Privacy notice – GDPR

Download as pdf

1. Background and objectives

Svenska Cellulosa Aktiebolaget SCA and its Group companies, referred to here as “SCA” or “we”, collect and use personal data in their operations. We are protective of the privacy of our employees, customers and other business contacts and ensure that we comply with the applicable data protection regulations, including the General Data Protection Regulation (GDPR), in all countries where SCA conducts operations.

SCA continuously takes the necessary steps to ensure that your personal data are processed in accordance with the applicable data protection legislation and accepted market practice.

The purpose of this General Privacy Notice is to provide an overview of how SCA works with GDPR. Special documents with more detailed privacy protection information, which could be relevant to you depending on the role you have and the context in which you come into contact with SCA, are published on SCA’s external website and on SCA’s intranet.

As a starting point, each company in the SCA Group is the data controller for its processing of personal data. Depending on the operation to which the personal data processing is attributable, the data controller responsibility may be assigned to various companies within the SCA Group.

Under section 15 below, you can find the contact information for our GDPR management organization. You are always welcome to contact the management organization if you have questions related to SCA’s processing of personal data.

2. What is the processing of personal data?

Personal data refers to all types of information that, directly or indirectly, independently or in combination with other information, can be associated with a living person. This may be name, address or personal identity number. Photos of people are also classified as personal data. Sound recordings that are stored in digital form may also be personal data, even if no names are given on the recording. A corporate registration number is often not a personal identity number, but may be if pertaining to a sole proprietorship.

The processing of personal data is “any operation which is performed on personal data”, such as collection, storage, processing, use for various purposes, the change or destruction of personal data.

This entails that processing of personal data occurs in all companies’ operations. SCA would not be able to conduct its operations without processing personal data. In many cases, SCA even has obligations to process personal data. It is important that the processing of personal data is always lawful and complies with existing regulations, such as GDPR. In this notice, you can read more about how SCA safeguards this within its operations.

3. SCA always complies with basic principles 

In this section, we have collected the basic principles that are always observed by SCA in the processing of personal data.

3.1. Lawfulness, fairness, transparency

Personal data must always be processed lawfully, fairly and in a transparent manner in relation to the data subject (that is, the individual person).

This entails, for example, that SCA bases each case of processing on a valid legal basis, such as processing that is required to perform a contract with the data subject or to meet a legal obligation. You can read more about legal basis in section 4.

The transparency requirement means that SCA must provide clear and transparent information on the processing of personal data to those affected. SCA does this, for example, by publishing and providing information about documents containing privacy protection information.

3.2. Purpose limitation

Personal data may only be collected and used for explicit purposes (reasons), and not further processed in a manner that is incompatible with those purposes. SCA ensures this by identifying and documenting the purposes of the activities in using various personal data.  

3.3. Data minimization

Personal data that are processes must be adequate, relevant and limited to what is necessary in relation to the purposes. SCA ensures that the data collected are actually required. SCA does not request information merely because it could be useful to have it. SCA does not use personal data for any other purpose than the one for which they were originally collected.

3.4. Accuracy

Personal data that are processed must be accurate and, where necessary, kept up to date. SCA takes appropriate action to ensure that incorrect or incomplete data are erased or rectified. SCA avoids storing copies of data in multiple systems so that incorrect sources and information that is not up to date are not stored and used in the operations.

3.5. Storage limitation

Personal data may only be processed during the time required for the objective of processing (purpose) to be met. SCA does not store or use data for longer than is necessary for the purposes for which the personal data are processed. The same data may be used for different purposes over periods of time of varying length. For example, data may be contained in SCA’s accounting for a long time, but may not be used for marketing.

When the data are no longer required, SCA removes them in stages, which means that they are either erased or anonymized.

3.6. Accountability

The principle of accountability entails that SCA must be able to demonstrate compliance with the General Data Protection Regulation (GDPR). Accordingly, SCA documents implemented and planned processes and measures pertaining to data protection matters.

3.7. Record

SCA documents and maintains records of the processing of personal data conducted in the operations.

3.8. Sensitive data

Certain personal data is, by its nature, particularly sensitive and for this reason, has stronger protection, so-called sensitive data. As a core rule, it is prohibited to process sensitive data, but there are exceptions. SCA takes special technical and organizational security measures regarding sensitive data. The processing of sensitive data can, for example, involve information about health, which are primarily managed by SCA’s HR unit and SCA Health.

4. Legal basis

All personal data processing must have a legal basis to be permissible. According to the General data Protection Regulation (GDPR), the legal bases that apply for SCA are:

• Performance of a contract, that is, that the processing is necessary for SCA to be able to perform a contract to which the data subject is party or to take steps at the request of the data subject prior to entering into a contract. Examples of this are SCA’s contracts with employees and customers who are private individuals.
• Compliance with a legal obligation, meaning that the processing is necessary to comply with a legal obligation to which SCA is subject according to law. An example is when SCA must save accounting information for a period of at least seven years to meet legal requirements under the Swedish Accounting Act.
• Legitimate interest, this means that processing is necessary for purposes that relate to the interests of SCA or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. When SCA uses legitimate interest as a legal basis for processing personal data, SCA documents the assessment that has been made. An example is that SCA processes contact information for potential business contacts on the basis of a legitimate interest.
• Consent, meaning that an individual has given consent to the processing of his or her personal data for one or more specific purposes. There are special requirements for consent and that must be met for consent to be valid as a legal basis, for example, that consent has been freely given. Since consent provided can be withdrawn at any time, SCA has minimized the use of consent as a legal basis.

You can read more about applicable legal bases for our processing in the documents with adapted privacy information.  

5. Information for the data subject

The transparency requirement entails, for example, that individuals (“data subjects”) are entitled to be informed when their personal data is processed. The information must include, for example, the contact details of the data controller, the legal basis for the processing and the purpose of the processing.

SCA ensures appropriate procedures for meeting this information obligation and SCA has adopted several internal and external information documents. SCA typically provides information about SCA’s personal data processing by providing or referring to documents containing information about privacy protection. 

6. Data subject’s rights

As an individual, you have certain rights in relation to SCA when SCA processes your personal data. SCA has established internal procedures and guidelines, as well as an internal organization, to ensure that individuals are able to exercise their rights in accordance with GDPR. More information about these rights are contained in the documents with privacy protection information that are published on sca.com/gdpr.

7. Security measures

SCA processes personal data in such a manner that ensures appropriate security for personal data, including for the purpose of preventing personal data breaches. This is achieved through technical and organizational action within the SCA Group. The level of security measures is assessed in relation to the risks with and type of personal data processing. Organizational security measures may be, for example, that SCA uses authorization controls and log systems for the IT systems that contain personal data and shell protection for entering and leaving SCA’s premises. Technical security measures may be, for example, that SCA has adequate protected wireless networks, password protection for mobile devices and e-mail encryption as required.

8. Provision of personal data

SCA engages cooperative partners and service providers that conduct services on behalf of SCA, such as the provision of IT services, marketing services, etc. In the provision of such services, the service provider/partner may gain access to personal data. These companies may only process personal data as set forth in the processor agreement signed with us, and in accordance with the specific instructions they receive when such an agreement is signed. They may not use your personal data for their own purposes and are required by law and contract to protect your personal data.

SCA may disclose personal data to third parties, such as the police or another authority if we are obliged to do so by law or as the result of an official decision to protect SCA’s legal interests or to investigate, uncover or prevent fraud, other crimes or security problems. SCA may also disclose personal data to legal advisers, auditors or business consultants.
In the event of a dispute, it may be necessary to transmit information containing personal data to other parties to the dispute.

SCA only provides personal data to a third party when there is a legal basis for the transfer and this is motivated by internal business purposes or otherwise well-founded. 
SCA has signed agreements with its data processors, including data processors in the SCA Group.

9. Transfer to third countries 

As its starting point, SCA only processes personal data within the EU/EEA. The General Data Protection Regulation (GDPR) entails that all EU member states have equal protection for personal data and personal privacy, meaning that personal data can be freely transferred within the EU/EEA without restrictions.

For a country outside the EU/EEA, so-called third countries, there is no corresponding protection for personal data and privacy. In the event that SCA transfers (or provides access to) personal data to third countries, such as the United States, SCA takes measures to ensure that personal data remains equally protected and the measures required to legally transfer personal data to countries outside the EU/EEA. This can be done by entering into EU Standard Contractual Clauses with the recipient (Link to Standard Contractual Clauses). We can also take further action. Such measures are mentioned in connection with the respective treatment, see for example section 14.

10. Risk analysis and impact assessment

SCA is responsible for identifying and classifying privacy risks related to each planned processing of personal data. Accordingly, SCA conducts a risk analysis of personal data processing. Particular privacy risks for the individual’s rights and freedoms may arise, for example, in the processing of sensitive data or if the processing is conducted on a large scale.

If it is likely that personal data processing could involve a high risk to an individual’s rights and freedoms, an assessment is made of the effects of the planned processing on the protection of personal data.

11. SCA employees are trained in GDPR issues

At SCA, our opinion is that all employees have a responsibility to understand the applicable data protection regulations, including the General Data Protection Regulation (GDPR). SCA supports its employees by continuously holding training courses adapted to employees’ actual needs in relation to the employees’ position at SCA and the personal data processing in question.

12. GDPR management organization

SCA has a specially composed management organization for issues related to GDPR. In addition to this, specific work is conducted to a large extent in the business areas in accordance with the management organization’s directives, such as updating internal special procedures and documentation.

13. Audits and regulatory compliance

Audits of SCA’s regulatory compliance in relation to data protection regulations are conducted regularly and in a structured manner. SCA has established procedures for the way in which the GDPR management organization, with the help of external parties, is to conduct thorough, independent and regular evaluations of SCA’s regulatory compliance. SCA has also established procedures for the implementation of gap analyses, as well as the follow-up and correction of any shortcomings identified. SCA has also adopted procedures for the way in which audit results are to be reported.

14. Processing of personal data

SCA collects personal data that you provide to us voluntarily when you have contact with us, such as by e-mailing us or entering a contract with SCA. We also collect personal data during ongoing business relationships with you.

Personal data may also be generated continuously during our business relationship with you as a result of your activities, such as your participation in events at SCA, or when we perform our legal obligations as a company.

SCA also collects data if you use our online forms and by using cookies on our websites that collect information on and from your web browser. Further information on this can be found in the cookie information on the specific website.

We may also supplement data from generally available sources, including public registers, primarily the SPAR population register and Lantmäteriet’s property register, and from companies and organizations webpages. In certain cases, SCA purchases information from companies that compile registers.

Below is a description of personal data processing that can generally cover many categories of registered users. Specific privacy notice documents which can be valid for you dependent on the role you have and within which context you are in contact with SCA, are published on SCA’s external webpage www.sca.com/gdpr and on SCA’s intranet.  

14.1. Processing of personal data for marketing

14.1.1. Description of processing and purpose

SCA processes personal data with the purpose of marketing our products and services to existing and potential customers, including the provision of relevant offers. Such communication or marketing may comprise, for example, an annual report, a newsletter with information about SCA’s operation, products and services or invitations to events or similar activities. We will adapt our marketing based on your professional role, the company/organization you belong to and your and business’s demonstrated interest in relation to SCA’s operations, products and services, in order to ensure that the marketing is relevant to you.

The personal data may also be used for analysis and follow-up of our marketing activities, either by SCA directly or through third parties on behalf of us, in order to improve our offers and generally to develop our operations. To be able to do this, we use e.g. Piwik Pro on our website. The information collected is used to maintain and improve the website, measure the effectiveness of advertising, protect against fraud, abuse and customize the content and ads that you see on our website and other websites. To ensure that your data is adequately protected, we have taken protective measures in the form of de-identification and pseudonymization measures. This guarantees masking of your IP address, which means that all data collected remains anonymous. For more information about how your personal data is processed in connection with the service, read more about Cookie information on the website www.sca.com.

Marketing activities may also be targeted to business contacts other than existing and potential customers if we consider that the business contact is significant for SCA in some respect, such as a market organization or group of companies.

14.1.2. Personal data processed and time for data storage

The personal data processed for this purpose are primarily name, contact details, information regarding participation at an event, details of your relationship with SCA, your professional role, which company and which branch you belong to, and what language to use when contacting you. For current customers/suppliers the personal data are stored during the customer/supplier relationship and one year thereafter. For potential customers/suppliers/other stakeholders the personal data are stored during three months from the time of collection if not the data subject has declined further distribution.

14.1.3. Legal basis for the data processing

The legal basis for SCA’s personal data processing for marketing is a legitimate interest, by which SCA, in each individual case, ensures that the fundamental rights and freedoms of our contract partners and business contacts do not override our legitimate interest in marketing activities and developing, optimizing and managing our operations. You are welcome to contact us if you would like to know more about how we have evaluated your legitimate interests against ours.

As far as marketing is concerned, the same legal basis is applied whether the data subject is covered by marketing in their role as company representative or as an individual forest owner/businessperson.

14.1.4. Deregistration

You have the possibility at all times to request deregistration of your data that is used for marketing. Such deregistration entails that your data, if there is no legal requirement preventing such sorting, will be erased and no longer used for marketing purposes. If you no longer wish to be included in marketing activities from an SCA company, you can deregister using gdpr@sca.com.

14.2. Processing of personal data for handling complaints from the public

14.2.1. Description of processing and purpose

SCA processes personal data for the purpose of managing complaints from the public relating to our industries’ operations, such as any gas emissions, odors and fiber dispersion. When we have received a complaint, we need to save the person’s contact information to be able to document the complaint and be able to reply to the person if necessary.

14.2.2. Personal data processed and time for data storage

The personal data processed for this purpose are primarily name, address, contact details, in some cases your car registration number, and information about the complaint. The personal data are stored during two years from the registered complaint and will then be deleted from our registers.

14.2.3. Legal basis for the data processing

The legal basis for SCA’s personal data processing for handling complaints from the public is a legitimate interest to be able to handle, and on some occasions, give compensation for the complaint.

14.3. Processing of personal data for contact persons on website

14.3.1. Description of processing and purpose

If you are a contact person for services offered on SCA’s website, such as a contact person for questions and purchases relating to hunting and fishing, we process your personal data by providing them on the website.

14.3.2. Personal data processed and time for data storage

The personal data processed for this purpose are primarily name and contact details. The personal data are stored during the time you are a contact person for current service and will then be deleted from the website.

14.3.3. Legal basis for the data processing

The legal basis for our processing is a legitimate interest, with that legitimate interest being the ability to effectively offer hunting and fishing services to consumers via our website.

14.4. Processing of personal data when leaving points of view connected to wind power project planning 

14.4.1. Description of processing and purpose

SCA collects information if you, as an interested party, provide opinions regarding SCA's development of wind power on the SCA group's land that is subject to so-called early dialogue to be able to provide your views to wind power planners and to be able to respond to your views in a correct way. In cases where planning begins, we also need to be able to provide a compilation of all opinions received from stakeholders to the current wind power designer.

14.4.2. Personal data processed and time for data storage

The personal data processed for this purpose are primarily name, contact details and given point of view. The personal data are stored during the time SCA is part of the wind power project and maximum three months thereafter.

14.4.3. Legal basis for the data processing

The legal basis for our processing is a balancing of interests, where our legitimate interest is to be able to provide your views to the wind power designer in order to then respond to your views in a correct way, as well as to be able to compile views from stakeholders. More detailed information is provided, where appropriate, on the relevant website in connection with your submission of your comments.

14.5. Processing of personal data in event of GDPR request

14.5.1. Description of processing and purpose

SCA processes personal data to manage requests in accordance with GDPR, such as, for example, requests for register extracts or corrections.

14.5.2. Personal data processed and time for data storage

The personal data processed for this purpose are primarily name, contact details, information on the request itself and information about SCA’s handling of the request. SCA could process the data for a period of a year from when the request is made for the purpose of being able to process a new request from the same person or to demonstrate compliance with GDPR.

14.5.3. Legal basis for the data processing

The legal basis for SCA’s personal data processing to handle requests according to GDPR is partly the completion of legal obligation (to handle the request) and partly a legitimate interest, by which SCA’s legitimate interest of being able to follow up on requests made and to defend itself against any claims of incorrect handling overrides the interests of the individual that their data not be processed.

14.6. Processing of personal data for trainings

14.6.1. Description of processing and purpose

SCA processes personal data to administer and implement trainings registered in SCA’s system for education. The processing applies to external teachers who hold trainings and external students, who may for example be one of our partners. External teachers need to be able to see and manage attendance for the people registered for a training, distribute training evaluations and mark the training as completed in SCA’s system for education. For an external student to complete training online and/or receive invitations/training evaluations for a training, an account must be created in SCA’s system for education.

14.6.2. Personal data processed and time for data storage

The personal data processed for external teachers and external students are primarily name and email address. Personal data for external teachers are stored during current collaboration and will then be deleted every six months. Personal data for external students are stored during six months from the end of the training.

14.6.3. Legal basis for the data processing

The legal basis for our processing is a legitimate interest, with that legitimate interest being the ability to administer and carry out trainings to our external partners connected to SCA’s business, and to use external teachers for, i.e. compulsory trainings.

14.7. Processing of personal data for external visitors to our sites

14.7.1. Description of processing and purpose

SCA processes personal data about external visitors to have knowledge, from a security perspective, of which people that are present at site.

14.7.2. Personal data processed and time for data storage

The personal data processed for this purpose are primarily name and company but could in some cases also include a car register number for the parking permit. The personal data are registered in conjunction with your visit and are being deleted continuously.

14.7.3. Legal basis for the data processing

The legal basis for our processing is a legitimate interest, with that legitimate interest being our knowledge, from a security perspective, of which people that are present at site in case of any incidents (i.e. evacuation for different reasons).

14.8. Processing of personal data in connection with video-surveillance

14.8.1. Why we process your personal data

SCA uses video-surveillance at our facilities and buildings. This is done in order to prevent, detect and investigate criminal activities and accidents, as well as to maintain a safe and secure environment for our employees and visitors. At our production facilities, there is also production-related video-surveillance, with the aim of preventing and preventing accidents.

In the places that are under video-surveillance, there are signs with more information.

14.8.2. What personal data we process about you and the current storage period

The personal data processed for this purpose is mainly image material. If sound is recorded, this must be particularly evident from the signage at the site. Recorded material is normally only stored for a few days and is discarded continuously. However, material may be stored for longer if it is needed to comply with specific legal requirements or if it is necessary to investigate burglary, an accident or the like.

14.8.3. Legal basis for the processing

The legal basis for our processing is a legitimate interest, where our legitimate interest in being able to ensure the safety of persons and property is deemed to outweigh the individual's interest in the data not being processed.

15. Contact SCA

For questions relating to this Notice, please contact SCA’s GDPR management organization as follows:

• by e-mail gdpr@sca.com or via the contact form at sca.com/gdpr
• by telephone: +46 (0)60 19 33 30 (switchboard), ask for the Head of Administration GDPR or Legal Counsel

Download as pdf

1. Introduction

In the framework of its business operations, SCA processes personal data relating to its customers and potential customers as well as other business contacts. We always take care to process personal data in a responsible and correct manner in accordance with applicable laws and regulations, such as the EU General Data Protection Regulation (GDPR).

In this information concerning personal data processing (the “Information”), you can read more about how we process personal data relating to our customer contacts (corporate customers, private forest owners and consumers).

2. Data controller

The SCA Group consist of several companies and operations. Each SCA company is the controller in relation to the processing of personal data within the framework of the business relationship between the SCA company and the company for which you are the contact person or representative, or between the SCA company and you as a private forest owner or consumer. The company that you have contact with within the SCA Group is thus the sender of this Information to you.

The designations “we”, “our” and “us” below pertain to the specific company within the SCA Group.

3. For what customer contacts do we process personal data?

We process personal data in relation to the following categories of customers, all of whom come into contact with our marketing and sales organization at SCA:

1. Contact person at a potential corporate customer, meaning we process personal data regarding the contact person or representative of a company that could be interested in buying products and services from SCA. See further details of our processing of personal data in relation to corporate customers in Section 4.
2. Contact person at a corporate customer, meaning we process personal data regarding the contact person or representative of a company that has an ongoing business relationship with SCA. See further details of our processing of personal data in relation to corporate customers in Section 5.
3. Private forest owner, meaning that you have a business relationship with us in your capacity as a private forest owner. See further details of our processing of forest owners’ personal data in Section 6.
4. Consumer, meaning you are a customer of ours in your capacity as a private individual. See further details of our processing of consumers’ personal data in Section 7.
   In this Information, you can read all about our personal data processing in relation tor the above categories of customer contacts. To enable you to easily find information regarding the processing of your personal data, we have divided the information below into each customer category and it is thus sufficient that you read the section stated above for each customer category. If, for example, you are a contact person for an active corporate customer and want to know more about our processing of your personal data, it is sufficient for you to read Section 5 below.

4. Our processing of your personal data as a contact person at a potential corporate customer

4.1. Which personal data do we process about you?

We may process the following personal data about you as a contact person or representative of a potential corporate customer:

• name, 
• contact information (such as address, e-mail address and telephone number),
• role/title, 
• information on the company you work for, and
• information that you provide to us (via our contact form, e-mail correspondence, registration for an event, etc.).

In the event that we do not receive the above mentioned personal data directly from you, we gain access to such data through other business contacts or public sources, such as websites or similar.

4.2. Why and on what legal basis do we process your personal data?

For marketing and campaigns

We process your name and contact information for the purpose of contacting you and offering and marketing our goods and services to you using various methods of direct marketing by e-mail and post, including newsletters, our newspapers, invitations to events and price offers.

The legal basis for processing your personal data in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to market the products and services that we believe your company may be interested in. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your privacy on the basis of the potential benefits that the marketing offers for our customer contacts. If you have nonetheless declined marketing from us, we will not send any marketing to you.

To be able to conduct customer events

We process your name, contact information, information about the company you represent and any information on food preferences and other requirements that you submit to us when registering with the aim of being able to conduct various customer events, such as meetings, training courses, dinners, conferences and similar customer activities. The legal basis for processing your personal data in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to conduct customer events with your participation. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your privacy on the basis of the potential benefits that customer events offer for our business contacts.

To administer the contact form on www.sca.com

We process your name, contact information and information about the company you work for with the aim of being able to manage inquiries that are submitted using the contact form on SCA’s website and to be able to follow up on inquiries over time. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to administer or follow up on inquiries from our potential corporate customers regarding the performance of services in one of the SCA Group’s areas.

To follow up contacts and establish new business relationships

We process your name, contact information and information about the company you work for in a customer register with the aim of being able to follow up our contacts with you during a relevant period. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to follow up contacts with potential corporate customers and thereby establish new business relationships.

5. Our processing of your personal data as a contact person at a corporate customer

5.1. Which personal data do we process about you?

We may process the following personal data about you as a contact person or representative of a corporate customer:

• name, 
• contact information (such as address, delivery address, e-mail address and telephone number),
• role/title, 
• information on the company you work for,
• details of agreed content (meaning your customer agreement), orders and other information related to your potential contacts with SCA,
• details of your evaluation or assessment of SCA from customer surveys,
• information that you provide to us (via our contact form, e-mail correspondence, etc.), and
• accounting information.

In the event that we do not receive the above mentioned personal data directly from you, we gain access to such data through the company you work for, other business contacts or public sources, such as websites or similar.

5.2. Why and on what legal basis do we process your personal data?

For marketing and campaigns

We process your name and contact information for the purpose of contacting you and offering and marketing our goods and services to you using various methods of direct marketing by e-mail and post, including newsletters, our newspapers, invitations to customer events and price offers.

The legal basis for processing your personal data in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to market products and services to the company that you represent. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your privacy on the basis of the potential benefits that the marketing offers for our customer contacts. If you have nonetheless declined marketing from us, we will obviously not send any marketing to you.

To be able to conduct customer events

We process your name, contact information, information about the company you represent and any information on food preferences and other requirements that you submit to us when registering with the aim of being able to conduct various customer events, such as meetings, training courses, dinners, conferences and similar customer activities. The legal basis for processing your personal data in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to conduct customer events with your participation. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your privacy on the basis of the potential benefits that customer events offer for our customer contacts.

To administer the contact form on www.sca.com

We process your name, contact information and information about the company you represent with the aim of being able to manage inquiries that are submitted using the contact form on SCA’s website and to be able to follow up on inquiries over time. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to administer or follow up on inquiries from our customer contacts regarding the performance of services in one of the SCA Group’s areas.

To be able to maintain contacts, enter into and manage agreements, and otherwise manage the customer relationship

We process your name, contact information and information about the company you work for in a customer register with the aim of being able to maintain contact with you as the contact person for a corporate customer and manage measures relating to the customer relationship and agreements entered into.

We also process your name, contact information and information about the company you work for in order to establish agreement documentation regarding what has been agreed between the company you represent and SCA. Such personal data is also processed to be able to send an order confirmation and manage information and invoicing in connection with the sale.

To the extent that e-mail correspondence contains personal data, we process this data to maintain or establish business relationships and to enable internal and external communication.

The legal basis for processing your personal data in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to manage an existing business relationship with the company you represent.

For managing claims on goods and services

We process your name, contact information, information on your orders, your payment history and other details related to your contacts with SCA for the purpose of addressing any eventual complaints about goods and services. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to manage complaints about goods and services.

To be able to investigate customer satisfaction and improve our operations

We process your name, contact information, information about the company you represent and details of your evaluation or assessment of SCA for the purpose of surveying customer satisfaction among our corporate customers. Our customers’ evaluation and assessment of SCA is also a key factor in enabling us to continuously improve our business. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to survey customer satisfaction and develop and improve our operations.

For accounting purposes

For accounting purposes, we process details about the transaction that has occurred between us and the corporate customers for the orders made. For this reason, we may process the name and contact details that appear on the invoice or in other accounting documentation. The legal basis for our processing of your personal data for this purpose is that it is necessary to complete SCA’s legal obligation.

6. Our processing of your personal data as a private forest owner

6.1. Which personal data do we process about you?

We may process the following personal data about you as a forest owner:

• name, 
• contact information (such as address, delivery address, e-mail address and telephone number), 
• personal identity number,
• information about your forest holding and your property (such as property designation, county, product (ha), quality, total production capacity, status regarding any felling needs and similar information with a direct connection to your property and forest holding),details of agreed content (meaning the customer agreement between you and SCA),
• information on your orders, payment history and other details related to your contacts with SCA,
• details of your evaluation or assessment of SCA from customer surveys, also categorized based on gender,
• information that you provide to us (via our contact form, e-mail correspondence, etc.), and
• accounting information.

In the event that we do not receive the above mentioned personal data directly from you, we gain access to such data through public registers, particularly the Real Property Register (Sw: Lantmäteriet). 

6.2. Why and on what legal basis do we process your personal data?

For marketing and campaigns

We process your name, contact information and, in certain cases, information about your forest holding for the purpose of being able to market relevant forest products and services to you as a private forest owner through, for example, invitations and other targeted mailings. We may also use Facebook and Google Ads to advertise to the target group of private forest owners that we believe could be interested in our marketing offering. The legal basis for processing your personal data in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to market products and services to you. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your privacy on the basis of the potential benefits that marketing offers for our customer contacts. If you have nonetheless declined marketing from us, we will obviously not send any marketing to you.

To be able to conduct customer events

We process your name, contact information and, in certain cases, details of your forest holding as well as any information on food preferences and other requirements that you submitted to us when registering with the aim of being able to conduct various customer events, such as meetings, training courses, dinners, conferences and similar customer activities. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to conduct customer events with you as a private forest owner. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your privacy on the basis of the potential benefits that customer events offer for our customer contacts.

To administer the contact form on www.sca.com

We process your name, contact information and information about you as a private forest owner with the aim of being able to manage inquiries that are submitted using the contact form on SCA’s website and to be able to follow up on inquiries over time. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to administer or follow up on inquiries from our customer contacts regarding the performance of services in one of the SCA Group’s areas.

To be able to maintain contacts, enter into and manage agreements, and otherwise manage our business relationship 

We process your name, contact information and information about you as a private forest owner in a customer register with the aim of being able to maintain contact with you as a private forest owner and manage measures relating to our business relationship.

We also process your name, contact information and information about you as a private forest owner as well as information about your forest holding for the purpose of establishing agreement documentation regarding what has been agreed between you and SCA, entering into agreements and managing the fulfillment of agreements with you (also online). Such personal data is also processed to be able to send an order confirmation and manage information and invoicing in connection with the delivery of our forest products and services to you. 

To the extent that e-mail correspondence contains personal data, we process this data to maintain or establish business relationships and to enable internal and external communication.

The legal basis for processing your personal data in this case is to enable the agreement with you to be entered into and fulfilled as well as a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to manage an existing business relationship with you.

To meet requirements linked to land balance and application for an acquisition permit in accordance with the Land Acquisition Act (1979:230)

SCA processes information linked to our agreement with you and your property in order to maintain and maintain SCA's list of SCA's so-called market balance. This list is also included in the documentation that we submit to the County Administrative Board with an application for an acquisition permit in accordance with the Land Acquisition Act prior to new acquisitions of forest properties. The personal data covered by this processing are: name, address, date of agreement, county, municipality, property designation, product (ha), quality, total production capacity.

The legal basis for our processing of personal data in this part is that we must have the opportunity to fulfill a legal obligation incumbent on SCA according to the Land Acquisition Act (1979: 230) to apply for an acquisition permit with the County Administrative Board, and a balance of interests, where SCA assesses that the processing is necessary to enable SCA to have continuously updated documentation to prove the soil balance.

For managing claims on goods and services

We process your name, contact information, information on your orders, your payment history and other details related to your contacts with SCA for the purpose of addressing any complaints about goods and services. The legal basis for processing your personal data in this case is that it is necessary to enable us to fulfill our agreement with you as a private forest owner.

To be able to investigate customer satisfaction and improve our operations

We process your name, contact information, information about you as a private forest owner and details of your evaluation or assessment of SCA for the purpose of surveying customer satisfaction among our customer contacts. Our customers’ evaluation and assessment of SCA is also a key factor in enabling us to continuously improve our business. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to survey customer satisfaction and develop and improve our operations.

Skogsvinge

We process details of your forest holding based on information from public registers (such as information on the property, mortgages, owner, rights and associations, etc.) for the purpose of being able to analyze your forest holding, but also to be able to offer you as a private forest owner access to our analyses and collated information about your forest holding by logging in to our digital service, Skogsvinge. When you are logging in, using BankID, we will handle your personal identity number for the purpose of identifying you in a safe way. If you turn to us with a support request we will also handle these personal data in order to handle your request in our case management system. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in identifying you, analyzing your forest holding based on public registers (Sw: Lantmäteriet), offering you access to our analyzes and compiled information about your forest holding, and handling potential support requests.

7. Our processing of your personal data as a consumer (private individual)

7.1. Which personal data do we process about you?

We may process the following personal data about you as a consumer (private individual):

• name, 
• contact information, such as address, e-mail address and telephone number,
• personal identity number,
• information on any contacts with SCA by, for example, telephone,
• details of your evaluation or assessment of SCA from customer surveys, also categorized based on gender,
• information on your orders and our agreements with you, 
• information on your potential belonging to any of our hunting teams, 
• information on you included in potential interview notes when in contact with SCA,
• accounting information, and
• information on your credit status, such as creditworthiness and any payment defaults.

In the event that we do not receive the above mentioned personal data directly from you, we gain access to such data through public registers and when conducting credit checks.

7.2. Why and on what legal basis do we process your personal data?

For marketing and campaigns

We process your name and contact information for the purpose of contacting you and offering and marketing our goods and services to you using various methods of direct marketing by e-mail and post, including newsletters, our newspapers, invitations to events and price offers. We send marketing mailings to consumers that have an existing customer relationship with SCA and to private individuals that we believe could be interested in buying goods and services from SCA.

The legal basis for processing your personal data in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to market products and services to you. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your privacy on the basis of the potential benefits that marketing offers for our customer contacts. If you have nonetheless declined marketing from us, we will obviously not send any marketing to you.

To be able to conduct customer events

We process your name, contact information and any information on food preferences and other requirements that you submitted to us when registering with the aim of being able to conduct various customer events, such as meetings, training courses, dinners, conferences and similar customer activities. We invite consumers that have an existing customer relationship with SCA and consumers that we believe could be interested in participating in our customer events. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to conduct customer events with you as a participant. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your privacy on the basis of the potential benefits that customer events offer for our customer contacts. If you have nonetheless declined marketing from us, we will obviously not send any marketing to you.

To administer the contact form on www.sca.com

We process your name and contact information with the aim of being able to manage inquiries that are submitted using the contact form on SCA’s website and to be able to follow up on inquiries over time. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to administer or follow up on inquiries from our customer contacts regarding the performance of services in one of the SCA Group’s areas.

For the management of customer relationships, managing orders, credit checks and agreements, etc.

We process your name, contact information, personal identity number and information on your orders and agreements with us for the purpose of managing your orders (including preparing and sending order confirmations and issuing notices regarding order status and delivery problems as well as providing support and answering questions from you), conducting credit checks to find out whether or not we can sell to you on invoice, and otherwise fulfilling our obligations to you as a consumer, and to optimize our business based on our customers geographical area and buying patterns.

To the extent that e-mail correspondence contains personal data, we process this data to maintain or establish business relationships and to enable internal and external communication.

The legal basis for processing your personal data in this case is to enable the agreement with you to be entered into and fulfilled as well as a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to manage an existing business relationship with you, and to optimize and make our business more effective.

For managing claims, returns, etc.

We process your name, contact information and information on your orders and agreements with us for the purpose of managing any request to return products or to exercise your consumer rights to claim an error and delay on our part. The legal basis for processing in this case is that it is necessary to enable us to fulfill our agreement and to complete our legal obligations in accordance with applicable consumer legislation.

To be able to investigate customer satisfaction and improve our operations

We process your name, contact information, information about you as a consumer and details of your evaluation or assessment of SCA for the purpose of surveying customer satisfaction among our customer contacts. Our customers’ evaluation and assessment of SCA is also a key factor in enabling us to continuously improve our business. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to survey customer satisfaction and develop and improve our operations.

Hunting and fishing

We process your name and contact information for you as a consumer for the purpose of being able to offer the purchase of a one-day permit for small game hunting and fishing on our land. The legal basis for processing in this case is that it is necessary to enable us to fulfill our agreement with you as a consumer or to take measures before such an agreement is entered into.

Mapping and assessment of hunting teams

We process your name, what hunting team you belong to, and potential interview notes on you as consumer, when belonging to one of SCA’s hunting teams, with the aim of being able to map and assess the gender distribution in our hunting teams. The compiled result enables internal training within Equality, Gender and Management (“EGM”), and to work with business improvements releated to EGM-questions. No personal data appears from such result or summary.

Lögdö Wild

We process your name and contact information for you as a consumer for the purpose of offering the booking of cottages and campsites in the wilderness. Bookings are managed on the website https://logdowild.se/. The legal basis for processing in this case is that it is necessary to enable us to fulfill our agreement with you as a consumer or to take measures before such an agreement is entered into.

Customer Club for pellets

We process your name and contact information for the purpose of administering your membership in our Customer Club for pellets, and to be able to contact you to provide and to market our products and services within the scope of the Customer Club through membership benefits and price offerings.

The legal basis for processing your personal data in this case is party to enable the conclusion and fulfillment of the agreement with you for the membership in the Customer Club, and partly a legitimate interest, i.e. the processing is necessary for our legitimate interest of being able to handle an ongoing business relationship with you and to provide and to market our products and services within the scope of the Customer Club.

For accounting purposes

For accounting purposes, we process details about the transaction that has occurred between us and you. For this reason, we will process the personal data that needs to be included in invoices and other accounting documentation. The legal basis for processing in this case is that it is necessary to complete SCA’s legal obligation.

8. Deliveries of pellets

SCA makes deliveries of pellets on behalf of distributors. In these cases, it is the distributor from whom you bought the pellets that is the data controller and is able to respond to any questions you may have concerning the processing of your personal data.

9. To whom do we forward personal data and where do we process personal data geographically?

We may give out your personal data if the need arises in conjunction with one of the following situations:

a) We may discloseyour personal data to other companies in the SCA Group. Your personal data may also be disclosed to and processed by third parties outside the SCA Group, such as to our cooperative partners and to our service providers who process personal data on our behalf, so-called processors. We have contracts with our processors that ensure that they process your personal data in accordance with this Information and our instructions. Examples of third parties to whom we may disclose your personal data include transport companies in connection with the delivery of goods, media agencies for the distribution of marketing mailings and legal advisors.

b) We may disclose your personal data to authorities, such as the National Land Survey, the County Administrative Board and the Swedish Tax Agency, to fulfill a legal obligation incumbent on us or to enable an application for a permit or deduction in which information containing personal data linked to you must be submitted. An example of such a situation is when we apply for an acquisition permit with the County Administrative Board in accordance with the Land Acquisition Act (1979: 230).

c) We may also share your personal data with third parties to permit a merger, an acquisition or a sale of all or part of SCA’s assets.

As a general rule, SCA and SCA’s cooperative partners process your personal data only within the EU and EEA. If personal data is processed outside the EU and EEA, SCA will take measures to ensure that the data remains equally secure and also take the measures required to legally transfer personal data to countries outside the EU and EEA.

10. How long do we process your personal data for the different purposes?

SCA will not keep your personal data for longer than necessary, taking into account the purpose for they were was collected. Therefore, we regularly delete personal data that is no longer needed.

Personal data processed by SCA to ensure that we can offer our goods and services to our customer contacts, or that we process to manage customer relationships and sales, is processed as long as you or the company for which you are a contact person are customers of SCA.

Some personal data ceases to be necessary for SCA during the ongoing customer relationship and some in direct connection with the customer relationship ending, while SCA must store other information for a shorter or longer time period if required in order to fulfill legal or tax requirements, official decisions, accounting requirements, etc. 
The time period for which we process your personal data for marketing purposes depends on whether you have given your consent for processing or if such processing is carried out on the basis of a legitimate interest (which is usually the case). If you have consented to receive direct marketing, newsletters and catalogs from us, we will process your personal data until you deregister, withdraw the consent you have given (see Section 11.6 below) or otherwise ask us to stop contacting you for this purpose.

In the vast majority of cases in which we process data for marketing purposes on the basis of a legitimate interest, we will, in as far as you have an existing business relationship with SCA, process your personal data for marketing purposes for a year after your customer relationship with us ceases. However, you can always request that we stop processing personal data for this purpose earlier than this. If you do not have an existing business relationship with SCA and have not expressed that you want to receive marketing from us, we will process your personal data for three months from the time of obtaining your contact information. However, we may obtain the data again and then send further marketing mailings to you.

If you want more information about the period during which we process your data, please contact us for additional information, see the contact details to SCA in Section 12 below.

11. Your rights

When we process your personal data, you have certain legal rights. Note that the exercise of these rights is subject to certain requirements and conditions as specified in the General Data Protection Regulation (GDPR).

11.1. Your right to information and access

You are entitled, without cost, to request in writing information about the personal data we process in relation to you. If your request is unfounded or excessive, for example if you often request extracts or erasure and at frequent intervals, we may either reject your request, or charge a fee that covers the administrative costs arising for us from your request.

11.2. Your right to rectification and erasure

If your personal data is inaccurate or incomplete, you have the right to request that we rectify or supplement such personal data.

You have the right to request erasure of your personal data in certain circumstances that are described in the General Data Protection Regulation (GDPR). Provided that your request falls within one of these circumstances, we will erase your data.

11.3. Your right to request restrictions

Under certain circumstances as specified in the General Data Protection Regulation (GDPR), you have the right to request restriction of processing. Where you have this right, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

11.4. Your right to data portability

You have the right in a structured, commonly used and machine-readable format to receive the personal data about you that you have provided and have the right to transmit this data to another controller when such a transfer is technically possible.

11.5. Your right to object to direct marketing

You can object at any time to your personal data being processed for direct marketing. If you do not want us to process your personal data for this purpose, we ask that you inform using the contact information presented below, see Section 12. We will then stop processing your personal data for this purpose and remove the data, provided that we do not need to process the data for any other purpose according to this Information.

11.6. Your right to withdraw your consent 

If we process your personal data based on your consent, you may at any time, fully or partially, withdraw your consent by contacting us, see our contact information in Section 12. If you withdraw your consent, we ask you to note that this does not affect the legality of the processing that took place earlier on the basis of the consent before it was withdrawn. SCA may also have another legal basis for processing your personal data (see our statement above under each purpose) and we may therefore be entitled to continue processing your personal data.

11.7. Your right to lodge a complaint

If you are dissatisfied with how we have processed your personal data, we ask that you contact us, see our contact details in Section 12. You also have the right to submit a complaint about our personal data processing to:

The Swedish Authority for Privacy Protection, PO Box 8114, SE-104 20 Stockholm, Sweden, or by e-mail: imy@imy.se.

12. Contact SCA

You can contact us in the following way:

• by the contact form at https://www.sca.com/gdpr (or e-mail gdpr@sca.com)
• by telephone on +46 60 19 33 30 (Switchboard). ask for Head of Administration GDPR or Legal Counsel.

Download as pdf

1. Data controller 

Svenska Cellulosa Aktiebolaget SCA, corporate identity number 556012-6293, processes personal data regarding its shareholders and representatives for companies that are shareholders. We are always careful to process personal data in a responsible and correct manner in accordance with applicable laws and regulations, such as the EU General Data Protection Regulation (GDPR).

In this information about privacy protection (the “Information”), you can read more about how we process personal data relating to our shareholders.

The designations “we”, “our” and “us” below pertain to Svenska Cellulosa Aktiebolaget SCA.

2. Categories of persons about whom SCA processes personal data

We process personal data about the following categories of persons covered by this Information:

1. Shareholders (private person). See further details of our processing of personal data in relation to you as shareholder in Section 3.
2. Representatives for legal persons who are shareholders, which means we process personal data about the representative or contact person for the legal person who is a shareholder in SCA and other persons who contact SCA in connection with general meetings of shareholders. See further details of our processing of personal data in relation to representatives of legal persons who are shareholders in Section 4.

In this Information, you can read all about our personal data processing for the above categories of persons. To enable you to easily find information regarding the processing of your personal data, we have divided the information below into each category of person and it is thus sufficient that you read the section stated above for each category of persons. If, for example, you are a representative for a legal person who is a shareholder and want to know more about our processing of your personal data, it is sufficient for you to read Section 4 below.

3. Our processing of your personal data as a shareholder (private person)

3.1. Which personal data do we process about you?

We may process the following personal data about you as a shareholder:

• name,
• contact information (such as address, e-mail address and telephone number),
• personal identity number,
• shareholdings,
• number of votes, voting rights and other rights connected to your shareholding
• shareholder assistant,
• shareholder representative,
• notes in minutes of general meeting,
• visual material and/or audio recordings (such as recordings during a general meeting)
• other information you make available to us (such as via e-mail, notifications to a general meeting, request to address a specific matter at a general meeting and other communication)

If we do not collect the personal data listed above from you directly, we can obtain it through Euroclear Sweden AB, which manages our shareholders’ register. Euroclear Sweden AB is responsible for the personal data processing that occurs in conjunction with managing SCA’s shareholders’ register. Otherwise, we can obtain access to your personal data from the person who is your agent or from public registers and sources.

3.2. Why and on what legal basis do we process your personal data?

Managing the shareholders’ register

To the extent that Euroclear Sweden AB provides us with information from the shareholders’ register, which applies ahead of an annual general meeting, for example, we process name, contact details, personal identity number, shareholding and number of votes to take measures related to the management of the shareholders’ register, for instance that we receive a request from a shareholder to present certain information from the shareholders’ register. The legal basis for processing in this case is a legal obligation, i.e. we must process your personal data to meet our legal obligations.

Preparing and publishing information ahead of a general meeting

We process name, shareholding, number of votes and in certain cases visual material in order to show our ten largest shareholders on SCA’s website. We do this to fulfill our contractual obligations toward the marketplaces where our shares are traded. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to publish information related to shareholdings in SCA. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your personal privacy.

Managing and conducting general meetings and related issues

We process all personal data listed above under Section 3.1 to manage and conduct general meetings (scheduled, extended or extraordinary), including the administration connected with the general meeting and related issues, such as voting, dividends and whether you are a direct or nominee-registered shareholder. The legal basis for processing in this case is a legal obligation, i.e. we must process your personal data to meet our legal obligations.

In advance of a general meeting of SCA, you will receive additional information about how we process your personal data in conjunction with the general meeting. Such additional information is a supplement to this Information.

Holding events

We process name, contact information and any information on food preferences and other requirements that you submitted to us when registering with the aim of being able to conduct various events and similar activities with shareholders. The legal basis for processing your personal data in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to conduct events with you as shareholder. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your personal privacy on the basis of the potential benefits that events offer for our shareholders.

Communicating news about SCA’s operations, etc.

We process name and contact details in order to communicate news about our operations, including interim reports, annual reports and mailings, such as newsletters. We may also process name and contact details in order to manage other communication with you as shareholder. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to communicate news about SCA’s operations to you as shareholder. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your personal privacy.

Managing inside regulations

We process name, contact details, personal identity number, shareholding and number of votes about shareholders discharging managerial responsibilities at SCA and/or with access to inside information in order to maintain an insider logbook. The legal basis for processing in this case is a legal obligation, i.e. we must process your personal data to meet our legal obligations.

4. Our processing of your personal data as representative of a legal person who is a shareholder

4.1. Which personal data do we process about you?

We may process the following personal data about you as representative or contact person for the legal person who is a shareholder and you who otherwise contacts SCA in connection with general meetings of shareholders:

• name,
• contact information (such as address, e-mail address and telephone number),
• personal identity number,
• notes in minutes of general meeting,
• visual material and/or audio recordings (such as recordings during a general meeting)
• other information you make available to us (such as via e-mail, notifications to a general meeting, request to address a specific matter at a general meeting and other communication)

If we do not collect the personal data listed above from you directly, we can obtain it through Euroclear Sweden AB, which manages our shareholders’ register. Euroclear Sweden AB is responsible for the personal data processing that occurs in conjunction with managing SCA’s shareholders’ register. Otherwise, we can obtain access to your personal data from public registers and sources.

4.2. Why and on what legal basis do we process your personal data?

Managing and conducting general meetings and related issues

We process all personal data listed above under Section 4.1 to manage and conduct general meetings (scheduled, extended and extraordinary), including the administration connected with the general meeting and related issues, such as voting, dividends and whether the shareholder you represent or are contact person for is a direct or nominee-registered shareholder. The legal basis for processing in this case is a legal obligation, i.e. we must process your personal data to meet our legal obligations.

In advance of a general meeting of SCA, you will receive additional information about how we process your personal data in conjunction with the general meeting. Such additional information is a supplement to this Information.

Holding events

We process name, contact information and any information on food preferences and other requirements that you submitted to us when registering with the aim of being able to conduct various events and similar activities with shareholders. The legal basis for processing your personal data in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to conduct events with you as contact person or representative for a shareholder. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your personal privacy on the basis of the potential benefits that events offer for our shareholders.

Communicating news about SCA’s operations, etc.

We process name and contact details in order to communicate news about our operations, including mailings, such as newsletters. We may also process name and contact details in order to manage other communication with you as representative or contact person for a legal person who is a shareholder. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to communicate news about SCA’s operations to you as contact person or representative for a shareholder. Our interest in processing your personal data for this purpose takes precedence over your potential interest in protecting your personal privacy.

5. To whom do we forward personal data and where do we process personal data geographically?

We may supply your personal data to other companies in the SCA Group. Your personal data may also be supplied to and processed by third parties outside the SCA Group, such as to our cooperative partners and to our service providers who process personal data on our behalf, so-called personal data processors. We have contracts with our processors that ensure that they process your personal data in accordance with this Information and our instructions. Examples of third parties to whom we distribute your personal data are legal advisors and public authorities.

We may also share your personal data to permit a merger, an acquisition or a sale of all or part of SCA’s assets.

As a general rule, SCA and SCA’s cooperative partners process your personal data only within the EU and EEA. If personal data is processed outside the EU and EEA, SCA will take measures to ensure that the data remains equally secure and also take the measures required to legally transfer personal data to countries outside the EU and EEA.

6. For how long do we process your personal data for the different purposes?

SCA will not retain your personal data for longer than necessary, taking into account the purpose for which they were collected. Therefore, we regularly delete personal data that is no longer needed.

Personal data processed by SCA to complete its legal obligations, for example to comply with legal requirements in accordance with the Swedish Companies Act (2005:551) and Accounting Act (1999:1078), are processed for the time we have these legal obligations and commitments to you.

Personal data processed by SCA for the purpose of distributing newsletters about our operations are processed for as long as you wish to receive such a newsletter.

If you want more information about the period during which we process your data, please contact us for additional information, see the contact details to SCA in Section 8 below.

7. Your rights

When we process your personal data, you have certain legal rights. Note that the exercise of these rights is subject to certain requirements and conditions as specified in the General Data Protection Regulation (GDPR).

7.1. Your right to information and access

You are entitled, without cost, to request in writing information about the personal data we process in relation to you. If your request is unfounded or excessive, for example if you often request extracts or erasure and at frequent intervals, we may either reject your request, or charge a fee that covers the administrative costs arising for us from your request.

7.2. Your right to rectification and erasure

If your personal data is inaccurate or incomplete, you have the right to request that we rectify or supplement such personal data.

You have the right to request erasure of your personal data in certain circumstances that are described in the General Data Protection Regulation (GDPR). Provided that your request falls within one of these circumstances, we will erase your data.

7.3. Your right to request restrictions

Under certain circumstances as specified in the General Data Protection Regulation (GDPR), you have the right to request restriction of processing. Where you have this right, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

7.4. Your right to data portability

You have the right in a structured, commonly used and machine-readable format to receive the personal data about you that you have provided and have the right to transmit this data to another controller when such a transfer is technically possible.

7.5. Your right to lodge a complaint

If you are dissatisfied with how we have processed your personal data, we ask that you contact us, refer to our contact details in Section 8. You also have the right to submit a complaint about our personal data processing to:

Integritetsskyddsmyndigheten
Box 8114
SE-104 20 Stockholm
E-mail: imy@imy.se

8. Contact SCA

You can contact us in the following way:

• by the contact form at https://www.sca.com/gdpr (or by e-mail gdpr@sca.com)
• by telephone: +46 (0)60 19 33 30 (switchboard), ask for Head of Administration GDPR or Legal Counsel

Download as pdf

1. Introduction

In the framework of its business operations, SCA processes personal data relating to, among others, its suppliers and potential suppliers as well as other business contacts. We always take care to process personal data in a responsible and correct manner in accordance with applicable laws and regulations, such as the EU General Data Protection Regulation (GDPR).

In this information concerning personal data processing (the “Information”), you can read more about how we process personal data relating to our suppliers.

2.  Data controller

The SCA Group consists of several companies and operations. Each SCA company is the controller in relation to the processing of personal data within the framework of the business relationship between the SCA company and the company for which you are the contact person or representative. The company that you have contact with within the SCA Group is thus the sender of this Information to you.

The designations “we”, “our” and “us” below pertain to the specific company within the SCA Group.

3. What categories of persons do we process personal data about?

We process personal data in relation to the following categories of suppliers, all of whom meet our purchasing organization at SCA:

1. Contact person at a potential supplier, meaning we process personal data about the contact person or representative of a supplier who could be interested in supplying products and/or services to SCA. See further details of our processing of personal data in relation to potential suppliers in Section 4.
2. Contact person at a supplier, meaning we process personal data about the contact person or representative of a supplier who has an ongoing business relationship with SCA. See further details of our processing of personal data in relation to suppliers in Section 5.

In this Information, you can read all about our personal data processing in relation to the above categories of supplier. To enable you to easily find information regarding the processing of your personal data, we have divided the information below into each supplier category and it is thus sufficient that you read the section stated above for each supplier category. If, for example, you are a contact person for an active supplier and want to know more about our processing of your personal data, it is sufficient for you to read Section 5 below.

4. Our processing of your personal data as a contact person at a potential supplier

4.1. Which personal data do we process about you?

We may process the following personal data about you as a contact person or representative of a potential supplier:

• name, 
• contact information (such as address, e-mail address and telephone number),
• role/title,
• information on the company you work for,
• information in the offer, and
• information that we receive during communication, such as e-mail correspondence or similar.

If we do not receive the above-mentioned personal data directly from you, we gain access to such data through other business contacts or public sources, such as websites or similar.

4.2. Why and on what legal basis do we process your personal data?

To obtain offers

We process your name and contact information for the purpose of obtaining offers from the supplier you work for and thereby to be able to evaluate the business offering. The legal basis for processing your personal data in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to determine the terms of the transaction, such as price and delivery terms.

To maintain contact and establish new business relationships

We process your name, contact information and information about the supplier you work for in a supplier register with the aim of being able to follow up our contacts with you during a relevant period. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to follow up contacts with potential suppliers and thereby establish new business relationships.

To communicate by e-mail

To the extent that e-mail correspondence contains personal data, we process this data to maintain or establish business relationships and to enable internal and external communication. The legal basis for the processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in maintaining or establishing business relationships and communicating by e-mail internally and externally.

5. Our processing of your personal data as a contact person at a supplier

5.1. Which personal data do we process about you?

We may process the following personal data about you as a contact person or representative of a supplier:

• name,
• contact information (such as address, e-mail address and telephone number),
• social security number,
• role/title,
• information on the company you work for,
• information in the offer,
• information in the supplier agreement,
• information that we receive during communication, such as in e-mail correspondence or similar.,
• nationality, username and access rights (needed when you log in to our systems, such as Sharepoint), and
• accounting information.

If we do not receive the above-mentioned personal data directly from you, we gain access to such data through other business contacts or public sources, such as websites or similar.

5.2. Why and on what legal basis do we process your personal data?

To obtain offers

We process your name and contact information for the purpose of obtaining offers from the supplier you work for and thereby to be able to evaluate the business offering. The legal basis for processing your personal data in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to determine the terms of the transaction, such as price and delivery terms.

To maintain contact and manage the business relationship

We process your name, contact information and information about the supplier you work for in a supplier register to be able to maintain contact with you as a supplier and manage measures relating to the business relationship. The legal basis for processing in this case is a legitimate interest, meaning that the processing is necessary for our legitimate interest in maintaining contact with our suppliers and otherwise maintaining order in the business relationship.

To be able to enter into supplier agreements

We process your name, contact information and information about the supplier you work for to establish agreement documentation regarding what has been agreed between the supplier you represent and SCA. Such personal data is also processed to be able to manage orders, information, and invoicing in connection with the purchase. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to manage the conclusion of agreements, establish documentation regarding the agreement we have with a supplier and implementing relevant measures in connection with the fulfillment the purchase.

To communicate by e-mail

To the extent that e-mail correspondence contains personal data, we process this personal data to maintain or establish business relationships and to enable internal and external communication. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in maintaining or establishing business relationships and communicating by e-mail internally and externally.

To be able to provide our suppliers with system access

We process your name, contact information, nationality, username and information on access rights for the purpose of giving you, as a contact person for the supplier, access to our systems and work tools. The legal basis for processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to maintain tools and functions to enable cooperation with our suppliers.

To provide our suppliers with access to workplace areas and to document entry and exit during construction projects

We process names, social security numbers, supplier names, project ID and check-in and check-out dates in relation to construction projects to to give you access to our workplace areas and to be able to report entries and exits to the Swedish Tax Agency if necessary. The legal basis for our processing to report to the Swedish Tax Agency is a legal obligation, i.e. the processing is necessary to be able to report to the Swedish Tax Agency who has been in the workplace area in connection with construction projects. The legal basis for our processing of stored personal data in connection with the distribution of access cards is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to ensure that only authorized persons can enter and move around the premises.

To enter into confidentiality and cooperation agreements

We process your name, title and information about the supplier for the purpose of entering into a confidentiality agreement and/or a cooperation agreement with you as a contact person or representative of the supplier, or if you work as an independent consultant. The legal basis for our processing in this case is a legitimate interest, meaning that processing is necessary for our legitimate interest in being able to secure a personal commitment regarding cooperation or confidentiality ahead of signing supplier agreements, etc.

6. To whom do we forward personal data and where do we process personal data geographically?

We may give out your personal data if the need arises in conjunction with one of the following situations:

a) We may disclose your personal data to other companies in the SCA Group. Your personal data may also be disclosed to and processed by third parties outside the SCA Group, such as to our cooperative partners and to our service providers who process personal data on our behalf, so-called processors. We have contracts with our processors that ensure that they process your personal data in accordance with this Information and our instructions. Examples of third parties to whom we disclose your personal data are legal advisors and public authorities.

b) We may also share your personal data to permit a merger, acquisition, or sale of all or part of SCA’s assets.

As a general rule, SCA and SCA’s cooperative partners process your personal data only within the EU and EEA. If personal data is processed outside the EU and EEA, SCA will take measures to ensure that the data remains equally secure and take the measures required to legally transfer personal data to countries outside the EU and EEA.

7. How long do we process your personal data for the different purposes?

SCA will not keep your personal data for longer than necessary, taking into account the purpose for which they were collected. Therefore, we regularly delete personal data that is no longer needed.

Personal data processed by SCA to ensure that we can buy relevant goods and services from our supplier contacts, or that we process to manage business relationships and purchasing, is processed if you or the supplier you work for are suppliers to SCA.

Some personal data ceases to be necessary for SCA during the ongoing business relationship and some in direct connection with the business relationship ending, while SCA must store other information for a shorter or longer period if required to fulfill legal or tax requirements, official decisions, accounting requirements, etc.

If you want more information about the period during which we process your data, please contact us for additional information. See the contact details for SCA in Section 9 below.

8. Your rights

When we process your personal data, you have certain legal rights. Note that the exercise of these rights is subject to certain requirements and conditions as specified in the General Data Protection Regulation (GDPR).

8.1. Your right to information and access

You are entitled, without cost, to request in writing information about the personal data we process in relation to you. If your request is unfounded or excessive, for example if you often request extracts or erasure and at frequent intervals, we may either reject your request or charge a fee that covers the administrative costs arising from your request.

8.2. Your right to rectification and erasure

If your personal data is inaccurate or incomplete, you have the right to request that we rectify or supplement such personal data.

You have the right to request erasure of your personal data in certain circumstances that are described in the General Data Protection Regulation (GDPR). Provided that your request falls within one of these circumstances, we will erase your data.

8.3. Your right to request restrictions

Under certain circumstances as specified in the General Data Protection Regulation (GDPR), you have the right to request restrictions on processing. Where you have this right, such personal data shall, except for storage, only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest.

8.4. Your right to data portability

You have the right in a structured, commonly used and machine-readable format to receive the personal data about you that you have provided and have the right to transmit this data to another controller when such a transfer is technically possible.

8.5. Your right to lodge a complaint

If you are dissatisfied with how we processed your personal data, please contact us. Refer to our contact details in Section 9. You also have the right to submit a complaint about our personal data processing to:

Integritetsskyddsmyndigheten, PO Box 8114, SE-104 20 Stockholm, Sweden, or by e-mail: imy@imy.se.

9. Contact SCA

You can contact us in the following way:

• by the contact form at https://www.sca.com/gdpr (or by e-mail gdpr@sca.com)
• by telephone on +46 60 19 33 30 (Switchboard). ask for Head of Administration GDPR or Legal Counsel.

Ladda ner denna text som pdf

1. Introduktion

Syftet med denna integritetsinstruktion (”Instruktion”) är att informera dig som vårdtagare (nedan ”du”, dig” och ”din(a)”) om den behandling av dina personuppgifter som sker inom ramen för SCA Hälsans (”SCA Hälsan”, ”vi”, ”oss” och ”vår”) verksamhet.

SCA Hälsan är en del av SCA Forest Products AB, org. nr 556379-3586. När vi i denna Instruktion refererar till SCA Hälsan omfattar det därför SCA Forest Products AB. Anställda i SCA Forest Products AB, och i övriga SCA bolag, har möjlighet att vända sig till SCA Hälsan för att ta del av den företagshälsovård som erbjuds den anställde i SCA koncernen som en förmån. SCA Hälsan tar även emot externa patienter. SCA Hälsan är i båda fall personuppgiftsansvarig för dina personuppgifter.

SCA Hälsan behandlar dina personuppgifter i enlighet med vid var tid gällande dataskyddslagstiftning vid all behandling av personuppgifter. Om du har frågor om hur vi samlar in, lagrar och använder dina personuppgifter eller om du vill utöva någon av dina rättigheter enligt gällande dataskyddslagstiftning ber vi dig att ta kontakt med oss, se kontaktuppgifter till SCA Hälsan i punkt 7.

Som privat vårdgivare följer vi både Dataskyddsförordningen (GDPR) och nationell hälso- och sjukvårdslagstiftning som t.ex. Patientdatalagen. Patientdatalagen kompletterar Dataskyddsförordningen (GDPR) och innehåller särskilda bestämmelser för personuppgiftsbehandling och journalföring i hälso- och sjukvården.

2. Vad, varför, och hur länge behandlar vi dina personuppgifter?

2.1. Vad är en personuppgift?

Personuppgifter är all slags information som kan knytas till en levande person. Det kan röra sig om namn, adress, personnummer, testresultat, symtom, diagnoser m.m.

SCA Hälsan behandlar framförallt personuppgifter om hälsa. Personuppgifter om hälsa faller inom den särskilda kategorin ”känsliga personuppgifter”. Att uppgifter om hälsa är känsliga personuppgifter innebär att det gäller särskilt höga krav för behandlingen av dem.

2.2. Vilka personuppgifter behandlar vi och varför?

Vi behandlar följande personuppgifter om dig:

• Namn
• Personnummer
• Adress
• Telefonnummer
• Hälsoinformation (men även information som du väljer att uppge av skäl som hör samman med förebyggande hälso- och sjukvård)
• För dig som är anställd inom SCA koncernen behandlar vi även uppgift om vilken arbetsplats/arbetsenhet du tillhör, din närmaste chef m.m.

Vi behöver spara och behandla dina personuppgifter för att vi ska kunna ge dig en god och säker vård i vår funktion som företagshälsovård, samt för verksamhets- och kvalitetsuppföljning. De närmare skäl till varför vi behandlar dina personuppgifter kan brytas ner i följande:

• utföra drog- och alkoholkontroll i samband med nyanställning och under pågående anställning,
• utföra förebyggande hälsovård och yrkesmedicin,
• utföra hälso- och sjukvård eller behandling,
• tillhandahålla behandlingar i samband med sjukgymnastik, psykoterapi, sjukskrivning och rehabilitering,
• föra journal,
• ställa medicinska diagnoser,
• förskriva och förnya recept på läkemedel, 
• skicka remisser till andra vårdgivare vid behov

2.3. Laglig grund

Vi behandlar dina personuppgifter (inklusive känsliga personuppgifter) med stöd av bestämmelser i Dataskyddsförordningen (GDPR) och Patientdatalagen. Aktuella bestämmelser i Dataskyddsförordningen är allmänt intresse (artikel 6.1 e), alternativt intresseavvägning (artikel 6.1 f), dvs. att behandlingen är nödvändig för vårt berättigade intresse av att kunna tillhandahålla hälso-och sjukvård på ett ändamålsenligt sätt och i enlighet med dina förväntningar som vårdtagare, samt hälso- och sjukvård (artikel 9.1 h och 9.3).

2.4. Hur länge uppgifterna sparas

SCA Hälsan kommer inte att spara dina personuppgifter längre än vad som nödvändigt med hänsyn till de ändamål för vilka de samlats in.

• Som vårdgivare är vi skyldiga att spara uppgifter i patientjournal i minst 10 år efter det att sista uppgiften fördes in i journalen. 
• Räkenskapsmaterial som enligt Bokföringslagen (1999:1078) ska sparas i minst 7 år, sparar vi under denna tid.
• Journaler sparas i pappersform för forskningsändamål i Merlo arkiv. Görs tillgängliga tidigast 50 år efter en persons död.

Vi genomför regelbundna gallringar genom vilka personuppgifter som inte längre är nödvändiga för ändamålet gallras bort.

3. Vilka delar vi dina personuppgifter med?

3.1. Sekretess

Inom hälso- och sjukvården gäller sträng sekretess och tystnadsplikt för uppgifter om hälsotillstånd eller om personliga förhållanden. SCA Hälsan kommer inte att lämna ut dina personuppgifter till obehöriga såvida vi inte har fått ditt uttryckliga samtycke till sådant utlämnande. Om vi skulle behöva överföra eller dela information om din hälsa eller andra personliga förhållanden kommer vi först att be om ditt samtycke.

3.2. Uppgiftsskyldighet

I vissa fall kan vi som vårdgivare vara skyldiga enligt lag eller förordning att lämna ut uppgifter till myndigheter. De författningar som reglerar sådan skyldighet är följande: Patientsäkerhetslagen (2010:659 6 kap § 15).

Utöver vad som annars följer av lag eller förordning är hälso- och sjukvårdspersonalen skyldig att lämna ut sådan uppgift som;

a) gäller huruvida någon vistas på en sjukvårdsinrättning om uppgifterna i ett särskilt fall begärs av en domstol, en åklagarmyndighet, Polismyndigheten, Säkerhetspolisen, Kronofogdemyndigheten eller Skatteverket,

b) behövs i verksamhet för personskydd av riksdagens ledamöter, statschefen och övriga medlemmar av kungahuset, statsråd, statssekreterare och kabinettssekreterare, om uppgifterna i ett enskilt fall begärs av Säkerhetspolisen,

c) behövs för rättsmedicinsk undersökning,

d) Socialstyrelsens råd för vissa rättsliga, sociala eller medicinska frågor behöver för som verksamhet,

e) behövs för prövning av ett ärende om att avskilja en studerande från högskoleutbildning eller polisprogrammet, eller

f) behövs för prövning av någons lämplighet att ha körkort, traktorkort eller taxiförarlegitimation enligt taxitrafiklagen (2012:211, Lag (2014:768)

3.3. Personuppgiftsbiträden

Vad som sägs ovan utesluter inte att en leverantör till oss, så som exempelvis en leverantör av IT-system, kan komma att ha tillgång till dina personuppgifter. Sådan tillgång kommer att begränsas till vad som är nödvändigt och vi har avtal med våra personuppgiftsbiträden som säkerställer att de behandlar dina personuppgifter i enlighet med denna Instruktion och våra instruktioner.

4. Hur skyddar vi dina uppgifter?

Inom hälso- och sjukvården gäller sträng sekretess och tystnadsplikt för uppgifter om hälsotillstånd eller om personliga förhållanden. Vi följer de regler om tystnadsplikt som finns i Patientsäkerhetslagen (2010:659).

Bara den som behöver dina uppgifter i sitt arbete på SCA Hälsan får ta del av dina patientuppgifter. Detta innebär att endast den personal som är inblandad i din vård och behandling, eller som av annat skäl behöver uppgifterna för att fullgöra sitt arbete inom hälso- och sjukvården, får ta del av uppgifter om dina patientuppgifter (s.k. inre sekretess).

Den inre sekretessen på SCA Hälsan upprätthålls genom tekniska lösningar för behörighetstilldelning, åtkomstkontroll och organisatoriska åtgärder.

Vi strävar alltid efter att behandlingen av dina personuppgifter ska ske inom EU/EES. Vi och våra personuppgiftsbiträden behandlar, som huvudregel, dina personuppgifter endast inom EU/EES. Skulle personuppgifter behandlas utanför EU/EES kommer vi att vidta åtgärder för att se till att personuppgifterna fortsätter att vara lika skyddade och även vidta de åtgärder som krävs för att på lagligt sätt överföra personuppgifter till länder utanför EU/EES.

4.1. Automatiserat beslutsfattande

Dina personuppgifter kommer inte bli föremål för beslut som grundar sig på automatiserat individuellt beslutsfattande (inklusive profilering).

5. Du kan påverka hur vi behandlar dina personuppgifter

5.1. Allmänt

Personuppgiftsansvarig är SCA Hälsan, se mer i punkt 1. Du har rätt att kontakta oss om du vill ha ut information om de uppgifter vi har om dig, för att begära rättelse, överföring (dataportabilitet) eller för att begära att vi begränsar behandlingen, för att göra invändningar eller begära radering av dina uppgifter. Detta gör du enklast genom att kontakta oss på de uppgifter som framgår under punkt 7.

I det fall vår personuppgiftsbehandling av dina uppgifter görs med stöd av ditt samtycke har du rätt att när som helst återkalla ditt samtycke.

6. Rättigheter gällande din journal enligt Patientdatalagen

Du har rätt att på din begäran och så snart som möjligt att ta del av uppgifter som finns i din patientjournal, om inte annat följer av 6 kap. 12 § eller 13 § första stycket Patientsäkerhetslagen. Du har även rätt att få en kopia av hela eller delar av patientjournalen.

Du kan i vissa fall ha rätt att få din patientjournal förstörd. Anmälan om förstörelse av patientjournal ska göras till Inspektionen för vård och omsorg.

Om SCA Hälsan skulle vilja göra en journaluppgift tillgänglig för annan vårdgivare genom s.k. sammanhållen journalföring kommer SCA Hälsan först att informera dig om vad det innebär. Sammanhållen journalföring förutsätter ditt samtycke. Om du inte vill att dina journaluppgifter ska vara elektroniskt tillgängliga för en annan vårdgivare, kan du i vissa fall begära att dina uppgifter spärras helt eller delvis för elektronisk åtkomst. Väljer du att spärra dina uppgifter från elektronisk åtkomst kan det få konsekvenser för din vård, exempelvis att du själv kommer få berätta för annan vårdpersonal vad de behöver veta för att ge dig en god och säker vård. Observera att spärr endast kan göras i en elektronisk journal (och inte en pappersburen).

Du har rätt att på din begäran få ta del av information om den direkt- och elektroniska åtkomst som förekommit till din patientjournal, dvs. åtkomsthistoriken.

Om personuppgifter om dig har behandlats i strid med Patientdatalagen och/eller Dataskyddsförordningen (GDPR) kan du ha rätt till skadestånd.

Du har rätt till information om vad som gäller i fråga om sökbegrepp, direktåtkomst och utlämnande av uppgifter på medium för automatiserad behandling.

Du har rätt att skicka in en begäran om radering av journal till IVO – Inspektionen för vård och omsorg. Kontaktuppgifter finns att hitta på deras webbplats www.ivo.se eller via telefon 010-788 50 00. SCA Hälsan agerar sedan utifrån IVOs beslut.

7. Kontaktuppgifter

Du kan kontakta SCA Hälsan via följande kontaktvägar

• telefon: 060-19 41 00, fråga efter Verksamhetschef SCA Hälsan 
• SCA Hälsan, Box 846, SE-851 23 SUNDSVALL, att Verksamhetschef 

Du är också välkommen att besöka oss på SCA Hälsan för mer information.

Om du är missnöjd med hur vi behandlat dina personuppgifter ber vi dig att kontakta oss i första hand, se våra kontaktuppgifter ovan.

Du har även rätt att ge in ett klagomål till:

Integritetsskyddsmyndigheten, Box 8114, 104 20 Stockholm eller via imy@imy.se