Privacy policy

PRIVACY POLICY

This Privacy Policy sets out how Scandinavian Tobacco Group A/S collects and handles personal data when you visit our website or any application made available by us, including the use of our online store for purchasing our products and reports submitted under our whistleblower scheme, as well as any communication with us through our social media accounts.

If you apply for a position with our company, we will communicate the details of the personal data we collect and how we handle it to you separately when you contact us through our careers site. In certain cases, for example, if you are our business partner, supplier or consumer using another website or application made available by us or one of our group companies, we will provide you with the relevant information about what personal data we collect and how we handle it separately when you contact us through that channel.

Which personal data?

Website visitors

When you visit https://www.st-group.com/ (the “Site”), Scandinavian Tobacco Group A/S (“STG” or “we”) collects information about your IP address. Note that certain other companies than STG also collect your IP address when you visit the Site, in connection with the use of third-party cookies. How this occurs, and how you can go about limiting or turning off cookies in your web browser, is described in STG’s information about cookies.

Subscribers to company announcements from STG

When a user wishes to subscribe to announcements from STG, we request contact information, such as name and email address, in order to provide the subscription service.

For those who contact us

When you contact us via our contact form section on the Site, we require your contact information, such as name, email address and your address, to process and handle your request.

For reports under STG’s Whistleblower Scheme

When you report an incident under the STG Whistleblower Scheme, unless the report is submitted anonymously, we will collect the following information about you: name and contact details, company location and your relationship to STG (e.g. current/former employee, supplier, customer etc.). Additional information about you or other persons who are the subject of the report or involved in the investigation may be collected and processed in the course of investigating the report. If the report falls outside the scope of the STG Whistleblower Scheme, your personal data may be disclosed to our Human Resources department where it will be processed as described in our Employee Privacy Notice.

For shareholders

When you interact with us as a shareholder, we use your contact information, such as name, email address and your address for the purposes of administering our relationship with you as a shareholder.

For consumers purchasing our products online from the Cigar Shop Macanudo Copenhagen

When you order goods from our online store, you must register with at least your name, address, email address, telephone number, credit card details and information about ordered goods. We do not store your payment card information, but send it encrypted to the card issuer and acquirer.

We collect personal data from you, the card issuer (authorization for the payment) and other companies in the STG Group (in case of a complaint).

For visitors of our social media accounts

When you to interact with us on social media, for instance by liking our posts on LinkedIn and YouTube, or otherwise engage with us through these or other social media accounts, we may process your name, job title, place of work and contact details such as your telephone and/or email address.

What is the purpose of processing your personal data?

Website visitors

The purpose of processing your IP address is to be able to prevent infringements, incidents, and other misuse of our services on the Site, to run statistics on users to the Site and to update and improve the Site.

Subscribers to company announcements from STG

The purpose of processing your personal data is that we shall be able to provide you with the subscription service and that we shall be able to communicate with you in relation to such service. If you do not submit the information we request, we cannot offer you the subscription service.

For those who contact us

The purpose of processing your personal data is to enable us to respond to your query or manage your complaint, and to facilitate communication with you in relation to your request. Please be advised that we are unable to process your complaint/question without the information that we have requested.

For reports under STG’s Whistleblower Scheme

The purpose of processing your personal data is to investigate reports received under the STG Whistleblower Scheme.

For shareholders

The processing of your personal data is carried out for the purpose of administering our relationship with you as a shareholder. We also use your personal data to send out notices convening general meetings, and to register your participation in general meetings and any proxy given. To the extent you as a shareholder have submitted any questions for consideration at general meetings or proposed resolutions, we will process your personal data in accordance with this purpose.

For consumers purchasing our products online from the Cigar Shop Macanudo Copenhagen

The processing of your personal data is carried out for the purpose of completing your order and delivering your products, including authorizing the payment and shipping products to you.

We may also process personal data to comply with applicable data protection and e-commerce laws and to protect our legitimate interests, such as documenting, implementing and maintaining technical and organisational security measures; handling requests and complaints from you and others; investigating and reporting suspected security breaches in order to establish, enforce or defend legal claims; handling inspections and requests from regulatory authorities; handling disputes with you and third parties; preventing misuse and ensuring the proper functioning of the Site; and analyzing sales statistics to improve our marketing and sales efforts.

For visitors of our social media accounts

The purpose of processing your personal data through our social media accounts is to communicate with you in relation to our company’s activities and events, or any other information about our company and products, in accordance with the law.

Please note that the social media accounts in question are owned by third parties, namely the social media platform providers, and we are the administrators of these accounts. In the majority of instances, we and the owners of the social media platforms will be jointly responsible for the processing your personal data when processing your personal data for the same purpose.

What is the legal basis for processing your personal data?

Website visitors

The legal basis for processing your personal data is our legitimate interest in preventing misuse and in having a properly functioning Site.

Subscribers to company announcements from STG

The legal basis for processing your personal data is (i.) your consent to receive our company announcements or (ii.) our legitimate interest in administering your subscription.

For those who contact us

The legal basis for processing your personal data is our legitimate interest in handling your request.

For reports under STG’s Whistleblower Scheme

If the report falls within the scope of the Danish Whistleblower Act, the legal basis for the processing of personal data is Section 22 of the Danish Whistleblower Act.

In all other cases, we will process your personal data on the basis of STG's legitimate interest in investigating a report and our obligation to comply with a legal obligation to which STG is subject. Depending on the nature of the matter reported and the personal data processed, the legal basis for us to process your personal data may also be that the processing is necessary for the establishment, exercise or defence of legal claims or for the exercise of rights and obligations in the field of employment and social protection.

For shareholders

The legal basis for processing your personal data is (i.) to ensure performance of the contract with you; or (ii.) our legitimate interest to administer the relationship with you as a shareholder.

For customers purchasing our products online from the Cigar Shop Macanudo Copenhagen

The legal basis for processing your data is (i.) to ensure the performance of the contract with you; (ii) to ensure our compliance with the legislation on e-commerce and bookkeeping; (iii), or (iii) our legitimate interests for the purposes defined above.

For visitors of our social media accounts

The legal basis for processing your personal data is our legitimate interest in being able to communicate with you when you engage with us through our social media account and to administer our account.

How long do we store your personal data?

Website visitors

We will retain your IP address for the time necessary to fulfil the purposes described above. In certain circumstances we may also retain your personal data for a longer period, if we are required by law to do so or if it is necessary for us to establish, enforce, or defend legal claims. You may find specific retention periods in STG’s information about cookies.

Subscribers to company announcements from STG

We will delete your e-mail address immediately upon cancellation of your subscription or upon receipt of any objection to receiving further information from us.

We may retain your personal data for longer periods where it is necessary to comply with a legal obligation, or to establish, enforce, or defend legal claims.

For those who contact us

We will store your personal information for the duration necessary to fulfill the purpose defined above, which is to resolve your complaint or answer your question.

In certain circumstances, we may also retain your personal data for a longer period if it is necessary to comply with a legal obligation, or to establish, enforce, or defend legal claims.

For reports under STG’s Whistleblower Scheme

We will delete your personal data immediately in the event that (i) the matter reported falls outside the scope of the Whistleblower Scheme; or (ii) the matter reported is clearly unfounded. Personal data will also be deleted if it is no longer necessary to retain it, or if it is not relevant to the investigation.

In all other cases, we will retain your information for the duration of the investigation. In the case that disciplinary action is taken, or if there are any other grounds for retaining the data, it may be stored in the employee's personnel file. In such cases, the data will be deleted no later than 5 years after the employee's employment has ended, unless there are objective reasons for retaining the information for a longer period or a longer retention period is required by law.

For shareholders

We will store your personal information for the time necessary to fulfill the purpose defined above, i.e. for the duration of our relationship with you as a shareholder.

We may also retain your personal data for a longer time where it is necessary to comply with a legal obligation, or to establish, enforce, or defend legal claims.

For consumers purchasing our products online from the Cigar Shop Macanudo Copenhagen

We will store your personal data for as long as it is necessary to fulfil the purposes set out above, but generally for a maximum of 5 years, unless a longer period is required by applicable laws or to establish, enforce, or defend legal claims.

For visitors of our social media accounts

For details of how long we retain your personal data in connection with the use of the social media platforms, please refer to the privacy policy of the social media platform provider and to our cookie policy (STG’s information about cookies).

Who do we share your personal data with?

Website visitors

STG may share your personal data with other companies within the STG group of companies, as well as with collaborating partners such as external suppliers involved in IT hosting, website maintenance, subscription or other IT services.

Subscribers to company announcements from STG

STG may share your personal data with other companies within the STG group of companies, as well as with collaborating partners such as external suppliers providing IT hosting, maintenance, subscription or other IT services.

For those who contact us

STG may share your personal data with other companies within the STG group of companies, as well as with collaborating partners such as external suppliers providing IT hosting, website maintenance, subscription or other IT services.

For reports under STG’s Whistleblower Scheme

STG may share your personal data collected in connection with reports under the STG Whistleblower Scheme with other companies within the STG group of companies, public authorities or external parties involved in or assisting with the investigations.

For shareholders

For consumers purchasing our products online from the Cigar Shop Macanudo Copenhagen

STG may share your personal data with other companies within the STG group of companies, as well as with collaborating partners such as external suppliers involved in IT hosting, support, your card issuer, payment providers, and our bank connections.

For visitors of our social media accounts

We will share your personal data with social media platform providers, and we may also share it with other companies within the STG group of companies, as well as with collaborating partners such as external suppliers involved in IT support, digital marketing or other services.

In all of the mentioned cases above, we may also share your personal data with government agencies if we are legally obligated to do so, or if we suspect criminal activity.

Please note that the recipients described above, including IT support or other digital service providers, will process your personal data on our behalf and with our instructions. In such instances, the recipients are required to enter into a data processing agreement with STG and act in accordance with our instructions. STG ensures the secure processing of your personal data by taking all appropriate legal, technological, and organizational measures when transferring it to or sharing it with selected recipients. Recipients such as payment processors and banks are typically considered to be data controllers. This means they are responsible for processing your personal data in accordance with all applicable laws and regulations. In most cases, the social media platform providers are also considered to be independent or joint data controllers, which means that they alone or together with us are responsible for processing your personal data in accordance with the applicable laws and regulations.

Where do we process your personal data?

Your personal data will primarily be processed within the EU/EEA, but we may sometimes need to transfer it to countries outside the EU/EEA, such as the United States, for example, if we share your information with other companies in the STG group of companies.

STG will only transfer your personal data to a country outside the EU/EEA when there are legal grounds to do so and sufficient guarantees that your personal data will be handled lawfully. In such cases, STG will take all appropriate legal, technological and organisational measures to ensure that your personal data is processed securely, and with an adequate level of security comparable to the level of protection, comparable to that offered within the EU/EEA.

How do we protect your personal data?

STG takes the appropriate technical and organisational security measures needed to safeguard your personal data. Those measures may include, where appropriate, encrypting and pseudonymising personal data, ensuring confidentiality, integrity, availability and resilience of its systems and services, ensuring that availability of and access to personal data can be restored in a timely manner after an incident, as well as regularly assessing and evaluating the effectiveness of such technical and organisational measures.

WHAT ARE YOUR RIGHTS?

You have certain specific legal rights that you can enforce against us. A summary of these rights follows below.

Right to access/extracts from the register. You have the right to know what personal data about you we are processing. Upon request from you, we will provide you with information in writing about our processing of your personal data.

Right to data portability. You have the right to request a copy of the personal data you have provided to us in a structured, commonly used and machine-readable format. Provided that it is technologically possible – which is determined by STG – you also have the right to request that we transfer this personal data to another controller. The right to data portability applies to personal data that is processed via automated means and is based on a contract with you or your consent.

Correction of erroneous information. You have the right to request that we correct erroneous or incomplete information about yourself.

Deletion of certain data. You have the right to request that we delete your personal data under certain conditions, for example if your personal data is no longer necessary for the purpose for which we collected the data; if the processing is based on your consent and you have withdrawn such consent; if you object to a weighing of legitimate interests we have carried out and support for our legitimate interest is lacking; if your personal data was processed in an unlawful manner or if your personal data has to be deleted in order to fulfill a legal obligation.

In certain cases, we must save your personal data despite your request where we are legally required to retain your personal data, for example, in accordance with accounting and tax legislation. Similarly, we may need to retain certain data in order to establish, enforce or defend a legal claim.

Right to restrict processing of your personal data. You have the right to demand a restriction on our processing of your personal data in certain cases. If, for example, you have contested the fact that your personal data is correct, you can request a restriction on processing for a period of time that will allow us to verify if your personal data is correct.

Right to object to our processing of personal data. You have the right, under certain conditions, to object to our processing of your personal data.

You have the right to object to processing that is based on the legal grounds of our legitimate interest. However, we may continue processing your personal data despite your objection if we have compelling legitimate reasons to do so that override your privacy interests or for the establishment, exercise or defense of legal claims.

CONTACT AND QUESTIONS

Scandinavian Tobacco Group A/S (“STG”), Sandtoften 9, 2820 Gentofte, Denmark is the data controller for the processing of your personal data as described above.

If you have any questions about how we process your personal data, or if you would like to present a request about an excerpt from the registry, data portability, correction, or deletion – or present an objection or a restriction – please contact us at:

Scandinavian Tobacco Group A/S

Sandtoften 9

DK-2820 Gentofte

Denmark

E-mail: mydata@st-group.com

Telephone: +45 39 55 62 00

Customers who purchase our products online from the Cigar Shop Macanudo Copenhagen please contact us at:

Email: Silkegade@st-group.com

Telephone: 33140922

COMPLAINTS

If you have a complaint regarding STG’s processing of your personal data, you have the right to submit such complaints to the Danish supervisory authority at

Datatilsynet

Carl Jacobsens Vej 35

DK-2500 Valby

Denmark

E-mail: www.datatilsynet.dk

Telephone: +45 33 19 32 00

Last updated: September 2024