Privacy Policy

We respect your privacy. We are committed to safeguarding the privacy of our website visitors. Please read this document carefully as it sets out our 'Privacy Policy' which informs you what we do with your personal data, whether we are providing you with news alerts or using your personal data as part of the research that we conduct for or statistical purposes.

This Privacy Notice applies to the personal data of visitors to this website.

For the purpose of applicable data protection legislation (including but not limited to the General Data Protection Regulation (Regulation (EU) 2016/679) (the "GDPR"), the company responsible for your personal data is: British American Tobacco Belgium, Nieuwe Gentsesteenweg 21, 1702 Groot-Bijgaarden, Belgium (“BAT BELUX” or “BAT” or “us”).

We may amend this Privacy Notice from time to time. Please visit this page if you want to stay up-to-date as we will post any changes here.

If you are dissatisfied with any aspect of our Privacy Notice, you may have legal rights which we have described below where relevant.

1) Information we collect about you

Depending on the relevant circumstances and the laws and obligations that apply in your location, we may collect some or all of the information below:

• Name;
• Contact details (such as your e-mail address or mobile number);
• Country of residence;
• Category to which you belong (consumer, supplier / company, or other);
• Date of birth
• Additional information that you provide us voluntarily (for example, wholesaler details and wholesaler number);
• Technical data (e.g. the IP address).

The above list indicates which personal data we collect on our website.

BAT does not knowingly collect information from visitors to this website under the age of eighteen. If BAT becomes aware that a minor has provided information, it will be immediately deleted from BAT's databases.

2) How do we collect your personal data?

We collect your personal data largely in three ways:

• Personal data that you provide us with;
• Personal data that we obtain from other sources; and
• Personal data that we collect automatically.
• Personal data that you provide us with:
• You can share your personal data with us in multiple ways, such as:
• By proactively contacting us, usually by phone, email, through our contact form or through social media; and / or
• Because we contact you, either by phone or by e-mail.
• By collecting information through the intervention of the (your) BAT representative.

We usually receive personal data such as your contact details, your name, the country of residence, your date of birth, etc.

Personal data we obtain from other sources:

We may use other sources to obtain additional information about you, e.g. from third parties. An example of this is the information we receive about you from wholesalers or via the Google Analytics tool. Usually we so receive personal data such as name, address, contact details or information via a unique identifier (e.g. information about your activity on the website).

Personal data we collect automatically:

When you visit our website, we collect technical data by means of cookies such as the IP address your computer uses to connect to the internet, the type and version of your browser, your time zone setting, types and version of browser plugins, operating system and platform.

3) Why do we collect your personal data?

We collect, use and disclose your personal data for a number of reasons, including:

• to ensure that we can respond to any queries and contact you if you request us to do so
• for storing your details (and updating them when necessary) on our database, so that we can contact you in relation to email news alerts or respond to any query you have asked us to answer
• as part of the research that we conduct for statistical purposes
• to administer our website for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes
• to ensure the effective operation of software and IT services procured by us (including disaster recovery)
• for other reasons with your consent.

4) Who do we share your information with?

We will share your personal data primarily to ensure we provide you with the most relevant and up to date news, content and events, or to ensure we can respond to any query quickly and expeditiously. Unless you specify otherwise, we may share your information with any of the following groups:

• Any of our BAT entities, where this is necessary, and in accordance with laws on data transfers;
• Tax, audit, or other authorities, when we believe that the law or other regulation requires us to share this data (for example, because of a request by a tax authority or in connection with any anticipated litigation) or in order to help prevent fraud or to enforce or protect the rights and properties of British American Tobacco or its subsidiaries; or protect the personal safety of British American Tobacco employees, third party agents or members of the public.
• Third party service providers who perform functions on our behalf (including external consultants, investor relations service providers and professional advisers such as lawyers, auditors and accountants, technical support functions and IT consultants carrying out testing and development work on our business technology systems);
• Third party outsourced IT providers where we have an appropriate data processing agreements (or similar protections) in place;
• If a BAT entity merges with or is acquired by another business or company in the future, we may share your personal data with the new owners of the business or company (and provide you with notice of this disclosure); and
• Circumstances may arise where, whether for strategic or other business reasons, British American Tobacco decides to sell, buy, merge or otherwise reorganise businesses in some countries. Such a transaction may involve the disclosure of your personal information to prospective or actual purchasers, or the receipt of it from sellers. It is British American Tobacco’s practice to seek appropriate protection for personal information in these types of transactions.

We do not share, rent or trade your information with third parties for marketing or promotional purposes.

5) How long do we keep your personal data for?

We will not keep your personal data for longer than is necessary for the purposes for which we collect it unless we believe that the law or other regulation requires us to preserve it (for example, because of a request by a tax authority or in connection with any anticipated litigation).

When it is no longer necessary to retain your data, we will delete the personal data that we hold about you from our systems.

6) How do we keep your personal information secure?

We care about protecting your information. That's why we put in place appropriate measures that are designed to prevent unauthorised access to, and misuse of, your personal data.

We are committed to taking all reasonable and appropriate steps to protect the personal information that we hold from misuse, loss, or unauthorised access. We do this by having in place a range of appropriate technical and organisational measures, including encryption measures and disaster recovery plans.

Unfortunately, there is always risk involved in sending information through any channel over the internet. You send information over the internet entirely at your own risk. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted over the internet and we do not warrant the security of any information, including personal data, which you transmit to us over the internet.

If you suspect any misuse or loss of or unauthorised access to your personal information please let us know immediately. Please raise your concern by contacting us using the Contact us section of the website, in the first instance, and we will investigate the matter and update you as soon as possible on next steps.

7) Your rights

You have several rights regarding the data that we process about you. These are explained in more detail below.

Right to object

You can always inform us of the special reasons why you wish to object to the processing of your personal data that is based on the public interest or the legitimate interest of BAT. If these reasons outweigh our interests, we can stop processing. BAT cannot comply with this request if your personal data is related to a legal claim. For more information about this right, see Article 21 GDPR.

If we process your personal data to send e-mail notifications, you can always ask us to stop doing so without having to provide a special reason. For more information about this right, see Article 21 GDPR.

Right to withdraw consent

If the processing of your personal data for certain activities is based on your consent, you can withdraw this consent at any time. We will stop using your data for that purpose.

Right of access

You can ask us at any time to obtain information about whether or not to process your personal data and, if necessary, request a copy of the relevant categories of personal data that we process about you, as well as the other information as stated in Article 15 GDPR.

If we provide you with a copy of your personal data, we will not charge you for this unless permitted by law. If you request us for additional copies of this data, we may charge reasonable administrative costs. If the law allows us to, we can refuse your request. If we refuse your request, we will always inform you of the reasons for this.

Right to erasure

In certain circumstances you have the right to request that we "delete" your personal data. This right generally applies when:

• The data is no longer necessary for the purposes for which we collected it;
• You have withdrawn your consent to our use of your information, and we have no other valid reason to continue using it.

We are entitled in certain circumstances not to comply with your erasure request. In such a case, we will always inform you of our reason for doing this. If we comply with a valid data erasure request, we will take all steps reasonably practicable to erase the data in question.

For more information about this right, see Article 17 GDPR.

Right to restriction of processing

You have the right to request us to restrict your personal data in certain circumstances, e.g. if you dispute the accuracy of the personal data we hold about you, or you object to our processing of your personal data for our legitimate interests. A restriction of processing means that we may only temporarily store your data unless you give permission to process your data, in the context of a legal claim or in the public interest. A restriction can be lifted afterwards. We will of course notify you before we lift any restrictions on the processing of your personal data. For more information about this right, see Article 18 GDPR.

Right to rectification

You have the right to request the rectification of incorrect or incomplete personal data that we process about you. If we believe we have reasonable grounds not to comply with your request, we will explain our reasons for this decision. For more information about this right, see Article 16 GDPR.

Right to data portability

In some cases, you can legally transfer your personal data to other service providers. In essence, this means that you can transfer the data we hold about you to another third party. To this end, we provide you with your data in a common and machine-readable format that enables you to transfer the data. Another option is that we transfer the data directly for you if this is technically possible. For more information about this right, see Article 20 GDPR.

Right to file a complaint

You also have the right to complain to your local supervisory authority, in your case the Data Protection Authority. You can contact them in the following ways:

Telephone: +32 (0)2 274 48 00

Website: https://www.gegevensbeschermingsautoriteit.be/burger (via the contact form on the website)

Email: contact@apd-gba.be

Address: Drukpersstraat (rue de la Presse) 35, 1000 Brussels

If you wish to exercise any of your rights or withdraw your consent to the processing of your personal data (if consent is our legal basis for processing your personal data), please contact us via the contact form on the website. Please note that we may retain your messages in order to resolve issues you raise.

8) Where do we store your data and how do we communicate these internationally?

Your personal data may be transferred outside the European Economic Area to the types of entities described in section 4 above.

We want to ensure that your personal data is stored and transferred securely. Therefore, we only transfer data outside the European Economic Area or EEA (i.e. the EU Member States together with Norway, Iceland and Liechtenstein) if this is in accordance with data protection law and if the method of transfer provides adequate protection for your data, e.g.:

• By means of an agreement that considers the current standard contractual clauses of the European Commission; or
• By transferring your data to a country that the European Commission considers providing adequate data protection by law (an adequacy decision); or
• By providing any other appropriate safeguard as permitted under the GDPR.

9) Who is responsible for processing your personal data?

BAT processes your personal data for various purposes. These are explained in more detail below. BAT does not process your personal data without a legal basis.

We sometimes process your personal data based on our legitimate interest and if this interest is not overridden by your fundamental rights and freedoms.

We sometimes process your personal data based on your consent. When you register on our website, we ask for consents that allow us to use your personal data in certain ways. This permission is sometimes explicitly requested but can also be derived from a positive action or behavior (e.g. filling in the contact form).

The processing of your personal data may also be necessary to fulfill our obligations under our engagement with you.

Finally, we process your personal data if the processing is necessary to comply with our legal obligations.

10) How do we store and transfer your data internationally?