Onesies - Privacy Notice
Quick Navigation
Jump to content
BRITISH AMERICAN TOBACCO NORWAY AS
You can read our privacy notice in English or in Norwegian. Please choose the language you prefer.
Du kan lese personvernerklæringen på norsk eller engelsk. Vennligst velg det språket du foretrekker.
This Privacy Notice explains how British American Tobacco Norway AS ("we", "us" or “BAT”) processes your personal information as a data controller depending on your relation to BAT.
We are always committed to protecting and respecting your privacy and to process your personal data in accordance with relevant data protection legislation, i.e. the General Data Protection Regulation (the “GDPR”) and national legislation.
If you have any concerns or questions regarding BAT’s processing of your personal data, please do not hesitate to contact us using the below listed contact information.
The entity responsible for the processing of your personal information is:
British American Tobacco Norway AS
P.O. Box 3944 Ullevaal Stadion
0806 Oslo
Company registration no.: 979919042
Email: gdpr_emails@bat.com
Phone: +47 22 08 10 00
In the following tables you will find information about how BAT processes your personal data depending on your relation to BAT and the purposes of which we process your personal data.
In the tables you will find information on how we process your personal data, including information on our purposes with processing, the categories of personal data we process about you, how we collect your personal data, the legal basis on which we rely on when processing your personal data, information on the parties that we may share your personal data with and information on how long we retain your personal data.
You can choose between information on how we process your personal data, when:
Please choose the table that is relevant for you.
BAT processes your personal data for the purpose of completing your purchase, communicating and interacting with you as well as providing customer service to you and to handle any questions, inquiries, etc. that you might have about our products, services and BAT in general, e.g. as a business, as a workplace for recruitment purposes as well as for the purpose of improving our business and the quality of our service and products in this regard. We communicate with and provide customer service to both consumers and customers, and we communicate with you through email, phone, website communication such as contact formulas and chats and through social media chats and platforms, e.g. Instagram/Facebook when you follow or interact with our accounts on social media, depending on how you choose to contact us. BAT may also process your personal data for the purpose of verifying that you are above 18 years old when you shop in our White Space Snus Stores or other physical stores and choose to use our face scanner. Personal data are processed only temporarily when you use our face scanner and cannot be used by us or by others for identification purposes.
We may process the following categories of personal data about you:
Ordinary personal data:
We may process the following categories of personal data about you:
Name, email, telephone number, job title, information about your social media account and any information that you give us in your inquiry when you contact, e.g. the questions you might have and the information related to these as well as further information that we might need to handle your inquiry.
In some cases, we collect information verifying that you are above 18 years old, typically ID-card such as bankcard with this information, for example if we need to send you a new product, or your photo and limited related biometric data if you chose to use the face scanner when shopping in our White Space Snus Stores or other physical stores.
We will also use information related to any claims, complaints or other inquiries that you might have about our products, e.g. your experience with our products, side effects etc. Such information might in some cases be sensitive information if you choose to give us such.
When you call our customer service, we might record our conversation for internal training purposes, but only if you are informed of this and if you give us your consent.
If you communicate with us and our customer service for recruitment purposes, e.g. for the purpose of knowing more about life at BAT, the recruitment process etc. we will also process the information about you that you give us, i.e. your contact information, your inquiry, our correspondence and any attachments such as application, CV, etc. We will however always guide you to our official recruitment channel (careers.bat.com) for job applications or our HR department and we will then delete the material you might have sent.
If you communicate with us and/our customer service as a non-consumer, please also see below “When you are a customer, supplier, business partner or other third-party representative”.
Sources:
We collect your personal data directly from you.
We process your personal data on the following legal bases:
We may share your personal data with:
We will retain personal data processed for this purpose for:
We will retain your personal data for as long as it is necessary in order for us to find a solution on your inquiry, i.e. to answer your questions and/or handle your complaints and claims. As a main rule this is up to 6 months from the end of the communication or the end of the case your inquiry is about.
If your inquiry is or might develop into a potential dispute we may retain your personal data for a longer period of time. The retention period is hereafter depending on the circumstances around your inquiry, including what your inquiry is about, if it involves any damages etc., and we will only retain the personal data in order to be able to document the case and handle a potential (legal) dispute arising from or involving your inquiry and only for the period of time we might be met with a dispute etc. in accordance with the limitation regulation.
Any recordings of conversations that you are a part of based on your consent will be deleted after 30 days.
If we have asked for your ID card to verify your age, such ID card will be deleted within 30 days.
When using the face scanner for age verification purposes, your personal data will be deleted immediately after the result has been provided. Neither BAT nor our suppliers will store the personal data.
BAT processes your personal data for business operations purposes when you represent your employer or have a relation to a third party when your employer or such third party is a (potential) customer, supplier or other third-party to BAT, e.g. if you communicate with BAT as a part of you working for one of BAT’s (potential) business partners or other parties that BAT is communicating and co-operating with.
Examples of such communication and co-operation could be as a part of marketing of our products, sale and distribution of BAT’s products, accounts and customer management, KYC purposes, contact with public authorities, government officials, politicians, investment communitees, contact with journalists, media stakeholders, shareholders, participation in events, competitions and other marketing activities, when we use third-party suppliers and agencies to support our business, e.g. IT and digital support, drivers and carriers, co-operation with organisations, retailers, external consultants, BAT ambassadors, cleaning firms, food suppliers, on site guards, etc.
We may process the following categories of personal data about you:
Ordinary personal data:
Name, job title, workplace, log in details, signature and contact information such as your email and telephone number as well as other information that you choose to give us. We might also process copy of passport or other ID for KYC purposes.
Information about and related to the task/job/case etc. that our relationship concern, including all communication and processing of personal data in this regard, e.g. communication about our (potential) co-operation, our products and sales and distribution of our products, orders and returns, negotiations, potential disputes and complaints, general business matters, market, product and sales analysis, strategic, economics and budget managements, evaluations and performance, billing, invoicing and bookkeeping matters, crisis management, project and planning, external affairs and audits, branding and marketing, politics, business strategy, business plans, account and (potential) customer and account management, segmentation and service, management of IT systems and support etc.
Information related to your participation in events hosted by us or other events that we encourage you to participate in together with us, e.g. festivals.
If you are visiting or working at our locations, we will also process information about you through our use of CCTV surveillance and logging of the use of access cards.
Sources:
We collect your personal data either directly from you or from the third party that you work for a have a relation to: BAT’s customer, supplier or other third-party that we work with or have a relation to.
We process your personal data on the following legal bases:
We may share your personal data with:
We will retain personal data processed for this purpose for:
As a main rule, we will retain your personal data for as long as it is necessary in order for us to find a solution on your inquiry, i.e. to answer your questions and/or handle your complaints and claims. As a main rule this is up to 6 months five years as from the end of the communicationyear in which the last purchase or delivery was made, or as from the end of the case your inquiry is about.
If your inquiry isour relationship/collaboration or might develop into a potential dispute we may retain your personal data for a longer period of time. The retention period is hereafter depending on the circumstances around your inquiry, including what your inquiry is about, if it involves any damages etc., and we will only retain the personal data in order to be able to document the case and handle a potential (legal) dispute arising from or involving your inquiry and only for the period of time we might be met with a dispute etc. in accordance with the limitation relationship/collaboration with the party that you represent or have a relation to.
However, we may store the personal data for an extended period if deemed necessary in a specific case, e.g. for establishing legal claims or in order for BAT to be able to document the relationship and/or certain circumstances with respect to the customer, supplier or other third-party.
We may also delete your personal data earlier, which will be the case for example if you appear on CCTV, if you have participated in an event, a quiz or any other marketing activities.
Some inquiries follow the retention periods as mentioned under “When communicating with us or our customer service” – please refer to this purpose for more information.
In some cases, we will be transferring personal data to countries outside the EU/EEA.
Such transfers will take place on the basis of the following legal basis:
a) The country/countries has/have been deemed by the Commission of the European Union to have an adequate level of protection of personal data, i.e. the country is a “secure/adequate third country”
b) The country/countries has/have not been deemed by the Commission of the European Union to have an adequate level of protection of personal data. We will provide appropriate safeguards for the transfer:
c) In the absence of a decision that the country is secure/adequate and appropriate safeguards as mentioned above the transfer might in some, however limited cases take place if i) you have given your consent to the transfer, ii) the transfer is necessary for the performance of a contract between you as a data subject and BAT as data controller or the implementation of pre-contractual measures taken at your request, or iii) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of you as a data subject between BAT as the controller and another third party.
We will not use automated decision-making pursuant to GDPR article 22.
If you chose to use the face scanner to verify your age, and the result indicates that you are under 18 years old, or if the store employee otherwise is in doubt regarding the result of the face scan, you will be asked to present an ordinary ID-card or other valid identification to verify your age. As the store employee will make the final decision, we do not use automated decision-making under GDPR article 22.
Some of the information we process about you might be mandatory for us to collect in order to provide you the service that you request, e.g. when buying or receiving our products it is mandatory for us to collect certain information about you to sell you the products as well as it is mandatory for you to provide us with certain information with respect to customer service. The consequence of not providing us any mandatory information is however alone that we will not be able to provide you the requested service.
You have the following rights:
If processing of your personal information is based on your consent, you have the right to withdraw your consent at any time. Your withdrawal will not affect the lawfulness of the processing carried out before you withdrew your consent. You may withdraw your consent by contacting us at gdpr_emails@bat.com and +47 22 08 10 00. If you have given your consent in relation to cookies and you wish to withdraw your consent , please also see our cookie overview and policy.
Furthermore, you have the right to object to processing of your personal data as follows.
You can take steps to exercise your rights by contacting us at gdpr_emails@bat.com and +47 22 08 10 00.
There may be conditions or limitations on these rights. It is therefore not certain that for example you have the right of data portability in the specific case - this depends on the specific circumstances of the processing activity.
You may also always lodge a complaint with the local data protection supervisory authority:
The Norwegian Data Protection Agency, Datatilsynet
Postboks 458 Sentrum
0105 Oslo
Email: postkasse@datatilsynet.no
Phone: +47 22 39 69 00
Last updated: 29 December 2020