Privacy Policy

Last updated: March 20, 2018

This Privacy Policy (the “Privacy Policy”) describes our practices in connection with the personal data that you provide to any European company in our Group (“Domtar Personal Care Europe”) by any means, including off line forms (e.g., product orders), telephone calls, email, fax, a website which is operated (as indicated in its conditions of use) by a Domtar Personal Care Europe company (the “Website”) (the “Personal Data”). An updated list of Domtar Personal Care Group companies is available here:

1. Updates to this Privacy Policy

We may change this Privacy Policy. Please take a look at the “Last updated” legend at the top of this document to see when this Privacy Policy was last revised. The processing of your Personal Data will be governed by the Privacy Policy in force at the time your Personal Data are collected unless otherwise agreed by you or allowed under applicable law.

2. Who determines which Personal Data are collected, how and for which purposes (the data controller)?

The data controller (“us”, “we”, and “our”) will be:

1. in all events, the Domtar Personal Care Europe company that operates the relevant Website, and identified on the Basic Information on Data Protection; and
2. if you purchase or use a specific online product or service (other than mere browsing), the Domtar Personal Care Europe company that contracts with you, as identified in the relevant terms and conditions applicable to the purchase or use of the relevant product or service.

All terms and conditions of our products and services (unless expressly provided for therein), including this Privacy Policy, may be assigned to any third party.

3. What is the legitimation for processing your data?

The processing of your Personal Data will be made in the legitimate basis of:

1. Express consent given by you.
2. Performance of the contract between you and us (for example, when you purchase or order one of our products or services; or when you request or order a free sample; without your Personal Data we will not be able to provide you with the products or services ordered, or the samples requested).

4. How is your Personal Data collected?

Directly from you, when you are interacting with us, for example information you give us as requested by phone, email or detailed in the forms you may be asked to complete and also information we collect automatically from your use of our products or services such as your interaction with adverts that we place on websites or other media.

5. Which Personal Data and for which purposes are used by us?

We collect your Personal Data (automatically, as detailed in the forms you will be asked to complete or provided by you in your e-mail queries or telephone inquiries, which may include health related data such as a degree of incontinence, prescriptions, etc.) as required for the following purposes:

1. To evaluate an application to contract our products or services or participate in any competition. For example, this may include verifying whether you are eligible to enter into a competition or to check your credit rating when purchasing a product, etc.
2. To manage sales activities including managing orders, product samples, invoices, payment management and delivery of orders.
3. To provide you with a product or service you have requested and manage our contractual relationship with you. For example, to answer your questions or respond to comments submitted to us; to send you information or samples you have requested; to perform and enforce the terms and conditions that govern the product or service (which may include, depending on the product or service,  the recording of calls between us and you to evidence the rendering of the product or service or to identify any breach of the terms and conditions that govern the product or service, for accounting, billing and payment verification purposes, to collect debts, to serve notice of unpaid, due and enforceable debts to solvency files which payment has been requested from you); to award a prize if you are the winner of a competition, to post content you have submitted for publication, to share your Personal Data with payment processing organizations, to request you to fill in a questionnaire to better understand your circumstances and better assess your needs, etc.
4. To comply with our (contractual and legal) obligations or defend our interests in judicial or administrative proceedings (in any relevant jurisdiction). For example, this includes responding to the requests of governmental and judicial orders of any competent jurisdiction or sharing the Personal Data with other enforcement agencies regarding any mandatory requirement; to comply with our Group policies (such as Anti-Bribery policies) or to share information with sick funds or insurance companies; to respond to legal process such as subpoenas or discovery requests, pursuing legal rights and remedies, defending litigation and managing any internal complaints or claims (which can be reported through the internal whistleblowing system according to the Whistle-blowing policy available at http://www.domtar.ethicspoint.com)
5. To carry out any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock. For example, this includes a sale of our assets in connection with a bankruptcy proceeding or an intra-group corporate or business reorganization.
6. To analyse how our products and services are used by our customers and to improve our business. For example, this includes the analysis of statistical information on the use of our websites by visitors and of any feedback on our business or testimonials that you may provide.
7. To honour your preferences on direct marketing and for advert targeting purposes. You may receive direct marketing communications on personal care, medical devices, cosmetic and hygiene products and services, which may or may not be personalised for you (i.e., tailored to your profile), by any means (e.g., post, phone call, email, text message or other electronic means) and carry out targeted advertising. For example, whenever you provide us with any Personal Data (e.g., when you ask for our products or services), you may be asked for your preferences in this respect and provide you with information on the kind of direct marketing available and on whether us and/or a third party may send you such direct marketing or carry out targeted advertising. You may also decide to subscribe to one of our newsletters. To discontinue direct marketing or targeted advertising, you may send a request as explained in section 9. Furthermore, and regarding direct marketing by electronic means, where required by applicable law, we will obtain your consent inform you in each of our communications how to unsubscribe in a straightforward way and at no cost (other than as related to transmission of your request). We will answer your request as soon as reasonably practicable, and in any case, within the legally determined term (if there is one).

Please note that if you do opt-out of receiving marketing-related messages from us, we will still send messages as necessary to fulfill other purposes (such as administrative messages relating to the operation of the product or service).

6. How long will we store your Personal Data?

We will store your Personal Data for 7 years for the above mentioned purposes 1 to 5, unless there is a subsisting legal reason that makes us to block and retain the data for a longer period.

We will store your Personal Data indefinitely for the above mentioned purposes 6 to 7, unless you withdraw your consent.

7. Which Personal Data and for which purposes are shared with third parties?

Personal Data may be used or shared with another Domtar Group companies worldwide (you can find a list of Domtar Group companies at the following link: http://www.attends.eu/corporate/List_Domtar_entities.pdf), or other third parties if:

1. it is necessary for the following purposes mentioned in section 5 above: (1) to evaluate an application regarding the contracting of our products or services or participate in any competition, (2) to manage sales, (3) to provide you with a product or service you have requested and manage our contractual relationship with you, (4) to comply with our (contractual and legal) obligations or defend our interests in judicial or administrative proceedings; (5) to carry out any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock; and (6) to analyse how our products or services are used by our customers and to improve our business;
2. it is necessary (7) to honour your preferences on direct marketing and targeted advertising purposes (mentioned in section 5 above), i.e., if you have agreed to receiving marketing and targeted advertising; or
3. to support us in performing any of the abovementioned purposes (e.g., cloud services providers that provide ICT infrastructure used by us to provide you with a product or service or Group management, administrative and support services, including ICT, finance and accounting support and internal audits).

All of these third party recipients may be located world-wide, including outside of the European Economic Area (EEA) (such as the US*). These countries may provide personal data protection standards that are not necessarily equivalent to those applicable in the EEA (in which case, specific safeguards are adopted by us for personal data originating in the EEA, such as ensuring the third party complies with either the Privacy Shield Principles, is subject to another adequacy finding or enters into a written agreement with us requiring that the third party provides a level of privacy protection equivalent to the one required within the EEA).

(*) In particular, this is the case of our affiliate in the US, Attends Healthcare Products Inc. (8081 Arco Corp Drive, Suite 330, Raleigh NC 27617).

Your Personal Data may also be shared with public authorities for compliance with legal obligations.

8. What are your responsibilities when you provide us with or allow us access to your Personal Data?

You must provide accurate Personal Data and only when you are 18 years of age(*) or over and keep them up-to-date. You must comply with any data protection and privacy legal requirements applicable to you. You must comply with and not disable any security measure of a Website. If you are acting as a (legal or de facto) representative of any legal entity, you must only provide your professional contact details in respect of that legal entity (and never your private contact details).

(*) We do not intend to collect, or direct any Personal Data collection to, data of individuals under 18 years old, and we request you that these Personal Data are not provided to us.

9. What are your rights when you provide Personal Data?

You may contact us (at dpc.dataprivacy@domtar.com with written proof of your identity) to exercise your rights:

(i) to request information about your data (right of access); (ii) to request that your Personal Data be rectified or deleted if it is inaccurate or incomplete (right or rectification or cancelation); (iii) to request restriction of processing of your Personal Data (right to restrict processing); (iv) to object to the processing of your Personal Data when processing is based in a legitimate interest (See paragraph 3. “What is the legitimation for processing your data?”) (right to object to processing); (v) to request the portability of your data (right of data portability); or (vi) to object an automated individual decision-making, including profiling. We will answer your request as soon as reasonably practicable, and in any case, within the term legally determined.

Moreover, where the processing is based on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

If you consider that we have violated or ignored your recognized rights, you may claim through your local Data Protection Authority:

You May find more information on the following link: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080.

If you have any questions regarding the processing of your data, or our Privacy Policy, you can contact our data Privacy Officer (DPO) by email (dpc.dataprivacy@domtar.com). It will be nice to assist you.