Personal data means any information that relates to an identified or identifiable individual. This definition includes personal data collected either offline or online through our consumer engagement centres, direct marketing campaigns, competitions, websites, applications and branded pages on third-party platforms, applications accessed or used through third-party platforms and our recruitment / job application channels.

We may collect personal data from a variety of sources. This includes:

• Personal data you provide to us directly,
• Personal data we collect automatically, and
• Personal data we collect from other sources.

Personal data you provide to us directly. 

We collect personal data you provide us when you sign up for a marketing newsletter, complete a survey, enter a competition, communicate with us through our websites or other online channels. In so doing, you may provide personal data, for example: 

• name, gender, home address, social media profiles, email, telephone number and date of birth; and
• feedback, recipe information or suggestions about our products where you decide to provide us with such information. 

Some Upfield brands may collect “special categories of personal data” about you (with your explicit consent). For more information on the special categories of data we collect and how we use it, please refer to the relevant section below.

As part of our staff member recruitment activities, we collect personal data that you provide to us in the course of applying for a role at Upfield. For example:

• Name, gender, home address and telephone number and date of birth. 
• Residency and work permit status, nationality and passport information.
• Payroll information, banking details.
• Wage and benefit information.
• Health status (for example, if you have a disability we need to be aware of). 
• Information from interviews and phone-screenings you may have had, if any.
• Date of hire, date(s) of promotions(s), work history, technical skills, educational background, professional certifications and registrations, language capabilities, and training records (taken from a CV, cover letter or application form).
• Voicemails, e-mails, correspondence, documents and communications created, stored or transmitted using our networks, applications, devices, computers or communications equipment.
• Letters of offer and acceptance of employment.

Personal data we collect automatically. 

We also receive and store certain types of personal data whenever you interact with us online. For example, we use cookies and tracking technologies (to find out more, see our Cookie Notice) when your web browser accesses our websites or advertisements and other content served by or on behalf of Upfield on other websites. 

Examples of the types of personal data we collect include: IP address, device ID, location data, computer and connection information such as browser type and version, time zone setting, browser plug-in types and versions, operating system, and purchase history – which Upfield sometimes aggregates with similar information from other consumers. During some of your internet browsing on Upfield’s websites we may also use software tools to measure and collect session information, including page response times, download errors, length of visits to certain pages, page interaction information, and methods used to browse away from the page. We may also collect technical information to help us identify your device for fraud prevention and diagnostic purposes.

Personal data we collect from other sources. 

We may collect personal data from other sources including: 

• our trusted partners (such as grocery retailers and retail insight providers);
• third-party platforms where we operate Upfield accounts (for example, when you use the “like” functionality on Facebook or the +1 functionality on Google+);
• advertising partners (for example we receive information about you and other visitors’ interactions with our advertising to measure whether our advertising is relevant and successful); 
• third-parties with whom we jointly offer products with other providers (for example, we may offer free product with a qualifying purchase); and 
• from social media (such as Twitter or Instagram). 

As part of our recruitment activities, we may collect personal information about you from social media sites such as LinkedIn (e.g. where you engage with Upfield pages / content on or apply for a role via LinkedIn).

Certain categories of personal data, such as race, ethnicity, religion, health, sexuality or biometric data are classified as “special categories of data” and benefit from additional protection under European Union data protection legislation.

We limit the circumstances where we collect and process these special categories of data. However, we may collect such data in the following circumstances:

• if you contact Upfield to discuss an experience with a product, you may provide certain health information relating to your dietary requirements (for example, that you are lactose intolerant); 
• if you contact Upfield specifically regarding our products which may have a nutrition or health benefit (e.g. ProActiv), we may ask you to provide us with limited health related information (e.g. your cholesterol levels and any variances);
• if you apply for a job at Upfield, we may collect information about you relating to pre-existing health conditions (for example if you have a disability that we need to be aware of), or information about your religion. 

Upfield only collects and uses this personal data where you have provided us with your explicit consent for us to do so or where we are legally required to process such data. In some instances, you may provide us with information which does not directly involve the collection of any special categories of data, but may imply or suggest your religion, health or other special categories of data.

• To process and respond to your inquiries / suggestions or registration / subscription requests, via e-mail, social media or our Upfield consumer “careline”;
• To develop and improve our products, communication methods and the functionality of our websites and online channels;
• For the purposes of competitions or promotions that you have entered;
• To authenticate the identity of individuals contacting us by telephone, electronic means or otherwise;
• For internal training and quality assurance purposes;
• To provide personalised communications and targeted advertising as well as product recommendations; and
• To process and manage job applications.

When we collect and use your personal data for any other purposes, we will inform you before or at the time of collection.

We also create profiles by analysing the information about your online surfing, searching and buying behaviour and your interactions with our brand communications by building segments (creating groups that have certain common characteristics) and by placing your personal data in one or more segments. For more information on this, see "Profiling" below.

We generally rely on legitimate interests for processing your personal data (as long as our legitimate interests are not overridden by your data protection interests or fundamental rights and freedoms). Our legitimate interests could exist for example, when you sign up to receive information about one of our brands or enter a competition and we use the personal data collected to better understand the needs of our customers.

In some cases, we process your personal data to perform a contract to which you are or will be a party. For example, we need to process your personal data to allow you to take part in one of our competitions, or to send you samples that you have requested.

We also process your personal data when we have a legal obligation (e.g., tax or social security obligations) to perform such processing. For example, a court order or a subpoena may require us to process personal data for a particular purpose.

Where appropriate (such as if we are collecting special category personal data for allergen related purposes, voluntary surveys regarding our products (e.g. their effect on levels of cholesterol) or staff diversity reasons), we will ask for your consent to process the personal data. Where you have given consent for processing activities, you have the right to withdraw your consent at any time. For further information on how to do this, please see the Contact Us section below.

Like most organisations with an online presence, Upfield uses your personal data to build profiles. We create profiles by analysing information about your online surfing, searching and buying behaviour and your interactions with our brand communications by building segments (creating groups that have certain common characteristics) and by placing your personal data in one or more segments. These segments are used by Upfield to personalise the website and our communications to you (such as showing relevant content to you when you visit our site or in a newsletter to you), and to display relevant offers and advertisements from the Upfield brands on the Upfield sites, and via third-party websites. The segments can also be used for third-party campaigns on the Upfield sites. Upfield profiles your data using cookies where you have provided consent for us to do so; for example, accepting the setting of cookies on your browser online. For more information, see our Cookie Notice

If you have asked to receive emails or SMS communications from us, we track whether you open, read or click on the content to see what you are interested in so that we can give you more content that we think you are more likely to enjoy.

We use this data to profile your likes and dislikes. For instance, if we see that you are regularly viewing Vegan recipes on our website, and you have opted in to receiving emails from us, we might give you an update on the new Vegan recipes that have just hit the site for your interest, or we may tailor our web content when you visit towards things we think you’ll be most interested in.

Based on this profile information, we may also give you advertising that we think you will like and want to see as you view content from us or from our network of publishers that we advertise with. Sometimes we may use your current location to serve advertising to you that is to do with promotions or events that are happening nearby that we think you might be interested in.

We may also use information you have provided to selected third-parties and consented to be shared, like your age, gender, life stage, lifestyle and wider interests to identify people who we think will have similar interests to you and who we believe will be interested in similar advertising.

In some instances, Upfield processes your personal data using automated means. An automated decision is a decision which is made solely by automatic means, where no humans are involved in the decision-making process related to your personal data. For example:

• Upfield uses game simulations of science-based behavioural assessments and data science techniques to assess prospective staff members. Candidates are required to play a set of games and the behavioural patterns exhibited during gameplay are assessed by an Upfield customised algorithm and Upfield staff to predict the candidate’s potential for a specific role. This algorithm is regularly tested to ensure it remains fair, effective and unbiased.

We will not make decisions based solely on automated decision making that have significant impact on you. If we do so we notify you and provide you with clear information about our decision to rely on automated processing to make our decision and our lawful basis for doing so. For example, Upfield processes your personal data using automated means only if it is necessary for the entering into or the performance of a contract with you, or when you have given your explicit consent.

You have the right not to be subject to a decision which is based solely on automated processing and which produces legal or other significant effects on you. In particular, you have the right:

• to obtain human intervention;
• to express your point of view;
• to obtain an explanation of the decision reached after an assessment; and
• to challenge such a decision.

As a global business, Upfield shares your personal data internally and with selected third-parties in the following circumstances:

• Third-party service providers. In order to carry out your requests, respond to your inquiries, provide you with samples, enable you to participate in competitions, make features or materials available to you through our websites, we may share your personal data with third-party service providers that perform functions on our behalf, such as companies that: i) host or operate Upfield’s websites, ii) analyse data, iii) provide customer service, iv) postal or delivery services, and v) other third-parties that participate in or administer our promotions or sponsorships. They have access to personal data needed to perform their functions but may not use it for other purposes. 

• Other third-parties. Your personal data will also be used by us or shared with our sponsors, advertisers, advertising networks, advertising servers, social media networks, and analytics companies or other third-parties in connection with marketing, promotional, data enrichment and other offers, as well as product information.

• Business transfers. Your personal data will be used by us or shared with Upfield Group for internal reasons, primarily for business and operational purposes. As we continue to develop our business, we may sell or purchase assets, subsidiaries or business units. In such transactions, your personal data generally is one of the transferred business assets but remains subject to this Privacy Notice (unless, of course, you consent otherwise). If another entity acquires us, our businesses or substantially all or part of our assets, or assets related to Upfield's websites, your personal data will be disclosed to such entity as part of the due diligence process and will be transferred to such entity as one of the transferred assets. 

• Legal disclosure. We may transfer and disclose your personal data to third-parties:
  • To comply with a legal or regulatory obligation;
  • At the request of governmental authorities conducting an investigation;
  • To verify or enforce our “Terms and Conditions” or other applicable policies;
  • To detect and protect against fraud, or any technical or security vulnerabilities;
  • To respond to an emergency; or otherwise
  • To protect the rights, property, safety, or security of third-parties, visitors to Upfield’s websites, Upfield or the public.

Your personal data will be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different to the laws of your country.

However, we have taken appropriate safeguards to require that your personal data will remain protected in accordance with this Privacy Notice. For example, our safeguards include implementing the European Commission’s Standard Contractual Clauses for transfers of personal data to non EEA-based third parties and between our group companies, which require all companies to protect personal data they process from the EEA in accordance with European Union data protection law. Further information regarding these safeguards is available upon request.

Upfield takes the security of your personal data very seriously. We take every effort to protect your personal data from misuse, interference, loss, unauthorised access, modification or disclosure.

Our measures include implementing appropriate access controls, investing in the latest information security capabilities to protect the IT environments we leverage, and ensuring we encrypt, pseudonymise or anonymise personal data wherever possible.

Access to your personal data is only permitted among our employees and agents on a need-to-know basis and subject to strict contractual confidentiality obligations when processed by third-parties.

You can exercise these rights at any point. We have provided an overview of these rights below together with what this entails for you. You can exercise your rights by sending an email or submitting a request through the “Contact Us” form on our websites.

You have the following data protection rights: 

• You have the right to access, correct, update or request deletion of your personal data at any time. We understand the importance of this and should you want to exercise your rights, please contact us.
• The right to data portability. The personal data you have provided us with is portable. This means it can be moved, copied or transmitted electronically under certain circumstances.
• Under certain circumstances, you have the right to restrict or object to certain types of processing, including processing for direct marketing (i.e., receiving marketing emails from us or being contacted about potential opportunities, events and promotions).
• You have the right to lodge a complaint directly with any local Supervisory Authority about how we process your personal data.
• If you have given your consent to anything we do with your personal data (i.e., we rely on consent as a legal basis for processing your special category personal data), you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal data with your consent up to that point is unlawful). You can withdraw your consent to the processing of your personal data at any time by contacting us with the details provided below.

If you have any questions or concerns about our use of your personal data, please contact us using the following details: Upfield.Privacy@upfield.com

We retain your personal data we collect from you where we have an ongoing legitimate business need to do so, and we only retain your personal data for no longer than is necessary to fulfil the purpose for which it was originally collected. For example, where you make a submit a query to us online, we will keep the personal data for a period which enables us to handle or respond to any complaints or concerns regarding our response or your query.

Your data may also be retained so that we can continue to improve your experience with us and to ensure that you receive any loyalty rewards which are due to you.

We retain the personal data we collect directly for targeting purposes for as little time as possible, after which we employ measures to permanently delete it.

We will actively review the personal data we hold and delete it securely, or in some cases anonymise it, when there is no longer a legal, business or consumer need for it to be retained. If this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your personal data and isolate it from any further processing until deletion is possible.

We will update this Privacy Notice when necessary to reflect customer feedback and changes in our products. When we post changes to this Privacy Notice, we will revise the “last updated” date. If the changes are significant, we will provide a more prominent notice (including, potentially email notification of Privacy Notice changes).

In addition to this Privacy Notice, there may be specific campaigns or promotions which will be governed by additional terms or notices. We encourage you to read these before participating in any such campaigns or promotions.