are not afforded greater weight than our legitimate interest in being able to communicate and plan our business.

We process personal data about job applicants to be able to carry out talent management through recruitment necessary for the running of the business.

The data we process is partly data the job applicant provide to us himself/herself, e.g. when submitting an application or at interview, and partly data we compile ourselves, by contacting references or by tests during the recruitment procedure.

The data comprises name, date of birth or personal ID number, address, e-mail address and phone number as well as information on grades, education an d work experience and in some cases photos.

Your personal data in the capacity of an employee at Holmen is processed for several purposes, such as fulfilling employment contracts and collective agreements, providing company health service and rehabilitation and also to run a effective, relevant and proper business.

The processing concerning employees mainly takes place by virtue of the legal basis for the performance of a contract in which you (the data subject) are a contracting party, that it the employment contract.

Processing also takes place in order to comply with legal obligations, for instance work environment legislation.

Holmen processes personal data regarding employees and visitors at our production sites and office premises for several purposes.

At Holmen's areas processing of personal data may be carried out by use of entrance systems, visiting logs and bookings as well as security related monitoring. At all production sites there are also production related monitoring.

Where camera surveillance is permanently conducted there are signs to point out the cameras. At the entrance of such areas more information is available regarding the camera surveillance, including who to contact, when data are removed and a specific statement if sound are being recorded. Data that are recorded by camera surveillance are often removed instantly (inter alia, data is not retained at all) or with short and frequent removal periods. This applies, provided that no burglary, accident or other circumstance motivates a retention of data for investigative purposes. The data will not be transferred to another recipient except for police authorities to investigate criminal offense. The data will not be used for automated decision making.

In some cases, Holmen is required to have a permit in accordance with the Environmental Code to be allowed to start, operate, or change an operation. For such cases, a consultation procedure is included which, among other things, intends to disseminate knowledge about matters that are important for the permit examination and to give nearby residents, the municipality, and other stakeholders the opportunity to submit comments. After the consultation has ended, Holmen prepares a consultation report and submits it to the county administrative board.

In connection with the consultation procedure according to the Environmental Code, Holmen processes personal data regarding nearby residents and other stakeholders. For Holmen, the consultation procedure is brought about prior to, for example, the construction of wind farm and quarrying facility.