Privacy Policy

Huhtamäki Oyj and its subsidiaries and other affiliates (later referred to as “Huhtamaki”) respects the privacy of its customers, suppliers and other stakeholders. This privacy notice (“Privacy Notice”) describes how Huhtamaki is processing personal data and what are the measures Huhtamaki takes to ensure the privacy and security of information collected and processed by Huhtamaki.

1. Data controller

In respect of each data subject’s personal data, the data controller is regarded to be the Huhtamaki group company which has a contractual relationship or other co-operation relationship with the data subject or with the organization the data subject is representing. The data controller may, thus, be either Huhtamäki Oyj (business ID 0140879-6) or any of its subsidiaries or other affiliates. For avoidance of doubt, in this Privacy Notice “we” or “Huhtamaki” shall refer to any Huhtamaki group company acting as the data controller in each individual case.

2. Contact details for Huhtamaki in matters concerning this Privacy Notice

Where the data subject has questions regarding this Privacy Notice or he/she wishes to exercise his/her rights, the data subject should contact the Huhtamaki group company which has a contractual relationship or other co-operation relationship with the data subject or the organization the data subject is representing.

Contact details for all Huhtamaki group companies can be found on Huhtamaki’s website at www.huhtamaki.com/contact-us/locations.

3. What personal data we process?

Customers

Purposes and legal basis for processing	We process customer data for following purposes: Managing and developing customer relationship Provision, sales and delivery of services and products Sending newsletters Payment and payment control Development of business and customer service Processing reclamations and defending against claims Accounting and other legal obligations Other purposes related to for example ensuring security of Huhtamaki’s premises. We process data of our customers to fulfil our legitimate interests arising from the contract and customer relationship we have with the company the person is representing. In some cases, we may also process personal data of the representatives of our potential customers with whom we have not yet concluded a contract or established a customer relationship. The processing of said data is based on our legitimate interest to explore and understand potential customers, to communicate with them and to develop our customer and market intelligence.
Categories of personal data we collect	Contact information, such as Name, phone number, email address, title Information on the company the data subject is representing as well as its location Information on whether the data subject is the main contact person for the company the data subject is representing Language preferences Status of the data subject (either active or inactive) Information related to managing orders and taking care of customer relationship (e.g. arranged meetings and visits to Huhtamaki’s premises) Information on marketing prohibitions and consents Information submitted by the data subject in sign-up forms for Huhtamaki’s events or campaigns
Where we collect the personal data from	From data subjects concerned In some cases, we may also collect personal data from the market research engines and external sources
Retention time	We retain customer data for the duration of the customer relationship or until you no longer represent our customer. After the customer relationship has ended, we retain the data for as long as the personal data is necessary for Huhtamaki’s genuine needs and legal and regulatory requirements Huhtamaki is subject to. We retain data on our potential customers and their representatives for as long as the data is necessary for Huhtamaki’s genuine needs and legal and regulatory requirements Huhtamaki is subject to.
Disclosure of personal data and categories of recipients of the data	We may disclose customer data within Huhtamaki group companies and, where we have a legal obligation to do so, to authorities. We may also transfer data to our service providers, who process the data on our behalf and in accordance with our instructions.
Transfer of personal data outside EU/EEA	Personal data can be transferred outside the EU/EEA in accordance with applicable data privacy laws and regulations and subject to the restrictions set in said laws and regulations. The locations of Huhtamaki group companies (also outside the EU/EEA) can be found on Huhtamaki’s website at https://www.huhtamaki.com/contact-us. Some of Huhtamaki’s service providers may also be located outside the EU/EEA, including the United States. When personal data is transferred outside the EU/EEA to a country, which does not guarantee adequate level of data protection, we will use appropriate safeguards, such as EU Commission’s standard contractual clauses or Privacy Shield Framework, in accordance with applicable data privacy laws and regulations. You can obtain information of these safeguards by contacting us. Our contact information can be found from section 2 of this Privacy Notice.
Do we conduct profiling?	We do not use your personal data for profiling.
Do I have to provide this data?	If you do not provide us with the personal data, we may not be able to serve you or the company you represent.

Website visitors

Purposes and legal basis for processing	Unless we specifically tell you otherwise before you submit personal information, we will only use it to: Respond to your questions or comments Better understand your viewing patterns and needs Help us understand how we can improve our products, services and website Share special information Contact you to ask for your opinion or willingness to participate in certain events Send you updates and information on Huhtamaki’s products and services Deliver the subscribed releases The processing of your data is based on a legitimate interest to provide you with the releases you have subscribed to, to answer your enquiries, to ensure the functionality and security of our website and to develop our website.
Categories of personal data we collect	Contact information, such as Name, phone number, email address, street address Name of the company the data subject is representing Other identifiers IP address Cookie data Information on release subscribers (stock exchange releases, press releases, managers’ transactions releases) Name, email address, country (optional), represented company (optional), classification of subscriber (e.g. customer, analyst, investor etc.)
Where we collect the personal data from	We only collect personal data that you voluntarily submit through our website. We do not automatically collect personal information without your knowledge.
Retention time	Data on release subscribers is retained as long as the subscription is valid. Other type of data on website visitors is retained for as long as the data is necessary for Huhtamaki’s genuine needs and legal and regulatory requirements Huhtamaki is subject to.
Disclosure of personal data and categories of recipients of the data	We may disclose personal data within Huhtamaki group companies and, where we have a legal obligation to do so, to authorities. We may also transfer data to our service providers, who process the data on our behalf and in accordance with our instructions.
Use of cookies	To improve your visits to our site, we may use “cookies” or other automatically collected data to obtain non-personal information (cookies are text information files that your browser places on your computer when you visit a website). We do not use cookies to collect and store personally identifiable information. You are asked for your consent to allow the use of cookies when you first visit our website and when your previous consent has expired. You may select which cookies you allow by category. Only essential cookies are always active, as these are necessary for our website to function properly. If you wish to withdraw or change your consent, you can do so at any time via this link: Cookie Settings. You may also refuse the use of cookies by selecting the appropriate settings in your browser. Please keep in mind that if you disable the use of all cookies, you may not be able to view all parts of our website. Our website uses analytics tools, such as Google Analytics, a web analytics service provided by Google Inc. Google utilizes the information collected by a cookie to track and examine the use of our site, to prepare reports on its activities and share them with other Google services. Our analytics account anonymizes the user’s IP address as soon as technically feasible at the earliest possible stage of the collection network. Read more about Google Analytics https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage You can prevent Google’s collection and use of data, including the IP address, by downloading and installing the browser plug-in available under https://tools.google.com/dlpage/gaoptout?hl=en
Transfer of personal data outside EU/EEA	Personal data can be transferred outside the EU/EEA in accordance with applicable data privacy laws and regulations and subject to the restrictions set in said laws and regulations. The locations of Huhtamaki group companies (also outside the EU/EEA) can be found on Huhtamaki’s website at https://www.huhtamaki.com/contact-us. Some of Huhtamaki’s service providers may also be located outside the EU/EEA. When personal data is transferred outside the EU/EEA to a country, which does not guarantee adequate level of data protection, we will use appropriate safeguards, such as EU Commission’s standard contractual clauses or Privacy Shield Framework, in accordance with applicable data privacy laws and regulations. You can obtain information of these safeguards by contacting us. Our contact information can be found from section 2 of this Privacy Notice.
Do we conduct profiling?	We do not use your personal data for profiling.
Do I have to provide this data?	If you do not provide us with the personal data, we may not be able to offer you some of our services.

Suppliers and other stakeholders

Purposes and legal basis for processing	We process supplier and other stakeholder data for following purposes: Fulfilling contracts Organizing Huhtamaki’s business functions Delivery management Co-operation and business relationship management Developing Huhtamaki’s business Accounting and other legal obligations Other purposes related to for example ensuring security of Huhtamaki’s premises. We process data of our supplier and stakeholder representatives to fulfil our legitimate interests arising from the contract and co-operation relationship we have with the company the person is representing.
Categories of personal data we collect	Contact information, such as Name, phone number, email address, facsimile, title Information on the company the data subject is representing and the data subject’s area of responsibility Information related to managing the co-operation (e.g. arranged meetings)
Where we collect the personal data from	From supplier and stakeholder representatives
Retention time	We retain the personal data for the duration of the co-operation relationship or until you no longer represent our supplier or other stakeholder. After the co-operation relationship has ended, we retain the data as long as the personal data is necessary for Huhtamaki’s genuine needs and legal and regulatory requirements Huhtamaki is subject to.
Disclosure of personal data and categories of recipients of the data	We may disclose supplier and stakeholder data within Huhtamaki group companies and, where we have a legal obligation to do so, to authorities. We may also transfer data to our service providers, who process the data on our behalf and in accordance with our instructions.
Transfer of personal data outside EU/EEA	Personal data can be transferred outside the EU/EEA in accordance with ap-plicable data privacy laws and regulations and subject to the restrictions set in said laws and regulations. The locations of Huhtamaki group companies (also outside the EU/EEA) can be found on Huhtamaki’s website at https://www.huhtamaki.com/contact-us. Some of Huhtamaki’s service providers may also be located outside the EU/EEA, including the United States. When personal data is transferred outside the EU/EEA to a country, which does not guarantee adequate level of data protection, we will use appropriate safeguards, such as EU Commission’s standard contractual clauses or Privacy Shield Framework, in accordance with applicable data privacy laws and regulations. You can obtain information of these safeguards by contacting us. Our contact infor-mation can be found from section 2 of this Privacy Notice.
Do we conduct profiling?	We do not use your personal data for profiling.
Do I have to provide this data?	If you do not provide us with the personal data, we may not be able to engage in or continue co-operation with the company you represent.

Shareholders, other investors and analysts

Data controller	Huhtamäki Oyj, Revontulenkuja 1, 02100 Espoo, Finland
Purposes and legal basis for processing	We need to process personal data of shareholders and their representatives to maintain a shareholders’ register, to be able to verify shareholders’ identity and right to participate in general meetings and to be able to communicate with them. We need to process personal data of other investors and analysts to fulfil our legitimate interests and to communicate with them. We need to process personal data of shareholders and their representatives, other investors and analysts to be able to provide information to the public as a company listed on Nasdaq Helsinki Ltd. We process shareholders’, other investors’ and analysts’ personal data to fulfil our legal obligations. We may also process the data in order to fulfil our legitimate interests to disclose information to the public and to communicate with and to maintain good relationships with our shareholders, investors and analysts. In addition, data can be processed for other purposes related to for example ensuring security of Huhtamaki’s premises.
Categories of personal data we collect	Contact information, such as Name, street address, phone number, email address Other information Personal identity number or other identifying information, nationality, number of shares and voting rights, book-entry account number Other information concerning shareholders’ participation in the general meetings (including information on power of attorneys) We also collect personal data of proxy representatives and of assistants representing / assisting shareholders in general meetings We receive information provided to us in notifications of major shareholdings (flagging notifications)
Where we collect the personal data from	From the shareholders From Euroclear Finland (national central securities depository) From other investors and analysts or companies they are representing.
Retention time	Data will be retained as long as needed under Huhtamaki’s legal obligations as a company listed on Nasdaq Helsinki Ltd. In addition, data can be retained as long as it is necessary for Huhtamaki’s genuine interests and needs.
Disclosure of personal data and categories of recipients of the data	Information regarding major shareholders, flagging notifications and list of analysts following Huhtamaki can be found on Huhtamaki corporate website www.huhtamaki.com. We are required to disclose the list of shareholders to anyone requesting based on applicable laws and regulations (publicity of shareholders’ register) We may disclose certain data to authorities where we have a legal obligation to do so. We may also transfer data to our service providers, who process the data on our behalf and in accordance with our instructions.
Transfer of personal data outside EU/EEA	Public data disclosed on Huhtamaki corporate website is available for anyone also outside EU/EEA. In some cases, personal data can be transferred outside the EU/EEA (e.g. in case of service providers) in accordance with applicable data privacy laws and regulations and subject to the restrictions set in said laws and regulations. When personal data is transferred outside the EU/EEA to a country, which does not guarantee adequate level of data protection, we will use appropriate safeguards, such as EU Commission’s standard contractual clauses or Privacy Shield Framework, in accordance with applicable data privacy laws and regulations. You can obtain information of these safeguards by contacting us. Our contact information can be found from section 2 of this Privacy Notice.
Do we conduct profiling?	We do not use your personal data for profiling.
Do I have to provide this data?	Shareholders have a legal obligation to provide this data to us. To be able to exercise your rights and interests as other investors and analysts you are required to provide this data to us.

Huhtamaki Speak Up channel

Purposes and legal basis for processing	Huhtamaki Speak Up channel is a web-based grievance system for Huhtamaki. It provides an opportunity to the employees, customers, suppliers and other stakeholders to report suspicions of violations; anything that is not in line with Huhtamaki values, Code of Conduct, any other Huhtamaki policies or any laws or regulations. The system enables reporting either by name, or anonymously if allowed by local laws and regulations. Huhtamaki Speak Up channel can be accessed by visiting the website: https://report.whistleb.com/Huhtamaki. Personal data related to the channel is processed for the purposes of investigating and resolving the suspected violation. The processing is conducted as (i) processing is necessary for Huhtamaki to comply with its legal obligations; and (ii) processing is necessary to fulfil the legitimate interests of Huhtamaki.
Categories of personal data we collect	Information collected and processed related to the channel will be limited to the minimum necessary and will contain data such as: Contact information Date of the report and reporting category Description of the alleged misconduct or violation Actions taken during the investigation Outcome of the investigation and the possible disciplinary and/or corrective actions
Where we collect the personal data from	Information will be collected from the person reporting the suspected violation by using the channel or via other means and from persons (internally and/or externally) involved in the investigation of the suspected violation. Information can be also collected from Huhtamaki’s internal systems, as applicable.
Retention time	Personal data related to the channel will be retained as long as the data is necessary for Huhtamaki’s genuine needs and legal and regulatory requirements Huhtamaki is subject to.
Disclosure of personal data and categories of recipients of the data	All reports made will be forwarded to Huhtamaki Global Compliance who will coordinate the channel and support the respective business segment and/or function in the investigation of the suspected violations. Huhtamaki Speak Up channel is operated by an external service provider, WhistleB, Whistleblowing Centre AB. Huhtamaki has contractually ensured that WhistleB, as a data processor, processes personal data in accordance with the applicable laws and regulations. In addition, Huhtamaki may use other service providers (such as law firms, translation agencies, external investigators) to conduct and/or help with the investigation. Information may be also disclosed to the external parties, such as to the competent authorities in accordance with the applicable laws and regulations or if required for the purposes of the investigation.
Transfer of personal data outside EU/EEA	Personal data can be transferred outside the EU/EEA in accordance with applicable data privacy laws and regulations and subject to the restrictions set in said laws and regulations. The locations of Huhtamaki group companies (also outside the EU/EEA) can be found on Huhtamaki’s website at https://www.huhtamaki.com/contact-us. Some of Huhtamaki’s service providers may also be located outside the EU/EEA. When personal data is transferred outside the EU/EEA to a country, which does not guarantee adequate level of data protection, we will use appropriate safeguards, such as EU Commission’s standard contractual clauses or Privacy Shield Framework, in accordance with applicable data privacy laws and regulations. You can obtain information of these safeguards by contacting us. Our contact information can be found from section 2 of this Privacy Notice.
Do we conduct profiling?	We do not use your personal data for profiling.
Do I have to provide this data?	Data subjects may voluntarily use Huhtamaki Speak Up channel if they are willing to make a report about any suspected violation.

4. Security measures

Manual material

Possible manual material is stored in locked spaces, access to which is only granted to people with a valid need to access the data.

Data processed electronically

Huhtamaki’s IT systems are protected against unauthorized access with various data protection functions, including technical measures to prevent and detect any safety breaches that may threaten the personal data. Huhtamaki applies customary authorization processes, e.g. individual access rights and passwords related to its systems. Access is allowed only for such persons who have a legitimate need to access the personal data. In case of outsourced data processing activities, Huhtamaki protects the data security by applying appropriate confidentiality and other clauses in the outsourcing agreements.

5. What rights you have

Right to object to direct marketing

You have the right to object to direct marketing at any time, free of charge. You may use the right by contacting Huhtamaki in accordance with section 6 of this Privacy Notice.

Other rights

You also have other rights with regards your personal data, including:

Right of access – you are entitled to have information concerning your personal data that is processed as well as a copy of such data.
Right to rectification – you have a right to have inaccuracies related to your personal data corrected.
Right to erasure – you have the right to require the data controller to delete your personal data if the continued processing of that data is not justified.
Right to withdraw consent (when processing is based on consent) – in order for a consent to be valid, it needs to be withdrawable, and you have the right for such withdrawal at any time.
Right to data portability – under certain conditions, you may require your data to be ported to yourself or to another company in a commonly used machine-readable format.
Right to object – In certain situations you have the right to object to processing of your personal data, upon which the processing shall cease. You have the right, on grounds relating to your particular situation, to object to processing if the processing is based on legitimate interest. When data is processed for the purposes of direct marketing, you always have the right to object to such processing, including profiling.
Right to restrict processing – you have, in some situations, the right to limit the processing of your data to some purposes. This means that we must refrain from using the data during the period for which the right applies. This right may be used e.g. if you contest the lawfulness of the processing or the accuracy of the data, and we are in the process of verifying the accuracy of the data.
Right to lodge a complaint with the supervisory authority – you have the right to lodge a complaint with the competent supervisory authority as described in the local laws and regulations.

6. How you can contact us and exercise your rights

You can contact us regarding all questions concerning protection of your personal data in our data processing activities. You can find our contact information from section 2 of this Privacy Notice.

You can also exercise your rights, free of charge, by contacting us. We will answer your request within one (1) month of receipt of your request, unless there are justified causes to extend this time by two (2) further months. If we cannot fulfil your request, e.g. due to legal obligations, we will inform you in writing within the same time period stated above and provide you the reasons due to which we are unable to fulfil your request. In this case, you can always lodge a complaint with the supervisory authority, if you disagree with our decision.

7. Changes to Privacy Notice

Huhtamaki may amend this Privacy Notice from time to time. While we will aspire to inform you of any significant changes to this Privacy Notice, you are encouraged to regularly visit our website and review the notice for updates.