- Privacy Notice
At BAT, we collect a variety of information about people we interact with as part of our business and may use it in lots of different ways. We are committed to ensuring that your personal information is protected and never misused.
BAT is made up of different legal entities (details of which can be found at www.bat.com). This Privacy Notice is issued on behalf of the BAT Group so when we refer to "BAT", "us", "we" or "our" we mean the relevant company in the BAT Group responsible for personal information collected about you. Nicoventures Trading Limited is the controller and responsible for this website.
These Terms refer to the following additional documents, which also apply to your use of the Site:
- Information we collect about you
- How we collect your information
- Our legal basis for using your information
- Sharing your information with third parties
- Where we store your information
- How we safeguard your information
- How long we keep your information
- Your rights
- How to contact us
1. Information we collect about you
We collect and process information about you as you use the Site, or when you contact us.
The type of personal data that we collect and process about you include (but are not limited to):
- Technical Data including internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
- Usage Data, including information about how you use our website.
We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this Privacy Notice.
For details of the legal bases that we rely on to be able to use and process your personal information, please see “our legal basis for using your information” below.
2. How we collect your information
We use different methods to collect data from and about you including through:
- Direct interactions. You may give us your data by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you give us feedback or contact us.
- Automated technologies or interactions. As you interact with our website, we will automatically collect data about your equipment, browsing actions and patterns. We collect this personal data by using cookies and other similar technologies. Please see our Cookies Policy for further details.
3. Our legal basis for using your information
There are different legal bases that we rely on to use your personal information, namely:
- Performance of a contract – the use of your personal information may be necessary to perform a contract that you have with us. We also may need to use your information to comply with other legal obligations that apply to us.
- Consent – we may rely on your consent, in certain cases, such as to contact you with further information. You may withdraw your consent at any time.
- Legal obligation – we have a legal obligation to ensure that we comply with all statutory and regulatory requirements within the jurisdictions within which we operate. These obligations may require us to collect, store and sometimes share your personal information with other organizations such as the police, tax authorities or other public authorities or governmental enforcement agencies.
- Legitimate interests – If required, we may have a legitimate interest in using your information in the other ways. The law allows this only insofar as such interests are not outweighed by a greater need to protect your privacy. Examples where we rely on our legitimate interest include (but are not limited to):
- Prevention and detection of criminal activity;
- Customer relationship management; and
- Establishing and defending legal claims.
4. Sharing your information with third parties
We may share your information with any of the following groups:
- any of our group entities, where this is necessary, and in accordance with laws on data transfers;
- third party outsourced providers, for example for operation of this website where we have an appropriate data processing agreement (or similar protections) in place;
- if one of our group entities merges with or is acquired by another business or company in the future, we may share your personal information with the new owners of the business or company (and provide you with notice of this disclosure); and
- if we have to share your information to comply with legal or regulatory requirements, or if we have to enforce or apply our Terms and Conditions or any other agreements or to protect our rights, property or our customers, etc.
- We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
We may share the non-personal aggregated statistics data about visitors to the Site with third parties for analytics and statistical purposes.
5. Where we store your information
Your personal information may be transferred outside of the European Economic Area (EEA) to the third parties described in “sharing your information with third parties” above.
We want to make sure that your personal information is stored and transferred in a way, which is secure. We will therefore only transfer data outside of the EEA where it is compliant with data protection legislation and the means of transfer provides adequate safeguards in relation to your data, for example:
- by way of an intra-group agreement between our group entities, incorporating the current standard contractual clauses adopted by the European Commission for the transfer of personal information to jurisdictions without adequate data protection laws;
- by way of a data transfer agreement with a third party, incorporating the current standard contractual clauses adopted by the European Commission for the transfer of personal information to jurisdictions without adequate data protection laws;
- by transferring your data to an entity which has signed up to the EU-U.S. Privacy Shield Framework for the transfer of personal information from entities within the EU to entities in the United States of America or any equivalent agreement in respect of other jurisdictions;
- by transferring your data to a country where there has been a finding of adequacy by the European Commission in respect of that country's levels of data protection via its legislation; or
- where it is necessary for the conclusion or performance of a contract between ourselves and a third party and the transfer is in your interests for the purposes of that contract; or
- where you have consented to the transfer.
Where we transfer your personal information outside the EEA and where the country or territory in question does not maintain adequate data protection standards, we will take all reasonable steps to ensure that your data is treated securely and in accordance with this Privacy Notice. You can ask to see these by contacting us using the contact details below.
6. How we safeguard your information
We care about protecting your information. That's why we put in place appropriate measures that are designed to prevent unauthorised access to, and misuse of, your personal information.
We are committed to taking all reasonable and appropriate steps to protect the personal information that we hold from misuse, loss, or unauthorised access. We do this by having in place a range of appropriate technical and organisational measures, including encryption measures and disaster recovery plans.
Unfortunately, the transmission of information via the Internet is not completely secure. Although we will apply our normal procedures and comply with legal requirements to protect your information, we cannot guarantee the security of your information transmitted to the Website and any transmission is at your own risk.
The Site may from time to time contain links to and from other websites. If you follow a link to any of those sites, please note that those sites ought to have their own privacy policies and that we do not accept any responsibility or liability for those sites or for their privacy policies. Please check those privacy policies before you submit your information to those sites.
7. How long we keep your information
We will keep your information you have submitted to us as required by law or other regulation (for example, because of a request by a tax authority or in connection with any anticipated litigation).
When it is no longer necessary to retain your data, we will delete the personal information that we hold about you from our systems. After that time, we may aggregate the data (from which you cannot be identified) and retain it for analytical purposes.
8. Your rights
You have a number of rights in relation to your information under data protection law. In relation to certain rights, we may ask you for information to confirm your identity and, where applicable, to help us to search for your personal information. Except in rare cases, we will respond to you within one month from either (i) the date that we have confirmed your identity or (ii) where we do not need to do this because we already have this information, from the date we received your request.
Right to object
This right enables you to object to us processing your personal information where we do so for one of the following reasons:
- where we rely on our legitimate interests to do process your information;
- to enable us to perform a task in the public interest or exercise official authority;
- in certain circumstances, to send you direct marketing materials; or
- for scientific, historical, research, or statistical purposes.
Except for the purposes for which we are sure we can continue to process your personal information, we will temporarily stop processing your personal information in line with your objection until we have investigated the matter. If we agree that your objection is justified in accordance with your rights under data protection laws, we will permanently stop using your data for those purposes. Otherwise we will provide you with our justification as to why we need to continue using your data.
Right to withdraw consent
Where we have obtained your consent to process your personal information for certain activities, you may withdraw this consent at any time and we will cease to use your data for that purpose unless we consider that there is an alternative legal basis to justify our continued processing of your data for this purpose, in which case we will inform you of this condition. If you withdraw your consent, our use of your personal information before you withdraw is still lawful.
Right of access (Data Subject Access Requests)
You may ask us for a copy of the information we hold about you at any time, and request us to modify, update or delete such information. If we provide you with access to the information we hold about you, we will not charge you for this unless permitted by law. If you request further copies of this information from us, we may charge you a reasonable administrative cost. Where we are legally permitted to do so, we may refuse your request. If we refuse your request we will always tell you the reasons for doing so.
If you would like to request access to your information, it would assist us with dealing with your request if you could use the subject heading ‘Data Subject Access Request’, or quote this over the phone, when contacting us. Please note that this is not mandatory and we will still deal with any requests without this reference.
Right to erasure
You have the right to request that we "erase" your personal information in certain circumstances. Normally, this right exists where:
- the data is no longer necessary;
- you have withdrawn your consent to us using your data, and there is no other valid reason for us to continue;
- the data has been processed unlawfully;
- it is necessary for the data to be erased in order for us to comply with our obligations under law; or
- you object to the processing of your data and we are unable to demonstrate overriding legitimate grounds for our continued processing.
We would only be entitled to refuse to comply with your request for erasure in limited circumstances and we will always tell you our reason for doing so.
When complying with a valid request for the erasure of data we will take all reasonably practicable steps to delete the relevant data.
Right to restrict processing
You have the right to request that we restrict our processing of your personal information in certain circumstances, for example if you dispute the accuracy of the personal information that we hold about you, you object to our processing of your personal information for our legitimate interests or you require us to keep it in connection with legal proceedings. If we have shared your personal information with third parties, we will notify them about the restricted processing unless this is impossible or involves disproportionate effort. We will, of course, notify you before lifting any restriction on processing your personal information.
We may only process your information whilst its processing is restricted if we have your consent or are legally permitted to do so, for example for storage purposes, to protect the rights of another individual or company or in connection with legal proceedings.
Right to rectification
You have the right to request that we rectify any inaccurate or incomplete personal information that we hold about you. If we have shared this personal information with third parties, we will notify them about the rectification unless this is impossible or involves disproportionate effort. You may also request details of the third parties that we have disclosed the inaccurate or incomplete personal information to. Where we think that it is reasonable for us not to comply with your request, we will explain our reasons for this decision.
Right of data portability
If you wish, you have the right to transfer your personal information between service providers where we rely on your consent or the performance of your contract as the legal basis to use that information. In effect, this means that you are able to transfer the details we hold on you to another third party. To allow you to do so, we will provide you with your data in a commonly used machine-readable format so that you can transfer the data. Alternatively, we may directly transfer the data for you if technically possible.
Right to complain
You have the right to lodge a complaint with your local supervisory authority. If you are in the UK this is the Information Commissioner's Office. You can contact them in the following ways:
- Phone: 0303 123 1113
- Email: firstname.lastname@example.org:
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
How to exercise your rights
If you would like to exercise any of these rights, please contact us on the details provided under How to contact us. Please note that we may keep a record of your communications to help us resolve any issues that you raise.
We may make changes to this Privacy Notice at any time by posting a copy of the modified notice on the Site or, where appropriate, by sending you an email with that notice. Any changes will take effect 7 days after the date of our email or the date on which we post the modified terms on the Site, whichever is the earlier.
10. How to contact us
If you have any queries about this Privacy Notice, including your rights in relation to your personal information, please contact us via post at the address below or via email at Data_privacy@bat.com:
Data Protection, Nicoventures Trading Limited, Globe House, 4 Temple Place, London, WC2R 2PG, United Kingdom.
Other articles you may be interested in
Is vaping risk free?
A closer look at the health impacts, and the importance of buying from responsible retailers
Using a vaping device
A guide to help you understand the different types of devices, the basics of handling e-liquids and maintenance
Four important points about vaping
Tackling four topics that may be misunderstood
Can vaping be an alternative to smoking?
What you might expect if you completely switch cigarettes for a vape