Ahlstrom Data Protection Statement

1. General

This Data Protection Statement applies to all external stakeholders, such as customers, website visitors, potential job applicants, partners and suppliers, of Ahlstrom Oyj and its subsidiaries (“Ahlstrom”, “us”, “we”). We protect your privacy and always strive for a high level of data protection. This Data Protection Statement explains how we collect and process your personal data within the scope of your relationship with Ahlstrom.

Please carefully read this Data Protection Statement, especially in the section that relates to your role or position in the relationship with Ahlstrom (customer, website visitor, job applicant, partner or supplier).

If you have any questions about how we process your personal data, you are always welcome to contact us via the contact details below.  

2. About Ahlstrom

We are Ahlstrom and our main activity is to develop fiber-based specialty materials, supply innovative and sustainable solutions to our customers

We take the protection of your personal data seriously. We are committed to fulfilment of our data protection obligations set by the General Data Protection Regulation, as well as other relevant laws and regulations.

3. Data Controller’s Contact details

Ahlstrom Oyj 

Keilaranta 18
01250 Espoo
Finland 

Commercial ID (Y-tunnus): 2480661-5

Email: dataprotection@ahlstrom.com

4. Processing of personal data

4.1 Sources of personal data

We receive most of the personal data directly from you. Personal data may be collected during ordering, purchasing, shipping of our products and services, managing customer relationship between you and Ahlstrom or visiting our website, subscribing to our newsletters, etc.

4.2 Purposes of processing personal data

In the table below you can find what personal data is being processed for which purposes and what are the legal bases for such processing. Please pay attention to a relevant section that applies depending on your role or relationship with Ahlstrom.

If you are Ahlstrom’s customer

Processing purpose	Legal basis	Data categories
Management of customer relationship	Contract	Name, contact details, title, company representation, physical address, phone number, customer communication
Customer survey	Legitimate interest	Name, contact details, ratings of NPS and comments from the NPS forms.
Organizing virtual conventions	Consent Legitimate Interest	Customer details such as name, title, home address, telephone and mobile numbers, email address, date of birth, sex, customer number, purchase and/or service use history and details. Corporate customer, partner and vendor details such as name, title, home address, telephone and mobile numbers, email address, date of birth, sex, service use history and details. IT management details such as details of equipment data related to the service provided including technical identifiers, username, location, contact details, communication data and metadata and technical events related to the services provided including system and application logs.
Social media marketing	Legitimate Interest	Name, contact details
Newsletter / Email marketing	Consent Legitimate Interest	Name, contact details, title, company representation, information about product interest
Lead generation activities	Consent	Name, contact details, information about product interest
Content and Material storage and distribution	Legitimate Interest	Contact details, activity with the content with have been sent (through the cookies)
Campaign management, lead qualification and management	Consent Legitimate Interest	Names, emails, phone numbers, addresses

If you are Ahlstrom’s website visitor

Processing purpose	Legal basis	Data categories
Development of our services and products (including website)	Consent	Cookie preferences and cookie-related information from website visitors. Please see our Cookie Policy for more information.

If you are Ahlstrom’s potential customer

Processing purpose	Legal basis	Data categories
Social media marketing	Legitimate Interest	Name, contact details
Lead generation through website	Consent	Name, contact details, Information about product interest
Lead generation through exhibitions, trade shows, digital campaigns	Consent	Name, contact details, title, company representation, physical address, phone number
Content and Material storage and distribution	Legitimate Interest	Contact details, activity with the content with have been sent (through the cookies)

If you are seeking employment at Ahlstrom (job applicant)

Processing purpose	Legal basis	Data categories
Recruitment	Consent	Basic personal details: name, gender, contact details, phone number, email address, city and country of residence, education, work experience & CV, language skills, motivation & introduction, possible additional information given by the applicant: LinkedIn profile link; source (how did you hear about this position), availability date, legal authorization to work in the country; In the USA also: ethnicity, veteran category, disability, accommodation needs.

If you are helping Ahlstrom to produce, deliver or develop our products or services (partner or supplier)

Processing purpose	Legal basis	Data categories
Management of contractor / partner relationship	Contract	Personal data needed for effective cooperation, delivery of services and management of assigned projects, name, contact details, title, organization affiliation, project contributions and work descriptions, other work-related communications.
Monitoring security on work devices and identities	Legitimate interest (Ahlstrom provides its partners and external consultants with work devices and identities and has a legitimate interest in maintaining high levels of security in corporate IT environment)	File data (such as file names, sizes, and hashes, but not file contents), process data (running processes, hashes), registry data, network connection data (host IPs and ports, but not exact location of the person), machine details (such as machine identifiers, usernames, and the operating system version), activities with identities (sign-in logs and actions performed on IT systems) and email metadata.

5. Use of Cookies and other tracking technology

Ahlstrom uses “cookies” to obtain information to improve your visits to the Ahlstrom website. Cookies are text information files that your browser places on your computer when you visit a website. Ahlstrom may collect this data to analyze the viewing patterns of our site visitors, but no Personal Information will be collected.

You may manage your cookie preferences via the Cookie Settings link at the footer of Ahlstrom website.

Please note that if you do not allow the use of cookies, you may not be able to view all parts of this website. For more information, please refer to our Cookie Policy.

6. Vulnerable groups

Ahlstrom does not intend to process any personal data of vulnerable individuals; however, we acknowledge that some of such information might be captured as a part of your customer profile. In such case we will take all necessary steps to ensure that such data is protected from unauthorized access, loss or alteration as well as implement measures to store such data only for as long as necessary for the identified purposes. If you have any questions concerning the way personal data is processed, we are happy to provide additional information and answer any questions.

7. Retention times

We have determined retention periods based on the purpose of the processing and the applicable legislation. For example, accounting-related laws require us to store your personal data for a certain period. We review the personal data we collect regularly to ensure that the personal data we have is up to date and is not retained longer than needed or required by the relevant laws.

If you wish to have more detailed information about our retention times, please contact us by sending a request to our data protection email dataprotection@ahlstrom.com.

8. Recipients of the personal data

Ahlstrom may engage business partners and service providers that might have access to your personal data. To ensure high levels of security and data protection such engagement of business partners or service providers will be accompanied by an appropriate written agreement.

We may have to disclose certain information to regulatory bodies, law enforcement authorities, when this is required. We only do so based on an adequate legal warrant or subpoena issued by the relevant court.

In mergers or acquisitions, the acquiring entity (successor) may obtain access to relevant customers, website visitor data assets.

9. Data transfers outside of the EU/EEA

Ahlstrom makes every attempt to localize its data stores. However, in case the data transfer is imminent or necessary, Ahlstrom will conduct such transfer relying upon allowed data transfer mechanisms (such as Adequacy decisions, Standard Contractual Clauses, etc.) and put in place appropriate safeguards that support proper data security.

10. Security of your personal data

Ahlstrom has implemented appropriate security policies and procedures to protect your personal data from loss, alteration, misuse, or unauthorized access.

Any information contained in manual registers is located in locked and guarded premises with limited access by designated employees.

Most of the external related personal data is saved in a web-based service and may be only accessed by certain designated persons with a valid strong username and password. Ahlstrom’s data management systems are encrypted through the operating system’s protection methods and firewall as well as other technical measures.

If you wish to have more detailed information about our technical and organizational measures, please contact us by sending a request to our data protection email dataprotection@ahlstrom.com.

11. Your rights 

You have certain rights concerning your personal data, such as the right to access, update, delete and have a copy of your personal data. We seek to ensure that you can exercise your rights efficiently. You can exercise your rights by sending a request to dataprotection@ahlstrom.com.

A list of your rights and their explanations are listed below.

The Right to be Informed	You have the right to be informed about our organization and the details of personal data processing activities Ahlstrom carries out with your personal data. In addition, you have a right to receive information about the recipients to whom your personal data might be disclosed.
The Right to Access	You have the right to obtain confirmation as to whether or not personal data concerning you is being processed, and if so, to access that personal data and obtain certain information related to its processing.
The Right to Rectification	You have the right to request Ahlstrom to correct inaccurate personal data concerning you.
The Right to Erasure (“Right to be Forgotten”)	You have the right to request deletion of your personal data. This right might be limited in some cases, for example, when the law requires Ahlstrom to retain specific types of information to comply with the legal obligation to store data.
The Right to Restrict Processing	You have the right to restrict the processing of your personal data. Restricting the processing means that Ahlstrom will limit the processing of certain data to only storing it.
The Right to Data Portability	You have a right to request from Ahlstrom your personal data in a structured, commonly used and machine-readable format that allows transmitting such data to another controller.
The Right to Object to Processing	In certain cases, you have a right to object to processing of personal data concerning you. In this case we will analyze whether legal bases for data processing are sufficient to continue processing, or we shall stop processing your personal data.
Rights Related to Automated Decision Making	Ahlstrom does not make decisions based on solely automated processing of personal data which would have legal or other similar significant effects on data subjects.
Rights to withdraw consent	In case the processing of personal data is based on your consent you have the right to withdraw consent unconditionally at any time. This, however, does not affect the lawfulness of the processing based on consent before its withdrawal. To get acquainted with the processing activities, where Ahlstrom uses consent as a legal basis, please see the table with details above.
Right to lodge a complaint with supervisory authority	If you consider that the processing of personal data relating to you infringes the GDPR, you have the right to lodge a complaint with your local data protection authority.

If you need more information or help with the exercise of your rights, or if you have any other questions related to the processing of your data or this privacy statement, please contact us by sending email  dataprotection@ahlstrom.com or write to our physical address mentioned above.

12. Changes to this statement

We reserve the right to update this data protection statement in case our activities change. Any updates will be published to this policy, readily accessible to data subjects at Ahlstrom’s external website.

This Data Protection Statement has been last updated December 2024.