Privacy Notice

1. WHAT INFORMATION DO WE COLLECT ABOUT YOU AND HOW DO WE USE IT?

We only collect and hold the personal data you provide to us when you visit our website, such as through filling out a contact form or registering to attend an event.

We may also collect details of your visits to our site including, but not limited to, traffic data, location data, weblogs, and other communication data.

We need to process your personal data for a variety of reasons. Under the UK General Data Protection Regulation (GDPR), when we process or use your personal data, we need a legal basis to do this. In the context of the relationship that you have with us in visiting our website, please see detailed information below.

2. SHARING YOUR PERSONAL DATA WITH OTHERS

Sometimes we will share your information with others for various reasons which we detail below. When necessary, we may share your information with any of the following groups:

• Certain other BAT Group entities. Your personal data may be shared with other members of the BAT group, for example, in the country in which you tell us you reside, if the circumstances require such sharing. 
• Regulatory, tax and other authorities. We may share your information with authorities when we believe that the law or other regulation requires us to do so (for example, because of a request in connection with any anticipated litigation or in order to help prevent fraud or to enforce or protect the rights and properties of BAT or its subsidiaries).
• Third-party service providers that support us with our business activities. We may share your information with other companies who perform tasks on our behalf, such as email/text messaging providers; Cloud IT service providers, business suite solution providers; data analytics agencies; IT strategic implementation partners; hosting service providers or third parties who assist us in the context of analysis and insights activities to inform our marketing strategies. We will only share information with these companies where we have a contract with them that tells them how they are able to use your personal data in a legally compliant way according to our instructions (this is sometimes known as a ‘data processing agreement’ or similar).
• Professional advisors and auditors. We may disclose your personal data to professional advisors (such as legal advisors and accountants) or auditors for the purpose of providing professional services to us.
• Mergers and acquisitions. If a BAT entity merges with or is acquired by another business or company in the future, we may share your personal data with the actual or potential buyer of the business or company (and its agents and advisers).

3. HOW WE LOOK AFTER YOUR INFORMATION

We care about protecting your information. That is why we put in place appropriate measures that are designed to prevent unauthorised access to, and misuse of, your personal data. We are committed to taking all reasonable and appropriate steps to protect the personal data that we hold from misuse, loss, or unauthorised access. We do this by having in place a range of appropriate technical and organisational measures, including encryption measures and disaster recovery plans.

If you suspect any misuse or loss of or unauthorised access to your personal data, please let us know immediately by contacting us using the details provided at the end of this notice.

4. WHERE DO WE STORE YOUR INFORMATION?

In using your personal data, we process it using a variety of technical systems, networks and facilities some of which may be outside of the UK.  When we transfer someone’s personal data outside of the UK, we do this in ways which are permitted by data protection laws such as contractual terms (approved by the UK data protection regulator) between us and the receiving organisation, or we will only transfer your data to a country which has been legally ‘pre-approved’ to receive UK personal data because its laws are as robust as those we have in the UK.

5. HOW LONG DO WE KEEP YOUR INFORMATION?

We only keep your personal data for as long as we strictly need it and where we have an ongoing legitimate business need to do so, or where it is necessary to comply with applicable legal requirements (such as evidencing your age to comply with strict age verification laws).

When we have no legal basis to retain your personal data, we will either permanently delete or anonymise it or, if this is not possible (for example, because your personal data has been stored in backup archives where we need to retain it for one year or longer if legally required to do so), then we will securely store your personal data and isolate it from any further processing until deletion is possible.

If you would like more information regarding our data retention policies and practices, please contact us by using the “Contact Us” section at the end of this Privacy Notice.

6. YOU HAVE RIGHTS!

Subject to certain exceptions, by law you have several rights in relation to the information we hold about you. If you want to exercise your rights, we may ask you for information to confirm your identity and, where applicable, to help us search for your personal data. Except in rare cases, we will make sure to respond to you within one month from the later of (i) the date on which we receive your request or (ii) the date on which we have confirmed your identity.

Right of access (also known as Subject Access Requests)

You may ask us for a copy of the information we hold about you. If we provide you with a copy, we will not charge you. If you request further copies of this information from us, we may charge you a reasonable administrative cost.  We will only refuse your request in very limited circumstances as permitted by law, and we will always explain to you the reasons for which we are not fulfilling your request.

Right to correct the data we hold about you

You have the right to ask us to correct any inaccurate or incomplete personal data that we hold about you. If we have shared this personal data with third parties, we will notify them, unless this is impossible or involves disproportionate effort.

Right to object

You can object to us using your information if we are using it for the purpose of our legitimate interests.

If we agree that your objection is justified, we will permanently stop using your information for those purposes. Otherwise, we will explain why we need to continue using your information (for example, explaining that we need to use your information in connection with a legal claim).

Right to withdraw consent

Where we have asked your permission to use your personal data for certain activities, you may withdraw your permission at any time by emailing or calling us at the contact details set out below and we will stop using your information for that purpose.

Right to erasure

In certain cases, you have the right to ask us to "erase" your personal data.  Normally, you can do this where:

• It’s no longer necessary for us to use your information;
• We were relying on your consent to use your information and you have withdrawn your consent;
• Your information has been used unlawfully;
• Your information needs to be erased in order for us to comply with our obligations under law; or
• You object to the processing and we don’t have a compelling reason to continue using it.

In these cases, we will take all reasonably practicable steps to erase the relevant data.  We will only refuse to comply with your request to erase your information in limited circumstances, and we will always tell you our reason for doing so.

Right to restrict our use of your personal data

You can ask us to suspend our use of your personal data in certain circumstances. For example, during the time it takes us to respond to your request to correct the information we hold about you. If we have shared your information with third parties, we will notify them about the restricted use of your personal data unless this is impossible or involves disproportionate effort. We will, of course, notify you before lifting any restriction on our use of your personal data.

Right to move your data

You have the right to ask us to transfer certain personal data we hold about you to another third-party service provider.  Alternatively, you may ask us to transfer the information directly to you.

Rights relating to automated decisions

In certain circumstances, you may contest a decision made about you based on automated processing. We do not generally make decisions based solely on automated processing of your personal data, but when we do so, we will let you know.

Right to complain

You have the right to lodge a complaint with your local data protection supervisory authority, which is the Information Commissioner's Office in the UK.

7. HOW TO CONTACT US

If you have any queries about this Privacy Notice, including your rights in relation to your personal data, please contact us via our website (as applicable) or email us at data_privacy@bat.com.

Last updated on 02 September 2024