Smurfit Kappa Group Website Privacy Notice
1. About this Privacy Notice
The Smurfit Kappa domain (“www.smurfitkappa.com”) is operated by Smurfit Kappa Group (“Smurfit Kappa”, “Group”, “we”, “us” or “our”). In this Privacy Notice, your personal data means any information which Smurfit Kappa processes about you from which you can be directly or indirectly personally identified (“Personal Data”).
This Privacy Notice applies to Personal Data that we and/or on our behalf by our third party service providers collected and process in the course of your dealings with us. Smurfit Kappa Group acts as data controller in this regard and your Personal Data will be under the responsibility of the Group.
Smurfit Kappa is a global company with locations around the world. A full list of entities in the Group is available here. As part of our global approach, we endeavour to adopt consistent approaches to our processing of Personal Data to the extent possible. Depending on the region in which you are located, the entities within the Group have established procedures in place to ensure that your Personal Data is protected.
If you have any questions on this Privacy Notice, please contact the Group Legal Department at grouplegal@smurfitkappa.com
2. How We Collect Your Personal Data
i). Information you provide to us:
[We will collect and store any information you provide to us when you]:
- have opted-in for marketing and / or business communications;
- use our website to access our services;
- use our social media accounts;
- are an existing Smurfit Kappa customer; and
- access our vendor portal.
ii) Other Information we collect:
- when you visit our website we collect cookie data
3. Categories of Personal Data Collected
The table below details the categories of Personal Data that we collect in connection with our domain. Smurfit Kappa acts as controller with respect to this Personal Data.
When you opt-in to our marketing and/ or communications
| Category of personal data | Personal data we collect | Description |
|---|---|---|
| Contact Details | Name Email address Telephone number |
We process this information when you agree to receive marketing communications from us. |
| Employment Details | Company Name Location |
We process this information when you agree to receive marketing communications from us. |
| Business Activities and Interests | Area of interest and Marketing preferences | We process this information when you agree to receive marketing communications from us. |
When you use our website
| Category of personal data | Personal data we collect | Description |
|---|---|---|
| Device/IP Data | IP address, Operating system and browser used to access our website, Internet Service Provider, and Time and date the website was accessed |
This information is collected through the settings on our website. For further information, please see the section on Cookies below. |
When you use our social media accounts
| Category of personal data | Personal data we collect | Description |
|---|---|---|
| Contact Details | Name Email address Telephone number |
We process this information when you interact with our social media accounts, provided this information is publicly visible from your social media profile. |
| Location Details | Location Country |
We process this information when you interact with our social media accounts, provided this information is publicly visible from your social media profile |
| Employment Details | Job title Company Area of interest |
We process this information when you interact with our social media accounts, provided this information is publicly visible from your social media profile |
If you are a Smurfit Kappa customer
| Category of personal data | Personal data we collect | Description |
|---|---|---|
| Contact Details | Name |
This information is collected to process and deliver your order. |
| Employment Details | Details of your employer | This information is collected to process and deliver your order. |
| Payment Information | Billing information Communication with us and our staff |
This information is collected to process and deliver your order. |
If you use our vendor portal
| Category of personal data | Personal data we collect | Description |
|---|---|---|
| Supplier Details | Name Address Tax Identification Number |
We process this information, collected through our vendor portal, when you are created as a vendor in our ERP system.. |
| Supplier Bank Details | Bank Name Account Number IBAN Bank Account key |
We process this information, collected through our vendor portal, when you are created as a vendor in our ERP system. |
| Employment Details – Contact Person | Name Telephone Number Email Address Job Title |
We process this information, collected through our vendor portal, when you are created as a vendor in our ERP system. |
4. Purposes for Processing Personal Data
If you are from a jurisdiction that requires a legal basis for processing your Personal Data (such as the EU or the UK), our legal basis for collecting and using the Personal Data described above will depend on the Personal Data concerned and the specific context in which we collect it. We will only process your Personal Data if we have a lawful basis for doing so.
The lawful bases are explained below:
i. Performance of a Contract: When it is necessary for Smurfit Kappa to process your Personal Data to:
- Comply with legal obligations under a contract with you. This includes our obligations under the terms and conditions of your order, or
- To verify information before entering into a contract with you.
ii. Legitimate Interest: Where Smurfit Kappa has an interest in using your Personal Data in a certain way, which is necessary and proportionate in light of improving our customer experience and audience & targeting.
iii. Consent: When Smurfit Kappa asks you to actively indicate your agreement to Smurfit Kappa’s use of your Personal Data for a certain purpose.
iv. Compliance with Legal Obligations: When Smurfit Kappa must process your Personal Data to comply with a law.
The table below details how Smurfit Kappa will use your Personal Data and the accompanying lawful basis.
| Purpose | Legal Basis | Categories of personal data processed |
|---|---|---|
|
Provision of Goods To provide Goods in accordance with our contract with you.
|
Performance of a Contract. |
Contact Data, Identifier(s). |
|
Use of our Vendor Portal To provide access to and use of our vendor portal |
Legitimate Interest including to provide an efficient way of communicating with our suppliers and administering the supplier relationship. |
Name of the supplier Address Contact Details Bank Details Bank Name Account Number IBAN Bank Account key Tax Identification Number Mandatory Attachments: • Legal Representative ID (copy) • Company registration document • Bank Letter / Statement • Company Tax ID document (copy) • Letterhead |
|
Payment Processing To process your payment to Smurfit Kappa |
Performance of a Contract. | Payment Information |
|
Marketing For marketing, promotion and advertising purposes where the law requires us to collect your consent. For example, when the law requires consent for email marketing. |
Consent or legitimate interests, depending on where you are. |
Contact Details Advertising preferences |
|
Information Provided on a Voluntary Basis To provide certain voluntary services as part of your Smurfit Kappa experience. For example, when we use your Personal Data to
|
Consent Legitimate interest including to provide our goods. |
Contact Details Preferences |
|
Legal Claims To establish, exercise or defend legal claims. For example, if we are involved in litigation |
Legitimate Interest including to seek legal advice |
Device/IP Data, Contact Data, Identifier(s), Payment Information, Contact Details (Marketing). |
|
Compliance with Legal Obligations
|
Compliance with Legal Obligations, Legitimate Interest including compliance with international legal requirements. |
Device/IP Data, Contact Data, Identifier(s), Payment Information, Contact Details (Marketing). |
|
Compliance with law enforcement requests To comply with a request from law enforcement, courts, or other competent authorities. |
Compliance with Legal Obligations, Legitimate Interest including to assist law enforcement authorities with prevention or detection of serious crime. |
Device/IP Data, Contact Data, Identifier(s), Payment Information, Contact Details (Marketing). |
|
Research and surveys To conduct research and surveys. |
Consent, Legitimate Interest including to improve our service provision. |
Customer Request. |
Where required by applicable data privacy laws, we will only use your Personal Data for the purposes for which we collect it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your Personal Data for any other reasonable purposes in connection with our engagement with you, the purpose and legal basis for any other further processing will be notified in advance from time to time.
Where we rely on a legitimate purpose of Smurfit Kappa or a third-party recipient of the personal data in order to use and disclose personal data, you are entitled to object to such use or
disclosure and if you do, we will stop processing your personal data for that purpose unless we can show there are compelling legitimate reasons for us to continue to do so.
5. How We Share Your Personal Data
Depending on your relationship with us, we may disclose some or all of your Personal Data to service providers and other parties listed in this section.
Service Providers and Affiliates
We will share Personal Data with our service providers and affiliates so that they can provide services to us. Our service providers help us to provide the website, support or marketing and PR services to you. We carefully select our service providers and we take corresponding measures to protect your Personal Data when service providers are engaged.
Legal Obligations
We may share any Personal Data where this is required by law or regulation, or court or administrative order having force of law, or where required by any of Smurfit Kappa’s regulators.
Business Transfers
Your Personal Data may be transferred to a different entity, and our legal and other advisors, if we undergo, or evaluate, a merger, acquisition, bankruptcy or other transaction (or proposed transaction) in which that entity assumes control of our business or assets of our business (in whole or in part).
6. Transfers of Personal Data
Because of the global nature of our business, your Personal Data may be transferred to Smurfit Kappa Group companies, subcontractors and partners located in countries across the world. We will always take steps to ensure that any international transfer of Personal Data is carefully managed to protect your rights and interests.
Some transfers may be outside of the European Economic Area (“EEA”) to countries which do not have equivalent protections, and for those transfers Smurfit Kappa’s policy is that (i) they do not occur without prior written authority; and (b) that an appropriate transfer mechanisms is implemented to protect your Personal Data. We implement the standard contractual clauses to cover transfers of your personal data to our affiliates and vendors outside the EEA.
You have the right to ask us for more information about the safeguards we have put in place (including a copy of the transfer mechanism as mentioned above. Contact us if you would like to receive further information or to request a copy of the relevant safeguard (which may be redacted to ensure confidentiality).
7. Data Security and Retention
We seek to protect your Personal Data from unauthorised access, use and disclosure using appropriate physical, technical and organisation security measures based on the type of Personal Data and how we are processing that Personal Data.
We retain Personal Data about you for as long as necessary to provide you with our products or marketing purposes (where consent has been given). In some cases, we retain Personal Data for longer, if doing so is necessary to comply with our legal obligations, to defend a legal claim or is otherwise required by applicable law, rule or regulation. In general, Smurfit Kappa (or its service providers on its behalf) will hold this information for a period of 30 months after you cease to interact with us, unless we are obliged to hold it for a longer period under law or applicable regulations.
Any Personal Data is deleted or rendered unavailable as soon as the purpose of storage no longer applies. The data is also rendered unavailable or deleted when a prescribed storage duration mandated by the laws in your jurisdiction expires unless there is a necessity for the continued storage of the data for the conclusion of a contract or the fulfilment of a contract.
8. Your Rights in relation to Personal Data
Under applicable privacy laws, you may have rights over your Personal Data as a data subject.
For further information on whether you can exercise any of the rights below in your jurisdiction, please contact us at: grouplegal@smuriftkappa.com. We have set out in this section certain data subject rights under GDPR, which apply to clients based in the EEA.
i. Request access to your Personal Data. This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
ii. Request correction of the Personal Data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
iii. Request erasure of your Personal Data. This enables you to ask us to delete or remove Personal Data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Data where you have exercised your right to object to processing (see below).
iv. Object to processing of your Personal Data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation, which makes you want to object to processing on this ground.
v. Request the restriction of processing of your Personal Data. This enables you to ask us to suspend the processing of your Personal Data, for example if you want us to establish its accuracy or the reason for processing it.
vi. Request the transfer of your Personal Data to another party.
vii. Withdraw your consent at any time if your Personal Data is processed on the basis of consent. If you withdraw your consent, this will not affect the lawfulness of how we used your Personal Data before you withdrew consent.
viii. Lodge a complaint with a competent supervisory authority if you consider that the processing of your Personal Data infringes applicable law. We request that you contact us in the first instance so that we can respond to your complaint. The contact details are available here: https://edpb.europa.eu/about-edpb/about-edpb/members_en.
You can request to exercise the rights above by contacting us using the details below. Your rights will in each case be subject to the restrictions set out in applicable data protection laws. Further information on these rights, and the circumstances in which they may arise in connection with our processing of your Personal Data, can be obtained by contacting our Data Protection Representative in writing to Group Legal Department, Smurfit Kappa Group, Beech Hill, Clonskeagh, Dublin 4, Ireland.
9. Changes to this Privacy Notice
We constantly try to improve our services, so we may need to change this Privacy Notice from time to time to reflect changes in technology, law, business operations or any other reason we determine is necessary or appropriate.
If at any time we decide to use your Personal Data in a manner significantly different from that stated in this notice, or otherwise disclosed to you at the time it was collected, we will notify you by e-mail or post, and you will have a choice as to whether or not we use your Personal Data in the new manner.
10. Contact Information
If you have any questions or queries about this Privacy Notice, the ways in which we collect and use your Personal Data or your choices and rights regarding such collection and use, please do not hesitate to contact us at:
i. Phone: +353 1 202 7000
ii. Email: grouplegal@smurfitkappa.com
iii. Address: Group Legal Department, Smurfit Kappa Group, Beech Hill, Clonskeagh, Dublin 4, Ireland
Last Updated: September 2023