Onesies - Privacy Notice

BAT processes your personal data for marketing and branding purposes, when you have signed up to receive newsletters and other marketing material from BAT, if you follow and/or interact with our accounts on social media or if you participate in any BAT marketing activities, such as events, parties, competitions, lotteries etc. as well as if you contribute to any BAT branding, e.g. by letting us use your picture for marketing purposes.

Categories of personal data and sources

We may process the following categories of personal data about you:

Ordinary personal data:

Name, email address, information about your consent and preferences, information about your age, information about your social media account, information about how you interact with us on social media platforms, e.g. your comments, likes etc.

Information that you choose to give us when interacting with us on marketing platforms or as part of marketing activities, e.g. lotteries or competitions.

If you participate in any BAT events we might also take pictures and videos from the event but only with your consent to do so.

If you give us your consent to do so when signing up to receive newsletters from us, we will collect information related to your reading of our marketing messages.

Sources:

We collect your personal data directly from you

Legal basis

We process your personal data on the following legal bases:

• Article 6.1.a (consent)
• Article 6.1.f (necessary for the pursuit of our legitimate interest in marketing of our business and our products)including:
  - Sending newsletters and other marketing material to you and optimizing the effect of such marketing
  - Hosting and participation in events and other marketing activities
  - Promoting our products and business on social media and other platforms as well as interacting with our customers and consumers on various social media and platforms

Recipients

We may share your personal data for the described purpose with:

• Business partners and third parties, including suppliers and vendors, that we work with to assist our company (e.g. suppliers, service providers, technical and IT and digital support)
• Group entities
• Social media; in some cases, we are joint controllers together with the social media provider, such as Facebook. See Facebooks privacy notice 
• The public; if you give us your consent to use any material that includes you to publish publicly, e.g. on our website
• (Potential) purchasers, sellers and advisors in case of a sale or purchase

Data retention

We will retain personal data processed for this purpose as long as you are signed up to receive newsletters from us.

Don’t forget - you can always unsubscribe in the bottom of the newsletters that we send you! See more below on how to withdraw your consent. 

Marketing material will be kept in accordance with our agreement and the specific case in question, but will be deleted as soon as possible, e.g. when a competition or lottery is over.

Pictures and videos of you will be kept for a maximum of 2 years.

Some personal data follow the retention periods under “When communication with us and our customer service” below.

BAT processes your personal data for the purpose of communicating and interacting with you as well as providing customer service to you and to handle any questions, inquiries, etc. that you might have about our products, services and BAT in general, e.g. as a business, as a workplace for recruitment purposes as well as for the purpose of improving our business and the quality of our service and products in this regard. We communicate with and provide customer service to both consumers and customers, and we communicate with you through email, phone, website communication such as contact formulas and chats and through social media chats and platforms, e.g. Instagram/Facebook when you follow or interact with our accounts on social media, depending on how you choose to contact us

Categories of personal data and sources

We may process the following categories of personal data about you:

Ordinary personal data:

Name, email, telephone number, job title, information about your social media account and any information that you give us in your inquiry when you contact, e.g. the questions you might have and the information related to these as well as further information that we might need to handle your inquiry.

In some cases, we collect information verifying that you are above 18 years old, typically ID-card such as bankcard with this information, for example if we need to send you a new product.

Information related to any claims, complaints or other inquiries that you might have about our products, e.g. your experience with our products, side effects etc. Such information might in some cases be sensitive information if you choose to give us such.

When you call our customer service, we might record our conversation for internal training purposes if you give us your consent to do so. 

If you communicate with us and our customer service for recruitment purposes, e.g. for the purpose of knowing more about life at BAT, the recruitment process etc. we will also process the information about you that you give us, i.e. your contact information, your inquiry, our correspondence and any attachments such as application, CV, etc. We will however always guide you to our official recruitment channel (careers.bat.com) for job applications or our HR department and we will then delete the material you might have sent.

If you communicate with us and/our customer service as a non-consumer, please also see below “When you are a customer, supplier, business partner or other third-party representative”.

Sources:

We collect your personal data directly from you when you contact us.

Legal basis for the processing

We process your personal data on the following legal bases:

• Article 6.1.a (consent) with respect to recordings
• Article 6.1.b (necessary for the performance of a contract)
  Article 6.1.c (necessary to comply with our legal obligations), including
  - regulation that we are subject to for the purpose of handling any claims or complaints that you might have about our products, including regulation that set out our obligations towards you
• Article 6.1.f (necessary for the pursuit of our legitimate interest in operating and developing our business, including
  - providing customer service to you and handle claims and complaints
  - optimizing and improving our products, our business and our customer service
• Article 9.2.f (necessary for the establishment, exercise or defence of legal claims) with respect to sensitive data processed to handle claims, complaints and other inquiries, e.g. information about side effects and your experience with our products.

Recipients

We may share your personal data with:

• Business partners and third parties, including suppliers and vendors, that we work with to assist our company (e.g. suppliers, call centres, service providers, technical and IT and digital support)
• Social media if we communicate with you through such
• Group entities
• Public authorities if requested and/or necessary
• (Potential) purchasers, sellers and advisors in case of a sale or purchase

Data retention

We will retain your personal data for as long as it is necessary in order for us to find a solution on your inquiry, i.e. to answer your questions and/or handle your complaints and claims. As a main rule this is up to 6 months from the end of the communication or the end of the case your inquiry is about.

If your inquiry is or might develop into a potential dispute, we may retain your personal data for a longer period of time. The retention period is hereafter depending on the circumstances around your inquiry, including what your inquiry is about, if it involves any damages etc., and we will only retain the personal data in order to be able to document the case and handle a potential (legal) dispute arising from or involving your inquiry and only for the period of time we might be met with a dispute etc. in accordance with the limitation regulation.

Any recordings of conversations that you are a part of based on your consent will be deleted after 30 days.

If we have asked for your ID card to verify your age, such ID card will be deleted within 30 days

.

BAT processes your personal data for business operations purposes when you represent your employer or have a relation to a third party when your employer or such third party is a (potential) customer, supplier or other third-party to BAT, e.g. if you communicate with BAT as a part of you working for one of BAT’s (potential) business partners or other parties that BAT is communicating and co-operating with.

Examples of such communication and co-operation could be as a part of marketing of our products, sale and distribution of BAT’s products, accounts and customer management, KYC purposes, contact with public authorities, government officials, politicians, investment communitees contact with journalists, media stakeholders, shareholders, participation in events, competitions and other marketing activities, when we use third-party suppliers and agencies to support our business, e.g. IT and digital support, drivers and carriers, co-operation with organisations, retailers, external consultants, BAT ambassadors, cleaning firms, food suppliers, on site guards, etc.

Categories of personal data and sources

We may process the following categories of personal data about you:

Ordinary personal data:

Name, job title, workplace, log in details, signature and contact information such as your email and telephone number as well as other information that you choose to give us. We might also process copy of passport or other ID for KYC purposes.

Information about and related to the task/job/case etc. that our relationship concern, including all communication and processing of personal data in this regard, e.g. communication about our (potential) co-operation, our products and sales and distribution of our products, orders and returns, negotiations, potential disputes and complaints, general business matters, market, product and sales analysis, strategic, economics and budget managements, evaluations and performance, billing, invoicing and bookkeeping matters, crisis management, project and planning, external affairs and audits, branding and marketing, politics, business strategy, business plans, account and (potential) customer and account management, segmentation and service, management of IT systems and support etc.

Information related to your participation in events hosted by us or other events that we encourage you to participate in together with us, e.g. festivals.

If you are visiting or working at our locations, we will also process information about you through our use of CCTV surveillance and logging of the use of access cards.

Sources:

We collect your personal data either directly from you or from the third party that you work for a have a relation to: BAT’s customer, supplier or other third-party that we work with or have a relation to.

Legal basis for the processing

We process your personal data on the following legal bases:

• Article 6.1.c (necessary for the fulfillment of our legal obligations to perform KYC checks of our customers)
• Article 6.1.f (necessary for the pursuit of BAT’s legitimate interest in business operations and development), including:
  - communication and co-operations with customers, suppliers and other third parties and business partners that we work with or have a relation to,
  - production of products,
  - sale and distribution of products,
  - marketing of our products and our business
  - customer management and development
  - security measures, such as the use of surveillance and access cards
  - as well as other business-related matters.

Recipients

We may share your personal data with:

• Business partners and third parties, including suppliers and vendors, that we work with to assist our company (e.g. suppliers, warehouses, carriers, other service providers, technical and IT, legal and digital support)
• Social media depending on the character of our agreement and the actual circumstances, e.g. if you are an ambassador for BAT or if you participate in an event hosted by BAT
• Group entities
• Public authorities if requested
• The third party that you work with or have a relation to; BAT’s customer, supplier or other third parties and business partners
• (Potential) purchasers, sellers and advisors in case of a sale or purchase
• Festivals and other parties hosting events that we participate in with our customers as well as even bureau assisting us with planning these

Data retention

We will retain personal data processed for this purpose for:

As a main rule we will retain your personal data for up to five years as from the end of the year in which the last purchase or delivery was made, or as from the end of our relationship/collaboration or the relationship/collaboration with the party that you represent or have a relation to.

However, we may store the personal data for an extended period if deemed necessary in a specific case, e.g. for establishing legal claims or in order for BAT to be able to document the relationship and/or certain circumstances with respect to the customer, supplier or other third-party.

We may also delete your personal data earlier, which will be the case for example if you appear on CCTV, if you have participated in an event, a quiz or any other marketing activities.

Some inquiries follow the retention periods as mentioned under “When communicating with us or our customer service” – please refer to this purpose for more information.