top of page

 PRIVACY NOTICE - SOCIAL

 

 

1. INTRO 

At BAT we are committed to protecting your privacy – this means that we will make sure that any information you give to us by visiting our social media pages, or participating in our competitions (including ones run by our collaborative partners such as McLaren or DVLM) that you enter from our social media pages (such as Instagram, Facebook or YouTube) ("Competition") are only used for the purposes set out in this “Privacy Notice”. 

 

This Privacy Notice tells you how we collect and use your personal data, and let you know about your privacy rights. This Privacy Notice applies to everyone who visits our social media pages, or participates in our Competitions when visiting social media pages. 

 

For the purpose of this Privacy Notice, the relevant legal entity responsible for processing your personal data is called Nicoventures Trading Limited, which is part of the British American Tobacco group (collectively "BAT", “us”, “ours” or "we").

 

If you need or want to get in touch with us, we have provided general contact details in the "How to Contact Us" section of this Privacy Notice or (to save you scrolling to this section), you can email us at data_privacy@bat.com.

 

Please be aware that we may update this Privacy Notice at any time.  This will be done without notice to you so make sure that you check this page regularly.  If you have trouble in finding future versions, please let us know by using the contact details above.

 

2. WHAT INFORMATION WE COLLECT ABOUT YOU

Depending on the circumstances and applicable local laws and requirements, we may collect the information detailed below. You can learn about the reasons why we do this later in this Privacy Notice.

 

  • If you visit our social media pages and like our posts, include a hashtag or mention relating to us or tag us in a post, we will collect your social media handle and post related information (the content, time and date of your post);

  • If you send us a direct message, we will collect your social media handle (e.g. your social media account name) and anything you provide within the content of correspondence;

  • Where you are required to share personal data for your entry to a Competition (such as a selfie or a written post) we will collect the content of your Competition entry;

  • Where you enter into one of our Competitions hosted on our social media pages and you win, we may collect your full name, town, country of residence, email address, date of birth, telephone number, age verification documentation (including either a copy of your passport or driving licence where required).  Note that we may ask a third party company to do this for us on our behalf.

 

​

3. HOW DO WE COLLECT YOUR INFORMATION?

Most of the data we hold about you, will be information you provide to us when interacting on our social media pages, communicating with us via email, direct message or submitting your entry for our Competitions.  We may ask third parties (i.e., companies we work with) to assist in our Competitions for example, to collect information about you on our behalf, to conduct verification checks of proof of age and to send prizes to your home address.  

 

We may also collect some personal data about you which we’ve collected indirectly.  For example, when you interact with our content. This information may include the time you’ve sent us a direct message or posted a comment or ‘liked’ our post.

 

We may collect details about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from a competition page (including date and time), and gather broad demographic information for aggregated use.

           

4. HOW WE LAWFULLY USE YOUR INFORMATION

There are a few ways the law allows us to process (i.e. use) your personal data.  These are explained below according to each data type.

  • Where using your data is needed to perform a contract with you

    • To participate in the competition, e.g. sending direct messages, and transferring personal data to prize fulfilment partners;

 

  • Where using your data is in our legitimate interests

We can process your personal data where it is in our “legitimate interests” to do so, and those legitimate interests are not outweighed by any potential prejudice to you - some of these are set out below:

  • To communicate with you via our social media pages;

  • To market and advertise BAT products and services to the extent permitted by the law;

  • To help us establish, exercise and defend legal claims; and

  • For our internal admin purposes.

 

We don't think that any of the activities set out in this Privacy Notice will prejudice you in any way. However, you do have the right to object to us and we’ve set out details regarding how you can go about doing this in the ‘You Have Rights!’ section below.

 

  • Where using your data is necessary for us to carry out our legal obligations

When we have legal obligations that we need to comply with, we can use your personal data to comply with those other legal obligations (for example to verify your age, which we are mandated to do by law).

 

  • Where you give us your consent to use your personal data

We can use your data where you have specifically given us permission to do so in certain circumstances. For example, where we wish to use your name and image in our publicity materials.  You have the right to withdraw your consent at any time. We have set out details regarding how you can go about this in the section ‘You Have Rights!’ below.

​

5. SHARING YOUR PERSONAL DATA WITH OTHERS

Sometimes we will share your information with others for various reasons which we detail below. We may share your information with any of the following groups:

 

  • Certain other BAT Group entities. Your personal data may be shared with other members of the BAT group, for example, in the country in which you tell us you reside, if the circumstances require (such as if you want to link with our local e-commerce sites, or we need to do this for a prize fulfilment if you win a competition, or even if we need to handle a complaint from you (or another) or for a legal reason involving your personal data). 

 

  • Regulatory authorities. We may share your information with authorities when we believe that the law or other regulation requires us to do so (for example, because of a request in connection with any anticipated litigation or in order to help prevent fraud or to enforce or protect the rights and properties of BAT or its subsidiaries).

 

  • Organisations that support us with our business activities. We may share your information with other companies (such as third-party service providers) who perform tasks on our behalf (such as assisting in making sure that entrants to a competition are over the age of 18 or sending out prizes to winners). We will only share information with these companies where we have a contract with them that tells them how they are able to use your personal data in a legally compliant way according to our instructions (this is sometimes known as a ‘data processing agreement’ or similar).

 

  • Professional advisors and auditors. We may disclose your personal data to professional advisors (such as legal advisors and accountants) or auditors for the purpose of providing professional services to us.

 

  • Acquisitions. If a BAT entity merges with or is acquired by another business or company in the future, we may share your personal data with the actual or potential buyer of the business or company (and its agents and advisers).

​

6. HOW WE LOOK AFTER YOUR INFORMATION

We care about protecting your information. That is why we put in place appropriate measures that are designed to prevent unauthorised access to, and misuse of, your personal data.

 

We do this by having in place a range of appropriate technical and organisational measures, including encryption measures and disaster recovery plans. We update and test our security technology continuously and we restrict access to your personal data on a need-to-know basis.  

​

7. WHERE DO WE STORE YOUR INFORMATION?

In using your personal data, we process this using a variety of technical systems, networks and facilities some of which may be outside of the United Kingdom.  When we transfer someone’s personal data outside the United Kingdom, we do this in ways which is permitted by data protection laws such as contractual terms (approved by the UK data protection regulator) between us and the receiving organisation, or we will only transfer your data to a country which has been legally ‘pre-approved’ to receive UK personal data because its laws are as robust as those we have in the United Kingdom.

 

​

8. HOW LONG DO WE KEEP YOUR INFORMATION?

We only keep your personal data for as long as we strictly need it and where we have an ongoing legitimate business need to do so (for example, to comply with applicable legal requirements such as evidencing your age to comply with strict age verification laws).

 

When we have no legitimate business need to retain your personal data, we will either permanently delete or anonymise it or, if this is not possible (for example, because your personal data has been stored in backup archives where we need to retain it for one year or longer if legally required to do so), then we will securely store your personal data and isolate it from any further processing until deletion is possible.

 

If you would like more information regarding our data retention policies and practices, please contact us by using the “Contact Us” section at the end of this Privacy Notice.

​

9. YOU HAVE RIGHTS!

You have various rights in relation to the data which we hold about you.

 

You can....

  • Object

This right enables you to object to us processing your personal data. If you object, we will stop using your data unless we can demonstrate compelling legitimate grounds (which overrides your interests) or if our use of your data is necessary for the establishment, exercise or defence of legal claims. 

 

  • Withdraw your consent

Where we have obtained your permission to process your personal data for certain activities, you may withdraw this consent at any time.  If you ask us to do this, we’ll stop using your data unless we consider that there is an alternative legal reason to justify our continued processing of your data for this purpose, in which case we will tell you. However, it’s important to know that withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal. 

 

  • Have access to your data

You may ask us to confirm we are processing your personal data, or to receive a copy of the information we may hold about you at any time.  We will respond to your request within one month. That period may be extended by two further months where necessary, taking into account the complexity and number of requests.  We may request proof of identification to verify your request.  If you request further copies of this information from us, we may charge you a reasonable administrative cost.  Where we are legally permitted to do so, we may refuse your request. If we refuse your request, we will always tell you the reasons for doing so.

 

  • Ask for your personal data to be permanently deleted

You have the right to request that we "erase" your personal data in certain circumstances. We would only be entitled to refuse to comply with your request for erasure in limited circumstances and we will always tell you our reason for doing so.

 

  • Ask us to restrict the use of your personal data

You have the right to request that we restrict our processing of your personal data in certain circumstances, for example if you dispute the accuracy of the personal data that we hold about you or you object to our processing of your personal data for our legitimate interests. If we have shared your personal data with third parties, we will notify them about the restricted processing unless this is impossible or involves disproportionate effort. We will, of course, notify you before lifting any restriction on processing your personal data.

 

  • Ask us to correct your personal data

You have the right to request that we rectify any inaccurate or incorrect personal data that we hold about you. If we have shared this personal data with third parties, we will notify them about the rectification unless this is impossible or involves disproportionate effort. You may also request details of the third parties that we have disclosed the inaccurate or incomplete personal data to. Where we think that it is reasonable for us not to comply with your request, we will explain our reasons for this decision.

 

  • Complain

You also have the right to lodge a complaint with a supervisory authority if you have concerns about how BAT processes your personal data. In the United Kingdom, this is the Information Commissioner’s Office (known as the ‘ICO’) whose contact details are available here.

​

10. HOW TO CONTACT US

If you have any queries about this Privacy Notice, including your rights in relation to your personal information, please send us a direct message via our social media account, or website (as appliable) or email us at data_privacy@bat.com.

​

​

​

bottom of page