Privacy Notice

(„Essity” or „We”) is committed to protecting your privacy. This Privacy Notice outlines how Essity, as a data controller under the General Data Protection Regulation (“GDPR”) and the e-Privacy Regulation (“e-Privacy Regulation”) collects and processes personal data and other information about users.

 

  1. Categories of Personal Data and purposes of processing

 

Metadata

 

You are entitled to use our website or mobile application without providing any personal data related to you. In this case Essity will only collect the following data that is generated as a result of your use:

 

Sender page, access details and time, amount of data transferred, transmission status, web browser type, IP address, operating system and interface, language and browser software version.

 

We use your IP address to enable you to access our website or application. After the IP address is no longer required for this purpose we will shorten it by removing the last 8 characters of your IP address. The metadata, including the shortened IP address, is used to improve the quality and services of our website or application by analysing the behaviour of our users.

 

User account

 

If you open a user account on the website or in the app, we may ask you to provide us certain personal information, including: your name, address, e-mail address, password of your choice, telephone number, bank account details, credit/debit card details, billing and shipping addresses, enquiries about certain products/services (voluntary), requests to receive marketing emails (voluntary). Essity processes this personal data for the purposes of providing services sending you marketing materials and to the extent permitted by applicable law moreover to analyse your interests for marketing purposes.

 

Product orders

 

When you order a product through our website or app, Essity collects and processes the following personal data about you: your account details, product type and quantity, purchase price, order date, order status, product returns, customer service requests. Essity processes this personal data for the purposes of fulfilling its contractual obligations and product orders, providing customer support services, complying with legal standards, submitting, asserting and defending legal claims and for targeted marketing activities.



Giveaway games 

 

If you participate in giveaway games Essity collects and processes the following personal data about you: name, address, e-mail address, date of data input, fact of selection as a winner, prize, quiz answer. Essity processes this personal data for the purposes of carrying out the game, notifying the winner, delivering the prize to the winner, managing the event and for marketing purposes.



Health data

 

Essity may also collect and process health data when you order certain products as a result of the order of the product. Health data is considered sensitive data under the GDPR and Essity will take all necessary steps to protect such sensitive data as required by law. Subject to consent Essity collects and processes health data only for the purposes of contractual relationship and fulfilling product orders, providing customer support services, complying with legal obligations, defending, establishing and enforcing legal claims, and for personalized marketing purposes.



  1. Third parties 


  • Transfer to service providers

 

Essity may use third-party service providers that are considered Essity’s data processors to provide certain services to Essity such as website service providers, marketing service providers or IT support providers. In the course of providing these services these third party service providers are entitled to access and/or process your personal data. To ensure the confidentiality and protection of your personal data we expect these third party service providers to implement and maintain appropriate security measures.


  • Other recipients

 

Essity may transfer personal data to law enforcement agencies, government agencies, legal representatives, external consultants or business partners in accordance with the provisions of applicable data protection rules. In the event of a merger or acquisition of business entities personal data may be transferred to third parties involved in the merger or acquisition.


  • International transfers of personal data 

 

The collected or received personal data can be transferred to or processed by recipients located within or outside the European Economic Area (“EEA”). For the list of countries that ensure an adequate level of protection of personal data under European data protection law, please click on the following link: http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm. However, other recipients are located in countries that do not guarantee an adequate level of protection of personal data under European data protection law. Essity will take all necessary measures to provide an adequate level of protection for data transfers outside the EEA as required by applicable data protection law. In the case of transfers to countries that do not guarantee an adequate level of data protection transfers will be made on the basis of appropriate safeguards, such as standard contractual clauses adopted by the European Commission or any supervisory authority or approved codes of conducts subject to binding and enforceable commitments of the recipients or approved certification mechanisms subject to binding and enforceable commitments by the recipients.  You have the right to request a copy of these appropriate guarantees as set out in Section 7 (contact us).

 

  1. Legal basis for processing

 

We process your personal data on the following legal bases:

 

  • you have given your consent to the processing of your personal data for one or more specified purposes;

 

  • the processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract;

 

  • processing is necessary for compliance with a legal obligation to which we are subject;

 

  • processing is necessary to protect your vital interests or those of another natural person;

 

  • processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us;

 

  • processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require the protection of personal data, in particular if you are a child;

 

  • other applicable legal basis for processing, in particular on the grounds of the provisions laid down in the legislation of the Member States;

 

The legal basis for processing your sensitive data may include: 

 

  • you have given your explicit consent to the processing of your sensitive data for one or more specified purposes;

 

  • processing is necessary for the purposes of carrying out  of Essity’s or your obligations  and the exercise of your specific rights arising from  the field of employment and social security and social protection law;

 

  • the processing concerns personal data that you have explicitly disclosed;

 

  • processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.

The disclosure of your personal data is required by law or by contractual obligation, or is necessary to enter into a contract with us or to provide you  the products or services you request or you have simply done so voluntary.

 

Refusal to provide personal data may result in certain disadvantages for you for example it is possible that we may not be able to provide you with certain products or services. However, unless otherwise provided, refusal to share your personal data will not have any legal consequences for you.



  1. What rights do you have and how can you exercise them? 

 

If you have given your consent to collection, processing and use of your certain personal data, you have the right to withdraw your consent at any time for the future. You also have the right to object to the processing of your personal data for marketing purposes without any additional costs above the distribution costs based on the basic fees.

 

In accordance with the applicable data protection rules, you have the right to: (i) request access to your personal data; (ii) request rectification of your personal data; (iii) request erasure of your personal data; (iv) request restriction of the processing of your personal data; (v) request portability; (vi) object to the processing of your personal data (including objection to profiling); and (vii) object to automated decision-making (including profiling).

 

Please note that your abovementioned rights may be subject to restrictions under applicable national data protection laws. Please find below more information about your rights which you are entitled to in cases covered by the GDPR. 

 

To exercise your rights, please contact in accordance with Section 7 below.

 

You have the right to lodge a complaint to the competent data protection supervisory authority: Authority for Data Protection and Freedom of Information (e-mail address: ugyfelszolgalat@naih.hu, Postal address: 1363 Budapest, Pf.: 9.)

 

  1. Cookies and other tracking technologies

 

This website or application uses cookies. For more information, please see our Cookie Policy.

 

  1. How long do we process your personal data? 

 

Your personal data will be stored for as long as it is necessary to provide the services and products you requested. Following the termination of our legal relationship  we will remove your personal data from our systems and records or take appropriate steps to anonymise the data unless we need to retain the data to comply with a relevant legal obligations (e.g. for tax purposes). We will keep your contact details and interests in our products or services for longer periods insofar as Essity is entitled to send you marketing materials. We may also be obliged under applicable law to retain certain personal data for up to 8 years after the end of the relevant tax year. Moreover we may retain your personal data on a need-to-know basis even after termination of the contractual relationship  if it is necessary to comply with other laws or to assert, exercise or defend legal claims. After the termination of our contractual relationship we will restrict the processing of your personal data to these limited purposes as far as possible.

 

  1. Contact us

 

If you wish to exercise your rights as a data subject or if you have any other questions about this Privacy Policy, please send your request by e-mail to:

 

dataprivacy@essity.com

 

Essity Aktiebolag (publ), Compliance&Ethics Team, P.O. Box 200, SE-101 23 Stockholm, Sweden