Privacy policy

 

Introduction and overview

We have drawn up this data protection declaration in order to provide you with initial general information in accordance with the requirements of the General Data Protection Regulation (EU) 2016/679 and applicable national laws. Which personal data (data for short) we process as the controller and will process in the future is described in our general privacy policy Privacy Policy | Sappi explained in more detail. The terms used are to be understood as gender-neutral.

If you still have any questions, please contact the responsible body named below or in the legal notice.

Legal basis

In the following privacy policy, we provide you with transparent information on the legal principles and regulations, i.e. the legal basis of the General Data Protection Regulation, which enable us to process personal data.

We only process your data if at least one of the following conditions applies:

1. Consent (Article 6(1)(a) GDPR): You have given us your consent to process data for a specific purpose. An example would be the storage of the data you enter in a contact form.
2. Contract (Article 6(1)(b) GDPR): In order to fulfil a contract or pre-contractual obligations with you, we process your data. For example, if we conclude a purchase contract with you, we require personal information in advance.
3. Legal obligation (Article 6(1)(c) GDPR): If we are subject to a legal obligation, we process your data. For example, we are legally obliged to keep invoices for accounting purposes. These usually contain personal data.
4. Legitimate interests (Article 6(1)(f) GDPR): In the case of legitimate interests that do not restrict your fundamental rights, we reserve the right to process personal data. For example, we need to process certain data in order to operate our website securely and efficiently. This processing is therefore a legitimate interest.

Other conditions such as the fulfilment of recording in the public interest and the exercise of official authority as well as the protection of vital interests do not generally arise for us. If such a legal basis is relevant, it will be indicated at the appropriate point.

Contact details of the person responsible

If you have any questions about data protection or the processing of personal data, you will find below the contact details of the controller in accordance with Article 4(7) of the EU General Data Protection Regulation (GDPR):
Sappi Austria Produktions-GmbH & Co. KG
Brucker Straße 21, 8101 Gratkorn, AUSTRIA
technical.services@sappi.com
+43 3124 201 2803

e-mail: technical.services@sappi.com
Telephone: +43 3124 201 2803
Imprint: https://technical-service-gratkorn.at/impressum

Storage duration

It is a general criterion for us that we only store personal data for as long as is absolutely necessary for the provision of our services and products. This means that we delete personal data as soon as the reason for the data processing no longer exists. In some cases, we are legally obliged to store certain data even after the original purpose has ceased to exist, for example for accounting purposes.

If you wish your data to be deleted or revoke your consent to data processing, the data will be deleted as quickly as possible and insofar as there is no obligation to store it.

Rights under the General Data Protection Regulation

In accordance with Articles 13 and 14 GDPR, we inform you of the following rights to which you are entitled in order to ensure fair and transparent processing of data:

• According to Article 15 GDPR, you have a right to information about whether we process your data. If this is the case, you have the right to receive a copy of the data.
• According to Article 16 GDPR, you have a right to rectification of data, which means that we must correct data if you find errors.
• According to Article 17 GDPR, you have the right to erasure ("right to be forgotten"), which specifically means that you may request the erasure of your data.
• According to Article 18 GDPR, you have the right to restriction of processing, which means that we may only store the data but no longer use it.
• According to Article 20 GDPR, you have the right to data portability, which means that we will provide you with your data in a commonly used format upon request.
• According to Article 21 GDPR, you have the right to object, which will result in a change in the processing after enforcement.
• Under Article 22 GDPR, you may have the right not to be subject to a decision based solely on automated processing (e.g. profiling).
• According to Article 77 GDPR, you have the right to lodge a complaint. This means that you can lodge a complaint with the data protection authority at any time if you believe that the processing of your personal data is in breach of the GDPR.

Austria Data Protection Authority

Address: Barichgasse 40-42, 1030 Vienna
Telephone no: +43 1 52 152-0
E-mail address: dsb@dsb.gv.at
Website: https://www.dsb.gv.at/

Data transfer to third countries

We only transfer or process data to countries outside the scope of the GDPR (third countries) if you consent to this processing or other legal authorisation exists. This applies in particular if the processing is required by law or necessary for the fulfilment of a contractual relationship and in any case only insofar as this is generally permitted. In most cases, your consent is the most important reason why we process data in third countries. The processing of personal data in third countries such as the USA, where many software manufacturers offer services and have their server locations, may mean that personal data is processed and stored in unexpected ways.

Where possible, we endeavour to use server locations within the EU if this is offered.

Security of data processing

We have implemented both technical and organisational measures to protect personal data. Where possible, we encrypt or pseudonymise personal data. In this way, we make it as difficult as possible for third parties to infer personal information from our data.

We use the "Real Cookie Banner" consent tool to manage the cookies and similar technologies used (tracking pixels, web beacons, etc.) and related consents. You can find details on how "Real Cookie Banner" works at https://devowl.io/de/rcb/datenverarbeitung/.
The legal basis for the processing of personal data in this context is Art. 6 para. 1 lit. c GDPR and Art. 6 para. 1 lit. f GDPR. Our legitimate interest is the management of the cookies and similar technologies used and the related consents.

The provision of personal data is not required by contract and is not necessary for the conclusion of a contract. You are not obliged to provide the personal data. If you do not provide the personal data, we will not be able to manage your consents.

Closing words

As mentioned at the beginning, which personal data (data for short) we process as the controller and will process in the future is described in our general privacy policy Privacy Policy | Sappi explained in more detail.

We reserve the right to amend this privacy policy, as well as our general privacy policy, from time to time.