Privacy Policy of Arctic Paper Munkedals AB

Information on the processing of personal data

1. Who is who in this Privacy Policy?

We, i.e. the controller of your personal data, as described in section 3.

You, i.e. the natural person whose personal data we process.

2. What is GDPR?

GDPR is Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). This Privacy Policy includes also considerations regarding national legislation on data protection, such as the Swedish Act (SFS 2018:218) with supplementary provisions to the EU General Data Protection Regulation “Data Protection Act”.

3. Who is the controller of your personal data and what are their contact details?

Arctic Paper Munkedals AB (“We”, “APM”) are the controller when processing your personal data. If you have any queries or want to reach out to us regarding how we process your data, please use our contact details:

Arctic Paper Munkedals AB

Bruksvägen 40

455 81 Munkedal

Sweden

Reg. no.: 556000–5273

e-mail: [email protected]

4. For what purpose and on what basis do we process your personal data? How long do we keep them?

Choose your role from the list below:

Purpose of processing	Description of the legal basis	GDPR provision
Personnel recruitment	Legitimate interest in finding relevant candidates to our job openings	Article 6(1)(f)

If we provide you with our services or products and you are therefore our customer or a representative of our customer, we process your personal data as follows:

Purpose of processing	Description of the legal basis	GDPR provision
Processing of customer data – for the purpose of fulfilling a contract with a customer or taking action prior to concluding a contract	Necessity for the performance of a contract to which the data subject is party or for taking steps prior to entering into a contract	Article 6(1)(b)
Processing of customer's representative data – for the purpose of fulfilling a contract with a customer or taking action prior to concluding a contract	Legitimate interest in being able to conclude and perform a contract between us and the customer	Article 6(1)(f)
Fulfilment of legal obligations related to the customer contract	Fulfilment of legal obligations imposed on us by law, in particular tax and accounting obligations	Article 6(1)(c)
Redressing or defending against possible claims	Legitimate interest to establish, assert or defend against claims, including debt collection	Article 6(1)(f)
Processing of customer data – to handle complaints	Necessity for the performance of a contract to which the data subject is party (as regards complaints)	Article 6(1)(b)
Processing of customer representative data – to handle complaints	Legitimate interest in being able to perform the contract between us and the customer (as regards complaints)	Article 6(1)(f)
Marketing	Legitimate interest in sending marketing to existing customers about new campaigns and products	Article 6(1)(f)
Online survey	Consent	Article 6(1)(a)
Keeping a customer record	Legitimate interest in keeping a customer record for future contacts	Article 6(1)(f)

Processing of customer data – for the purpose of fulfilling a contract with a customer or taking action prior to concluding a contract

Purpose of processing: Processing of customer data – for the purpose of fulfilling a contract with a customer or taking action prior to concluding a contract
Description of the legal basis: Necessity for the performance of a contract to which the data subject is party or for taking steps prior to entering into a contract
GDPR provision: Article 6(1)(b)

Processing of customer's representative data – for the purpose of fulfilling a contract with a customer or taking action prior to concluding a contract

Purpose of processing: Processing of customer's representative data – for the purpose of fulfilling a contract with a customer or taking action prior to concluding a contract
Description of the legal basis: Legitimate interest in being able to conclude and perform a contract between us and the customer
GDPR provision: Article 6(1)(f)

Fulfilment of legal obligations related to the customer contract

Purpose of processing: Fulfilment of legal obligations related to the customer contract
Description of the legal basis: Fulfilment of legal obligations imposed on us by law, in particular tax and accounting obligations
GDPR provision: Article 6(1)(c)

Redressing or defending against possible claims

Purpose of processing: Redressing or defending against possible claims
Description of the legal basis: Legitimate interest to establish, assert or defend against claims, including debt collection
GDPR provision: Article 6(1)(f)

Processing of customer data – to handle complaints

Purpose of processing: Processing of customer data – to handle complaints
Description of the legal basis: Necessity for the performance of a contract to which the data subject is party (as regards complaints)
GDPR provision: Article 6(1)(b)

Processing of customer representative data – to handle complaints

Purpose of processing: Processing of customer representative data – to handle complaints
Description of the legal basis: Legitimate interest in being able to perform the contract between us and the customer (as regards complaints)
GDPR provision: Article 6(1)(f)

Marketing

Purpose of processing: Marketing
Description of the legal basis: Legitimate interest in sending marketing to existing customers about new campaigns and products
GDPR provision: Article 6(1)(f)

Online survey

Purpose of processing: Online survey
Description of the legal basis: Consent
GDPR provision: Article 6(1)(a)

Keeping a customer record

Purpose of processing: Keeping a customer record
Description of the legal basis: Legitimate interest in keeping a customer record for future contacts
GDPR provision: Article 6(1)(f)

We will store your personal data up to 2 years after the expiration of the customer relationship.

In case of:

Marketing and keeping a customer record, we will store your personal data up to 2 years from our last interaction,
claims, we will store your personal data for this purpose until the claim has been settled and up to 10 years according to 2 § of the Statute of Limitations Act,
online survey, we will only store your personal data until the survey has ended. We will then anonymise your personal data.

If you provide us with services or goods and are therefore our contractor or a representative of our contractor, we process your data as follows:

Purpose of processing	Description of the legal basis	GDPR provision
Contractor data processing – for the purpose of fulfilling a contract with a contractor or taking action prior to entering into a contract with a contractor	Necessity for the performance of a contract to which the data subject is party or for taking steps prior to entering into a contract	Article 6(1)(b)
Processing of data of the contractor's representative – for the purpose of fulfilling the contract with the contractor or taking steps prior to its conclusion	Legitimate interest in being able to conclude and perform a contract between us and a contractor	Article 6(1)(f)
Performance of legal obligations related to the contract with the contractor	Fulfilment of legal obligations imposed on us by law, in particular tax and accounting obligations	Article 6(1)(c)
Redressing or defending against possible claims	Legitimate interest to establish, assert or defend against claims	Article 6(1)(f)
Administration of access to our systems and premises	Legitimate interest in providing you with access	Article 6(1)(f)
Keeping a contractor record	Legitimate interest in keeping the contractor record	Article 6(1)(f)

Contractor data processing – for the purpose of fulfilling a contract with a contractor or taking action prior to entering into a contract with a contractor

Purpose of processing: Contractor data processing – for the purpose of fulfilling a contract with a contractor or taking action prior to entering into a contract with a contractor
Description of the legal basis: Necessity for the performance of a contract to which the data subject is party or for taking steps prior to entering into a contract
GDPR provision: Article 6(1)(b)

Processing of data of the contractor's representative – for the purpose of fulfilling the contract with the contractor or taking steps prior to its conclusion

Purpose of processing: Processing of data of the contractor's representative – for the purpose of fulfilling the contract with the contractor or taking steps prior to its conclusion
Description of the legal basis: Legitimate interest in being able to conclude and perform a contract between us and a contractor
GDPR provision: Article 6(1)(f)

Performance of legal obligations related to the contract with the contractor

Purpose of processing: Performance of legal obligations related to the contract with the contractor
Description of the legal basis: Fulfilment of legal obligations imposed on us by law, in particular tax and accounting obligations
GDPR provision: Article 6(1)(c)

Redressing or defending against possible claims

Purpose of processing: Redressing or defending against possible claims
Description of the legal basis: Legitimate interest to establish, assert or defend against claims
GDPR provision: Article 6(1)(f)

Administration of access to our systems and premises

Purpose of processing: Administration of access to our systems and premises
Description of the legal basis: Legitimate interest in providing you with access
GDPR provision: Article 6(1)(f)

Keeping a contractor record

Purpose of processing: Keeping a contractor record
Description of the legal basis: Legitimate interest in keeping the contractor record
GDPR provision: Article 6(1)(f)

We will store your personal data up to 2 years after the expiration of our contractor relationship.

Purpose of processing	Description of the legal basis	GDPR provision
Internal communication on our information screens	Consent	Article 6(1)(a)

Purpose of processing	Description of the legal basis	GDPR provision
Fulfilling a contract regarding a course/training or taking action prior to entering into a contract regarding a course/training	Necessity for the performance of a contract to which the data subject is party or for taking steps prior to entering into a contract	Art. 6.1.b and 3 ch. 10 § Act (2018:218) with supplementary provisions to the GDPR

Purpose of processing	Description of the legal basis	GDPR provision
Contacting in case of emergency	Consent	Article 6(1)(a)

5. Where do we get your personal data from?

If you are a customer, job applicant or contractor, we will process the personal data you provide us with when you interact with us, e.g. by communication with us or if you make a purchase. If you are customer, we will also process personal data such as contact details and login details provided by our internal system for keeping record of customers.

We also collect information including contact information from publicly available sources, to be able to initiate contact and/or complete applicable information.

6. To whom do we transfer your personal data, i.e. who will be the recipient of your data?

We may share your personal data with other parties, in accordance with this Privacy Policy. The recipients of your personal data will be:

companies within the Arctic Paper Group, if necessary to provide and administrate our business,
data processors/subcontractors providing services to us, including services within IT, hosting, security, accounting, agency services and customer communication.
public authority or court, if necessary by law, or a decision by a court or authority. For example, this includes sharing information with the police to prevent or investigate crimes.

7. Will your personal data be transferred to a third country (i.e. a country outside the European Economic Area) or an international organisation?

We aim to process your data within the European Union/European Economic Area. For certain services provided by our subcontractors, your personal data may be transferred to a third country.
When transferring your personal data to a third country, we will ensure that appropriate security measures are applied. Such security measures may include the European Commission's standard contractual clauses (SCCs), binding corporate rules or a decision stating the appropriate level of protection for a particular country. We will also assess whether additional organisational or technical security measures should be applied to ensure an adequate level of protection for personal data transferred to a third country.

We will transfer personal data to one of our group companies (Arctic Paper UK Limited), which is located in United Kingdom. The European Commission has concluded that an adequate level of protection for personal data is ensured in the UK. This is based on Implementing Regulation (EU) 2021/1772 of 28 June 2021 on the basis of the GDPR, establishing an adequate level of protection of personal data by the United Kingdom (notified under document C(2021) 4800).

8. What rights do you have as we process your personal data?

You have the right to object at any time to the processing of your data based on legitimate interests, on grounds relating to your particular situation. You also have the right to object to direct marketing. We will not continue process your personal data, unless we have a compelling legitimate ground to do so.

In addition, you are entitled to the following rights:

the right to request access to your personal data, and to receive a copy of the data that we process free of charge,
the right to request the rectification of your personal data, if it is incorrect or incomplete,
the right to delete your personal data. We are obliged to delete your personal data if we have no legitimate interest in storing it,
the right to request the restriction of the processing of your personal data under certain circumstances, e.g. if you have requested rectification of your data and we need to control this,
the right to data portability, which means that you have the right to transfer your personal data to another controller upon request.

If the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. This will not affect the lawfulness of any processing carried out before the withdrawal. If you want to withdraw your consent, please contact [email protected].
You also have the right to lodge a complaint to Integritetsskyddsmyndigheten, if you are not satisfied with our processing of your personal data.

9. Is the provision of personal data voluntary?

Providing personal data is voluntary, but it is necessary:

to performance of concluded contracts or taking steps prior to their conclusion,
if required so we can fulfil legal obligations.

If you do not provide the data, it will not be possible to perform the above actions.

10. What about automatic decision-making?

We will not make decisions about you that are based solely on automated processing, including profiling, and that produce legal effects or otherwise materially affect you in a similar way.

11. Changes to this Privacy Policy

This Privacy Policy will be reviewed and updated once a year, if necessary. If we make any material updates to our processing of your personal data, we will notify you of such changes and obtain your consent where necessary. Non-material changes will be reflected in this Privacy Policy, and we encourage you to review it regularly. This Privacy Policy was updated in 2026.