DOMTAR EUROPEAN PRIVACY POLICY - CUSTOMERS

This global privacy policy (the “Privacy Policy”) describes our practices in connection with the personal data that you provide to any European company in our Group (a “Group Company”) by any means, including off line forms (e.g., product orders), telephone calls, email, a website which is operated (as indicated in its conditions of use) by a Group Company (the “Website”) (the “Personal Data”). An updated list of our European Group Companies is available here.

1. Updates to this Privacy Policy

We may change this Privacy Policy. Please take a look at the “Last updated” legend at the top of this document to see when this Privacy Policy was last revised. The processing of your Personal Data will be governed by the Privacy Policy in force at the time your Personal Data are collected unless otherwise agreed by you or allowed under applicable law.

2. Who determines which Personal Data are collected, how and for which purposes (the data controller)?

The data controller (“us”, “we”, and “our”) will be:

- For products or services contracted offline: the Group Company that contracts with you, as identified in the terms and conditions applicable to the purchase or use of the relevant product or service.

- For products and services contracted online:

  (1) in all events, the Group Company that operates the relevant Website, as identified in its conditions of use; and

  (2) if you purchase or use a specific online product or service (other than mere browsing), the Group Company that contracts with you, as identified in the relevant terms and conditions applicable to the purchase or use of the relevant product or service.

All terms and conditions of our products and services (unless expressly provided for therein), including this Privacy Policy, may be assigned to any third party.

3. How is your Personal Data collected?

  • Directly from you, when you are interacting with a Group Company, for example information you give us as requested by phone, email or detailed in the forms you may be asked to complete and also information we collect automatically from your use of our products and services such as your interaction with adverts that we place on websites or other media.
  • From third parties: if allowed by law,for example, if you are in the process of contracting for a product or service for which we need to evaluate your financial solvency, we may check your credit rating by consulting financial solvency files held by third parties, we may also be receive your data from third parties for one of the purposes specified below.

4. Which Personal Data and for which purposes are they used by us?

We collect Personal Data (automatically, as detailed in the forms you will be asked to complete or provided by you in your e-mail queries or telephone inquiries, which may include health related data such as a degree of incontinence, prescriptions, etc.) as required for following purposes:

(1) To evaluate an application to contract our products or services or participate in any competition. For example, this may include verifying whether you are eligible to enter into a competition or to check your credit rating when purchasing a product, etc.

(2) To provide you with a product or service you have requested and manage our contractual relationship with you. For example, to answer your questions or respond to comments submitted to us; to send you information or samples you have requested; to perform and enforce the terms and conditions that govern the product or service (which may include, depending on the product or service, the recording of calls between us and you to evidence the rendering of the product or service or to identify any breach of the terms and conditions that govern the product or service, for accounting, billing and payment verification purposes, to collect debts, to serve notice of unpaid, due and enforceable debts to solvency files which payment has been requested from you); to award a prize if you are the winner of a competition, to post content you have submitted for publication, to share your Personal Data with payment processing organizations, to request you to fill in a questionnaire to better understand your circumstances and better assess your needs, etc.

(3) To comply with our (contractual and legal) obligations or defend our interests in judicial or administrative proceedings (in any relevant jurisdiction). For example, this includes responding to the requests of governmental and judicial orders of any competent jurisdiction or sharing the Personal Data with other enforcement agencies regarding any mandatory requirement; to comply with our Group policies (such as Anti-Bribery policies) or to share information with sick funds or insurance companies.

(4) To carry out any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock. For example, this includes a sale of our assets in connection with a bankruptcy proceeding or an intra-group corporate or business reorganization.

(5) To analyse how our products and services are used by our customers and to improve our business. For example, this includes the analysis of statistical information on the use of our websites by visitors and of any feedback on our business or testimonials that you may provide.

(6) To honour your preferences on direct marketing and for advert targeting purposes. You may receive direct marketing communications on personal care, medical devices, cosmetic and hygiene products and services, which may or may not be personalised for you (i.e., tailored to your profile), by any means (e.g., post, phone call, email, text message or other electronic means) and carry out targeted advertising. For example, whenever you provide us with any Personal Data (e.g., when you ask for our products or services), you may be asked for your preferences in this respect and provide you with information on the kind of direct marketing available and on whether us and/or a third party may send you such direct marketing or carry out targeted advertising. You may also decide to subscribe to one of our newsletters. To discontinue direct marketing or targeted advertising, you may send a request as explained in section 7. Furthermore, and regarding direct marketing by electronic means, where required by applicable law, we will obtain your consent inform you in each of our communications how to unsubscribe in a straightforward way and at no cost (other than as related to transmission of your request). We will answer your request as soon as reasonably practicable, and in any case, within the legally determined term (if there is one).
Please note that if you do opt-out of receiving marketing-related messages from us, we will still send messages as necessary to fulfill other purposes (such as administrative messages relating to the operation of the product or service).

5. Which Personal Data and for which purposes are they shared with third parties?

Personal Data may be used or shared with another Group Company or other third parties if:

(i) it is necessary for the following purposes mentioned in section 4 above:

(1) to evaluate an application regarding the contracting of our products or services or participate in any competition, (2) to provide you with a product or service you have requested and manage our contractual relationship with you, (3) to comply with our (contractual and legal) obligations or defend our interests in judicial or administrative proceedings; (4) to carry out any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock; and (5) to analyse how our products or services are used by our customers and to improve our business;

(ii) it is necessary (6) to honour your preferences on direct marketing and targeted advertising purposes (mentioned in section 4 above), i.e., if you have agreed to receiving marketing and targeted advertising; or

(iii) to support us in performing any of the abovementioned purposes (e.g., cloud services providers that provide ICT infrastructure used by us to provide you with a product or service or Group management, administrative and support services, including ICT, finance and accounting support and internal audits).

All of these third party recipients may be located world-wide, including outside of the European Economic Area (EEA) (such as the US*). These countries may provide personal data protection standards that are not necessarily equivalent to those applicable in the EEA (in which case, specific safeguards are adopted by us for personal data originating in the EEA, such as ensuring the third party complies with either the Safe Harbor Principles, is subject to another adequacy finding or enters into a written agreement with us requiring that the third party provides a level of privacy protection equivalent to the one required within the EEA).

(*) In particular, this is the case of our affiliate in the US, Attends Healthcare Products Inc. (8081 Arco Corp Drive, Suite 330, Raleigh NC 27617).

6. Your responsibilities when you provide us with or allow us access to your Personal Data

You must provide accurate Personal Data and only when you are 18 years of age(*) or over and keep them up-to-date. You must comply with any data protection and privacy legal requirements applicable to you. You must comply with and not disable any security measure of a Website. If you are acting as a (legal or de facto) representative of any legal entity, you must only provide your professional contact details in respect of that legal entity (and never your private contact details).

(*) We do not intend to collect, or direct any Personal Data collection to, data of individuals under 18 years old, and we request you that these Personal Data are not provided to us.

7. Managing your rights regarding your Personal Data held by us as data controller

You may contact us (at dpc.dataprivacy@domtar.com with written proof of your identity) (i) to request a copy of your Personal Data; or (ii) to request that your Personal Data be rectified or deleted if it is inaccurate or incomplete; or (iii) to object to the processing of your Personal Data for certain purposes (such as direct marketing). We will answer your request as soon as reasonably practicable, and in any case, within the term legally determined (if there is one in the relevant jurisdiction).

8. Cookies

Cookies are information files stored on your computer that help websites remember who you are and information about your visit. In those Websites where cookies are used, you will find a cookie policy which provides detailed information on which cookies are used therein, how to deactivate them and the consequences thereof.

9. Third party websites

The third party websites you access through the Website fall outside of our control and are not covered by this Privacy Policy but governed by the privacy policies of these third parties’ websites that are neither reviewed nor endorsed by us.

Last update: June 2015