BAT WCA - Privacy Notice

Right of access (also known as Subject Access Requests)

You may ask us for a copy of the information we hold about you. If we provide you with a copy, we will not charge you. If you request further copies of this information from us, we may charge you a reasonable administrative cost.  We will only refuse your request in very limited circumstances as permitted by law, and we will always explain to you the reasons why we are not fulfilling your request.

Right to correct the data we hold about you

You have the right to ask us to correct any inaccurate or incomplete personal information that we hold about you. If we have shared this personal information with third parties, we will notify them, unless this is impossible or involves disproportionate effort.

Right to object

You can object to us using your information if we are using it for the purpose of direct marketing.

Right to withdraw consent

Where we have asked your permission to use your personal information for certain activities, you may withdraw your permission at any time by emailing or calling us at the contact details set out below and we will stop using your information for that purpose.

Right to erasure

In certain cases, you have the right to ask us to "erase" your personal information.  Normally, you can do this where:

•  It’s no longer necessary for us to use your information;
•  we were relying on your consent to use your information and you have withdrawn your consent;
•  Your information has been used unlawfully;
•  your information needs to be erased in order for us to comply with our obligations under law; or
•  You object to the processing and we don’t have a compelling reason to continue using it.

In these cases, we will take all reasonably practicable steps to erase the relevant data.  We will only refuse to comply with your request to erase your information in limited circumstances, and we will always tell you our reason for doing so.

Right to restrict our use of your personal information

You can ask us to suspend our use of your personal information in certain circumstances. For example, during the time it takes us to respond to your request to correct the information we hold about you. If we have shared your information with third parties, we will notify them about the restricted use of your personal information unless this is impossible or involves disproportionate effort. We will, of course, notify you before lifting any restriction on our use of your personal information.

Right to move your data

You have the right to ask us to transfer certain personal information we hold about you to another third-party service provider.  Alternatively, you may ask us to transfer the information directly to you.

Rights relating to automated decisions

In certain circumstances, you may contest a decision made about you based on automated processing. We do not generally make decisions based solely on automated processing of your personal data, but when we do so, we will let you know.

Right to complain

You have the right to lodge a complaint with your local data protection supervisory authority. For example, the local data protection supervisory authority in Nigeria is the National Information Technology Development Agency in Nigeria.

2. Who do we share your information with?

At BAT, we do not share, rent or trade your information with third parties for marketing or promotional purposes. When necessary we may share information about you with the following recipients:

•  any of our BAT group companies;
•  Tax, audit, or other authorities, when we believe we are legally required to do so, where the relevant authority has asked us to assist (for example, because of a request by a tax authority or in connection with any expected litigation), or in order to help prevent fraud or to protect the rights of BAT; or protect the personal safety of BAT employees, third party agents or members of the public;
•  third party service providers such as external consultants and professional advisers (including law firms, auditors and accountants), technical support functions, and IT consultants carrying out testing and development work on our business technology systems);
•  third parties for the purposes of background screening checks, credit worthiness checks, order fulfilment, delivery, customer support services and storage services;
•  third party outsourced IT providers, including but not limited to email/text messaging providers; Cloud IT service providers, business suite solution providers; data analytics agencies; IT strategic implementation partners; hosting service providers;
•  if it is proposed that a BAT Group entity or business is to merge with or be acquired by another business in the future, we may share your personal information with potential purchasers, where this is necessary, or the new owners of the business or company.

3. Do we transfer your personal information to other countries when we share it?

Sometimes when we share your personal information with the third parties described in section 2 above, it may be transferred to countries outside West and Central Africa.

We will do our best to ensure that your personal information is stored and transferred in a way which is secure.

When we transfer your personal information outside the West and Central Africa area, we take appropriate steps to protect that information, which includes transferring to organizations within countries that the National Information Technology Development Agency, and any other local data privacy regulatory agency has judged offers adequate protection for your information.

4. How do we use your personal information and how do we legally do this?

We need to process your personal information for a variety of reasons or ‘purposes’.  These purposes for which we use your information are summarized below. In addition, when we process (or ‘use’) your personal information we need a legal basis to do this. The general legal bases that allow us to use your information are set out below. To find out which specific legal grounds we rely on for the processing of your personal information in the context of each particular purpose, please choose from the options in this Privacy Notice selecting the one(s) that best fits your connection to BAT.  If you need any assistance, please contact us using the contact details below.

Performance of a contract

We need to process your personal information to perform a contract with you or take steps at your request prior to entering into a contract.

Legal obligation

We have a legal obligation to ensure that we comply with all statutory and regulatory requirements within the jurisdictions within which we operate (including those relating to bribery and corruption, money laundering and sanctions) when engaging with third parties.  These obligations may require us to collect, store and sometimes share your personal information with other organizations such as the police, tax authorities or other public authorities or governmental enforcement agencies (including those outside West and Central Africa).

Consent

We may ask your permission to use your personal information in certain circumstances. Where you give your permission, you are entitled to withdraw it at any time, and we shall make this clear at the time of collection.

5. How do we ensure your information is safe with us?

We care about protecting your information. That's why we put in place appropriate measures that are designed to prevent unauthorized access to, and misuse of, your personal information.  We are committed to taking all reasonable and appropriate steps to protect the personal information that we hold from misuse, loss, or unauthorized access. We do this by having in place a range of appropriate technical and organizational measures, including encryption measures and disaster recovery plans.

If you suspect any misuse or loss of or unauthorized access to your personal information, please let us know immediately by contacting us using the details provided at the end of this notice.

Unfortunately, the transmission of information via the Internet is not completely secure. Although we will apply our normal procedures and comply with legal requirements to protect your information, we cannot guarantee the security of your information transmitted from you to us.

6. Contact us

To exercise any of your rights or if you have any questions or complaints about this Privacy Notice please email by writing to BAT Data Privacy Officer.