ORORA PRIVACY POLICY - Pollock Orora Retail

This privacy policy describes the privacy practices of Orora Limited and its affiliates, subsidiaries, international and associated entities which includes but is not limited to (“Orora” “our,” “we”) for our websites (“Website”) or any website or mobile application that we own, operate or control that links to this Privacy Policy.

At Orora, we are committed to protecting your privacy and using your data carefully. In this policy, we outline what personal data we collect, why we collect it and what we do with it. Our goal is to make sure you know how we collect, use, share and store your personal data when you create an Orora account, interact with our customer support specialists and visit www.ororagroup.com or other Orora websites and apps covered by this privacy policy.

This Privacy Policy applies to our websites, mobile applications, marketing content, advertisements, and communications regarding Orora’s products and services. This Policy applies to anything we send to you (or a service provider sends acting on our behalf) on third-party websites, platforms and applications based on your site usage information. We encourage you to read the privacy policies of these third-party websites before using those websites.

In certain jurisdictions, including Australia, there are exemptions which apply to particular “employee records”. In such circumstances, Orora is not required to comply with relevant privacy laws in relation to such employee records. While Orora makes every effort to treat your personal information in accordance with this Privacy Policy, Orora is entitled to rely on any “employee records” or other exemptions available under applicable local laws.

What personal information?

The data we collect and process about you depends on who you are and how we interact with you. Personal information is data that identifies you or that makes you identifiable. It includes data that could be used to identify, locate, track or contact you.

If you are a customer, business partner, or express interest in our solutions:

Learning about our company and our solutions: If you request or indicate an interest in information about our solutions or partnership opportunities, we process your name, email address, phone number, job title, information about the organisation where you work, including its website address, and any comments you provide. We append business information related to the organisation where you work from third party sources, such as business intelligence providers, information from publicly available sources, such as LinkedIn, as well as information about the number and frequency of your interactions with us online and offline, such as at events, webinars, via email and our website. We may also process personal information about you that we collect either directly, through forms or data entry fields on our website, or through passive collection by cookies and other data collection technologies as described in this policy. We maintain and update this information as we continue to engage with you and use it as described under the Legitimate Interests processing purposes described below.
Using the Orora Customer Portals: If you are an authorized user of our platform, we process your name, email address, username, password, IP address, job title, phone number, information about the organisation where you work, actions you have taken in the applications on the platform, such as record creation, changes, input, responses, analysis, and approvals, and tickets filed on your behalf related to our platform.
Receiving marketing, sales-related and business development communications from us: If our marketing team or a member of our sales or business development teams sends communications to you, we process your name, phone number, email address, postal address, job title, job function, company name, company size, company financial information, IP address, device type, email view information including IP address and associated city, birthday if provided, and information about which of our solutions you use or which may be of interest to you.
Market research and surveys: If you participate in our market research and surveys, we process your email address, job title, phone number, survey responses, company name, job function, state, country, and any comments you provide.

If you visit the websites and online properties we provide:

We process personal information about you that we collect either directly, through forms or data entry fields on our website, or through passive collection by cookies and other data collection technologies. The types of personal data we collect and process in each of these contexts is further explained in the following four categories:

Contact us and registration forms: we process your name, email address, company where you work, phone number, job function, job title, country, and any comments you provide.
Consumer opinion surveys: we process your survey responses.
Cookies and other data collection technologies: we use browser session cookies, which are temporary cookies that are erased from your device’s memory when you close your Internet browser or turn your computer off, and persistent cookies, which are stored on your device until they expire, unless you delete them before that time. We group browser cookies on our site into three categories, which you can manage through our “Cookie Preferences” manager:
- Required cookies: These cookies are necessary to enable the basic features of this site to function, such as allowing images to load or allowing you to select your cookie preferences.
- Functional cookies: These cookies allow us to analyse your use of the site to evaluate and improve our performance. They may also be used to provide a better customer experience on this site. For example, remembering your log-in details or providing us information about how our site is used.
- Advertising cookies: These cookies may be used to share data with advertisers so that the ads you see are more relevant to you, allow you to share certain pages with social networks, or allow you to post comments on our site.

If you are an employee, contractor, job applicant, temporary hire or former employee:

Applying to work at Orora: If you apply to work at Orora, we collect personal information about you and your professional experience, education and training such as your application, your name (and any former names), postal address, email address, phone number, universities attended, academic degrees obtained, grades, professional certifications and licenses, employment history, and curriculum vitae or resume.
Offer of employment, temporary hire or contractor position: Prior to making an offer of employment, temporary hire, or a contractor position, we process personal information to conduct professional reference checks in accordance with applicable laws. If we extend an offer of employment, temporary hire or a contractor position at Orora to you, we will process personal information about the position to which you have been appointed, your job title at Orora, the compensation or project-based contractor rate we offer to you, whether you or your employment agency accepts the offer, your signature, and your starting compensation, agency agreed compensation or project-based contractor rate, and your start date at Orora.
Employment-Related Background checks: Prior to commencement of your employment with us, we conduct and may engage service providers to conduct background checks that involve the necessary personal information processing as permitted by the laws in the location in which you reside and/or work. More details are provided to you in the context of our request to you to complete these checks.
As an employee or contractor or temporary hire of Orora: we may collect and process personal information about your benefits, nationality, residency status, personal or email address, office or other workplace location, work phone number, mobile phone number, photographs, passport, visas, marital status, beneficiaries, profile, emergency contact details, financial account information, disability status, race, gender, age, social security number or other government-issued identification number, holiday and paid time off days, salary, incentive compensation, Orora stock options granted, Orora stock ownership, assigned projects, performance against your assigned goals, training completed, any performance improvement plans, any disciplinary actions taken, system accounts, technology and physical assets provided to you, your role and actions taken in connection with Orora projects and processes.
If your employment with Orora ends, we process personal information necessary to off-board you from Orora, including deactivation of your access to our systems, fulfilling our financial, benefits, informing your privacy agency and other related obligations with respect to the end of your employment with Orora.
In certain countries, supplemental privacy notices will be provided to Orora employees and contractors, and where applicable, consent will be obtained, to ensure compliance with local requirements.

We will not collect, use or disclose sensitive information about you unless it is necessary to operate our business and we have your consent or unless we are legally required to collect, use or disclose that information. Sensitive information includes any information about a person’s race, ethnic origin, political opinions, religious or philosophical beliefs or affiliations, membership of a professional, trade or political association or union, sexual preferences or practices, criminal record, health information or genetic information about an individual that is not otherwise health information.

We also operate video surveillance devices in our premises and may monitor and record your communications with us (including email and telephone) for legitimate business and security purposes.

Why do we collect and process personal information?

The reasons that we collect and process information about you depends on who you are and how we interact with you.

If you are a customer, business partner, or express interest in our solutions:

If you have a contract or other agreement in place with us, we collect and process personal information about you in order to fulfil the following obligations to you under that contract or agreement to:

Provision your account on our business systems, customer portal and other systems to provide requested goods or services
Authenticate you to enable you to access your account and conduct business with us
Provide customer service and support, and investigate issues that you raise
If you apply for a credit account with an Orora business, we may request credit information from you or a credit reporting body, and disclose the information we receive to one or more credit reporting bodies, and use this information to assess your credit worthiness for a trading account
- If you are a customer with our Australian companies, and apply for a credit account, we may request credit information from you or a credit reporting body, and disclose the information we receive to one or more credit reporting bodies, in accordance with the Privacy Act. The information we collect and hold includes identification information such as your name and address, the type and amount of credit applied for, the fact that information was requested from a credit reporting body (and the information received following such a request), any court judgments relating to credit provided to you in the past, and information relating to your solvency from the National Personal Insolvency Index. We use this information to assess your credit worthiness for a trading account and (where applicable) to register interests on the Personal Property Securities Register. If you nominate Orora as a commercial reference to a third party, we may provide limited credit information to that third party
Communicate with you, including via email, about your use of our customer portals and business, obtain your input on new features, functionality, and content, and to provide information about our solutions
De-provision your account on our business systems, customer portal and other systems, where required. If you have provided your consent, we process personal information about you to send direct email marketing communications about our solutions. You may withdraw your consent at any time by clicking the “unsubscribe” link in the email communications we send to you. You may also withdraw consent by exercising Your Rights as described below.

Our legitimate interests: We process personal information about you based on our legitimate business interests, including for the following purposes, to which you may exercise Your Rights to object as described below:

To renew your account or service you have requested, based on our legitimate business interest in retaining you as a customer or partner
To provide additional solutions you request based on our legitimate business interest to respond to your reasonable requests and to retain you as a customer or partner
To determine whether, when, and the IP address and associated city of, a marketing, sales, or business development email communication we sent was viewed based on our legitimate interest to effectively manage and improve upon such communications with you
To understand the business that you work for and your prior experience based on our legitimate interest to tailor our communications with you to improve our engagement with you
To manage our legal, financial, policy and regulatory compliance responsibilities and to demonstrate our compliance upon request

Statistical and research purposes: We may further analyse use of our solutions, and characteristics of the companies that use our solutions (e.g., by size and industry sector) to help us understand and make decisions about customer and market needs, to improve our solutions, to design new solutions, and to inform partnership and business development decisions.

If you visit the websites and online properties we provide:

If you have provided your consent, we process personal information about you to:

Respond to your individual rights requests
Manage your consent preferences
Ads Interests: to apply your device-specific interests for both mobile apps and mobile websites, to create a non-permanent unique ID within our platform for the purpose of storing and communicating interests within our internal platform, to communicate and share your interests to service providers, including whether you want to receive interest-based ads, and to enable us to honour your interests according to the preferences you have set
Deliver the resources and information you have requested online
Send direct email marketing communications about our solutions, events and related resources that may be of interest to you
Use cookies and other data collection technologies to help you navigate our website or technical solutions, personalize and provide a more convenient experience to you, analyse which pages you visit, which features you use, provide features such as social sharing widgets and videos, measure advertising and promotional effectiveness, assess which areas of our site you visit to remarket to you after you visit our site, and to provide content to you from our third party content partners

You may withdraw your consent at any time by clicking the “unsubscribe” link in the email communications we send to you. You may also withdraw consent by exercising Your Rights as described below, including through our rights management solution.

To investigate complaints or concerns based on our legitimate interest to ensure that such complaints or concerns are addressed appropriately
To evaluate the characteristics and needs of our customers based on our legitimate interest in improving the solutions we offer and provide
To communicate with you about Orora events, industry or related news based on our legitimate interest in engaging with you as a customer
To administer our website and to understand how our website visitors navigate through our websites

Statistical and research purposes: We may further analyse information we gather online to improve the online experience and resources we provide to our users

If you are an employee, contractor, job applicant, temporary hire or former employee:

If you have a contract or other agreement with us, we process personal information about you to fulfil the specific obligations we have to you under the applicable contract or agreement such as:

Payment of project fees to contractors and temporary hires
Managing performance obligations under employment contracts, where applicable
Management of Orora stock options pursuant to stock option agreements
Management of stock ownership pursuant to stock purchase and related agreements

Our legitimate interests: we process personal information about you based on our legitimate interests, including to establish and manage our relationship with and responsibilities to you and for effective operation of our business, such as to:

Recruit new talent to join Orora
On-board employees, contractors and new hires to Orora
Grant and ensure appropriate access to Orora systems and facilities
Ensure the security and safety of the workplace and the tangible and intangible assets for which we are responsible
Assign roles and responsibilities
Manage team and cross-functional communications and collaboration
Promote a positive workplace culture
Administer payroll
Benefits administration
Award and pay incentive compensation
Invoice payments
Managing Orora projects and processes
Maintaining corporate, financial and other essential business records and reporting
Evaluating financial and operational performance
Managing compliance, including, but not limited to our privacy, security, accounting, labour and employment, and other legal and regulatory obligations

Statistical and research purposes: We may further analyse information to evaluate and understand employee engagement and to develop plans to continuously improve our workplace culture.

How do we protect your personal data?

We take the security of your personal data very seriously. Accessing your personal data is only permitted among our team members on a need-to-know basis and subject to strict contractual confidentiality obligations when processed by third-parties.

International Data Transfers

If you are accessing our websites from outside the United States of America, please note that your data may be transferred to, stored or processed in the United States. We do take steps to protect your privacy and afford the rights to opt-in, request changes to or delete your data. However, please note that by accessing our websites you consent to the transfer of your information to our data processing facilities and third-party tools that we utilize as described throughout this Privacy Policy.

We may transfer, access, or store personal information about you outside of your country. This may include but is not limited to, transferring, accessing, or storing personal information about you outside the European Economic Area (“EEA”), Switzerland, Australia, New Zealand, Mexico, Canada, the United States or another country that requires legal protections for international data transfer. When we do, we will ensure that an adequate level of protection is provided for the information by using one or more of the following approaches:

We may transfer personal information to countries that have privacy laws that have been recognized by the country from which the data are transferred as providing similar protections for the data.
We may enter into written agreements with recipients that require them to provide the same level of protection for the data.
We may rely on other transfer mechanisms approved by authorities in the country from which the data are transferred.

How do we share data about you?

At Orora, we only share personal information in ways that we tell you about.

We do not sell or rent personal information to third parties and we do not share personal information with third parties that are not owned by us or under our control or direction except as described in this Policy.

Service providers. We share personal information with service providers that help us with our business activities. They only are authorized to process that information as necessary and as directed by us.
Required by law. If we are required to disclose personal information as part of a legal process, we will take commercially reasonable steps to inform you as part of that process. We may also be required to disclose personal information in response to lawful requests by government authorities, including requests from national security agencies or law enforcement.
Safety, fraud prevention, government requests and protection of our rights are all reasons where we may share personal information where we believe in good faith it is necessary.
Mergers, acquisitions, divestitures, or asset sales but only if the acquiring organization agrees to this Policy’s protections.

Keeping and Securing Your Data

We will keep personal information about you for as long as we provide solutions to you, as long as you work for or with us, or as long as we are addressing a concern, question, complaint, or request you have made to us, as applicable to our interactions with you. If we have a contract or other agreement with you, we will follow the retention obligations of that agreement.

We may keep data longer if we have a legal obligation to keep it or to maintain necessary records for legal, financial, compliance, or other reporting obligations, and to enforce our rights and agreements. We also may keep data about you for statistical analysis or research purposes.

We take appropriate security measures to protect personal information against loss, misuse, and unauthorized access, alteration, disclosure or destruction. We also have implemented measures to maintain the ongoing confidentiality, integrity and availability of the systems and services that process personal information, and will restore the availability and access to data in a timely manner in the event of a physical or technical incident.

What are your rights?

You have the right to object to certain uses of your personal data. To exercise those rights, please contact us at the relevant address below. You have rights under privacy and data protection laws related to the data we process about you. You do not have to pay a fee, and we will aim to respond to your request within 30 days, unless otherwise stated in this Policy or required by law. We will honour the requests you make related to your rights as the relevant regional law allows, which means in some cases there may be legal or other official reasons that we may not be able to address the specific request you make related to your rights. Subject to applicable regional laws, you may have the:

Right to be informed: right to be provided with clear, transparent and easily understandable information about how we use your personal data and your rights. This information is covered through the contents of this Privacy Policy
Right to access and rectification: right to access, change or correct your personal data. Please contact us to exercise this right
Right to data portability: personal data you provide us can be moved, copied or transmitted electronically in certain circumstances
Right to be forgotten: right to request the deletion of your data, in some circumstances. If you would like us to delete this data, please submit a request and we will take reasonable steps to respond in accordance with legal requirements. If we no longer need the personal data we collect for any purpose and we are not required by law to keep it, we will do what we can to delete, destroy or permanently remove any data that could be used to personally identify you
Right to restrict processing: right to restrict the processing of your personal data, in certain circumstances
Right to object: right to object to certain types of processing, including processing for direct marketing (i.e., receiving emails from us notifying you or being contacted with varying potential opportunities), in certain circumstances
Right to lodge a complaint: right to lodge a complaint with a Supervisory Authority, if you object to the way we process your personal data
Right to withdraw consent: right to withdraw your consent to the use of your personal data at any time, even if you have provided consent to the use of your personal data in the past. To withdraw consent, please email us
Rights related to automated decision-making: the right to human intervention, to express your point of view, to obtain an explanation of a decision reached after an assessment, and to challenge a decision based solely on automated processing and which produces legal or other significant effects on you

California residents may additionally:

request the names and addresses of affiliated companies and categories of Personal Information we share for direct marketing purposes by contacting us here
request the following up to two times in a 12-month period via our Rights Manager found hereand we will respond within 45 days:
- The categories of personal information we have collected about you in the past 12 months
- The categories of sources from which we collect personal information
- The business purpose for collecting or selling personal information
- The categories of third parties with whom we share personal information
- The specific personal information we have collected about you in the past 12 months
- The categories of personal information that we sold about you and the categories of third parties to whom the personal information was sold in the past 12 months, or verification that no personal information was sold
- The categories of personal information we disclosed about you for a business purpose in the past 12 months, or verification that no personal information was disclosed

Orora will not discriminate against anyone who exercises their legal rights.

Privacy for Children

Orora is committed to protecting the privacy of children. Our websites are intended for use by adults. We do not knowingly collect information about children or sell products to children. If you are a child, we kindly ask that you do not use our website. If we discover that we have collected personal data from a child, we will delete that data as soon as we are able.

How to contact us about your information or request to opt-out

If you wish to obtain access to your personal information held by us, or to request us to correct any errors in that information, please contact us by:

United States

Please contact us at 1-888-526-3723 or at privacy@ororagroup.com if you any questions or would like to review, access, delete, correct or update your personal information. You can also submit written inquiries to:

Privacy Officer
Orora Packaging Solutions
6600 Valley View Street
Buena Park, CA 90620, USA

Australia

Please contact us at +61 3 9811 7111 or at privacy@ororagroup.com if you any questions or would like to, access, delete, correct or update your personal information. You can also submit written inquiries to:

Privacy Officer
Orora Limited
109 Burwood Road
Hawthorn, Victoria 3122, Australia

If you are not satisfied with how Orora has dealt with your enquiry, you may contact the Office of the Australian Information Commissioner at enquiries@oaic.gov.au or by calling 1300 363 992.

New Zealand

Privacy Officer
Orora Packaging New Zealand Limited
239 Cavendish Drive
Manukau, New Zealand

If you are not satisfied with how Orora has dealt with your enquiry, you may contact the Office of Privacy Commissioner at investigations@privacy.org.nz or by calling 0800 803 909.

European Economic Area

The nominated Representative for data protection matters within the European Union is:

Email

privacy@ororagroup.com

Privacy Officer
Orora Landsberg
15 Hill Street Edinburgh
EH2 3JP UK

Privacy Policy Updates

We may update this policy from time to time. We will provide notice of any material changes to our Policy as required by law. We will also post an updated copy on our website. Please check our site periodically for updates.

This Privacy Policy was last updated January, 2020.