Privacy policy

We are committed to safeguard the personal data we process

Metsä Group is committed to safeguard the processing of the personal data of our owners, customers, suppliers, employees, job applicants and other stakeholders in compliance with good data processing practices and applicable legislation. We require the same from our business partners.

Your privacy is important to Metsä Group. This website provides you general information on how Metsä Group collects, uses and protects your personal data. You can also find some general advice about your privacy related rights and how to use them.

The types of personal data we collect

We collect certain personal data about you. “Personal data” is any data that can be used to identify you directly or indirectly.

We collect personal data that you or your employer provides to us when doing business with us, when you request us to send you marketing materials, newsletters or other materials; and when you sign up for events or participate in competitions. The data we collect depends on whether you are our customer, supplier or other stakeholder, but in most cases include at least your name, postal address, e-mail address, language preference, job title and business affiliations.

In some cases your personal data has been supplemented by information retrieved from other sources, including public authorities, searches via publically available search engines, sector-specific newsletters, social media and your employer’s website.

How we process the collected personal data

We use the personal data we collect to carry out and develop business with you or the company you represent, to send you newsletters, marketing materials, invitations to events and for other legitimate reasons which have been described in more detail in our Privacy Statements.

We do not sell, distribute or otherwise make your personal data available to third parties. However, we may share information with our service providers or other suppliers e.g. for the provision of ICT, marketing or other services.

Only the people who need to process personal data in their job role have access to your personal data.

Your rights

You have the right to know what personal data we process about you and may request a copy. You are also entitled to have incorrect personal data corrected and request us to delete your personal data. In certain situations you can also object to personal data processing. It is important to understand that the limitation or deletion of your personal data may mean that we are unable to continue our business relations with you as today. You also have the right to receive your personal data in a machine-readable format and have the data transferred to another party responsible for data processing. To exercise your rights please use the Personal Data Request Form which can be found on this website.

If you are dissatisfied with how we process your personal data, you are entitled to report this to the Finnish data protection authority.

Find out more from Privacy Statements and other privacy materials on this website.

Customer and other stakeholder privacy statements

Privacy statement

Metsä Forest
Privacy statement

Metsä Forest

Updated March 25, 2024

This Metsäliitto Cooperative, Metsä Forest privacy statement (“Privacy Statement”) describes our personal data handling practices including a description of the gathered personal data and how the personal data is processed. The privacy statement may be changed from time to time. The up-to-date version can be always found on our website.

1. Data Controller

Metsäliitto Cooperative, Metsä Forest, registered address of the head office at Revontulenpuisto 2, 02100 Espoo, Finland

Metsä Forest is an auxiliary name of Metsäliitto Cooperative.

2. Contact Person

Metsäliitto Cooperative customer service team
Tel. +358 10 7770
Email: jasenpalvelut@metsagroup.com

3. The purpose and legal ground of processing personal data

Metsäliitto Cooperative processes personal data of its potential and existing customers and members. The personal data is processed in connection with electronic services, wood trade, forest services, investments in members’ capital, payments, invoicing, debt collection and credit checks. In addition the personal data is processed in connection with the data subject’s own contacts, customer surveys, know your customer (KYC) process, development of products and services, quality management, reporting, marketing and personalizing its content and other actions in connection with membership and customership.

Metsäliitto Cooperative receives personal data of forest owners also from the Finnish Forest Centre’s Forest Information System. Metsäliitto Cooperative uses this data for forestry related direct marketing (marketing letters sent by post and telemarketing).

Our legal ground for collecting and processing personal data is 1) legitimate interest based on the customer relationship or a potential customer relationship (for example membership, wood trade or forest service order), or on direct marketing to the contacts received from the Finnish Forest Centre’s Forest Information System, 2) consent, 3) performance of a wood trade or forest service contract or 4) compliance with a legal obligation.

4. Processed Personal Data

Basic information on forest owners received from the Finnish Forest Centre’s Forest Information System:

First and last name

Address, phone number, e-mail address

Language

Municipality where the forest owner’s forest is located, area class of the forest

Basic information on the potential customers received via different contact channels:

First and last name

Address, phone number, e-mail address

Possible information on the real estate for drafting an offer

Basic information on contact persons of industrial customers:

First and last name

Phone number, e-mail address

Work title and role in the Metsä Forest customership (e.g. agreements)

Basic information on the customer or member:

First and last name

Address, phone number, e-mail address

Date of birth or personal id

Business id

Language

Membership registration date and membership resignation date

Member/customer number

Metsäliitto Cooperative’s contact person of the member/customer

Persons authorized by the member/customer

Municipality of residence or other electoral district

Possible administrative body (information whether the person is member of the Cooperative’s District Committee, Representative Council, Supervisory Board or Board of Directors)

Members’ shares and information on interest on members’ capital

Forest owner group and tax information

Bank details

Real estate information

Information on consent and prohibition for marketing

Information if the person has deceased

Forest resource data

Information on possible guardian

Conference and meeting preferences and requests

Other information based on the membership/customership:

Customer level and groups

Sales, purchase, harvesting, transport and forest service transactions and investments in members’ capital

Order confirmations

Payments and credit information

Timber measurement data

Contact/conversation history

Bonus information

Log ins to Metsäverkko service and transactions executed in the service

Forest tax accounting

Results from the internal investigations to the quality of forest operations

Information on roadways and soil preparation

Photographs attached to forest resource data

Requests for offers and offers

Marketing events

Information on and answers to customer and other surveys

Personal data collected in connection with the use of the service / website etc. such as:

Service / website usage

Device information

Log information

IP address

Cookies and similar technologies

5. Regular sources of information

Personal data in the member and customer register is provided mainly by the persons themselves or is collected in connection with wood trade or other member/customer events or when the person registers to Metsäliitto Cooperative’s web services. In addition, data may be received from public sources (such as data received from the Finnish Forest Centre or phone numbers, credit rating and ca-dastre information received from other cooperation partners). Per-sonal data may also be updated from Population Information Sys-tem or from other similar reliable third-party information systems. Finnish Forest Centre discloses data about i.a. new forest owners, forest resource data and forest management proposals in accord-ance with applicable legislation.

6. Regular destinations of disclosed data and whether the data is transferred to countries outside the EU/ EEA

If needed, Metsäliitto Cooperative may disclose personal data in connection with forest certifications to the certification bodies (PEFC certificate: Kestävän Metsätalouden yhdistys ry (KMY ry) and auditing companies supervising the area specific certifications; FSC®- certificate: FSC® International and auditing companies supervising the Metsä Group FSC® group certificate (FSC-C111942)). In addition, personal data may be disclosed to the extent necessary to meet any applicable law, regulation, legal process or enforceable governmental request.

Metsäliitto Cooperative may use external service providers. These service providers (and their possible subcontractors) act as Metsäliitto Cooperative’s data processors. They process personal data on behalf of Metsäliitto Cooperative only for the provision of services to Metsäliitto Cooperative. The service providers have no independent right to use the personal data for any independent purposes.

The personal data is mainly processed within EU/EEA but it may also be processed outside EU/EEA. Metsäliitto Cooperative will only transfer your personal data outside the EU/EEA in accordance with one of the legal grounds described below:

the recipient country is regarded by the European Commission to provide adequate protection for your personal data;

we have put in place appropriate safeguards for the transfer by using the standard contractual clauses for the transfer of personal data to third countries issued by the European Commission; or

you have given your consent to the transfer, or there is another legal basis for the transfer under the applicable data protection legislation.

7. Data Security

Personal data is handled with care and in confidence. The register is only used by personnel whose job requires processing of the personal data.

Paper documents are stored in locked spaces where access is granted only to people who need it.

All personal data is protected by regularly reviewed appropriate technical and organisational data security measures against accidental and/or unlawful access, alteration, destruction or other processing including unauthorized disclosure and transfer. Such measures include proper firewall arrangements, appropriate encryption of telecommunication and messages, secure server rooms and up-to-date ICT system access management practices.

8. Your rights

You have the right to:

access, update, remove and correct your personal data;

cancel your consent, where the processing of personal data is based on your consent (Metsäliitto Cooperative’s newsletter or electronic marketing)

object to the use of your personal data on grounds relating to your particular situation when our legal ground for processing your personal data is our legitimate interest (including the right to object the processing of your personal data for direct marketing purposes);

demand Metsäliitto Cooperative to restrict the processing of your personal data; and

receive your personal data in machine-readable format and transfer such information to another data controller, where you have provided the personal data to Metsäliitto Cooperative and where the processing of such information is based on your consent or a contract between you and Metsäliitto Cooperative.

You can exercise any of your rights above by contacting Metsäliitto Cooperative via our privacy website https://www.metsagroup.com/privacy-policy/. Alternatively you may visit us in person or contact us by post/email at the address set out below. Metsäliitto Cooperative may request you to specify your request in writing and authenticate your identity before handling your request.

Requests shall be submitted in writing to:
Metsäliitto Cooperative
Member services
jasenpalvelut@metsagroup.com

Revontulenpuisto 2
02100 Espoo
Finland

Request can be submitted in person at:
Revontulenpuisto 2
02100 Espoo
Finland

Please note that we may not be able to execute all your rights if we have a legal ground for it.

If you are unhappy with the way we process your personal data, you have a right to make a complaint to the competent supervisory authority, who is responsible for monitoring compliance with the applicable data protection legislation. In Finland the competent supervisory authority is the Data Protection Ombudsman (tietosuoja(at)om.fi).

9. Data retention policy

Personal data is actively maintained throughout the life-cycle of the co-operation in question. Personal data is retained only as long as necessary and justifiable or as required by applicable legislation or for the exercise of claims or litigations or internal investigations. Metsäliitto Cooperative has defined data retention principles and personal data shall be deleted regularly in accordance with the principles.

Metsäliitto Cooperative retains personal data of forest owners received from the Finnish Forest Centre’s Forest Information System for two years after which the data shall be deleted unless the forest owner has not become a customer of Metsäliitto Cooperative.
Privacy statement

Metsä Wood
Privacy statement

Metsä Wood

Updated 09.05.2023

This privacy statement describes how Metsäliitto Cooperative (Metsä Wood) processes personal data of its corporate customers’ and other stakeholders’ representatives. The privacy statement may be changed from time to time. The up-to-date version can be always found on our website.

1. Data Controller

Metsäliitto Cooperative, Metsä Wood, registered address of the head office at Revontulenpuisto 2, 02100 Espoo, Finland (hereinafter ‘’Metsä Wood’’)
Metsä Wood is an auxiliary name of Metsäliitto Cooperative.

2. Contact Person

Please contact by e-mail
privacy@metsagroup.com

3. The purpose and legal basis of processing personal data

The register contains personal data of Metsä Wood’s potential and existing customers’ and other stakeholders’ representatives.

The personal data is processed in connection with customer and stakeholder management activities as well as in connection with the registration for Metsä Wood’s online services and their use (e.g. metsawood.online, Wood Academy and Finnwood software).

Metsä Wood uses personal data for supporting its business analysis and operations, business intelligence, customer surveys, know your customer (KYC) process, reporting, invoicing, delivery of products and services, quality management, improving products and services, personalizing content and marketing.

Our legal basis for collecting and processing personal data is our legitimate interest based on the potential or existing business/stakeholder relationship.

4. Processed Personal Data

Metsä Wood processes the following personal data:

Name

Street address, postal code, city, country

Phone number

E-mail address

Organisation

Education

Job Title / Role / Role classifications (e.g. decision maker or top manager)

Language

Conference and meeting preferences and requests

Contact preferences (phone/email/mail restrictions)

Indicator of access to Metsä Wood’s digital platforms

Customer survey communication prohibition

Consent or prohibition for marketing

Personal data collected in connection with the use of the Metsä Wood web service, website or software etc. such as:

Service / website / software usage and statistics on the use preferences

Device information

Log information

IP address

Location data (country level)

Cookies and similar technologies

5. Regular sources of data

Personal data is mainly provided by the data subjects themselves upon the commencement of or during the co-operation. Personal data is also collected by Metsä Wood in connection with the use of Metsä Wood’s or its group companies’ websites or online services by the registered person.

6. Regular destinations of disclosed data and whether the data is transferred to countries outside the EU/ EEA

Metsä Wood does not disclose personal data to unauthorized third parties. Metsä Wood collaborates with different partners operating in the construction field. Metsä Wood may within the framework of cooperation disclose customer’s contact information to its partner, if the customer is aware and wants the personal data to be disclosed to such partner. Metsä Wood may also disclose personal data to authorities or other third parties, if required by applicable legislation or enforceable governmental request.
Metsä Wood may use external service providers. These service providers and their possible subcontractors act as Metsä Wood’s data processors. They process personal data on behalf of Metsä Wood only for the provision of services to Metsä Wood. The service providers have no independent right to use the personal data for any independent purposes.

The personal data can be processed within EU/EEA and outside EU/EEA. Metsä Wood will only transfer your personal data outside the EU/EEA in accordance with one of the legal grounds described below:

the recipient country is regarded by the European Commission to provide adequate protection for your personal data;

we have put in place appropriate safeguards for the transfer by using the standard contractual clauses for the transfer of personal data to third countries issued by the European Commission; or

you have given your consent to the transfer, or there is another legal basis for the transfer under the applicable data protection legislation.

7. Data Security

Personal data is handled with care and in confidence. Personal data is only used by personnel whose work tasks requires processing of the personal data.

Systems that include personal data require login to the register by either giving personal user ID and password, or by utilizing single-sign on technology. User rights require separate approval from nominated Metsä Wood personnel.

All personal data is protected by regularly reviewed appropriate technical and organisational data security measures against unlawful access, alteration, destruction or other processing including unauthorized disclosure and transfer. Such measures include proper firewall arrangements, appropriate encryption of telecommunication and messages, secure server rooms and up-to-date ICT system access management practices.

8. Your rights

You have the right to:

access, update, remove and correct your personal data;

object to the use of your personal data on grounds relating to your particular situation; and

demand Metsä Wood to restrict the processing of your personal data.

You can exercise any of your rights above by contacting Metsä Wood via our privacy website https://www.metsagroup.com/privacy-policy/.

Alternatively you may visit us in person or contact us by post at the address set out below. Metsä Wood may request you to specify your request in writing, and if necessary authenticate your identity before handling your request.

Requests shall be submitted in writing to:

Metsäliitto Cooperative, Metsä Wood
Attn: Legal Services
Revontulenpuisto 2
02100 Espoo
Finland

Request can be submitted in person at:

Revontulenpuisto 2
020100 Espoo
Finland.

Please note that we may not be able to execute your rights if we have a legal ground for it.

If you are unhappy with the way we process your personal data, you have a right to make a complaint to the competent supervisory authority, who is responsible for monitoring compliance with the applicable data protection legislation. In Finland the competent supervisory authority is the Data Protection Ombudsman (tietosuoja(at)om.fi).

9. Data retention policy

Personal data is retained only as long as necessary and justifiable under applicable law or as may be required by applicable law or for the exercise of claims or due to litigations or internal investigations.

Metsä Wood’s customers’ and stakeholders’ personal data is actively maintained throughout the life-cycle of the co-operation in question.
Privacy statement

Metsä Fibre
Privacy statement

Metsä Fibre

Updated 09.05.2023

This customer and stakeholder privacy statement describes how Metsä Fibre processes personal data of its corporate customers’ and other stakeholders’ representatives. The privacy statement may be changed from time to time. The up-to-date version can be always found on our website.

1. Data Controller

Metsä Fibre Oy (hereinafter “Metsä Fibre”) registered address of the head office at Revontulenpuisto 2, 02100 Espoo, Finland.

2. Contact information

Please contact by e-mail:
privacy@metsagroup.com

3. The purpose and legal ground of processing personal data

Metsä Fibre processes personal data of Metsä Fibre’s customers’ and stakeholders’ representatives. Metsä Fibre uses the personal data for customer and stakeholder management activities and for supporting its business analysis and operations, business intelli-gence, customer surveys, know your customer (KYC) process, reporting, invoicing, delivery of products, quality management, improving products and services, personalizing content and marketing.

Personal data is also processed in connection with the registration for Metsä Fibre’s online services and their use (e.g. Metsä Pulp Online and Metsä Timber Online).

Our legal ground for collecting and processing personal data is our legitimate interest based on the potential or existing business relationship.

4. Processed Personal Data

We may process the following data:

Name

Address

Phone number

E-mail address

Organisation

Education

Job Title / Role / Role classifications (e.g. decision maker, top manager; department where the person works)

Language

Conference and meeting preferences and requests

Contact preferences (phone/email/mail restrictions)

Indicator of access to Metsä Fibre’s digital platforms

Customer survey communication prohibition

Consent or prohibition for marketing

Personal data collected in connection with the use of the service / website etc. such as:

Service / website usage; statistics on the use preferences

Device information

Log information

IP address

Location information (country level information)

Cookies and similar technologies

5. Regular sources of data

Personal data is mainly provided by the persons themselves upon the start of or during the co-operation with Metsä Fibre. Personal data is also collected by Metsä Fibre in connection with the use of Metsä Fibre’s or its group companies’ websites or online services by the registered person.

6. Regular destinations of dis-closed data and whether the data is transferred to coun-tries outside the EU/ EEA

Metsä Fibre does not disclose personal data to unauthorized third parties. Metsä Fibre may disclose your personal data to the extent necessary to meet any applicable law, regulation, legal process or enforceable governmental request.

Metsä Fibre may use external service providers. These service providers (and their possible subcontractors) act as Metsä Fibre’s data processors. They process personal data on behalf of Metsä Fibre only for the provision of services to Metsä Fibre. The service providers have no independent right to use the personal data for any independent purposes.

The personal data is mainly processed within the EU/EEA but in can also be processed outside EU/EEA. Metsä Fibre will only transfer your personal data outside the EU/EEA in accordance with one of the legal grounds described below:

the recipient country is regarded by the European Commission to provide adequate protection for your personal data;

we have put in place appropriate safeguards for the transfer by using the standard contractual clauses for the transfer of personal data to third countries issued by the European Commission; or

you have given your consent to the transfer, or there is another legal basis for the transfer under the applicable data protection leg-islation.

7. Data Security

Personal data is handled with care and in confidence. Personal data is processed only by personnel whose job requires processing of the personal data.

Processing requires the use of a personal user ID and password or single-sign on technology. User rights require separate approval from nominated Metsä Fibre personnel.

All personal data is protected by regularly reviewed appropriate technical and organisational data security measures against accidental and/or unlawful access, alteration, destruction or other processing including unauthorized disclosure and transfer. Such measures include proper firewall arrangements, appropriate encryption of telecommunication and messages, secure server rooms and up-to-date ICT system access management practices.

8. Your rights

You have the right to:

access, update, remove and correct your personal data;

object to the use of your personal data on grounds relating to your particular situation; and

demand Metsä Fibre to restrict the processing of your personal data.

You can exercise any of your rights above by contacting Metsä Fibre via our privacy website https://www.metsagroup.com/privacy-policy/. Alternatively you may visit us in person or contact us by post at the ad-dress set out in this section. Metsä Fibre may request you to specify your request in writing and authenticate your identity before handling your request.

Requests shall be submitted in writing to:

Metsä Fibre Oy
Attn: Legal Services
Revontulenpuisto 2
02100 Espoo
Finland

Request can be submitted in person at:

Revontulenpuisto 2
02100 Espoo

Please note that we may not be able to execute your rights if we have a legal ground for it.

If you are unhappy with the way we process your personal data, you have a right to make a complaint to the competent supervisory authority, who is responsible for monitoring compliance with the applicable data protection legislation. In Finland the competent supervi-sory authority is the Data Protection Ombudsman (tieto-suoja(at)om.fi).

9. Data retention policy

Metsä Fibre’s customers’ and stakeholders’ personal data is actively maintained throughout the life-cycle of the co-operation in question.

Personal data is retained only as long as necessary and justifiable or as required by applicable legislation, for the exercise of claims or due to litigations or internal investigations.
Privacy statement

Metsä Board
Privacy statement

Metsä Board

Updated 09.05.2023

This privacy statement describes how Metsä Board processes personal data of its corporate customers’ and other stakeholders’ representatives. The privacy statement may be changed from time to time. The up-to-date version can be always found on our website.

1. Data Controller

Metsä Board Oyj (hereinafter “Metsä Board”), registered address of the head office at Revontulenpuisto 2, 02100 Espoo, Finland

2. Contact Person

Please contact by e-mail
privacy@metsagroup.com

3. The purpose and legal ground of processing personal data

The register contains personal data of Metsä Board’s potential and existing customers’ and stakeholders’ contact persons and other representatives. Metsä Board uses the personal data collected in connection with customer and stakeholder relationship management activities and for supporting its business analysis and operations, business intelligence, customer surveys, know your customer (KYC) process, reporting, invoicing, deliver of products, quality manage-ment, improving products and services, personalizing content and marketing.

Personal data is also processed in connection with the registration for Metsä Boards’s online services and their use (e.g. Metsä Board Online).

Our legal ground for collecting and processing personal data is our legitimate interest based on the potential or existing business or stakeholder relationship.

4. Processed Personal Data We may process the following personal data:

Name

Office address, postal code, city, country

Work phone number

E-mail address

Organization

Job title and role and role classifications (e.g. decision maker, top manager)

Language

Gender (for the purposes of customer communication salutation in certain countries)

Conference and meeting preferences and requests

Indicator of access to Metsä Board’s digital platforms

Customer survey communication prohibition

Consent or prohibition for marketing

Contact requests via our website or other channels

Personal data collected in connection with the use of a web service / website etc. such as:

Service / website usage and statistics on the use preferences;

Device information;

Log information;

IP address;

Location data (country level)

Cookies and similar technologies;

5. Regular sources of in-formation

Personal data is mainly provided by the data subjects themselves upon the commencement of or during the co-operation with Metsä Board. Personal data is also collected by Metsä Board in connection with the use of Metsä Board’s or its group companies’ websites or online services by the registered person.

6. Regular destinations of disclosed data and whether the data is trans-ferred to countries out-side the EU/ EEA

Metsä Board does not disclose personal data to unauthorized third parties. Metsä Board may disclose personal data to authorities or other third parties, if required by applicable legislation.

Metsä Board may use external service providers. These service providers (and their possible subcontractors) act as Metsä Board’s data processors. They process personal data on behalf of Metsä Board only for the provision of services to Metsä Board. The ser-vice providers have no independent right to use the personal data for any independent purposes.

The personal data is mainly processed within the EU/EEA but it may be processed also outside the EU/EEA. Metsä Board will only transfer your personal data outside the EU/EEA in accordance with one of the legal grounds described below:

the recipient country is regarded by the European Commission to provide adequate protection for your personal data;

we have put in place appropriate safeguards for the transfer by using the standard contractual clauses for the transfer of personal data to third countries issued by the European Commission; or

you have given your consent to the transfer, or there is another legal basis for the transfer under the applicable data protection legislation.

7. Data Security

Personal data is handled with care and in confidence. The personal data is only used by personnel whose job requires processing of the personal data.
All personal data is protected by regularly reviewed appropriate technical and organizational data security measures against accidental and/or unlawful access, alteration, destruction or other processing including unauthorized disclosure and transfer. Such measures include proper firewall arrangements, appropriate encryption of telecommunication and messages, secure server rooms and up-to-date ICT system access management practices. Paper documents are stored in locked premises with access only on a need-to-know basis.

8. Your rights

You have the right to:

access, update, remove and correct your personal data;

object to the use of your personal data on grounds relating to your particular situation; and

demand Metsä Board to restrict the processing of your personal data.

You can exercise any of your rights above by contacting Metsä Board via our privacy website https://www.metsagroup.com/privacy-policy/.

Alternatively you may visit us in person or contact us by post at the address set out in this section. Metsä Board may request you to specify your request in writing and authenticate your identity before handling your request.

Requests shall be submitted in writing to:

Metsä Board Oyj
Attn: Legal Services
Revontulenpuisto 2
02100 Espoo
Finland

Request can be submitted in person to:

Revontulenpuisto 2
02100 Espoo
Finland

Please note that we may not be able to execute your rights if we have a legal ground for it.

If you are unhappy with the way we process your personal data, you have a right to make a complaint to the competent supervisory au-thority, who is responsible for monitoring compliance with the appli-cable data protection legislation. In Finland the competent supervi-sory authority is the Data Protection Ombudsman (tieto-suoja(at)om.fi).

9. Data retention policy

Personal data is retained only as long as necessary and justifiable under applicable law or as may be required by applicable law or for the exercise of claims or due to litigations or internal investigations.

Metsä Board’s customers’ and stakeholders’ personal data is actively maintained throughout the life-cycle of the co-operation in question.
Privacy statement

Metsä Tissue
Privacy statement

Metsä Tissue

Updated 09.05.2023

This privacy statement describes how Metsä Tissue processes personal data of its corporate customers’ and other stakeholders’ representatives. The privacy statement may be changed from time to time. The up-to-date version can be always found on our website.

1. Data Controller

Metsä Tissue Oyj (hereinafter “Metsä Tissue”) registered address of the head office at Revontulenpuisto 2, 02100 Espoo, Finland.

2. Contact Person

Please contact by e-mail:
privacy@metsagroup.com

3. The purpose and legal ground of processing personal data

Metsä Tissue processes personal data of their customers’ and other stakeholders’ representatives. Metsä Tissue uses the personal data collected in connection with customer and stakeholder management activities and for supporting its business analysis and operations, business intelligence, customer surveys, know your customer (KYC) process, reporting, invoicing, delivery of products, quality management, improving products and services, personalizing content and marketing.

Our legal ground for collecting and processing personal data is legitimate interest based on the potential or existing business relationship.

4. Processed Personal Data

Metsä Tissue may process the following personal data:

Name

Street address, postal code, city, country

Phone number

E-mail address

Organisation

Education

Job Title / Role / Role classifications (e.g. decision maker or top manager)

Language

Conference and meeting preferences and requests

Contact preferences (phone/email/mail restrictions)

Indicator of access to Metsä Tissue’s digital platforms

Customer survey communication prohibition

Consent or prohibition for marketing

Contact requests via our websites or other channels

Personal data collected in connection with the use of online service / website etc. such as:

Service / website usage and statistics on the use preferences

Device information

Log information

IP address

Location information (country code)

Cookies and similar technologies

5. Regular sources of data

Personal data is provided mainly by the persons themselves upon the start of or during the co-operation with Metsä Tissue. Personal data is also collected by Metsä Tissue in connection with the use of Metsä Tissue’s or its group companies’ websites or online services by the person.

6. Regular destinations of dis-closed data and whether the data is transferred to coun-tries outside the EU/EEA

Metsä Tissue does not disclose personal data to unauthorized third parties. Metsä Tissue may disclose personal data to authorities or other third parties, if required by applicable legislation, legal process or enforceable governmental request.

Metsä Tissue may use external service providers. These service providers (and their possible subcontractors) act as Metsä Tissue’s data processors. They process personal data on behalf of Metsä Tissue only for the provision of services to Metsä Tissue. The service providers have no independent right to use the personal data for any independent purposes.

The personal data is mainly processed within the EU/EEA but it may also be processed outside the EU/EEA. Metsä Tissue will only transfer your personal data outside the EU/EEA in accordance with one of the legal grounds described below:

the recipient country is regarded by the European Commission to provide adequate protection for your personal data;

we have put in place appropriate safeguards for the transfer by using the standard contractual clauses for the transfer of personal data to third countries issued by the European Commission; or

you have given your consent to the transfer, or there is another legal basis for the transfer under the applicable data protection leg-islation.

7. Data Security

Personal data is handled with care and in confidence. Personal data is processed only by personnel whose job requires processing of the personal data.

All personal data is protected by regularly reviewed appropriate technical and organisational data security measures against accidental and/or unlawful access, alteration, destruction or other processing including unauthorized disclosure and transfer. Such measures include proper firewall arrangements, appropriate encryption of telecommunication and messages, secure server rooms and up-to-date ICT system access management practices. Paper docu-ments are stored in locked premises with access only on a need-to-know basis.

8. Your rights

You have the right to:

access, update, remove and correct your personal data;

object to the use of your personal data on grounds relating to your particular situation; and

demand Metsä Tissue to restrict the processing of your personal data.

You can exercise any of your rights above by contacting Metsä Tissue via our privacy website https://www.metsagroup.com/privacy-policy/.

Alternatively you may visit us in person or contact us by post at the address set out in this section. Metsä Tissue may request you to specify your request in writing and authenticate your identity before handling your request.

Requests shall be submitted in writing to:

Metsä Tissue Oyj
Attn: Legal Services

Revontulenpuisto 2
02100 Espoo
Finland.

Request can be submitted in person at:

Revontulenpuisto 2
02100 Espoo
Finland.

Please note that we may not be able to execute your rights if we have a legal ground for it.

If you are unhappy with the way we process your personal data, you have a right to make a complaint to the competent supervisory authority, who is responsible for monitoring compliance with the applicable data protection legislation. In Finland the competent supervisory authority is the Data Protection Ombudsman (tieto-suoja(at)om.fi).

9. Data retention policy

Personal data is retained only as long as necessary and justifiable or as required by applicable legislation, or for the exercise of claims or due to litigations or internal investigations. Personal data is actively maintained throughout the life-cycle of the co-operation in question.

Other privacy statements

Privacy statement

Compliance and Ethics Channel
Privacy statement

Compliance and Ethics Channel

Updated 09.05.2023

This Metsä Group privacy statement describes our personal data handling practices including a description of the collected personal data and how the personal data is processed. This privacy statement may be changed without prior notice to the extent possible under the applicable legislation.

1. Data controller

Metsäliitto Cooperative (hereinafter “Metsä Group”), registered address of the head office at Revontulenpuisto 2, 02100 Espoo, Finland.

Depending on the applicable national legislation regarding the Whistleblowing Directive ((EU) 2019/1937), Metsä Group’s local legal entities may also act as controllers of personal data for the cases reported under the said directive.

2. Contact person

Please contact by e-mail:
privacy@metsagroup.com

3. The purpose for processing personal data

Metsä Group Compliance and Ethics Channel (“Channel”) provides an opportunity to report suspicions of misconduct; anything that is breaching the law or is not in line with Metsä Group’s values or Metsä Group’s Code of Conduct. The Channel is also to be used in connection with the so called Whistleblowing Directive for reporting any violations of European Union and/or national laws under the scope of the directive. Personal data may be processed in connection with the Channel while notifications/reports are being sent via the Channel. The personal data will only be processed for handling the reports and reacting on the possible wrongdoings.

Our legal basis for collecting and processing personal data is either i) Metsä Group’s legal obligation under the Whistleblowing Directive and its implementing national legislation or ii) legitimate interest based on 1. Metsä Group’s obligation to ensure compliance with applicable legislation, 2. Metsä Group’s continuous efforts to promote an open, safe and ethical business environment and 3. the vendor/customer/employment/other stakeholder relationship between Metsä Group and the data subjects.

5. Processed personal data

When using the Channel for reporting, personal data may be received via the Channel by Metsä Group on i) people who make the report and ii) people whose claimed misconduct is being reported. The report may be done anonymously. However, we encourage the reporters to leave their contact details for the efficient processing of the matter. We do not intend to process any special categories of personal data (such as data related to an individual’s health, race, religion or political opinions).

The personal data received via the Channel may include for example the following personal data:

first and last name

language

contact details (e.g. email, phone number)

role and job title

gender

details on the reported misconduct

6. Regular sources of information

Data is collected via the Channel when a person makes a report/notification on a certain misconduct one has experienced or notified, and during the further investigation process. During the investigation, the individuals may be contacted and further details may be asked from him/her and the accuracy of the personal data may be checked (if the individuals are identifiable from the report).

7. Regular destinations of disclosed data and whether the data is transferred to countries outside the EU/ EEA

Metsä Group does not disclose personal data to unauthorized third parties. Metsä Group may disclose personal data to authorities or other third parties, if required by the investigation or applicable legislation.

Metsä Group uses an external service provider to provide the Channel. The service provider and its subcontractors act as data processors of Metsä Group and the personal data will be processed by such service providers only for the provision of services to Metsä Group and on behalf of Metsä Group.

Metsä Group may process personal data in such jurisdictions Metsä Group has presence. Therefore, the personal data may be processed within EU/EEA and outside EU/EEA. Metsä Group will only transfer your personal data outside the EU/EEA in accordance with one of the legal bases described below:

the recipient country is regarded by the European Commission to provide adequate protection for your personal data;

we have put in place appropriate safeguards for the transfer by using the standard contractual clauses for the transfer of personal data to third countries issued by the European Commission; or

you have given your consent to the transfer, or there is another legal basis for the transfer under the applicable data protection legislation.

8. Data security

Personal data is handled with care and in confidence. The register is only used by restricted personnel whose duties include the investigation of any misconduct reported via the Channel. That is mainly done by the Metsä Group Compliance Committee and/or local specifically nominated persons. The reports received via the Channel are strictly confidential.

The access to the register in the Channel is password protected. Access rights are based on Metsä Group’s strict protocol and assessed regularly.

All personal data is protected by regularly reviewed appropriate technical and organisational data security measures against accidental and/or unlawful access, alteration, destruction or other processing including unauthorized disclosure and transfer. Such measures include proper firewall arrangements, appropriate encryption of messages, secure server rooms and up-to-date ICT system access management practices.

9. Data subject rights

You have the right to:

access, update, remove and correct your personal data;

object to the use of your personal data on grounds relating to the particular situation when our legal ground for processing your personal data is our legitimate interest;

demand Metsä Group to restrict the processing of your personal data.

The rights above may be exercised via our privacy website https://www.metsagroup.com/privacy-policy/ or by visiting us in person or contacting by post at the address set out in this section 9. Metsä Group will always authenticate your identity before handling the request.

Please note that your right may be refused if the processing of your personal data is necessary for the ongoing investigation of any claimed misconduct or for Metsä Group’s legal obligations under the Whistleblowing Directive or other applicable legislation.

If you are unhappy with the way we process your personal data, you have the right to make a complaint to the competent supervisory authority, who is responsible for monitoring compliance with the applicable data protection legislation.

Requests shall be submitted in writing to:

Metsäliitto Cooperative
Attn: Legal Services
Revontulenpuisto 2
02100 Espoo
Finland.

Request can be submitted in person at:

Revontulenpuisto 2
020100 Espoo
Finland.

10. Data retention

Personal data is retained only as long as necessary and justifiable for the purposes of handling the reports via the Channel, internal investigations or litigations or as required by applicable national legislation. The retention times are assessed regularly.
Privacy statement

Vendors
Privacy statement

Vendors

Updated 09.05.2023

This Metsä Group vendor register privacy statement (“Privacy Statement”) describes our personal data handling practices including a description of the gathered personal data and how the personal data is processed. This Privacy Statement may be changed from time to time. Up-to-date version can always be found on our website.

1. Data Controller

Metsäliitto Cooperative and its subsidiaries (hereinafter “Metsä Group”), registered address of the head office at Revontulenpuisto 2, 02100 Espoo, Finland

2. Contact Person

Please contact by e-mail:
privacy@metsagroup.com

3. Name of the Register

Metsä Group vendor, contract and vendor contact person register (“Register”).

4. The purpose for processing personal data

Personal data of the contact persons of Metsä Group’s product and service vendors is processed in connection with Metsä Group vendor management activities such as planning, organizing and following-up vendor meetings. Additionally, such personal data is processed when e-signing and storing vendor agreements in the Register and in connection with surveys and vendor claim handling process. Vendors using Metsä Group’s Vendor Portal can see their own contact person information.

In Metsäliitto Cooperative’s (Metsä Forest’s) supplier portal (Toimit-tajaverkko) also personal data of suppliers’ employees is collected in connection with working in Metsäliitto Cooperative’s forest sites. This is necessary for ensuring the work safety of the employees, resource planning and complying with Metsäliitto Cooperative’s legal obligations.

Our legal ground for collecting and processing personal data is the i) legitimate interest based on the supplier relationship initiated between us and you or, in case of Metsäliitto Cooperatives’ forest site suppliers’ employees, other substantive connection between the parties, and ii) in connection with Metsäliitto Cooperative’s forest site suppliers’ employees, compliance with legal obligations related to work safety.

5. Processed Personal Data

We process vendor contact person data such as:

Contact person first and last name

Contact person language

Contact person contact details (email, phone number and com-pany address)

Contact person role and job title

Conference and meeting preferences and requests

Customer survey communication prohibition

Personal data of suppliers’ employees working at Metsäliitto Cooperative’s forest sites:

First and last name

Language

Information on whether the person is adult or underaged

Email address and phone number

Job title

Tax number

In case of emergency, the contact details of the so called ICE contact person

Required competencies (such as work safety card)

If the person is acting as a part time entrepreneur, also business id, company name and tax number

Possible data related to forest site accidents at work or other quality or environmental anomalies (these data are retained separately and accessed only to a very restricted amount of persons whose duties require processing of such data)

Documents proving the foreign worker's right to work, such as passport/ID card, official travel document, residence permit card, certificate of pending application for residence permit.

In the case of posted workers, the identity of the representative of the company to be posted.

6. Regular sources of information

Data is collected in connection with Metsä Group’s vendor management and sourcing activities, questionnaires, vendor claim handling process and directly from the contact persons of the vendors. Source of the vendor master data is Metsä Group’s centralized vendor master data database. The data of suppliers’ employees working at forest sites is collected from each supplier.

7. Regular destinations of disclosed data and whether the data is transferred to countries outside the EU/ EEA

Metsä Group does not disclose personal data to unauthorized third parties. Metsä Group may disclose personal data to authorities or other third parties, if required by applicable legislation, legal pro-cesses or enforceable governmental request.

Metsä Group may share the personal information with third parties Metsä Group has engaged to provide services. These companies are contractually bound to use any personal data disclosed to them only to perform the contracted services. Such service providers do not have the right to utilize the personal data for their own, inde-pendent purposes.

The personal data can be processed within EU/EEA and outside EU/EEA. Metsä Group will only transfer your personal information outside the EU/EEA in accordance with one of the legal grounds described below:

the recipient country is regarded by the European Commission to provide adequate protection for your personal information;

we have put in place appropriate safeguards for the transfer by using the standard contractual clauses for the transfer of personal information to third countries issued by the European Commission; or

you have given your consent to the transfer, or there is another legal basis for the transfer under the applicable data protection leg-islation.

8. Data Security

Personal data is handled with care and in confidence. Personal data is only used by personnel whose job requires executing vendor management and processing personal data related thereto.

Users login to by either giving their personal user ID and password, or by utilizing single-sign on technology. Users have defined roles in what they can see and what type of tasks they can execute. User rights are based on Metsä Group organizational structure and sourc-ing category responsibilities.

User administration is handled and kept up to date centrally against Metsä Group centralized identity management system. User rights require separate approval from nominated Metsä Group business area approvers.
All personal data is protected by regularly reviewed appropriate technical and organisational data security measures against accidental and/or unlawful access, alteration, destruction or other processing including unauthorized disclosure and transfer. Such measures include proper firewall arrangements, appropriate encryption of telecommunication and messages, secure server rooms and up-to-date ICT system access management practices.

9. Right of access

You have the right to:

access, update, remove and correct your personal data;

object to the use of your personal data on grounds relating to the particular situation when our legal ground for processing your personal data is our legitimate interest;

demand Metsä Group to restrict the processing of your personal data.

The rights above may be exercised via our privacy website https://www.metsagroup.com/privacy-policy/ or by visiting us in person or contacting by post at the address set out in this section. Metsä Group may ask you to give further details on your request and may authenticate your identity before handling the request, if needed.

If you are unhappy with the way we process your personal data, you have the right to make a complaint to the competent supervisory authority, who is responsible for monitoring compliance with the applicable data protection legislation. In Finland the competent authority is the Data Protection Ombudsman (tietosuoja(at)om.fi)

Requests shall be submitted in writing to:

Metsäliitto Cooperative
Attn: Legal Services
Revontulenpuisto 2
02100 Espoo
Finland.

Request can be submitted in person at:

Revontulenpuisto 2
020100 Espoo
Finland.

10. Data retention policy

Personal data is retained only as long as necessary and justifiable or as required by applicable legislation, or for the exercise of claims, or due to litigations or internal investigations.

Metsä Group vendors’ contact persons’ data is maintained through-out the life-cycle of Metsä Group and vendor co-operation.

11. What else you should know

Personal data of vendors’ contact persons may be used by Metsä Group also for survey purposes.

If you wish us not to use your personal data for such purposes, please inform us in writing:

Metsäliitto Cooperative
Purchasing
Krista Hurskainen
P.O. BOX 10
02020 Metsä, Finland
krista.hurskainen(at)metsagroup.com
Privacy statement

Recruitment
Privacy statement

Recruitment

Updated 09.05.2023

This Metsä Group recruitment privacy statement (“Privacy Statement”) describes our personal data handling practices including a description of the gathered personal data and how the personal data is processed. This Privacy Statement may be changed without prior notice to the extent possible under the applicable legislation.

1. Data Controller

The local legal entity acting as the employer and Metsäliitto Cooperative (the ultimate parent company of Metsä Group) each as an independent data controller (hereinafter “Metsä Group”), registered address of the head office at Revontulenpuisto 2, 02100 Espoo, Finland.

2. Contact Person

Please contact by e-mail:
workday@metsagroup.com

3. Name of the register

Metsä Group recruitment (“Register”)

4. The purpose and legal basis of processing personal data

The Register contains personal information that is provided during the recruitment and selection process.

Metsä Group uses the personal data collected in connection with the recruitment process to communicate with the applicant, to manage Metsä Group's recruiting and hiring processes, and for compliance with legal and regulatory requirements. In case the applicant is hired, the data is used for lifecycle management of the employment.

Our legal basis for the collecting and processing personal data is 1) our legitimate interest based on the recruiting process relationship initiated between Metsä Group and applicant; and 2) consent provided by job applicant. Additionally, in some countries consent is required for specific purposes such as recruitment related drug testing or security clearances.

5. Personal data to be processed

The Register consists of a database which includes the following information entered or provided by each job applicant:

Required information:

Name

Contact information: Street address, postal code, city, country, phone number, email address

Language skills

Attached files (e.g. CV, application letter, certificates)

Optional information requested to determine the applicant's competence and suitability:

Education

Job applicant’s job interests

Job applicant’s working history (including information on whether the person has previously worked for Metsä Group)

Other skills relevant to the job (such as IT skills, information of driving license)

Working hours and availability (e.g. possible starting date)

Salary expectation

Referees

Gender (asked only for reporting on the implementation of equality)

The following information will also be collected during the recruitment process:

Actions performed for the job applicant (e.g. information on the stage of the recruitment process)

Possible video interview material

Information from a possible applicant assessment

Information on suitability for work in connection with a medical examination before hiring

Depending on the recruitment, the application form might also include an open text field in which the applicants are asked to briefly tell about themselves and any relevant information related to the position applied for. Also, the form can include additional, recruitment specific questions.

In some recruitment processes, Metsä Group uses the so-called anonymous recruitment. In such processes, some of the applicant's personal information is masked in the beginning of the recruitment process.

Read more about anonymous recruitment: https://www.metsagroup.com/careers/work-with-us/anonymous-recruitment/

6. Regular sources of information

Personal data is provided by the registered persons themselves upon the recruitment process. Personal data might also be collected in connection with possible applicant assessments, referees, authorized third parties (such as recruitment partners) and medical examination.

7. Regular destinations of disclosed data and data transfers to countries outside the EU/ EEA

Metsä Group does not disclose personal data to third parties without permission. Metsä Group may disclose personal data to authorities or other third parties if this is necessary, for example, due to applicable legislation or an enforceable request from an authority.

Metsä Group may share personal information with third parties that provide services to Metsä Group. These companies have contractually agreed to process personal data only on behalf of Metsä Group and for the performance of separately agreed contracted services. Such service providers do not have an independent right to use the personal data for their own purposes.

The personal data can be processed within EU/EEA and outside EU/EEA. Metsä Group will only transfer your personal information outside the EU/EEA in accordance with one of the legal bases described below:

the recipient country is regarded by the European Commission to provide adequate protection for your personal data;

we have put in place appropriate safeguards for the transfer by using the standard contractual clauses for the transfer of personal data to third countries issued by the European Commission; or

you have given your consent to the transfer, or there is another legal basis for the transfer under the applicable data protection legislation.

8. Data Security

Personal data is handled with care and in confidence. The Register is only used by personnel whose job requires processing of the personal data.
Users login to the register by either giving their personal user ID and password, or by utilizing single-sign on technology. User rights require separate approval from nominated Metsä Group personnel.

All personal data is protected by regularly reviewed appropriate technical and organizational data security measures against accidental and/or unlawful access, alteration, destruction or other processing including unauthorized disclosure and transfer. Such measures include proper firewall arrangements, appropriate encryption of telecommunication and messages, secure server rooms and up-to-date ICT system access management practices.

9. Your rights

You have the right to:

access, update, remove and correct your personal data;

withdraw your consent, where the processing of personal data is based on your consent;

object to the use of your personal data on grounds relating to your particular situation when our legal basis for processing your personal data is our legitimate interest;

demand Metsä Group to restrict the processing of your personal data; and

receive your personal data in machine-readable format and transfer such information to another data controller, where you have provided the personal data to Metsä Group and where the processing of such information is based on your consent

You can exercise any of your rights above by contacting Metsä Group via our privacy website https://www.metsagroup.com/privacy-policy/. Alternatively you may contact us by post at the address set out in this section 9. Metsä Group may request you to specify your request in writing and may authenticate your identity before handling your request, if needed.

If you are unhappy with the way we process your personal data, you have a right to make a complaint to the competent supervisory authority, who is responsible for monitoring compliance with the applicable data protection legislation. In Finland the competent supervisory authority is the Data Protection Ombudsman (tietosuoja@om.fi).

Requests shall be submitted in writing to:

Metsä Group, HR / Recruitment
P.O. Box 10, 02020 Metsä, Finland

Requests shall be submitted personally:

Revontulenpuisto 2
02100 Espoo

10. Updating your data

Personal data included in the Register can be updated by login to recruitment tool with automatically received user-id and password.

11. Data Retention Policy

Personal data is retained based on the job applicant’s consent for 18 months from the latest update of the application. If the applicant has not given their consent, the personal data will be kept only as long as necessary and justifiable or as required by applicable legislation. However, the personal data may be retained for an extended period if required by applicable law, for the exercise of claims or due to litigations or internal investigations.
Privacy statement

Metsä Spring stakeholders
Privacy statement

Metsä Spring stakeholders

This Metsä Spring stakeholder register privacy statement (“Privacy Statement”) describes our personal data handling practices including a description of the gathered personal data and how the personal data is processed. This Privacy Statement may be changed without prior notice to the extent possible under the applicable legislation.

1. Data Controller

Metsä Spring Oy, registered address of the head office at Revontu-lenpuisto 2 A, 02100 ESPOO

2. Contact Person

Please contact by e-mail:
niklas.vonweymarn@metsagroup.com

3. Name of the Register

Metsä Spring stakeholder register (“Register”)

4. The purpose and legal ground of processing personal data

The Register contains personal data of contact persons of stakeholders including inter alia, prospects (i.e. potential investment objects), investment objects, co-financiers, and external service providers (subcontractors).

Metsä Spring uses the personal data collected in connection with customer and stakeholder relationship management activities and for supporting its business analysis and operations, business intelligence, customer surveys, know your customer (KYC) process, reporting, invoicing, delivery of products, quality management, improving products and services, personalizing content and marketing.

Our legal basis for collecting and processing personal data is a legitimate interest based on the potential or existing collaboration.

5. Processed Personal Data

Personal data such as:

Name

Phone number

E-mail address

Organisation (affiliation)

Position / Job Title / Role

Organisation address

Preferred language

6. Regular sources of information

Personal data is provided mainly by the registered person himself/herself or other persons representing the customer or the stakeholder as part of the customer using the service (Online) upon the commencement of or during the co-operation. Personal data is also collected by Metsä Spring in connection with the use of Metsä Spring’s or its affiliate companies’ websites or online services by the registered person.

7. Regular destinations of dis-closed data and whether the data is transferred to coun-tries outside the EU/ EEA

Metsä Spring may disclose your personal data to the extent necessary to meet any applicable law, regulation, legal process or enforceable governmental request.

In some cases Metsä Spring uses external service providers to collect, use, analyze and otherwise process data on its behalf. These service providers are bound to use personal data shared with them only to perform their services Metsä Spring has hired them to provide.

The personal data can be processed within EU/EEA and outside EU/EEA. Metsä Spring will only transfer your personal data outside the EU/EEA in accordance with one of the legal grounds described below:

the recipient country is regarded by the European Commission to provide adequate protection for your personal data;

we have put in place appropriate safeguards for the transfer by using the standard contractual clauses for the transfer of personal data to third countries issued by the European Commission; or

you have given your consent to the transfer, or there is another legal basis for the transfer under the applicable data protection legislation.

8. Data Security

Personal data is handled with care and in confidence. The register is only used by personnel whose job requires processing of the personal data.
Users login to the register by either giving their personal user ID and password, or by utilizing single-sign on technology. User rights require separate approval from nominated Metsä Spring personnel.

All personal data is protected by regularly reviewed appropriate technical and organisational data security measures against accidental and/or unlawful access, alteration, destruction or other processing including unauthorized disclosure and transfer. Such measures include proper firewall arrangements, appropriate encryption of telecommunication and messages, secure server rooms and up-to-date ICT system access management practices.

9. Your rights

You have the right to:

access, update, remove and correct your personal data;

object to the use of your personal data on grounds relating to your particular situation; and

demand Metsä Spring to restrict the processing of your personal data.

You can exercise any of your rights above by contacting Metsä Spring via our privacy website https://www.metsagroup.com/privacy-policy/. Alternatively you may visit us in person or contact by post at the address set out in this section. Metsä Spring may request you to specify your request in writing and authenticate your identity before handling your request.

If you are unhappy with the way we process your personal data, you have a right to make a complaint to the competent supervisory authority, who is responsible for monitoring compliance with the applicable data protection legislation. In Finland the supervisory authority is the Data Protection Ombudsman (tietosuoja(at)om.fi)

Requests shall be submitted in writing to:
Metsä Spring
Revontulenpuisto 2 A
02100 ESPOO

Request can be submitted in person at:
Revontulenpuisto 2 A
02100 ESPOO

10. Data retention policy

Personal data is retained only as long as necessary and justifiable or as required by applicable legislation or for the exercise of claims or due to litigations or internal investigations.

Personal data is actively maintained throughout the life-cycle of the co-operation in question.
Privacy statement

Metsä Fibre's Kemi bioproduct mill project
Privacy statement

Metsä Fibre's Kemi bioproduct mill project

This Metsä Fibre’s Kemi bioproduct mill project (“project”) privacy statement describes our personal data handling practices including a description of the collected personal data and how the personal data is processed. The privacy statement may be changed from time to time. The up-to-date version can be always found on our website.

1. Data Controller

Metsä Fibre Oy / Kemi bioproduct mill project (hereinafter “Metsä Fibre”), registered address of the head office at Revontulenpuisto 2, 02100 Espoo, Finland.

2. Contact information

Please contact by e-mail:
bttsiteoffice@metsagroup.com

3. The purpose and legal ground of processing personal data

Metsä Fibre processes personal data of the personnel of project’s contractors, vendors and subcontractors. Metsä Fibre uses the personal data for the following purposes: on-site health and safety monitoring (including vehicle speed monitoring and health security), access management, contract management, fulfilling legal obligations and other legitimate purposes necessary for the completion of the project. Metsä Fibre may also process the personal data on the basis of legitimate interest to protect Metsä Fibre’s interests such as the establishment, exercise or defence of legal claims and related court or any other similar procedures.

Our legal ground for collecting and processing personal data is either legitimate interest based on the business relationship and / or consent, as applicable.

4. Processed Personal Data

Personal data such as:

Name

Address

Phone number

E-mail address

Tax number

Nationality

Language

Gender

Photo

Passport copy

Organisation

Title / job role / job role description

Qualifications (training data and permits)

On-site access control data

Vehicle registration number

Loss of on-site driving permit e.g. due to speeding

Covid-19 test data

5. Regular sources of data

Personal data is collected during on-site induction when the person enters the project site for the first time. The data is provided by the persons themselves or by other persons having the right to provide the data, such as the employer or main contactor representative. Personal data is also collected in connection with contract management during the project. The personal data content is updated during the project, if needed.

Metsä Fibre receives possible positive Covid-19 test results directly from the service provider (Suomen Terveystalo). In addition, Metsä Fibre receives a report confirming that everyone working on-site during the project has been tested to control on-site safety during the pandemic. All personal data related to the Covid-19 testing practices is being kept separate from other personal data controlled by Metsä Fibre and accessed only by specifically named employees. The personal data is used only to track possible chains of infection and to take care of on-site safety and legal requirements.

Personal data is also collected by Metsä Fibre in connection with the use of Metsä Fibre’s or its group companies’ websites or online services by the registered person.

6. Regular destinations of dis-closed data and whether the data is transferred to coun-tries outside the EU/ EEA

Metsä Fibre does not disclose personal data to unauthorized third parties. Metsä Fibre may disclose personal data to authorities or other third parties to the extent necessary to meet any applicable law, regulation, legal process or enforceable governmental request.

Metsä Fibre may use external service providers. These service pro-viders (and their possible subcontractors) act as Metsä Fibre’s data processors. They process personal data on behalf of Metsä Fibre only for the provision of services to Metsä Fibre. The service providers have no independent right to use the personal data for any independent purposes.

The personal data is mainly processed within the EU/EEA but it may be processed also outside EU/EEA. Metsä Fibre will only transfer your personal data outside the EU/EEA in accordance with one of the legal grounds described below:

the recipient country is regarded by the European Commission to provide adequate protection for your personal data;

we have put in place appropriate safeguards for the transfer by using the standard contractual clauses for the transfer of personal data to third countries issued by the European Commission; or

you have given your consent to the transfer, or there is another legal basis for the transfer under the applicable data protection leg-islation.

7. Data Security

Personal data is handled with care and in confidence. The personal data is only used by personnel whose job requires processing of the personal data. Covid-19 related test data is processed only by separately named personnel of Metsä Fibre who have committed to confidentiality. Any Covid-19 related test data is stored separate from any other personal data controlled by Metsä Fibre.

All personal data is protected by regularly reviewed appropriate technical and organisational data security measures against accidental and/or unlawful access, alteration, destruction or other processing including unauthorized disclosure and transfer. Such measures include proper firewall arrangements, appropriate encryption of telecommunication and messages, secure server rooms and up-to-date ICT system access management practices. Paper documents are stored in locked premises with access only on a need-to-know basis.

8. Your rights

You have the right to:

access, update, remove and correct your personal data;

withdraw your consent where the processing is based on your consent;

receive your personal data in machine readable format and transfer the data to another controller provided that you have provided the personal data to Metsä Fibre yourself and that the processing is based on your consent;

object to the use of your personal data on grounds relating to your particular situation when our legal ground for processing your per-sonal data is our legitimate interest; and

demand Metsä Fibre to restrict the processing of your personal data.

You can exercise any of your rights above by contacting Metsä Fibre via our privacy website https://www.metsagroup.com/privacy-policy/. Alternatively you may visit us in person or contact us by post at the address set out in this section. Metsä Fibre may request you to specify your request in writing and authenticate your identity before handling your request.

Requests shall be submitted in writing or in person to:

Metsä Fibre Oy / Kemi bioproduct mill project
Tehdastie 94
94200 KEMI

Please note that we may not be able to execute your rights if we have a legal ground for it.

If you are unhappy with the way we process your personal data, you have a right to make a complaint to the competent supervisory authority, who is responsible for monitoring compliance with the applicable data protection legislation. In Finland the competent supervisory authority is the Data Protection Ombudsman (tieto-suoja(at)om.fi).

9. Data retention policy

Personal data is retained only as long as necessary and justifiable or as required by applicable legislation or for the exercise of claims or due to litigations or internal investigations.

Personal data is actively maintained throughout the life-cycle of the co-operation in question.
Privacy statement

Metsä Group visitor centers
Privacy statement

Metsä Group visitor centers

Updated July 5, 2022

This Privacy Statement describe how Metsäliitto Cooperative processes your personal data during your visit in Metsä Group’s visitor centers. We may update this Privacy Statement and the latest version is available on our website.

1. Data Controller

Metsäliitto Cooperative (‘’hereinafter Metsä Group’’), registered address of the head office at Revontulenpuisto 2, 02100 Espoo, Finland

2. Contact Person

Please contact by e-mail
privacy@metsagroup.com

3. The purpose and legal ground of processing personal data

Registered persons are customers and other stakeholders representatives visiting Metsä Group's visitor center.

Personal data is processed e.g. in connection with and for the purpose of reservation requests, photography, visitor survey and games. In addition, personal data is processed in connection with the person's own contacts.

Our legal basis for the collection and processing of personal information is a legitimate interest based on a customer relationship or potential customer relationship.

4. Processed Personal Data

Reservation request:

First and last name of contact person

E-mail address

Organization

Visitor survey:

Person’s first and last name

Phone number and e-mail address

Open comments

Personal data collected from actions by visitor

Picture

Player name / username

E-mail address

Personal data collected in connection with the use of a web service / website etc. such as:

Service / website usage and statistics on the use preferences;

Device information;

Log information;

IP address;

Location data (country level)

Cookies and similar technologies;

5. Regular sources of data

Personal data is mainly provided by the data subjects themselves.

6. Regular destinations of disclosed data and whether the data is transferred to countries outside the EU/ EEA

Metsäliitto Cooperative does not disclose personal data to unauthorized third parties. Metsäliitto Cooperative may within the framework of cooperation disclose customer’s contact information to its partner, if the customer is aware and wants the personal data to be disclosed to such partner. Metsäliitto Cooperative may also disclose personal data to authorities or other third parties, if required by applicable legislation or enforceable governmental request.

Metsäliitto Cooperative may use external service providers. These service providers and their possible subcontractors act as Metsäliitto Cooperatives data processors. They process personal data on behalf of Metsäliitto Cooperative only for the provision of services to Metsäliitto Cooperative. The service providers have no independent right to use the personal data for any independent purposes.

The personal data can be processed within EU/EEA and outside EU/EEA. Metsäliitto Cooperative will only transfer your personal data outside the EU/EEA in accordance with one of the legal grounds described below:

the recipient country is regarded by the European Commission to provide adequate protection for your personal data;

we have put in place appropriate safeguards for the transfer by using the standard contractual clauses for the transfer of personal data to third countries issued by the European Commission; or

you have given your consent to the transfer, or there is another legal basis for the transfer under the applicable data protection legislation.

7. Data Security

Personal data is handled with care and in confidence. The register is only used by personnel whose work tasks requires processing of the personal data.

Systems that include personal data require login to the register by either giving personal user ID and password, or by utilizing single-sign on technology. User rights require separate approval from nominated Metsäliitto Cooperative personnel.

All personal data is protected by regularly reviewed appropriate technical and organisational data security measures against unlawful access, alteration, destruction or other processing including unauthorized disclosure and transfer. Such measures include proper firewall arrangements, appropriate encryption of telecommunication and messages, secure server rooms and up-to-date ICT system access management practices.

8. Your rights

You have the right to:

access, update, remove and correct your personal data;

cancel your consent, where the processing of personal data is based on your consent (Metsäliitto Cooperative’s newsletter or electronic marketing);

object to the use of your personal data on grounds relating to your particular situation;

demand Metsäliitto Cooperative to restrict the processing of your personal data; and

receive your personal data in machine-readable format and transfer such information to another data controller, where you have provided the personal data to Metsäliitto Cooperative and where the processing of such information is based on your consent or a contract between you and Metsäliitto Cooperative.

You can exercise any of your rights above by contacting Metsäliitto Cooperative via our privacy website https://www.metsagroup.com/privacy-policy/. Alternatively you may visit us in person or contact us by post at the address set out below. Metsäliitto Cooperative may request you to specify your request in writing, and if necessary authenticate your identity before handling your request.

Requests shall be submitted in writing to:
Metsäliitto Cooperative
Attn: Legal Services
Revontulenpuisto 2
02100 Espoo
Finland

Request can be submitted in person at:
Revontulenpuisto 2
02100 Espoo, Finland

Please note that we may not be able to execute your rights if we have a legal ground for it.

If you are unhappy with the way we process your personal data, you have a right to make a complaint to the competent supervisory authority, who is responsible for monitoring compliance with the applicable data protection legislation. In Finland the competent supervisory authority is the Data Protection Ombudsman (tietosuoja(at)om.fi).

9. Data retention policy

Personal data is retained only as long as necessary and justifiable under applicable law or as may be required by applicable law or for the exercise of claims or due to litigations or internal investigations.

Metsäliitto Cooperatives customers’ and stakeholders’ personal data is actively maintained throughout the life-cycle of the co-operation in question.
Privacy statement

Online training
Privacy statement

Online training

In this Privacy Statement, we describe how Metsäliitto Cooperative and its subsidiaries process the personal data of those who register for and participate in online training (hereinafter ‘’training’’). This Privacy Statement may be amended from time to time. An up-to-date version of the Privacy Statement can be found on our website.

1. Data Controller

Metsäliitto Cooperative and its subsidiaries (hereinafter referred to as "Metsä Group"), registered address of the head office Revontulenpuisto 2, 02100 Espoo, Finland

2. Contact person

Contact by e-mail
privacy@metsagroup.com

3. Purposes and legal basis for the processing of personal data

The data subjects are the persons who participate in and register for Metsä Group's training courses. The personal data collected will be processed for the purpose of conducting the training. Personal data is also used for training development and support, data management, surveys, reporting, product and service development, content targeting and marketing.

Our legal basis for collecting and processing personal data is a legitimate interest based on a potential or existing customer or stakeholder relationship between us and the delivery of the training.

4. Personal data processed

We process the following personal data:

Name

Street address, postal code, city, country

Phone number

E-mail address

Organisation

Prohibition of customer surveys

Marketing consents or bans

Contact requests via our website or other channels

Personal data collected in connection with the use of the online service or website, such as:

Use of the service/website and statistics on usage patterns

Device information

Log information

IP address

Location information (country code)

Cookies and other similar technologies

5. Regular data sources

Personal data are mainly obtained from the data subject himself/herself at the time of registration and during the training. In addition, Metsä Group collects personal data when the data subject visits the websites or services of companies belonging to Metsä Group.

6. Regular disclosures of personal data and transfer of data outside the EU or EEA

Metsä Group does not disclose personal data to third parties without permission. However, Metsä Group may disclose necessary information to third party organizing the training. Metsä Group may disclose personal data to public authorities or other third parties if necessary, for example, to comply with applicable law or an enforceable request from a public authority.

Metsä Group may use external service providers. Such service providers and their subcontractors, if any, act as processors of Metsä Group's personal data and process personal data solely for the purpose of providing a service to Metsä Group on its behalf and for its account. Service providers do not have independent access to personal data.
Your personal data is generally processed within the EU/EEA, but may also be processed outside the EU/EEA. Metsä Group will only transfer your personal data outside the EU/EEA if there are any of the legitimate grounds described below:

The European Commission considers that the recipient country provides an adequate level of protection for your personal data;

we have put in place appropriate safeguards for the transfer of personal data and have used the European Commission's standard contractual clauses for the transfer of personal data to third countries; or

you have given your consent to the transfer, or there is another legal basis for the transfer under the applicable data protection legislation

7. Data security

Personal data will be treated with care and confidentiality. Personal data will only be processed by persons whose processing is necessary for the performance of their duties.

All data is protected by regularly reviewed and appropriate security measures to prevent access, alteration, destruction or other processing, including unauthorised disclosure or transfer, whether accidental or unlawful. These measures include adequate firewall arrangements, encryption of telecommunications and messages where appropriate, secure server rooms and up-to-date access control policies for information systems. Paper documents are stored in locked premises, accessible only to those who need them.

8. Rights of the data subject

You have the right to:

To have access to your personal data and to update, delete and rectify your personal data;

object to the use of your personal data on grounds relating to your particular situation; and

to request Metsä Group to restrict the processing of your personal data.

You can exercise your rights as set out above by contacting Metsä Group via our website https://www.metsagroup.com/privacy-policy/. Alternatively, you can contact us in person, by post or by sending an email to the address below. Metsä Group may ask you to specify your request in writing and to provide proof of your identity before processing your request.

Requests may be submitted in writing:
Metsäliitto Cooperative
Legal Affairs
Revontulenpuisto 2
02020 METSÄ
Requests can be delivered by hand:
Revontulenpuisto 2
02100 Espoo
Please note that we may not be able to enforce all your rights if we have a legitimate ground for exception.

If you are dissatisfied with the way we process your personal data, you have the right to lodge a complaint with the competent supervisory authority responsible for enforcing compliance with applicable data protection legislation. In Finland, the supervisory authority is the tietosuojavaltuutettu (tietosuoja(at)om.fi).

9. Data retention policy

Personal data will be kept only for as long as necessary and justified or as required by applicable law, or if the retention of personal data is necessary for the purposes of claims for damages, legal proceedings or internal company investigations. Personal data will be actively maintained and updated throughout the lifecycle of the cooperation.