Privacy Notice

1. Purpose

The purpose of this Privacy Notice is to provide you as a data subject information on how Stora Enso processes your personal data when you use mobile applications developed by Stora Enso. Protecting your privacy and personal data is of utmost importance to Stora Enso, and we will be happy to help you with any issues regarding the protection of your data and exercising of your rights. Do not hesitate to contact us should you have any questions about the content of this Privacy Notice or other issues involving processing of your personal data. See section 2 for contact information "Data controller".

2. Data Controller

Stora Enso Oyj and its subsidiaries are joint data controllers in respect of the personal data which they jointly process and share. Stora Enso Oyj and its subsidiaries share the data controller’s obligations and responsibilities between each other as they deem appropriate based on the relevant circumstances. In general, Stora Enso Oyj is responsible for (i) the functionality and security of the IT systems, (ii) data privacy and IT policies, guidelines and instructions for the group, and (iii) that global personal data sys-tems and registers are compliant with applicable privacy laws, while the subsidiaries for their part are responsible for (i) the validity, accuracy and completeness of the personal data within the systems, and (ii) ensuring that local personal data registers, systems and processes are in compliance with applicable local and EU laws. More information on Stora Enso’s subsidiaries and jointly controlling entities can be found here.

Regardless of the applicable data controller in each situation, you can always use your rights by con-tacting Stora Enso Oyj:

Address:
Stora Enso Oyj
Kanavaranta 1
P.O. Box 309
FI-00101 Helsinki
Finland

Email:
data.privacy@storaenso.com

Telephone:
+358 20 46 131

3. Legal basis and Purposes of Personal Data Processing

The legal grounds for collecting and processing your personal data in mobile applications are either fulfilment of an agreement concluded between a Stora Enso group company and you, the legitimate interest of Stora Enso or your consent.

Having a contract or preparation of a contract to which you are a contractual party usually requires processing of personal data. Such agreements are made in those instances where you download the application, accept the user terms and sign-in. Providing of certain personal data to Stora Enso is nec-essary in order to provide you the service. If you refuse to submit this personal data to Stora Enso, we may not be able to enable the usage or all features of the application you are requesting.

Stora Enso may also process your data on the basis of the legitimate interest. Such legitimate interests exist when Stora Enso has valid grounds to collect or process data for the purpose of conducting and supporting various activities relating to forest field works and locating forest assets. In some instances, legitimate interest pertains to ensuring the security, functionality and further development of our mobile applications.

We may also need to request your consent to process your data. A typical situation for requesting your consent is for processing your location data collected from the mobile device. You may revoke such consent at any time through the device settings in your mobile applications. You may also revoke your consent by contacting Stora Enso in accordance with section 11 below. But kindly note that some ap-plications do not serve you with all features if the consent is not given.

We may request to send you push notifications regarding your account or the application. If you wish to opt-out from receiving these types of communications, you may turn them off in your device’s settings.

4. Content of the Register

The personal data Stora Enso may collect and process within the register includes the following per-sonal data categories:

1. Profile information, including name, address, email address, phone number, language, approval date of user terms.
2. Location-based information (only when you allow).
3. Derivative data that our servers automatically collect when you access the application, such as your actions that are integral to the application, including interactions with the other applications via server log files.
4. Mobile device contents (only when you allow), including your mobile device’s camera and SMS messages and other. If you wish to change our access or permissions, you may do so in your device’s settings.
5. Mobile device data including device information such as your mobile device ID number, model, and manufacturer, version of your operating system, phone number, country and location.

Some of our mobile applications may connect you to other Stora Enso applications via servers and show data to you in the mobile application. This data is not stored in the mobile application. All data by default are non-public and not available for other users.

5. Regular Sources of Information

Personal data is primarily collected from you at the time when you upload the application. Data is also aggregated during the usage of the application or transferred from other Stora Enso application(s) through integrations.

6. Data Retention

Stora Enso regularly maintains, corrects and deletes unnecessary and outdated personal data when your account and/or relationship with Stora Enso is active. After your relationship with Stora Enso be-comes passive or you stop using the application, Stora Enso will still retain your personal data for pre-defined time periods. These time periods have been defined based on Stora Enso’s genuine needs and legislative requirements Stora Enso is subject to. For more information regarding the retention times of your personal data, please contact Stora Enso using the contact information listed in section 2.

7. Regular Data Disclosures

Personal data may be disclosed to other companies within Stora Enso company group for purposes compatible with the processing purposes defined in Section 3 of this Privacy Notice. Personal data col-lected and stored in mobile applications is not disclosed to any third parties.

Certain data processing activities may be outsourced to carefully selected IT service providers in which case such third-party processors operate on behalf of Stora Enso under a specific data processing agreement.

8. Data Transfers from EU/EEA

Personal data is only processed in the EU/EEA region.

9. Data Security

Personal data in Stora Enso’s mobile applications is protected in line with various Stora Enso security principles and requirements, including access limitations to dedicated persons, logging of activities and encryption. Stora Enso and its service providers are actively monitoring the confidentiality, integrity and availability of the IT environment and have implemented technical measures to prevent and detect in-cidents that may threaten any personal data.

10. Your rights

Access to information
You are entitled to obtain information on the personal data concerning you which Stora Enso is pro-cessing and to obtain a copy of such personal data. You are kindly asked to use the template provided on this Privacy site for such requests. The filled-out form or a request including similar information may be then presented to Stora Enso in accordance with section 11 of this Privacy Notice.

Right to rectification, erasure and restriction
You are entitled to have any personal data that is inaccurate, outdated, unnecessary or contrary to the purposes of data processing corrected or erased. You are kindly asked to use the template provided on this Privacy site for such requests. Requests concerning rectification and erasure may be presented in accordance with the instructions in section 11 of this Privacy Notice.

You are also entitled to have Stora Enso restrict the processing of your personal data for example when you are waiting for Stora Enso’s answer to your access or erasure request. Right to object to processing
On grounds relating to your particular situation, you are entitled to object to the processing of personal data concerning you, provided that the processing is based on Stora Enso’s legitimate interest.

You are kindly asked to use the template provided on this Privacy site for such requests and present them in accordance with the instructions in section 11 of this Privacy Notice. In this request, you shall define the particular situation based on which you are objecting to the data processing. Stora Enso may decline the request on statutory grounds.

Data Portability
You are entitled to receive an electronic copy of the personal data that has been provided by you for the purposes of performing the contract made between you and Stora Enso or where the processing is based on consent. Furthermore, the data may be transmitted directly to another data controller on your request, if this is technically feasible.

Right to withdraw consent
If the processing of your personal data is based on consent, you have the right to withdraw your con-sent any time.

Right to lodge a complaint
You are entitled to lodge a complaint with a competent data protection authority regarding the Stora Enso’s processing of personal data.Right to lodge a complaint

11. Contacting the Data Controller

In all questions and matters relating to personal data processing or your rights, you should contact Stora Enso. You may use their rights by sending an e-mail to data.privacy@storaenso.com.

Stora Enso is entitled to decline requests on statutory grounds. Stora Enso shall inform you of such a decline including the grounds for the decline.