Skip to main content

Privacy Statement

SMURFIT WESTROCK GROUP - DATA PROTECTION NOTICE


1. PURPOSE AND SCOPE OF NOTICE

This notice is intended to explain how your Personal Data will be handled by Smurfit Westrock Foundation (the "Foundation", "we", "us" and "our") and sets out the information including the personal information detailed below relating to you ("Personal Data") that will be collected and processed by the Foundation and/or on its behalf by its third party service providers in the context of your dealings with us. 
For the purposes of this notice, the controller of your Personal Data is Smurfit Westrock Foundation, registered as a charity in Ireland (charity number 20008963of Beech Hill, Clonskeagh, Dublin 4. Overall, your Personal Data will be under the responsibility of the Foundation. For more information about the Foundation, including a full list of entities in the Smurfit Westrock Group, click on this link. The Foundation has established procedures in place to ensure that your Personal Data is protected. If you have any questions or concerns about this notice, please email the Smurfit Westrock Group Legal department at grouplegal@smurfitwestrock.com

2. APPLICATION OF THIS NOTICE

IMPORTANT: please note that this Notice, while intended to be as complete and accurate as reasonably possible, is not exhaustive and may be updated from time to time in accordance with section 11 of this Notice.

This Notice is separated into a number of sections, some or all of which may be relevant to you depending on the nature of your relationship with the Foundation. In all cases, you have certain rights under data protection law which are set out in section 10. In particular, you have a right to object at any time to the processing of your Personal Data where we process your Personal Data on the legal basis of pursuing our legitimate interests.

Online Content & Marketing: if you have signed up to any online content or to receive marketing communications from us, you can read about how we will use your Personal Data for this purpose at section 4 OR by clicking here.

Website Users: if you use our website, Smurfit Westrock Foundation, (the "Website"), you can read about how we use your Personal data as a website user at section 5. Website users should also read our Cookies Policy.

Existing  or potential charity/ not for profit: if you are an existing or potential charity or not for profit  of Smurfit Westrock Foundation, you can understand how we process your Personal Data for administrative purposes at section 6.

3. WHAT PERSONAL DATA WE PROCESS


Depending on your dealings with us, we will process the following types of Personal data about you :

  • If you are an online /marketing contact, your name, your employment details with the relevant charity/ not for profits , your employment contact details, your business activities and interests and information relating to your subscription to, receipt of or interest in any of our mailing lists or newsletters.
  • If you use the Website, information about your visits to our Website, your location and IP address, the browser software you use and the date and time you access the Website,
  • If you are a  charity/ not for profit: your name, charity/ not for profit employer details, bank information, your employment contact details, details of your visits and your correspondence and communications with our staff and any information which is provided to us by you or on your behalf.
     

4. MARKETING AND BUSINESS CONTACTS


If you are a marketing/business contact we may obtain, collect and process your Personal Data for the following purposes:

  • To promote the Foundation’s activities;
  • To invite you to events;
  • To develop and maintain relationships with you;
  • To manage and administer our relationship with the Foundation’s contacts and with our charity/ not for profit contacts;
  • To send you marketing material, newsletters and other information;
  • To monitor and analyse your interest in the material we send to you;
  • To send you marketing information by post provided you have not objected to this; and
  • To take, collect, store and post photographs from the Foundation’s events or any photographs provided by you with your consent.
     

In these circumstances we generally rely on your consent to provide you with information about the Foundation’s projects and updates through direct marketing. In all other circumstances, including where we are already in contact with you, we rely on our legitimate interest to continue to contact you about projects which we think may be of interest to you.

You will always have the opportunity to stop receiving marketing communications. Where relevant, with postal communications you can opt out using the contact details in section 11. [You can always opt out of email marketing from us by clicking the "unsubscribe" link at the bottom of marketing emails which we send you.]

5. WEBSITE USERS


If you visit our Website we may obtain, collect and process your Personal Data for the following purposes:

  • To provide, improve, test and monitor the effectiveness of the Website;
  • To monitor metrics such as total number of visitors, traffic data and demographic patterns;
  • To ensure content on the website is presented in the most effective manner for you and to enhance your use of the website; and
  • To notify you of any changes to the Website and/or our services.
     

We obtain, collect and process this personal information based on our legitimate interest in ensuring that the Website is operating smoothly and in order to analyse which content is of most interest to visitors. This helps us to keep the Website available and to improve your experience when you visit the Website.


6. EXISTING CHARITIES/ NOT FOR PROFITS 


As an existing or future charity/ not for profits which the Foundation will work with, we may obtain, collect and process your Personal Data for the following purposes:

  • To conduct administrative, payment and operational processes;
  • To review and respond to any correspondence or queries you send us;
  • To monitor project progress and procedures;
  • To conduct due diligence checks;
  • To fulfil our agreement and comply with our obligations under the terms of engagement we may have with you;
  • To process any financial payments and manage the charities account with the Foundation;
  • To enter into contractual relations with the organisation with which you are connected;
  • To send you marketing information. Please see section 4 of this Notice for further information.
  • To comply with applicable Member State and European Union company law;
     


We obtain, collect and process your Personal Data for the above purposes based on the following legal bases:

  • our legitimate interest to ensure the operation of our business and the maintenance of our customer relationship with you;
  • a necessity in order to enter into and perform a contract with you;
  • a necessity to process your Personal Data in order to comply with a legal obligation under applicable Member State and European Union law to which we are subject.
     

In the event that you do not wish to provide us with your Personal Data so that we can process it for the purposes outlined above, we will not be able to provide services to you.

7. DISCLOSURE OF YOUR PERSONAL DATA

Depending on your dealings with us, we may disclose some or all of the Personal Data we collect from and obtain about you to the following parties: members of the Smurfit Westrock Group, service providers who provide support services, IT & website service providers, marketing companies, PR agencies, printers, advertising agencies and other suppliers, other people in your organisation, third parties involved in hosting or organising events, professional advisors such as tax or legal advisors, consultants and accountants, regulatory authorities (e.g. enforcement agencies and public bodies).

8. GROUP TRANSFERS OF YOUR PERSONAL DATA

We may transfer your Personal Data outside of the European Economic Area ("EEA") to other members of the Foundation and other recipients. Certain Recipients (our third party service providers and other Smurfit Westrock Group companies) who process your Personal Data on our behalf may transfer your Personal Data outside the EEA to a country that does not provide an adequate level of protection to your Personal Data. Where such transfers occur, it is our policy that: a) they do not occur without our prior written authority; and b) that an appropriate transfer agreement with the standard contractual clauses (where necessary) are  put in place to protect your Personal Data. If you would like to find out more about any such transfers, please contact our Data Protection Representative whose details are set out in Section 11 of this notice.


9. RETENTION OF YOUR PERSONAL DATA

In general, we expect to keep your Personal Data for what we deem a reasonable period after contact is made for marketing purposes. Once we have determined that we no longer need to hold your Personal Data, we will delete it from our systems.

Please note that in certain circumstances, we may hold your data for a longer period, for example, if we are processing an ongoing claim or believe in good faith that the law or a relevant regulator may reasonably in our view expect or require us to preserve your Personal Data. If you would like to know more about how long we will retain your Personal Data, please contact our Data Protection Representative whose details are set out in Section 11 of this notice.

 

10. YOUR RIGHTS AND HOW TO EXERCISE THEM


You have a number of rights in relation to your Personal Data, which are set out in this section 10. In particular these rights include the right to object to processing of your Personal Data where that processing is carried out for our legitimate interests. Note that in certain circumstances these rights might not be absolute.

Right Further Information
Right to Object You have a right to object at any time to the processing of your Personal Data where we process your Personal Data on the legal basis of pursuing our legitimate interests. When we process your Personal Data based on our legitimate interests, we make sure to consider and balance any potential impact on you and your data protection rights. We will not use your Personal Data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted by Member State or European Union law).
Right of Access You have the right to request a copy of the Personal Data held by us about you and to access the information which we hold about you. We will only charge you for making such an access request where we feel your request is unjustified or excessive.
Right to Rectification You have the right to have any inaccurate Personal Data which we hold about you updated or corrected.  
Right to Erasure In certain circumstances, you may also have your personal information deleted, for example if you exercise your right to object (see below) and we do not have an overriding reason to process your Personal Data or if we no longer require your Personal Data for the purposes as set out in this notice.
Right to Restriction of Processing You have the right to ask us to restrict processing your Personal Data in certain cases, including if you believe that the Personal Data we hold about you is inaccurate or our use of your information is unlawful. If you validly exercise this right, we will store your Personal Data and will not carry out any other processing until the issue is resolved.
Right to Data Portability You may request us to provide you with your Personal Data which you have given us in a structured, commonly used and machine-readable format and you may request us to transmit your Personal Data directly to another data controller where this is technically feasible. This right only arises where: (1) we process your Personal Data with your consent or where it is necessary to perform our contract with you; and (2) the processing is carried out by automated means.

You can exercise any of these rights by submitting a request to our Data Protection Representative in writing to Legal Department, Beech Hill Drive, Clonskeagh, Dublin 4.

We will provide you with information on any action taken upon your request in relation to any of these rights without undue delay and at the latest within 1 month of receiving your request. We may extend this up to 2 months if necessary, however we will inform you if this arises. Please note that we may ask you to verify your identity when you seek to exercise any of your data protection rights.

You also have the right to lodge a complaint with the Data Protection Commission. For further information see www.dataprotection.ie.

11. CHANGES TO THIS NOTICE & QUESTIONS


We may amend this Notice on occasion, in whole or part, at our sole discretion. Any changes will be effective immediately upon communicating the revised notice to you.

If at any time we decide to use your Personal Data in a manner significantly different from that stated in this notice, or otherwise disclosed to you at the time it was collected, we will notify you by e-mail or post, and you will have a choice as to whether or not we use your Personal Data in the new manner.

 

If you have any questions, comments or concerns about the way your Personal Data are being used or processed by the Company, please submit your question, comment or concern in writing to our Data Protection Representative at grouplegal@smurfitwestrock.com or by post to Group Legal Department, Smurfit Westrock Group, Beech Hill, Clonskeagh, Dublin 4, Ireland.