Privacy statement

SMURFIT WESTROCK GROUP – DATA PROTECTION DECLARATION

1. PURPOSE AND SCOPE OF THE DECLARATION

The purpose of this statement is to explain to you how your personal data is processed by Smurfit Westrock Corrugated Benelux B.V. (the ‘Group’, ‘we/us’, “us”) and what data, including the personal information about you set out below (‘personal data’) in connection with your dealings with us is collected and processed by the Group and/or on its behalf by external service providers.

For the purposes of this statement, the controller of your personal data is Smurfit Westrock Corrugated Benelux B.V. de Warandelaan 2, 4904 PC Oosterhout, the Netherlands, part of the Group. In general, your personal data is the responsibility of the Group. Click here for more information about the Group and a full list of the Group’s parts. The Group parts have procedures in place to ensure the protection of your personal data.

If you have any questions or concerns about this statement, please contact our marketing department by sending an email to the Group Legal Department at [email protected].

2. APPLICABILITY OF THIS DECLARATION

IMPORTANT: We have endeavoured in this statement to be complete and accurate as far as reasonably practicable, but please note that it is not exhaustive and may be subject to periodic amendment in accordance with Article 11 of this statement.

This statement is divided into a number of articles, all or part of which may be relevant to you depending on the nature of your relationship with the Group. In each case, you have certain rights under data protection laws. These are set out in Article 10. You have the right to object to the processing of your personal data at any time if we process it on the legal basis pursuing our legitimate interests.

Marketing & business contacts: if you have signed up to receive marketing communications from us, you can read how we use your personal data for this purpose in Article 4 or by clicking here.

Users website: if you use our website [www.smurfitwestrock.com/nl] and [www.smurfitwestrock.com/nl/be] , (the ‘website’), you can read how we use your personal data as a user of our website in article 5A. We also encourage website users to read our Cookie Policy.
Users’ website: if you use our website [www.smurfitwestrock.com/nl] and [www.smurfitwestrock.com/nl/be] , (the ‘Website’), you can read in Article 5A how we use your personal data as a user of our Website. We also encourage website users to read our Cookie Policy.
Social media users: if you use our social media accounts (Twitter and LinkedIn), you can read how we use your personal data as a social media user in article 5B.
Existing customers: if you are already a customer of Smurfit Westrock Corrugated Benelux B.V., you can read in Article 6 how we process your personal data for administrative and business purposes.

3. WHAT PERSONAL DATA DO WE RECEIVE?

Depending on your relationships with us, we process the following categories of personal data from you:

If you are a marketing/business contact: your name, job title, contact details, your business activities and interest, and information about your subscription to receive or interest in our mailing lists or newsletters.
If you visit the website: information about your visits to the website, your location and IP address, the browser software you use and the date and time you visit the website.
If you interact with our social media accounts, we collect personal data about you such as name, location, country, position, company, areas of interest, in the event that these types of personal data are publicly visible on your social media accounts.
If you are a customer: your name, employer details, billing information, details of your visits and correspondence and communications with our staff and any information provided to us by or for you.

4. MARKETING- EN ZAKELIJKE CONTACTEN

Als u een marketing- of zakelijk contact bent, verkrijgen, verzamelen en verwerken we uw persoonsgegevens mogelijk voor de volgende doeleinden:

Promotie van de bedrijfsactiviteiten van de Group;
Uitnodigingen voor evenementen;
Ontwikkeling en voortzetting van betrekkingen met u;
Beheer en administratie van onze relatie met onze zakelijke contacten en klanten;
Sending you marketing material, newsletters and other information;
Monitoring and analysing your interest in the material we send you;
Sending you marketing information by post, unless you have objected to this; and
Taking, collecting, storing and posting photographs at Group events.

In these cases, we generally rely on your consent, through direct marketing, to provide information to you about our products and services. In all other cases, even when we already have contact with you, we rely on our legitimate interest to continue contacting you about products that we think may be of interest to you.

You always have the option to stop sending marketing communications. You can unsubscribe from receiving communications by post using the contact details in article 11. You can always unsubscribe from our email marketing by clicking on the “unsubscribe” link at the bottom of the marketing emails we send you.

5A.USERS WEBSITE

When you visit our website, we may obtain, collect and process your personal data for the following purposes:

Displaying, improving and monitoring the effectiveness of the website;
Monitoring data such as total number of visitors, traffic data and demographic patterns;
Making sure that the website is presented in the most effective way for you and improving your use of the website; and
Notifying you of changes to our website and/or our services.

We obtain, collect and process this personal data based on our legitimate interest to ensure that our website functions properly and to analyse what content is of most interest to visitors. This helps us ensure that the website remains available and improve your experience when you visit the website.

5B. SOCIAL MEDIA USERS

If you visit our social media accounts, we may obtain, collect and process your personal data for the following purposes:

To understand the demographics, preferences and interests of our audience, to enable us to show our audience more relevant information and news through our social media accounts (profiling).
To optimise our audience and targeting.

6. EXISTING CUSTOMERS

If you are an existing customer, we may obtain, collect and process your personal data for the following purposes:

Conducting administrative, billing and operational processes;
Reviewing and responding to correspondence or requests you send us;
Monitoring sales levels and assessing patterns in sales;
Conducting due diligence;
Execution of orders and fulfilling our obligations under purchase agreements we may have entered into with you;
Processing payments and managing your customer account;
Contractual relations with the organisation to which you belong;
Sending you marketing materials. See Article 4 of this statement for further information.
Compliance with applicable law for Member State and EU companies;

We obtain, collect and process your personal data for the above purposes based on the following legal grounds:

our legitimate interest to ensure the operation of our business and maintenance of our customer relationship with you;
a need to enter into and perform a contract with you;
a need to process your personal data to fulfil a legal obligation incumbent on us under the applicable law of an EU Member State or Union law.
If you are not willing to provide your personal data so that we can process it for the above purposes, it will not be possible for us to provide services or products to you.

7.DISTRIBUTION OF YOUR PERSONAL DATA

Depending on your relationship with us, we may disclose personal data collected and obtained from and about you to the following parties: components and shareholders of the Group, service providers who provide support services, suppliers of IT & website services, marketing companies, PR firms, printers, advertising agencies and other suppliers, other people in your organisation, third parties involved in hosting or organising events or exhibitions, professional advisers, such as tax or legal advisers, consultants and accountants, regulatory authorities (e.g. law enforcement and government agencies) and third parties in connection with the purchase or sale of the Group or assets owned by the Group.

8. TRANSFERS OF YOUR PERSONAL DATA BY THE GROUP

We may transfer your personal data to parts of the Group or other recipients outside the European Economic Area (‘EEA’). Certain recipients (our third-party service providers and other companies within the Smurfit Westrock Group that process your personal data for us) may transfer your personal data to a country outside the EEA that does not protect your personal data to an appropriate degree. Where such transfers take place, we apply the following policy: a) they do not take place without our prior written consent; and b) an appropriate transfer agreement is applied to protect your personal data.

9. SAFETY OF YOUR PERSONAL DATA

.
Generally, we expect to retain your personal data for a reasonable period of time after the contact is established for marketing purposes. Once we have determined that we no longer need to retain your personal data, we will delete it in our systems.Please note that we may retain your data for longer under certain circumstances, for example, if we are in the process of settling a claim or believe in good faith that, in our judgment, the law or a competent regulator may reasonably expect or require longer retention of your personal data.

10. YOUR RIGHTS AND HOW YOU CAN EXERCISE THEM

You have a number of rights in relation to your personal data which are explained in this article 10. These include, in particular, the right to object to processing of your personal data when such processing is carried out for our legitimate interests. Please note that under certain circumstances these rights are not absolute.

RECHT	TOELICHTING
Recht op bezwaar	U heeft te allen tijde recht op bezwaar tegen de verwerking van uw persoonsgegevens als wij deze verwerken op basis van de rechtsgrond dat wij onze gerechtvaardigde belangen nastreven. Wanneer wij uw persoonsgegevens verwerken op basis van onze gerechtvaardigde belangen, zorgen wij voor een zorgvuldige afweging van de mogelijke gevolgen daarvan voor u en uw gegevensbeschermingsrechten. We gebruiken uw persoonsgegevens niet voor activiteiten waarbij onze belangen minder zwaar wegen dan de gevolgen voor u (tenzij we uw toestemming hebben of anderszins op grond van het recht van de lidstaat of de EU hiertoe verplicht of bevoegd zijn).
Right of inspection	You have the right to request a copy of the personal data we hold on you and to inspect it. We will only charge you for such inspection request if we believe your request is unfounded or excessive.
Right to rectification	You have the right to request the amendment or rectification of inaccurate personal data we hold about you.
Right to erasure	In certain circumstances, you may also request the erasure of your personal data, for example if you exercise the right to object (see below) and we do not have a compelling reason to process your personal data or if we no longer need your personal data for the purposes set out in this statement.
Right to restrict processing	You have the right in certain cases to ask us to restrict the processing of your personal data, including if you believe that the personal data we hold about you is inaccurate or our use of your data is unlawful. If you rightly invoke this right, we will store your personal data and not process it further until the matter is resolved.
Right of portability	You may request us to disclose the personal data you have given to us in a structured, common and machine-readable form, and you may request us to transfer your personal data directly to another controller, provided this is technically feasible. This right only applies if: (1) we process your personal data with your consent or when this is necessary for the performance of the agreement with you; and (2) the processing is automated.

You may exercise any of these rights by submitting a written request to our legal team at Smurfit Westrock Group Legal Department, Beech Hill Drive, Clonskeagh, Dublin 4, Ireland.

We will let you know as soon as possible, but no later than one month after receiving your request, what actions we have taken in response to your request in relation to any of these rights. If necessary, we may extend this period to two months, but we will inform you if this is the case. Please note that we may ask you to prove your identity when invoking any of your data protection rights.

You also have the right to file a complaint with the Dutch Personal Data Authority. For an explanation, see https://autoriteitpersoonsgegevens.nl/. In Belgium, this is possible with the Data Protection Authority. For an explanation, see https://www.gegevensbeschermingsautoriteit.be/

11. AMENDMENTS TO THIS STATEMENT

We reserve the right to amend all or part of this statement at our discretion. Any changes will take effect immediately from the time the revised statement is sent to you.

If at any time we decide to use your personal data in a substantially different way from that indicated in this statement or in a different way from that disclosed to you at the time it was collected, we will notify you by email. You may then determine whether we may use your personal data in the new manner.

If you have any concerns or comments or concerns about how your personal data is used or processed by the company, please contact our data protection representative at [email protected] or by mail to Group Legal Department, Smurfit Westrock Group, Beech Hill, Clonskeagh, Dublin 4, Ireland.