Amcor 's Privacy Policy

Privacy Notice for Amcor Online Content Last revised May 17, 2018 Amcor Group GmbH, Thurgauerstrasse 34, 8050 Zurich ("Amcor" or "we" or "our") and each of its affiliates and subsidiaries (collectively, the "Amcor Group") take data privacy seriously. This Privacy Notice (the "Notice") informs the users of www.amcor.com and any other Amcor Group company-managed online content on which this Notice is displayed (together the "Website") how Amcor, as controller within the meaning of the General Data Protection Regulation ("GDPR") and other applicable data protection legislation, collect and process personal data and other information of such users in connection with their use of the Website. Content Overview What personal data do we process about you and why? What is the legal justification for processing your personal data and what happens if you choose not to provide your personal data? Who do we transfer your personal data to and where are they located? How long do we keep your personal data? What rights do you have and how can you assert your rights? Do we use cookies and other tracking technologies? Questions and contact information Changes to this Notice 1. What personal data do we process about you and why? When you visit the Website: You may use the Website without providing any personal data about you. In this case, we will collect the following metadata that result from your use of the Website: browser type and version, operating system and interface, your domain name, if applicable, the website from which you are visiting us (referrer URL), webpage(s) you are visiting on our Website, the documents you download, the date and time of accessing our Website, and your internet protocol (IP) address. Your IP address will be used (i) to enable your access to our Website; (ii) to improve the quality and services of our Website; and (iii) to provide you with tailored marketing content. When you subscribe for an Amcor newsletter, download Amcor marketing material or product information, register for an event or webinar, request product information or make an inquiry through any of our online contact forms, we collect and process the following personal data about you: your job function/title, your name, the company name of your employer, your email address, the country and city where you live, and additional personal data you provide us with. We process such personal data (i) to provide you with newsletters, event details, webinar invitations and/or a response to your request or inquiry; (ii) to provide you with marketing materials; and/or (iii) to analyze your interests for marketing purposes. Fulfilling these purposes may include transferring your personal data to third parties as outlined in Section 3 below. 2. What is the legal justification for processing your personal data and what happens if you choose not to provide your personal data? We rely on the following legal grounds for the collection, processing, and use of your personal data: the processing is necessary to provide the Website and its services to you; your consent to the processing of your data for one or more specific purposes; the processing is necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering into a contract; the processing is necessary for compliance with a legal obligation to which we are subject; the processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of you which require protection of personal data; such legitimate interests are the fulfilment of the processing purposes set out above in Section 1, in particular to improve the quality and services of our Website and services as well as tailor marketing materials by analysing the usage behavior of our users in anonymised form, to prevent fraud, misuse of our IT systems, to ensure physical, IT and network security, to provide you with marketing materials if no consent is required. The provision of your personal data is not required by a statutory or contractual obligation. However, the provision of your personal data is necessary to enter into a contract with us or to receive our services, products and information as requested by you. The provision of your personal data is voluntary for you. Not providing your personal data may result in disadvantages for you--for example, you may not be able to receive certain products and services. However, unless otherwise specified, not providing your personal data will not result in legal consequences for you. 3. Who do we transfer your personal data to and where are they located? You should expect that we will transfer your personal data to third parties for the processing purposes described above as follows: Within the Amcor Group: Our affiliates (each affiliate including us referred to as "Amcor Affiliate") may receive your personal data as necessary for the processing purposes described above. Depending on the categories of personal data and the purposes for which the personal data has been collected, different internal departments within Amcor Affiliates receive your personal data. For example, our IT departments have access to your account data, and our sales departments have access to your data relating to an inquiry to respond to it. Moreover, other departments within the Amcor Group have access to certain personal data about you on a need to know basis, such as the legal department, the finance department or internal auditing. With data processors: Certain third party service providers such as IT support providers, whether affiliated or unaffiliated, will receive your personal data to process such data under appropriate instructions ("Processors") as necessary for the processing purposes described above, such as Website service providers, customer care providers, marketing service providers, marketing platforms, IT support service providers, and other service providers who support us in maintaining our commercial relationship with you. The Processors will be subject to contractual obligations to implement appropriate technical and organizational security measures to safeguard the personal data, and to process the personal data only as instructed. A list with all currently engaged Processors can be requested from digital@amcor.com. Other recipients: We may transfer - in compliance with applicable data protection law - personal data to law enforcement agencies, governmental authorities, judicial authorities, legal counsel, external consultants, or business partners. In case of a corporate merger or acquisition, personal data may be transferred to the third parties involved in the merger or acquisition. We will not disclose your personal data to third parties for advertising or marketing purposes or for any other purposes without permission. Any access to your personal data is restricted to those individuals that have a need-to-know in order to fulfill their job responsibilities. Amcor will also disclose your personal data as required or permitted by applicable law to professional advisors, governmental authorities, and courts. International transfers. You should expect that the recipients identified above which will receive or have access to your personal data, are located inside or outside the European Economic Area ("EEA"). In particular, the parent Company of Amcor Group (Amcor Limited) is located in Australia. For recipients located outside of the EEA, some are certified under the EU-U.S. Privacy Shield and others are located in countries with adequacy decisions pursuant to Art. 45 GDPR (such as Switzerland), and, in each case, the transfer is thereby recognized as providing an adequate level of data protection from a European data protection law perspective. Certain Processors will either be certified under the EU-U.S. Privacy Shield or will be located in such a country with adequacy decision. Other recipients might be located in countries which do not adduce an adequate level of protection from a European data protection law perspective. We will take all necessary measures to ensure that access to your personal data and transfers out of the EEA are adequately protected as required by applicable data protection law. With respect to transfers to countries not providing an adequate level of data protection, we will base the transfer on appropriate safeguards, such as standard data protection clauses adopted by the European Commission or by a supervisory authority (Art. 46(2)(c) or (d) GDPR), approved codes of conduct together with binding and enforceable commitments of the recipient (Art. 46 (2)(e) GDPR), or approved certification mechanisms together with binding and enforceable commitments of the recipient (Art. 46 (2)(f) GDPR). You can ask for a copy of such appropriate safeguards by contacting us as set out in Section 7 below. The data transfer to Amcor Affiliates is protected by standard data protection clauses adopted by the European Commission (Art. 46(2)(c) or (d) GDPR). The data transfer to Processors which are neither certified under the EU-U.S. Privacy Shield nor in a country with other adequacy decision will typically also be protected by such standard data protection clauses. 4. How long do we keep your personal data? Your personal data will be retained as long as necessary to provide you with the services and products requested. Once you have terminated the contractual relationship with us or otherwise ended your relationship with us, we will remove your personal data from our systems and records and/or take steps to properly anonymise it so that you can no longer be identified from it (unless we need to keep your information to comply with legal or regulatory obligations to which Amcor is subject, e.g. taxation purposes). We may retain your personal data after the termination of the contractual relationship if your personal data are necessary to comply with other applicable laws or if we need your personal data to establish, exercise or defend a legal claim, on a need to know basis only. To the extent possible, we will restrict the processing of your personal data for such limited purposes after the termination of the contractual relationship. 5. What rights do you have and how can you assert your rights? Right to withdraw your consent: If you have declared your consent regarding certain collecting, processing and other actions concerning your personal data (in particular regarding the receipt of direct marketing communication via email, SMS/MMS, fax, social media inmail, micro-messaging and telephone), you can withdraw this consent at any time with future effect. Such a withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal. You can withdraw your consent as follows: you can withdraw your consent by checking the "unsubscribe" check box we add in messages we send to you. In addition, we offer you to unsubscribe from services, respectively, to withdraw consent by clicking on the respective link below. If you wish to unsubscribe from a service from which you cannot unsubscribe through the link below, please send an email to digital@amcor.com. Unsubion from newsletters, and other marketing communication: http://whitepaper.amcor.com/unsubscribe Additional data privacy rights: Pursuant to applicable data protection law, you may have the right to: (i) request access to your personal data; (ii) request rectification of your personal data; (iii) request erasure of your personal data; (iv) request restriction of processing of your personal data; (v) request data portability; and/or (vi) object to the processing of your personal data (including objection to profiling). Below please find further information on your rights to the extent that the GDPR applies. Please note that these rights might be limited under the applicable local data protection law. Right to request access to your personal data: As provided by applicable data protection law, you have the right to obtain from us confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, to request access to the personal data. This access information includes - inter alia - the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipient to whom the personal data have been or will be disclosed. However, this is not an absolute right and the interests of other individuals may restrict your right of access. You may have the right to obtain a copy of the personal data undergoing processing free of charge. For further copies requested by you, we may charge a reasonable fee based on administrative costs. Right to request rectification: As provided by applicable data protection law, you have the right to obtain from us the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal data completed, including by means of providing a supplementary statement. Right to request erasure (right to be forgotten): As provided by applicable data protection law, you have the right to obtain from us the erasure of personal data concerning you and we may be obliged to erase such personal data. Right to request restriction of processing: As provided by applicable data protection law, you have the right to obtain from us that we restrict the processing of your personal data. In such case, the respective data will be marked and may only be processed by us for certain purposes. Right to request data portability: As provided by applicable data protection law, you have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you may have the right to transmit those data to another entity without hindrance from us. Right to object: Under certain circumstances, you have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by us and we are required to no longer process your personal data. Such right to object especially applies if we collect and process your personal data for profiling purposes in order to better understand your interests in our products and services or for certain types of direct marketing. If you have a right to object and if you exercise this right, your personal data will no longer be processed for such purposes by us. You may exercise this right by contacting us as stated in Section 7 below. Such a right to object may, in particular, not exist if the processing of your personal data is necessary to take steps prior to entering into a contract or to perform a contract already concluded. To exercise your rights, please contact us as stated under Section 7 below. You also have the right to lodge a complaint with the competent data protection supervisory authority in the relevant Member State (e.g., the place where you reside, work, or of an alleged infringement of the GDPR). 6. Do we use cookies and other tracking technologies? The Website uses cookies and other tracking technologies. For further information, please read our Cookie Policy on https://www.amcor.com/cookie-policy 7. Questions and contact information If you have any questions about this Notice or if you want to exercise your rights as stated above in Section 5, please contact us through either of: privacy@amcor.com +41 (0)44 316 17 17 Amcor Group GmbH, Thurgauerstrasse 34, 8050 Zurich 8. Changes to this Notice We may update this Notice from time to time in response to changing legal, regulatory or operational requirements. We will notify you of any such changes, including when they will take effect, by updating the "Last revised" date above or as otherwise required by applicable law. Your continued use of our Website after any such updates take effect will constitute acceptance of those changes. If you do not accept updates to this Notice, you should stop using our Website.