Privacy Statement

SMURFIT KAPPA GROUP - DATA PROTECTION NOTICE

1. PURPOSE AND SCOPE OF NOTICE

This notice is intended to explain how your Personal Data will be handled by Smurfit Kappa Group (the "Group", "we", "us" and "our") and sets out the information including the personal information detailed below relating to you ("Personal Data") that will be collected and processed by the Group and/or on its behalf by its third party service providers in the context of your dealings with us.
For the purposes of this notice, the controller of your Personal Data is Smurfit Kappa Group of Beech Hill, Clonskeagh, Dublin 4. Overall, your Personal Data will be under the responsibility of the Group. For more information about the Group, including a full list of entities in the Group, click on this lin k. The entities within the Group have established procedures in place to ensure that your Personal Data is protected. If you have any questions or concerns about this notice, please email the Group Legal department at grouplegal@smurfitkappa.com

2. APPLICATION OF THIS NOTICE

IMPORTANT: please note that this Notice, while intended to be as complete and accurate as reasonably possible, is not exhaustive and may be updated from time to time in accordance with section 11 of this Notice.

This Notice is separated into a number of sections, some or all of which may be relevant to you depending on the nature of your relationship with the Group. In all cases, you have certain rights under data protection law which are set out in section 10. In particular, you have a right to object at any time to the processing of your Personal Data where we process your Personal Data on the legal basis of pursuing our legitimate interests.

Marketing & Business Contacts: if you have signed up to receive marketing communications from us, you can read about how we will use your Personal Data for this purpose at section 4 OR by clicking here.

Website Users: if you use our website, [www.smurfitkappa.com ], (the "Website"), you can read about we use your Personal data as a website user at section 5. Website users should also read our Cookies Policy.

Existing Customers: if you are an existing customer of Smurfit Kappa Group customer, you can understand how we process your Personal Data for administrative and business purposes at section 6.

3. WHAT PERSONAL DATA WE PROCESS

Depending on your dealings with us, we will process the following types of Personal data about you :

If you are a marketing/business contact, your name, your employment details, your contact details, your business activities and interests and information relating to your subscription to, receipt of or interest in any of our mailing lists or newsletters.
If you use the Website, information about your visits to our Website, your location and IP address, the browser software you use and the date and time you access the Website,
If you are a customer: your name, employer details, billing information, details of your visits and your correspondence and communications with our staff and any information which is provided to us by you or on your behalf.

4. MARKETING AND BUSINESS CONTACTS

If you are a marketing/business contact we may obtain, collect and process your Personal Data for the following purposes:

To promote the Group's business activities;
To invite you to events;
To develop and maintain relationships with you;
To manage and administer our relationship with our business contacts and with our customers;
To send you marketing material, newsletters and other information;
To monitor and analyse your interest in the material we send to you;
To send you marketing information by post provided you have not objected to this; and
To take, collect, store and post photographs from Group events.

In these circumstances we generally rely on your consent to provide you with information about our products and services through direct marketing. In all other circumstances, including where we are already in contact with you, we rely on our legitimate interest to continue to contact you about products which we think may be of interest to you.

You will always have the opportunity to stop receiving marketing communications. With postal communications you can opt out using the contact details in section 11. [You can always opt out of email marketing from us by clicking the "unsubscribe" link at the bottom of marketing emails which we send you.]

5. WEBSITE USERS

If you visit our Website we may obtain, collect and process your Personal Data for the following purposes:

To provide, improve, test and monitor the effectiveness of the Website;
To monitor metrics such as total number of visitors, traffic data and demographic patterns;
To ensure content on the website is presented in the most effective manner for you and to enhance your use of the website; and
To notify you of any changes to the Website and/or our services.

We obtain, collect and process this personal information based on our legitimate interest in ensuring that the Website is operating smoothly and in order to analyse which content is of most interest to visitors. This helps us to keep the Website available and to improve your experience when you visit the Website.

6. EXISTING CUSTOMERS

As an existing customer, we may obtain, collect and process your Personal Data for the following purposes:

To conduct administrative, billing and operational processes;
To review and respond to any correspondence or queries you send us;
To monitor sales levels and review sales patterns;
To conduct due diligence checks;
To fulfil orders and comply with our obligations under any contract of sale we may have with you;
To process any financial payments and manage your customer account;
To enter into contractual relations with the organisation with which you are connected;
To send you marketing information. Please see section 4 of this Notice for further information.
To comply with applicable Member State and European Union company law;

We obtain, collect and process your Personal Data for the above purposes based on the following legal bases:

our legitimate interest to ensure the operation of our business and the maintenance of our customer relationship with you;
a necessity in order to enter into and perform a contract with you;
a necessity to process your Personal Data in order to comply with a legal obligation under applicable Member State and European Union law to which we are subject.

In the event that you do not wish to provide us with your Personal Data so that we can process it for the purposes outlined above, we will not be able to provide services or sell products to you.

7. DISCLOSURE OF YOUR PERSONAL DATA

Depending on your dealings with us, we may disclose some or all of the Personal Data we collect from and obtain about you to the following parties: members and shareholders of the Group, service providers who provide support services, IT & website service providers, marketing companies, PR agencies, printers, advertising agencies and other suppliers, other people in your organisation, third parties involved in hosting or organising events or trade fairs, professional advisors such as tax or legal advisors, consultants and accountants, regulatory authorities (e.g. enforcement agencies and public bodies) and third parties in connection with the sale or purchase of the Group or assets owned by the Group.

8. GROUP TRANSFERS OF YOUR PERSONAL DATA

We may transfer your Personal Data outside of the European Economic Area ("EEA") to other members of the Group and other recipients. Certain Recipients (our third party service providers and other Smurfit Kappa Group companies) who process your Personal Data on our behalf may transfer your Personal Data outside the EEA to a country that does not provide an adequate level of protection to your Personal Data. Where such transfers occur, it is our policy that: a) they do not occur without our prior written authority; and b) that an appropriate transfer agreement is put in place to protect your Personal Data. If you would like to find out more about any such transfers, please contact our Data Protection Representative whose details are set out in Section 11 of this notice.

9. RETENTION OF YOUR PERSONAL DATA

In general, we expect to keep your Personal Data for what we deem a reasonable period after contact is made for marketing purposes. Once we have determined that we no longer need to hold your Personal Data, we will delete it from our systems.

Please note that in certain circumstances, we may hold your data for a longer period, for example, if we are processing an ongoing claim or believe in good faith that the law or a relevant regulator may reasonably in our view expect or require us to preserve your Personal Data. If you would like to know more about how long we will retain your Personal Data, please contact our Data Protection Representative whose details are set out in Section 11 of this notice.

10. YOUR RIGHTS AND HOW TO EXERCISE THEM

You have a number of rights in relation to your Personal Data, which are set out in this section 10. In particular these rights include the right to object to processing of your Personal Data where that processing is carried out for our legitimate interests. Note that in certain circumstances these rights might not be absolute.

Right	Further Information
Right to Object	You have a right to object at any time to the processing of your Personal Data where we process your Personal Data on the legal basis of pursuing our legitimate interests. When we process your Personal Data based on our legitimate interests, we make sure to consider and balance any potential impact on you and your data protection rights. We will not use your Personal Data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted by Member State or European Union law).
Right of Access	You have the right to request a copy of the Personal Data held by us about you and to access the information which we hold about you. We will only charge you for making such an access request where we feel your request is unjustified or excessive.
Right to Rectification	You have the right to have any inaccurate Personal Data which we hold about you updated or corrected.
Right to Erasure	In certain circumstances, you may also have your personal information deleted, for example if you exercise your right to object (see below) and we do not have an overriding reason to process your Personal Data or if we no longer require your Personal Data for the purposes as set out in this notice.
Right to Restriction of Processing	You have the right to ask us to restrict processing your Personal Data in certain cases, including if you believe that the Personal Data we hold about you is inaccurate or our use of your information is unlawful. If you validly exercise this right, we will store your Personal Data and will not carry out any other processing until the issue is resolved.
Right to Data Portability	You may request us to provide you with your Personal Data which you have given us in a structured, commonly used and machine-readable format and you may request us to transmit your Personal Data directly to another data controller where this is technically feasible. This right only arises where: (1) we process your Personal Data with your consent or where it is necessary to perform our contract with you; and (2) the processing is carried out by automated means.

You can exercise any of these rights by submitting a request to our Data Protection Representative in writing to Group Legal Department, Beech Hill Drive, Clonskeagh, Dublin 4.

We will provide you with information on any action taken upon your request in relation to any of these rights without undue delay and at the latest within 1 month of receiving your request. We may extend this up to 2 months if necessary however we will inform you if this arises. Please note that we may ask you to verify your identity when you seek to exercise any of your data protection rights.

You also have the right to lodge a complaint with the Data Protection Commission. For further information see www.dataprotection.ie.

11. CHANGES TO THIS NOTICE & QUESTIONS

We may amend this Notice on occasion, in whole or part, at our sole discretion. Any changes will be effective immediately upon communicating the revised notice to you.
If at any time we decide to use your Personal Data in a manner significantly different from that stated in this notice, or otherwise disclosed to you at the time it was collected, we will notify you by e-mail or post, and you will have a choice as to whether or not we use your Personal Data in the new manner.

If you have any questions, comments or concerns about the way your Personal Data are being used or processed by the Company, please submit your question, comment or concern in writing to our Data Protection Representative at grouplegal@smurfitkappa.com or by post to Group Legal Department, Smurfit Kappa Group, Beech Hill, Clonskeagh, Dublin 4, Ireland.