Privacy notice – Cookies and forms

22.10.2025

List of type forms for marketing contacts applicable for this privacy notice:

• Web ‘contact us’ -forms
• Event registrations
• Digital marketing campaign forms
• Social media lead generations forms
• Order forms
• Event lead capture forms

List of websites applicable for this privacy notice:

• storaenso.com
• forest.storaenso.com
• codeofconduct.storaenso.com
• foodservice-offering.storaenso.com
• references.buildingsolutions.storaenso.com
• buildingconcepts.storaenso.com
• knowledge.buildingsolutions.storaenso.com
• packagingsolutionsstories.storaenso.com

1. Purpose

Stora Enso Oyj and its affiliates (“Stora Enso”) are committed to protecting the privacy of visitors when you visit our website storaenso.com or services available through our website. This Notice provides information on what personal data Stora Enso collects and how and for what purposes the data may be processed.

When visiting our website, browser may store a small text file called a cookie on visitor’s device. Cookies and similar technologies include a unique identifier that helps Stora Enso recognize and count the number of browsers accessing our site. In this notice, “cookies” refers to all technologies that collect data in this way.

Cookies allow Stora Enso to provide a more personalized experience — for example, by remembering your language preferences, country selection, and other settings based on how you use the site. These features would not function properly without cookies. Stora Enso does not use cookies to identify individual visitors.

The purpose of forms is to allow individuals to contact Stora Enso for business inquiries or subscribe to receive marketing material. Marketing emails are used for Stora Enso to engage users who have been in contact with us. The purpose is to liaise with individuals who have shown interest in our products and services.

2. Data Controller

Stora Enso Oyj and its subsidiaries are joint data controllers in respect of the personal data which they jointly process and share. Stora Enso Oyj and its subsidiaries share the data controller’s obligations and responsibilities between each other as they deem appropriate based on the relevant circumstances. In general, Stora Enso Oyj is responsible for (i) the functionality and security of the IT systems, (ii) data privacy and IT policies, guidelines and instructions for the group, and (iii) that global personal data systems and registers are compliant with applicable privacy laws, while the subsidiaries are responsible for (i) the validity, accuracy and completeness of the personal data within the systems, and (ii) ensuring that local personal data registers, systems and processes are in compliance with applicable local and EU laws.

For more information on Stora Enso’s subsidiaries and jointly controlling entities contact Stora Enso Oyj. Regardless of the applicable data controller in each situation, you can always use your rights by contacting Stora Enso Oyj:

Address:
Stora Enso Oyj
Katajanokanlaituri 4
P.O. Box 309
00101 Helsinki, Finland

data.privacy@storaenso.com
+358 20 46 111 (switchboard)

3. Lawfulness and Purposes of Personal Data Processing

Legal grounds for processing personal data within Stora Enso’s websites and forms are:

1. Website cookies and other tracking technologies:

• Consent, except for essential cookies

2. Forms and marketing contacts:

• Consent or legitimate interest

The purposes of personal data processing are:

1. Website cookies and other tracking technologies:

• Essential cookies
  For example: To ensure and improve the website integrity and security.
• Statistical cookies
  For example: We use statistical cookies including website and email tracking to record the use of our website and for the purpose of optimising our content and services for you.
• Preference cookies
  For example: We can personalise content based on your country’s location.
• Marketing cookies
  For example: The purpose of the marketing cookies is to increase the marketing relevance to users who have already shown interest in our content, services and products.
  
  Statistical, preference and marketing cookies are also used in our marketing processes to understand the business relevance of the contacts received, so-called leads. This is done e.g. by combining data with some other information such as industry databases. Please see the full list at the end of the page.

2. Forms for contacts:

• Form for requesting more information about Stora Enso - When submitting a form requesting more information about Stora Enso and e.g. our products or services, we ask to provide contact details. This enables us to answer the request personally.
• Email marketing subscription - When you provide your consent and your personal contact data specified above, we use this data to send you our email marketing such as newsletters and event invitations. Sending email marketing is tracked to see what contents you find interesting and to develop the contents based on preferences. You can unsubscribe at any time for certain or all e-marketing and tracking and manage your e-marketing preferences whenever you wish by using the link at the end of each marketing email. Furthermore, you can always send an email to data.privacy@storaenso.com and inform us of your consent withdrawal.
• When placing an order via form - If you place an order for us through any of our online marketplaces, we ask you to provide the necessary information to ensure we can deliver the product and close the transaction. You usually need to specify your first and last name, company name and address, VAT number, phone number and e-mail address and set a password for your account. This user account is not publicly visible. Processing is necessary for the performance of the contract that you have entered with Stora Enso by registering for a user account on our marketplace.
• If marketing email has been opened, it is possible for Stora Enso to identify the person via marketing automation system HubSpot. HubSpot is used as a marketing operations hub, including email marketing, social media management, lead management and managing digital marketing campaigns across digital channels.

4. Content of the register

Stora Enso collects and processes the following personal data:

1. Website cookies:

By default (essential):

• IP address of your device
• Date and time of access and length of the visit
• Name and URL of the visited page
• Referring website or service
• Browser used
• Language settings applied
• Where applicable, your device’s operating system and the identity of your access provider

For statistical purposes:

• For example: visit time

For preference purposes:

• For example: visitor’s country

For marketing purposes:

• For example: build a profile of interests and show relevant adverts on other sites

See updating cookie listing below for further details.

2. Forms and marketing emails, personal data collected may include:

• First name, Last name
• Title
• Organization, Company name
• Address
• Language
• Email address
• Phone number
• Content of the message
• Time
• Operating system
• Email opens
• Email clicks

5. Regular sources of information

6. Data Retention

Cookies:

• See the list of cookies and their retention times from the end of this page
• Website visitors can also delete cookies from their browser or device settings

Forms and marketing emails:

• Non-business-related engagements for 90 days;
• Inactive business-related leads up to 2 years;
• Active engagements are stored as long as data subjects engage or remain active towards Stora Enso

In the event of a security incident, data may be retained until the case has been resolved.

7. Personal Data Disclosures

Personal data from website cookies and forms be disclosed to governmental authorities/agencies (or similar) for the purposes of their regulatory tasks. Personal data can also be disclosed to companies within the Stora Enso company group for purposes compatible with the processing purposes defined in Section 3 of this privacy notice. List of third parties for cookies are listed at the end of this page.

Certain data processing activities related to your request may be outsourced to carefully selected third party service providers (such as IT service providers, payroll, consultants) in which case such third-party processors operate on behalf of Stora Enso under a specific data processing agreement. In these cases, Stora Enso transfers personal data to other third parties for the purposes of providing services to Stora Enso.

8. Data Transfers from EU/EEA

Some of the entities who receive personal data from Stora Enso or to whom Stora Enso has outsourced personal data processing functions are located outside the European Union and/or the European Economic Area. In such situations, Stora Enso ensures that a sufficient level of data protection is maintained with appropriate safeguards, e.g. by signing the EU Commission's model clauses with the party receiving the data. Where applicable, Stora Enso may rely on the applicable legal framework in data transfers to the US. Stora Enso group's internal data transfers are governed by a contractual framework based on the EU Commission's model clauses.

9. Data Security

Personal data in Stora Enso’s IT systems are protected against unauthorized access with various information security measures. Access to personal data is granted only to people who need access to fulfil the tasks and duties relating to their role within and with Stora Enso.

Additionally, Stora Enso and its service providers are actively monitoring the confidentiality, integrity and availability of the IT environment and have implemented technical measures to prevent and detect incidents that may threaten any personal data.

The security of personal data is also ensured when transferring or disclosing the data to other processors. The measures employed vary based on the sensitivity of the data and include e.g. identification of authorized recipients and encryption.

10. Purpose limitation

Personal data is only used for the purposes listed in this privacy notice.

11. Automated decision-making and profiling

Website visitors’ behavior can be profiled by being segmented based on the areas of interest, such as job seekers and investors.

No automated decision-making is done.

12. Your rights

Access to information

You are entitled to obtain information on the personal data concerning you which Stora Enso is processing and to obtain a copy of such personal data.

Right to rectification, erasure and restriction

You are entitled to have any such personal data that is inaccurate, outdated, unnecessary or contrary to the purposes of data processing corrected or erased. You are also entitled to have Stora Enso restrict processing of your personal data for example when you are waiting for Stora Enso’s answer to your access or erasure request.

Right to withdraw consent

You may withdraw your consent from Stora Enso to use cookies at any time by managing your preferences via cookie icon visible on every page on our website.

Right to object to processing

On grounds relating to your particular situation, you are entitled to object to the processing of personal data concerning you, provided that the processing is based on Stora Enso’s legitimate interest.

Data Portability

You are entitled to receive an electronic copy of the personal data that has been provided by you for the purposes of performing contract made between you and Stora Enso or where the processing is based on consent. Furthermore, the data may be transmitted directly to another data controller on your request, if this is technically feasible.

Exercising your rights

You can exercise the abovementioned rights by sending an email to data.privacy@storaenso.com. Your identity will be verified.

Right to lodge a complaint

You are entitled to lodge a complaint with a competent data protection authority regarding Stora Enso’s processing of personal data. You can lodge a complaint at your local data protection authority.

13. Contacting the data controller

In all questions and matters relating to personal data processing or your rights, you can contact Stora Enso.

You may use your rights by sending an e-mail to data.privacy@storaenso.com.