Supplier Code of Conduct

This Practical Guidance for Stora Enso's suppliers is aimed to help our suppliers to interpret and implement the requirements defined in our SCoC and to identify potential areas of improvement. The Guidance follows the same structure as the SCoC.

If you need further clarification on the terms used in the SCoC or this Guidance, please refer to the Terminology chapter at the end of the Guidance. If you have any feedback or questions, or require additional support with any parts of the SCoC or with implementing the requirements, please do not hesitate to contact us. 

The Supplier must:

• Comply with all applicable laws, regulations and permits. If there are differences between the requirements of laws, regulation and permits and this SCoC, or between the Supplier’s own code of conduct and this SCoC, the Supplier must adhere to whichever is stricter. 

Stora Enso is committed to fully follow all applicable legislation wherever we operate. But playing by the rules is not enough – we go beyond compliance whenever possible and always strive to be better. We encourage our suppliers to do the same.

Our SCoC outlines minimum standards for our suppliers that function as additional requirements to applicable laws and regulations.

• Demonstrate its commitment to and compliance with the requirements of this SCoC, or where applicable its own equivalent code of conduct, as well as all other relevant and applicable laws and regulations, through adequate management systems appropriate to the size and nature of the Supplier’s operations. This should, at least, include policies and guidelines, effective risk management, trainings, and the allocation of sufficient resources.  

Policies and guidelines present a company's commitment to and ways of working on different topics.

Having a management system means that you have a framework or process to ensure that your organisation can fully achieve its objectives, improve its performance, and act according to laws and regulations. It is a description of how the organisation works: an organisation chart including roles and responsibilities; main processes and their links to each other; target setting; monitoring performance; key documents and instructions. A management system can be manually documented and maintained or supported with IT tools.

The quality and exact function of your management system depends on the nature and size of your operations. A complex, global operation with many employees and potential risks will require an advanced management system that is based on standards, such as ISO 9001, ISO 14001, ISO 45001, and/or SA 8000. A privately owned small enterprise will need a lighter approach.

Risk management means that you are aware of and mitigate the impacts and risks of your operations on, for example, safety, ethical business, the environment, and human rights. You should systematically and in a reasonable manner document assessments and mitigation plans that are regularly reviewed by the senior management of your company. Assigning responsibility to specific people for individual topics helps to ensure that sufficient resources are allocated to material topics and targets.

• Ensure that its own suppliers and subcontractors comply with the requirements of this SCoC or equivalent standards and take responsibility for their work.

Companies operate in a complex world among many different stakeholders with various interests. For Stora Enso, it is not enough to only manage our own operations; we also need to take into account surrounding communities, our business partners, non-governmental organisations, and other stakeholders.

We want all stakeholders in our supply chain to know about the requirements of our SCoC or our supplier’s own code of conduct. To do this, you should consider communicating the requirements of our SCoC, or those set in your own code of conduct, to your supply chain and explaining why it is important to comply with them. You can also encourage your suppliers to learn more about your code of conduct and/or Stora Enso’s SCoC.

Monitoring your own suppliers and sub-suppliers, for example through contractual sustainability requirements, on-site audits, or site visits, will help you ensure that the services or materials you provide to us, and the materials you use to manufacture components, parts, or products, are sourced from environmentally and socially responsible sources. Materials and services that either directly or indirectly contribute to conflicts are unacceptable. Conducting due diligence in your sourcing operations will help you identify risks and inform the way you choose to monitor your suppliers and sub-suppliers.

As relevant, you must exercise due diligence regarding the source and chain of custody of the materials and services you provide/use and make any due diligence measures available upon request.

• Maintain transparent and accurate books and records to demonstrate compliance with the requirements of this SCoC, or where applicable, their own equivalent requirements, and applicable laws and regulations. Upon request, the Supplier shall provide Stora Enso with such documentation.

You should be able to provide evidence and documents that demonstrate how the requirements of our SCoC are taken into account in your operations.

We expect you to truthfully and accurately, as defined by applicable law, disclose information regarding your business activities, structure, financial situation, and performance in accordance with all applicable laws, regulations, and prevailing industry practices. For this purpose, you will need to maintain transparent and up-to-date financial records as well as records that enable you to demonstrate compliance with all applicable regulations.

• Act in compliance with all rules and regulations related to product safety as well as quality and due diligence requirements for all goods, such as equipment, articles, chemicals, and services delivered, including rules defined by Stora Enso when applicable.

Doing business responsibly also means complying with laws, regulations, standards, and policies related to the product safety, quality, and due diligence of all goods. Stora Enso has defined rules to ensure the safety of its operations to people and the environment. For example, when entering our premises or facilities, familiarise yourself with and adhere to the safety and environmental instructions of that site.

We require all our suppliers to deliver quality products and services that offer a high level of safety, reliability, and environmental performance. In particular, this applies to preventing, identifying, and correcting safety defects. For example, it is important that our suppliers maintain and update MSDS/SDS sheets for chemicals and receive such sheets from their own suppliers. We may ask for this information, or other relevant documentation related to chemicals, to ensure the safety of the chemicals used in our operations.

Conducting due diligence means that a company takes reasonable steps to avoid committing an offense or violation or breaching an agreement. Due diligence can include activities, such as investigations, audits, or document reviews.

• Have an appropriate business continuity plan to mitigate the impacts of potential exposure to terrorism, crime, business threats, cyber incidents, pandemics, natural disasters, and other relevant major accidents.

Business continuity is the advance planning and preparation undertaken to ensure that a company will have the capability to operate its critical business functions during unexpected and emergency events. These types of events can include natural disasters, business crises, pandemics, workplace violence, major accidents, or any event that results in a disruption of your business operations. It is essential to plan and prepare not only for events that will stop operations completely but for those that also have the potential to adversely impact operations. A business continuity plan outlines procedures and instructions an organisation must follow in the face of such disasters. It covers topics, such as business processes, assets, human resources, and business partners. 

The Supplier must:

• Have zero tolerance for corruption in all its forms and never pay, accept, or mediate bribes, facilitation payments, or kickbacks.

Stora Enso has a zero tolerance approach to corruption anywhere in its operations and value chain. Corruption, in this context, includes offering, giving, receiving, or soliciting bribes, facilitation payments, and other means to obtain improper benefit or advantage, either directly by a company or by a third party for its benefit.

•  Avoid providing or receiving excessive business entertainment that could inappropriately affect the outcome of business decisions

• Not pay for the travel or accommodation costs of Stora Enso Representatives when they are visiting the Supplier, nor offer them gifts, hospitality, or entertainment, except moderate catering in direct connection with business events. 

Competing and doing business should be based only on quality and competence. Gifts, hospitality, or expense payments that are of unreasonably high value, or that could inappropriately affect business decisions – or even create this impression – should be avoided. Rebates, commissions, donations, and should be made transparently.

Stora Enso always pays for the travel and accommodation costs of its employees. There is no occasion where an organisation or person inviting our representatives would be allowed to pay any of these costs. We encourage all our stakeholders to do business in this same transparent manner, so as to support fair and open competition.

• Prevent conflict of interest situations that affect Stora Enso’s legitimate interests and report such situation to Stora Enso without delay. 

A conflict of interest refers to situations in which personal interests, outside activities, external interests, or personal relationships may have an effect on your ability to fulfill your obligations. A conflict of interest could arise, for example, when you are involved in activities or contractual arrangements with other parties or have significant ownership and power in other companies, which could influence your decisions or work. This does not restrict your freedom to compete in the market, have contracts with other customers, and negotiate your business relationship with Stora Enso.

Working for companies other than Stora Enso is not a conflict of interest unless you have made a specific separate agreement that directly restricts your ability to act freely in your business relationship with us. Please inform us of any situation that could possibly be seen as resulting in a conflict of interest.

• Never participate in money laundering or the financing of terrorist, or criminal activities, and comply with applicable export controls and  trade sanction programmes. This requires conducting careful due diligence before selecting a business partner. 

Money laundering is the process through which an individual or organisation seeks to make the proceeds of criminal activity appear legitimate. Money laundering in this context also refers to the handling of any benefit that arises from acquisitive crimes, such as theft, fraud, or tax evasion. You should not knowingly or through negligence engage in transactions that constitute or facilitate money laundering and terrorist financing or that otherwise result in the unlawful diversion of assets.

Export controls are laws and regulations that restrict or require authorisation for the export, re-export, or transfer of certain goods, software, technology, or services, particularly those that could have military, security, or dual-use applications. Before exporting or transferring such items, you should check whether a licence or other authorisation is required and ensure that the intended recipient and end use are permitted.

The international community, including the UN, the EU, and individual countries, impose a wide variety of trade sanction programmes against violators of internationally recognised human rights and principles of law. These sanction programmes are typically targeted at specific countries or territories; persons, entities, and/or organisations; as well as types of products and/or activities. Sanction programmes also prohibit activities that are intended to circumvent or evade the imposed restrictions.

Compliance with applicable export control and sanction programmes is not only important for you or Stora Enso as a company, but also for individual employees. In some jurisdictions, breaches of export control or sanction programmes may lead to criminal liability and the imposition of fines on individual employees in a personal capacity.

Stora Enso is required to comply with the various sanction programmes applicable to its business. Each Stora Enso entity has, regardless of where it is incorporated, undertaken to comply with the sanction programs imposed by the EU, the UN, the US, and the UK, as well as any national or other local sanction programmes applicable to it. Stora Enso considers the sanction programmes applicable to a contracting Stora Enso entity to apply to the corresponding contractual relationship. As a minimum, therefore, the sanction programmes applicable to a contractual relationship are the EU, UN, UK, and US sanction programmes, together with any other sanction programmes applicable to the contracting entity, and suppliers are expected to comply with all such programmes accordingly. 

• Compete fairly and in compliance with all applicable antitrust and competition laws by, for example, not agreeing on price fixing, output levels, market sharing, or customer allocations and not sharing competitively sensitive information. 

Stora Enso is committed to free and open competition in markets. Supporting free and fair competition in the market works in our interest and benefits society at large.

All companies should be able to trade and compete as they wish, as long as they follow all applicable laws and regulations. This means, for example, never share competitively sensitive information of Stora Enso's competitors with Stora Enso, becoming involved in fixing prices in the sharing of confidential information between competitors, or in any other unfair or restrictive business practices.

• Comply with relevant data privacy legislation and other related regulations and implement effective practice to ensure the security of personal data and respect for everyone’s right to privacy throughout its operations. 

You must comply with applicable data protection and privacy laws, relevant official guidance, and any contractual privacy and security requirements applicable to our collaboration.

Personal data must only be collected, accessed, used, disclosed and retained for legitimate business purposes, and only to the extent necessary for those purposes. Appropriate technical and organizational measures must be implemented to protect personal data against accidental or unlawful destruction, loss, alteration, or unauthorized disclosure of or access to such data, taking into account the nature of the data and the related risks. Where third parties are engaged in connection with personal data processing, you shall ensure that appropriate privacy, confidentiality and security measures are applied. International transfers of personal data must comply with applicable cross-border transfer requirements.

You are required to reasonably cooperate with us in addressing privacy, data protection and cybersecurity matters related to our collaboration. Any actual or suspected personal data breach or cybersecurity incident that may affect personal data, systems or services involved in the business relationship with us must be reported to us without undue delay. 

• Protect entrusted confidential and sensitive information with due care and ensure the cyber security of its operations by understanding risks and implementing sufficient controls. 

You should understand your cybersecurity and information-protection risks. You should implement sufficient controls by aligning with recognized industry standards and certifications. Examples include ISO/IEC 27001 for information security management, SOC 2 Type II for control assurance, and the NIST Cybersecurity Framework for risk-based control selection. ISO/IEC 27701 or GDPR-aligned frameworks support data privacy. These standards demonstrate due care, benchmark control maturity, and provide independent assurance that confidential and sensitive information is properly protected.  

The Supplier must:
​
​

- Implement a systematic approach to OHS risk mitigation and controls, including identifying, assessing, and prioritizing risks, and applying the hierarchy of controls to reduce exposure to hazards.

- Comply with all applicable OHS and hygiene requirements defined by Stora Enso and ensure a safe and healthy working environment for its employees, visitors, and employees of any contractors working on its behalf.

We recommend that you have a written OHS policy in place, where your top management can communicate the importance of a healthy and safe workplace to all of your employees. Strong support from top management level is vital to the successful management of OHS topics, and managers should pro-actively demonstrate their commitment to health and safety through their own actions. 

- Assign responsibility for OHS issues within its organisation.

The responsibility for OHS issues should be clearly assigned to specific people in the organisation. All employees should know who has the overall responsibility of OHS and understand their own roles and responsibilities through regular training. 

- Take measures, including appropriate controls, work procedures, workplace inspections, and emergency plans, and provide necessary safety equipment and personal protective equipment (PPE), to prevent workplace hazards and accidents. Employees shall not be charged for required PPEs.

Suppliers are required to carry out Hazard Identification and Risk Assessments and to determine controls. Hazard Identification, Risk Assessment, and controls are the basic key elements of OHS management. Hazards must be identified and risks evaluated in all work areas and in all work types. The risk assessment must include all health and safety issues relevant to the work, including mechanical, biological, chemical, psycho-social, and ergonomics risks. The risk assessment must contain the evaluation/prioritisation of risk (e.g. impact x likelihood assessment) and corrective actions or measures to remove/mitigate/control the risk. As one example of OHS risk mitigation and controls, special attention has to be paid to controlling that appropriate PPE is available and used by employees. Employees must never be asked or expected to pay for PPE that is required for their role; this cost is the Supplier's responsibility.

Employees must identify risks before starting work. Supervisors must follow up on all safety rules and procedures being adhered to in daily work. All work has to be planned beforehand to ensure that the work can be done is a safe way.

Companies need to ensure that OHS rules and procedures are followed in daily work and that the physical conditions are safe by carrying out regular safety inspections and audits. The audits are important because the audit results give systematic information on the areas of strengths and opportunities for improvement.

Your written and well communicated procedures should be designed to respond to emergencies, such as fires, explosions, chemical spills, natural disasters, medical emergencies, or any other emergency situation that might arise in your operations. You should have sufficient capacity to provide first aid as necessary, in the shape of readily available first aid equipment and suitably trained staff. It is essential to hold regular drills to practice emergency responses. Emergency procedures are needed to ensure that in any case of emergency everyone immediately knows what actions they need to take to control the situation as soon as possible and limit any damage.

- Monitor and keep records of its OHS performance and hazards, and report and investigate all OHS-related incidents.

Ways to monitor and keep records of your OHS performance and risks include:

- Evaluating the effectiveness of your OHS work with suitable metrics. Typical OHS metrics include statistics on Total Recordable Incidents (TRI) and Lost Time Accidents (LTA) rates; number and type of incidents (near-misses, accidents); and absenteeism or attendance rates.

- Properly recording and investigating all accidents and near-misses.

- Defining concrete corrective actions as soon as possible after an incident and following up on their implementation.

- Keeping detailed records on the number and nature of near misses and accidents to define the right measures for eliminating their root causes.

If you operate within Stora Enso’s sphere of responsibility, such as at our mills, in our harvesting operations, or logistics services, or at our tree planting sites – you should also report all accidents to Stora Enso.

- Ensure that its personnel have received appropriate OHS training, strive to increase its employees’ and sub-contractors' awareness of health and safety issues, and enhance safety culture through open communications. 

OHS rules and procedures will not be effective if your employees are not aware of them. Ways to ensure that your employees understand the importance and practicalities of OHS issues include:

- Offering regular training on relevant OHS issues to ensure that everyone knows the risks and the correct way to work safely, and to build a proactive safety culture.

- Raising awareness through regular communications.

- Engaging employees in the continuous improvement of OHS. Employees often have the best understanding of working methods and how to improve safety.

- Establishing a forum to exchange information between employees and management on issues including unsafe incidents, safe working methods, up-coming regulation, and/or training. 

The Supplier must:

• Respect all internationally recognized human rights, which, as a minimum, should be considered to include the human rights protected in the International Bill of Human Rights and the principles concerning fundamental rights specified by the International Labour Organization (ILO).

The International Bill of Human Rights consists of the Universal Declaration of Human Rights together with the International Covenant on Civil and Political Rights and the International Covenant on Economic, Social and Cultural Rights. Together, these instruments set out the fundamental rights and freedoms that all people are entitled to, such as the right to life, liberty, and security; freedom from discrimination; and the rights to fair working conditions, health, and education. The ILO's fundamental principles cover freedom of association and the right to collective bargaining, the elimination of forced and child labour, and the elimination of discrimination in employment. We strongly recommend that our suppliers also commit to the UN Guiding Principles on Business and Human Rights (UNGPs). According to the UNGPs, respecting human rights means that companies:

• Make a public commitment to respecting human rights.
• Take the right steps to identify their potential impacts on people and address them. This is called due diligence.
• Provide grievance channels for all stakeholders to speak up and report potential misconduct, including cases related to human rights. Companies must also be prepared to remedy – to make right – any confirmed cases.
• Communicate and report transparently on their performance.

Human rights should be respected across your operations and in your relationships with business partners and other stakeholders that might be impacted by your operations. This includes your own employees, those of your suppliers and business partners, as well as people in surrounding communities. Related requirements apply equally to all workers, including permanent and temporary employees, onsite contractors, and agency workers, as well as piece-rate, salaried, hourly paid, legal young workers (minors), part time, night, and migrant workers.

In addition to labour rights, it is important to take into account environmental and social impacts related to:

• Surrounding communities where people’s health, livelihoods, access to clean water, education, and cultural life could be affected.
• Accommodation if provided to employees must be clean and safe, offer reasonable personal space, and be fitted with adequate emergency exits, heating, and ventilation. It should provide access to clean toilet facilities, potable water, and hygienic food preparation and storage facilities.
  
  
• The acquisition, renting, and leasing of land or property without prior and informed consent or adequate compensation to affected people.
• The improper displacement or resettlement of communities, including indigenous people, ethnic minorities, and other vulnerable groups, to support a company’s activities. This includes adverse impacts resulting from the establishment, expansion, reduction, or termination of operations.
• The improper treatment of people working on-site or living in neighbouring communities by security personnel employed by or acting on behalf of a company.
• The use and disposal of products and services.
• The non-resolution of grievances related to a company’s operations.

• Provide equal opportunities to all its employees and not discriminate against anyone based on ethnicity, gender, disabilities, sexual orientation, national and social origin, union membership, religious or political beliefs, or other such characteristics.
  
  
• Treat all employees with dignity and respect. Not allow or engage in any form of physical, psychological, verbal, or sexual harassment or abuse towards any employee.

Everyone has the right to feel safe, included, and respected at work. We have zero tolerance against discrimination and harassment of any kind and expect the same from our suppliers. Everyone should be treated equally regardless of ethnicity, gender, disabilities, sexual orientation, national and social origin, union membership, religious or political beliefs, or other such characteristics. This means, for example, that employees must not be treated less favourably because they belong to, or choose not to join, a trade union, or because of where they or their family come from. Discrimination is not acceptable during any part of any employment relationship (hiring, compensation, benefits, advancement, discipline, termination, or any other employment practices). All individuals, regardless of their position within the organisation, must be treated with due respect (ILO Conventions 100 and 111 on Discrimination).

All forms of unfair and inhumane treatment of workers, including bullying, abuse or harassment, are equally unacceptable to Stora Enso.

• Not employ any workers below 15 years or the legal national minimum age or below the age for completing compulsory schooling, whichever is higher (in line with the ILO Convention 138 on child labour). If child labour is found, the Supplier must take actions that are in the best interest of the child.

We do not accept any form of child labour anywhere along our supply chain. It is important to understand the risk of child labour in your own operations and among your suppliers and sub-suppliers, and to highlight that you completely condemn such practices. To ensure that no  person below the minimum age is employed in your operations (including your own employees and contracted workers), it helps to have robust age verification procedures and records in place.

If a child or underage person is found working in your operations or in your supply chain, you should inform Stora Enso immediately. Such cases should be handled together with experts to ensure that the actions taken are in the best interest of the child. This can mean, for example, that you help the child to attend and remain in school to ensure that they are not immediately employed by someone else. We also strongly recommend that you commit to the Children’s Rights and Business Principles.

• Ensure that employing young people above minimum age but under 18 years does not jeopardise their education, physical or mental health, safety, moral or social development. Hazardous or night work is not allowed.

We support the use of legitimate workplace apprenticeship programmes that comply with all relevant laws and regulations. All young workers below the age of 18 but over the minimum age (as defined above) must be protected from performing any work that is likely to be hazardous, that interferes with their education, or that may be harmful to their health or physical, mental, social, spiritual, or moral development. In practice, this also means that young workers must not be assigned night shifts or asked to perform hazardous tasks, such as work involving dangerous machinery, chemicals, heights, or heavy lifting, regardless of local practice.

• Not use or benefit from any forms of forced or compulsory labour. Retention of employees' personal documents, such as passports, ID cards, work or residency permits, or other similar personal legal documents, is prohibited.

This requirement is to ensure that your activities respect ILO Conventions 29 and 105 on Forced and Compulsory Labour. All work, including overtime work, must be voluntary, and workers must be free to leave employment on reasonable notice.

Involuntary labour includes all forced, bonded, or indentured labour, human trafficking, and any other form of labour where the worker is not working by choice but instead, is in some way forced to do so. Human trafficking, for example, includes the transportation, harbouring, recruitment, transfer, or receipt of any persons by means of threat, force, coercion, abduction, fraud, or payments to any person having control over another person for the purpose of exploitation.

Ways to ensure that involuntary labour does not exist in your operations or supply chains:

• Workers are not required to surrender any government-issued identification, ID cards, passports, work permits, or residency permits as a condition of their employment. This also applies to third-party agencies providing workers.
• Any loans or salary advancements to employees are based on fair terms that are clearly explained to the employee.
• All documents relating to employment relationships are available to employees, and explained accurately in a language understood by the worker whenever possible.

• Follow ethical recruitment practices and ensure any recruitment or labour agency working on behalf of the Supplier does the same. Employees must not be charged any recruitment fees or related costs, as defined by the ILO. Where such fees or costs have been paid by the employee, the employee must be repaid without any delay.

Human rights should always be respected in recruitment. The ILO defines recruitment fees and related costs broadly to include any fees or costs incurred in the recruitment process in order for workers to secure employment or placement, regardless of the manner, timing, or location of their imposition or collection. This can include, for example, fees for recruitment services, medical examinations, document processing, or transportation to the place of work. In addition to the labour rights requirements that are included elsewhere in this SCoC, ethical recruitment can mean, for example, that:

• No recruitment fees or other related costs are borne by the worker. If such fees or costs have already been charged, the worker is repaid promptly and in full.
• There is no coercion to sign an employment contract.
• The employment contract is clear and understandable for the worker.
• The employee is free to end the employment and return home (in the case of migrant workers).
• There are no limitations to freedom of movement (for example, withholding passports).

• Provide employees with a written contract, or equivalent, that clearly outlines information about the key terms of their employment in a language understood by the employee.

A written contract, or an equivalent document, gives employees clarity and legal certainty about their employment relationship from day one. At a minimum, it should be provided before work begins and should cover key terms such as job role and duties, working hours, wages and how they are calculated and paid, benefits, and notice periods. It should be written, or clearly explained, in a language the employee understands, and a copy should be kept by both the employer and the employee.

• Fully recognise employees’ right to organise, and to form and join (or not join) a union and bargain collectively. If (private) unions are not allowed, the Supplier must support other forms of employee representation.

These requirements are in line with ILO Conventions 87 and 98 on Freedom of Association and Collective Bargaining. Workers have the right to join (or not joint) or form trade unions of their own choosing, and to bargain collectively, without prior authorisation from management.

Ways to ensure that employees’ right to organize is respected:

• The employer does not obstruct or prevent such activities. When operating in an area where the right to freedom of association and collective bargaining is legally restricted or prohibited, the employer does not hinder any other forms of independent worker representation and negotiations.
• Worker representatives or trade union members are not penalised or discriminated against because of their links to a trade union or their legitimate trade union activity, in accordance with international labour standards.
• Worker representatives have access to the workplace in order to carry out their representative functions.

• Pay employees a wage meeting at least the national minimum wage, applicable collective agreement, or industry standards, whichever is higher. Wages are sufficient to meet basic needs and allow for some discretional income and is paid on time, regularly, in a transparent way, and directly to the employee. Wage deductions are not used as a disciplinary measure.

Wages must be paid on time and regularly, for example weekly or monthly as agreed, and employees should receive a clear, understandable payslip or equivalent showing how their pay was calculated. Wages must be paid directly to the employee, not to a third party, unless the employee has freely and clearly consented otherwise. Deducting wages as a form of punishment or discipline, for example for lateness, mistakes, or breaches of workplace rules, is not acceptable; any deductions should be limited to those required or permitted by law, such as tax or social security contributions, or freely agreed benefits.

• The Supplier takes particular care to ensure that its suppliers performing work at Stora Enso's sites adhere to the wage and working hours requirements set out in this SCoC.

If your own suppliers or subcontractors perform work at Stora Enso's sites, you remain responsible for making sure that they comply with the wage and working hours requirements described above. We recommend building these requirements into your contracts with such suppliers and monitoring their compliance, for example through site visits, payroll checks, or working-time records.

• Apply normal working hours that comply with applicable laws and applicable collective agreements. Where no such regulation exists, working hours shall not exceed 48 hours (or 60 hours, including overtime) per working week on a regular basis. Employees are provided with at least 24 consecutive hours of rest in every seven-day period.
  
  

Ways to ensure that employees do not work in excess:

• Employees’ weekly working hours do not exceed 60 hours, including overtime, except in emergency or exceptional situations. All overtime work is voluntary.
• The employer keeps verifiable working time procedures and records, including records of overtime hours, for all employees (per individual). Practices such as “double bookkeeping” on working hours are unacceptable.
• Workers have at least one day off in every seven-day period.
• Employees with family responsibilities, such as dependent young children or aged parents under their care, are given flexibility in their working arrangements to ensure equal opportunities.

• Overtime must be voluntary unless exceptions are allowed in national laws, collective or similar agreements, and compensated at a premium rate or as defined in national legislation or applicable collective agreement.

• Employees are allowed to freely enter and leave their workplace and any housing provided by the Supplier.

All employees should be allowed to exercise their right to freedom of movement. This includes freely entering and leaving the workplace and any housing provided by their employer.

• Employees must have access to clean drinking water, food and sanitation facilities at work. Any housing provided by the Supplier must be safe, comfortable, and healthy.

Access to basic necessities at work is a fundamental part of a decent and dignified working environment. This means, at a minimum, that employees have free and unrestricted access to clean drinking water throughout the working day, food or facilities to prepare and/or store food hygienically, and clean, functioning toilet and washing facilities appropriate for the number of employees on site.

If you provide housing to your employees, for example for migrant or seasonal workers, it must be safe, comfortable, and healthy. In practice, this means the accommodation should:

• Be structurally sound, with adequate space, lighting, heating, and ventilation for the number of people living there.
• Have access to clean drinking water, functioning sanitation, and washing facilities.
• Provide safe facilities for storing and preparing food.
• Be fitted with adequate emergency exits and firefighting equipment, and comply with applicable fire and building safety regulations.

Offer employees reasonable privacy and personal space, and allow them to freely enter and leave, in line with their right to freedom of movement.

• Ensure that all security personnel are properly trained to prevent actions that could lead to harm to people. Excessive use of force is strictly prohibited.

The Supplier must:

- Respect land rights and land use of communities, including indigenous people. Activities that may affect local or indigenous communities, such as agriculture and forestry development, is subject to their free, prior, and informed consent (FPIC).

Land rights cover the ability to use, manage, and benefit from land and natural resources, whether through legal ownership, customary tenure, or long-standing traditional use. Indigenous peoples often hold particularly strong ties to land based on ancestral occupation, even without formal legal title.

Free, Prior, and Informed Consent (FPIC) is a specific right of indigenous peoples under the UN Declaration on the Rights of Indigenous Peoples, allowing them to give or withhold consent to a project on their ancestral land or territory FPIC means that consent must be:

• Free – given voluntarily, without coercion, intimidation, or manipulation.
•  Prior – sought sufficiently in advance of any authorisation or start of activities, allowing enough time for the community's own decision-making processes.
• Informed – based on complete, accurate, and accessible information about the nature, scope, risks, and potential impacts of the activity, provided in a form and language the community understands.
• Consent – reflecting the community's own decision, reached through its own customary decision-making structures and representatives, and covering both agreement to proceed and the right to say no.

In practice: before starting activities like agriculture or forestry development that may affect local or indigenous communities, identify who is affected, engage in genuine dialogue, and secure their consent before proceeding.

• Strive to contribute to the positive social and economic development of the communities impacted by its operations, and minimise any negative impacts of their operations on those communities.

• Strive to engage in meaningful dialogue with impacted communities.

Investing in communities can improve their quality of life and generate business benefits for the company in the form of community support and competitive advantage. Managing company actions responsibly helps minimise their negative socio-environmental impacts and maximise the positive ones.

Ways to support and engage with communities:

• Initiating and maintaining a dialogue with communities that are impacted by your operations. 
• If there are known stakeholder concerns, or if such arise, it is best to address them proactively. You can collaborate with partners, such as expert NGOs, on this work.
• In practice, you can, for example, support local educational projects, organizations that address the interests of vulnerable groups, or the cultural activities of indigenous communities.

The Supplier must:

• Prevent significant nature and environmental degradation, such as harmful soil alteration, water or air pollution, harmful emissions, excessive water use and consumption, soil degradation, biodiversity loss, or other impacts on natural resources such as deforestation.

This is an overarching requirement that sits alongside, and reinforces, the more specific environmental requirements below. It means proactively identifying where your operations could cause significant harm to nature, whether through pollution, overconsumption of natural resources, or loss of biodiversity, and taking action to prevent that harm before it occurs. "Nature” is broader than the traditional concept of “the environment”: it encompasses not only environmental pressures such as pollution and resource use, but also the condition and functioning of ecosystems and species that an organisation depends on, impacts, or influences, including forests, soils, freshwater and other ecosystems.

• Use resources efficiently and ensure adequate operational control minimizing adverse impacts on nature and the environment. Depending on industry, operational controls can cover topics such as emissions and energy management; water effluents; raw materials and water use; and the storage and handling of chemicals, hazardous materials, and waste.