External privacy notice
1. Introduction and scope
This External Privacy Notice has been adopted by Billerud AB and its subsidiary companies (each company is individually referred to as "Billerud", "we" or "us"). The External Privacy Notice has been adopted to describe how we process your personal data in the situations described below and how we use cookies on our public websites.
Billerud AB or one of its subsidiary companies is the data controller in respect of the processing of your data, as indicated in Section 4.1 below.
The External Privacy Notice applies to our processing of personal data relating to you:
(i) as representative or contact person of our business customers, suppliers, contractors and distributors, including where you are using customer portals or other digital services that we may provide;
(ii) as a forest owner, prospective forest owner, or user of digital services and applications that Billerud provides for forest owners;
(iii) as visitor of our public websites or social media profiles/pages or subscriber to our newsletter or other information from us;
(iv) as visitor at our offices, mills, production facilities or other operational sites where camera surveillance is conducted; or
(v) being specifically referred to this External Privacy Notice, e.g. by an agreement, a notice or similar.
We appreciate your interest in our company and your visit to our website. We are committed to your privacy and have a duty to fulfil the provisions of the EU Regulation 2016/679 (General Data Protection Regulation). Please read the following information regarding how we process your personal data.
If you have any questions about this information, or if you wish to exercise any of your rights as set out below, please contact Billerud via the contact information listed under Section 4.2 below.
2. Collection and processing of personal data, including legal grounds
2.1 General
The term "personal data" means any information which, either directly or indirectly via other data, can be linked to a natural individual, such as name, address, telephone number, e-mail address, personal identification number, IP address and logs from a web browser.
The term "processing of personal data" means any operation performed on personal data, such as the collection, storage, adaptation, disclosure or compilation of personal data.
2.2 Collection, processing and deletion of personal data, including legal grounds
2.2.1 Contact persons and other representatives at our business customers/suppliers
Data and purpose: We process personal data that you or your employer (i.e. our business customer or supplier) have provided to us for the purpose of (a) administering the relationship with you in your capacity as contact person, signatory or other representative of an entity being a registered or potential business customer or supplier with us and (b) sending relevant marketing, invitations and information to the business customer or supplier that you represent. For example, this may concern name, contact details, personal identification number (if the customer/supplier is a sole trader), preferences/interests as well as the history of purchased products and services.
If you have been granted access to a customer portal that we provide, we will process your log in details in order to provide the customer portal.
Retention and erasure: The data will be kept until we have been notified of a new person that shall be the contact person and/or representative or, if you are a user of a customer portal, until you have deleted your account.
Legal ground: We base the processing on our legitimate interest of maintaining, and establishing, the relation with our business partners (business customers/suppliers), including our interest in providing customer portals where applicable.
2.2.2 Forest owners and digital services
Data and purpose: We process personal data about you as a forest owner, including contact details, property holdings, land holdings, geographic information linked to forest properties, harvesting areas and other data relating to your forest holdings. The data is processed in order to administer the contractual relationship with you as a forest owner, to plan and follow up on forestry measures, to ensure traceability and sustainability monitoring in our operations, and to fulfil requirements under applicable certification schemes, industry standards and control mechanisms. The data may, where applicable, be shared with external auditors, certification bodies, control bodies or other parties conducting audits or verifications relating to such requirements, as well as with service providers, IT providers and other business partners that process data on Billerud's behalf under agreement, and with public authorities where required by law.
We also process name and address about you as a forest owner, collected from external sources such as public and private registers, for the purpose of informing you, as a trader, about our business.
If you use a digital service or app provided by Billerud, we may also process data about you and your forest holdings in order to: i) provide information about your forest holdings and your forest management plan, ii) enable advisory services and dialogue regarding forestry measures, iii) facilitate transactions between you and Billerud, iv) provide relevant information, news and marketing regarding our products and services, and v) develop, analyze and improve our digital services and provide support, troubleshooting and security-related functions.
For processing of personal data about a hunting team and its members in connection with hunting leases administered via the web-based service Jaktrapport (www.jaktrapport.se), a separate privacy notice applies, see Behandling av personuppgifter. This External Privacy Notice does not apply to such processing.
Retention and erasure: The personal data is processed for as long as necessary to fulfil the purposes above, or for as long as required by law, agreement or applicable certification requirements. The data is thereafter deleted or anonymized in accordance with Billerud's data retention routines.
Legal ground: The processing is carried out in order to fulfil an agreement with you as a forest owner and on the basis of our legitimate interest in administering the contractual relationship, providing digital services, ensuring traceability and sustainability monitoring, fulfilling requirements under applicable certification and control systems, and informing existing and prospective forest owners about Billerud's business, products and services.
2.2.3 Websites and social media
Data and purpose: Billerud collect personal data such as name, e-mail address and other information which you voluntarily provide. Billerud also receives and stores information from your web browser, such as IP address, cookie information and the pages you visit, to log files on our server. For more information regarding cookies, please refer to section 3 and 6 below.
Billerud uses the information collected to respond to your requests regarding products and services, to improve the content on our website and the services we provide and to develop anonymous usage statistics.
We also use personal data for direct marketing in accordance with law and market practice. We use the information we collect with regard to how you, as a user, use of the website so that we can analyse search behavior and be able to provide you with personalised content. Personal data may also be processed indirectly in connection with the development and administration of Billerud's IT systems.
Personal data that we request from you and indicated as mandatory is required to be provided in order for us to fulfil your request, e.g. to send news letters that you subscribe to. Please note that Billerud is not responsible for your privacy or the content on external websites to which we may provide links on this website.
Retention and erasure: Billerud erases collected personal data when the purpose of the processing has been completed.
Legal ground: We will process your personal data when it is necessary to fulfil a request from you or otherwise when it is necessary for the purposes of a legitimate interests for Billerud, inter alia, for improving the website. If a certain data process requires your prior consent, we will collect such consent before carrying out the processing in question.
2.2.4 Camera surveillance
Purpose and data: As part of Billerud's safety work, we use camera surveillance at our offices, mills, production facilities, industrial sites, access points and other operational areas where camera surveillance is considered justified. The camera surveillance is used to prevent, detect and investigate crime, unauthorized access, security incidents, accidents and other events that may affect the safety of people, facilities, equipment or operations. The personal data processed mainly consists of image and video material of individuals present within the areas under camera surveillance. Camera footage may be disclosed to law enforcement authorities, insurers, or other recipients where necessary to investigate or manage an incident, or where disclosure is required by law.
Retention and erasure: Personal data collected through camera surveillance is retained only for as long as necessary to fulfil the purposes above and is handled in accordance with Billerud's internal data retention and information management routines. Where the material is needed to investigate an incident, a security event or legal proceedings, it may be retained for a longer period.
Legal ground: We base the processing of personal data carried out through camera surveillance on our legitimate interest in protecting our employees, visitors, facilities, assets and operations, and in maintaining an appropriate level of security within Billerud's operations.
2.2.5 Other processing when you have been specifically referred here
If you have been referred to this External Privacy Policy from any other document (e.g. an agreement), it means that the purpose and retention of, and the legal ground for, the current processing as well as the data being processed are specified in the document that referred you here.
2.3 Disclosure of personal data to a third party
Billerud will not sell your personal data to a third party. We may share personal data with companies within the Billerud Group, suppliers and other business partners that process personal data on Billerud's behalf, as well as with certification bodies, control bodies, external auditors and other recipients where necessary to fulfil applicable certification requirements, sustainability requirements or other audit and control processes. Personal data may also be disclosed where required by law, a decision by a public authority, or another legal obligation.
Where personal data is transferred to Group companies, suppliers or other recipients outside the EU/EEA, Billerud is responsible for ensuring that the personal data is protected at a level equivalent to that within the EU/EEA, for example by using the European Commission's standard contractual clauses or another approved transfer mechanism.
2.4 Your rights in relation to your personal data
You have certain rights under applicable data protection legislation in relation to our processing of your personal data. If you wish to exercise any of your rights or have questions about how we process your personal data, please contact us using the contact details in Section 4.2 below.
As specified in the General Data Protection Regulation, you have the right to:
- request access (a record of the personal data undergoing processing) to your personal data;
- request rectification of your personal data;
- request erasure of your personal data;
- request that we restrict the processing of your personal data;
- object to the processing of your personal data and, in respect of processing based on your consent, to withdraw your consent at any time; and
- receive personal data about you that you have provided to us (data portability).
You are also entitled, at any time, to submit complaints to the relevant supervisory authority if you consider that our processing is not carried out in accordance with applicable data protection legislation.
3. Billerud's use of cookies
On our website we use cookies in order to give you the best possible experience when you visit the site.
3.1 What is a cookie and what is it used for?
A cookie is a small text file that the website you visit stores on your computer (or a similar device, such as a tablet or mobile phone).
There are two types of cookies - persistent cookies and session cookies. This website uses both types of cookies. Persistent cookies are stored as a file on your computer for a certain period of time until they are deleted by the visitor to the website or the server that sent them. Session cookies are stored temporarily while the visitor is browsing on a webpage and disappear when the visitor closes their web browser.
Cookies are either first party cookies or third party cookies. First party cookies are placed by the website that you visit, whilst third party cookies are placed by another party/website than the website you are visiting. Third party cookies are for example often used by advertising networks to identify a certain user and to use information about how such user has consumed content on the various websites and provide (customized) marketing on the various websites included in the network.
3.2 Consent to the use of cookies
According to the Swedish Act on Electronic Communication (SFS 2003:389), everyone who visits a website with cookies shall have access to information that the website contains cookies and the purpose of using these cookies. The visitor must also consent to the use of cookies. You consent by allowing cookies or categories of cookies in the cookie message that appears when you visit the website.
You can, at any time, change your cookie settings in the cookie message.
If you, now or in the future, wants to say no to cookies or delete cookies, you can also do so by changing your web browser settings, please refer to the next section.
3.3 If you want to avoid cookies
You can choose to block cookies via your browser settings so that it automatically denies the placement of cookies or informs you every time a website requests to place a cookie. You can also delete cookies already stored in your browser. Exactly how this may be done varies between different browsers and you can read more about this in your browser instructions or in the help function included in most browsers. Some service providers, e.g. Google, also provides its own opt out tools that you can read more about on their websites.
Please visit www.aboutcookies.org for more information about how to manage and remove cookies.
Please note that blocking cookies may result in you not having full access to all pages and functions on our website. It may also adversely affect your user experience.
4. Data controller and contact
4.1 Data controller
Websites, social media and newsletters: The Billerud Group company that provides the specific website, social media profile/page or the newsletter is the data controller. Billerud AB is the data controller in respect of the corporate site of Billerud Group.
Business customers/suppliers: The Billerud Group company that has entered into an agreement with the business customer or supplier is the data controller.
Camera surveillance: The Billerud Group company that is specified in the information text located at each location where camera surveillance is conducted is the personal data controller, or if not specified therein, Billerud AB.
When you, in other cases, have otherwise been referred to this External Integrity Notice: The Billerud Group company that is specified in the document that refers you here is the personal data controller, or if not stated therein, Billerud AB.
4.2 Contact details
If you have any questions regarding this External Privacy Notice or on how we process your personal data or if you further contact details to the data controllers above, please contact us by e-mail, post or telephone.
Billerud AB
PO Box 703
SE-169 27 Solna, Sweden
Tel: +46 (0)8 553 335 00
For general questions: info@billerud.com
For questions or requests relating to Section 2.4: privacy@billerud.com
5. Updates of the external privacy notice
Billerud may, at any time, revise this External Privacy Notice by posting an updated version on the website.
This External Privacy Notice was last updated on 25 September 2026.