We may use your Identity, Contact, Technical, Usage, Account, and Profile Data, including Identity, Contact and Profile data we have received from data brokers or aggregators such as Amobee, which have operations inside the UK, to form a view on what we think you may want or need, or what kinds of products and services may be of interest to you. Combining data from multiple sources in this way is commonly known as “enriching data” or “profile building”. This is how we decide which products, services and offers to include in marketing messages we send. This process may involve automated decision-making to determine which marketing messages will be most meaningful to you based on your interests, preferences, and location. If you would not like us to use data from data brokers and aggregators to enrich the data we have collected from you or if you would like to object to automated decision-making, please contact the Data Privacy Team
. We will not use Special Category data in building a profile about you unless you give us your consent to do so.
You can ask us to stop sending you email marketing messages at any time by clicking on the “unsubscribe” link within the message or by contacting the Data Privacy Team
We may also use your Identity, Technical, Usage, Account, and Profile Data to help us understand the types of products and services that might be of interest to other consumers like you. To do this, we partner with social media companies like Facebook and Instagram to identify and deliver marketing messages to audiences of their consumers who share your characteristics, which are known as “lookalike audiences.” We will not use any Special Category data we collect from you to create lookalike audiences unless you give us your consent to do so. Delivering advertising to you through lookalike audiences involves the use of automated decision-making to build the lookalike audiences and deliver marketing messages to them. If you would like to object to our use of automated decision-making, please contact the Data Privacy Team
You can obtain further information on the legitimate interests balancing exercises which we have carried out by contacting the Data Privacy Team
. 1. SHARING YOUR DATA WITH THIRD PARTIES
We may share your data with third parties, including other companies within Kraft Heinz and with third-party service providers who provide services to us as further explained below.
Where we provide Personal Data to contractors and suppliers who provide services to us, including assistance with the processing activities set out in this notice, we will enter into a data processing agreement (including provisions required by the GDPR, Data Protection Act 2018 and UK GDPR) with those contractors and suppliers.
In order to fulfil our legal and other obligations and in connection with our rights including protection of our legitimate interest, we reserve the right to disclose Personal Data (or Special Category Data as appropriate) to law enforcement agencies, regulatory bodies, government agencies and other third parties as required by law or for administrative purposes (for example, HM Revenue and Customs in the UK) and to the extent that local law allows and/or requires this.
We may transfer your Personal Data to other Kraft Heinz group companies, partners, suppliers, law enforcement agencies and to other organisations that are located outside the UK and the EEA for the purposes of establishing and performing your contract with us, fulfilling legal obligations, and where necessary to fulfill our legitimate interests described above, where our interests are not overridden by your data protection rights.
The laws of some jurisdictions outside the UK and EEA may not be as protective as data protection laws in the UK and EEA. Kraft Heinz will ensure that, for such jurisdictions, appropriate measures are in place for compliance with data protection law in relation to transfer of Personal Data to those jurisdictions. 2. DATA RETENTION
We have legal duties to keep various records and records need to be held for different periods of time, depending on their contents.
We will therefore keep Personal Data for as long as we reasonably consider we may need to in connection with those obligations.
Where we do not have keep Personal Data for a period specified by law we will not keep Personal Data for longer than data protection law allows us to.
For further information about our approach to data retention, please contact the Data Privacy Team
. 3. YOUR LEGAL RIGHTS
Under the Data Protection Act 2018 and UK GDPR you are entitled to ask Kraft Heinz for a copy of your Personal Data and to ask for it to be corrected, edited or have its processing restricted. In certain situations, you may also be entitled to ask Kraft Heinz to delete your Personal Data or transfer some of your Personal Data to other organisations.
You may also have rights to object to some processing of your Personal Data although Kraft Heinz may continue that processing if it is required in connection with legal obligations.
Your Personal Data rights may be limited or subject to exceptions in some situations; for example, where Kraft Heinz demonstrates that it has a legal requirement to process your data, such as where tax authorities require us to retain it or where it is needed for proper performance of a contract.
Where Kraft Heinz has asked for your consent to process Personal Data and that consent is withdrawn we will not process that Personal Data further but may not be able to continue providing the goods or services for which the Personal Data was sought.
Where Kraft Heinz has a legal right or obligation to retain Personal Data or wishes to do so in connection with its legitimate interests, it may do so even if you have withdrawn consent for Kraft Heinz to hold your Personal Data.
Where Kraft Heinz requires Personal Data to comply with legal or contractual obligations, the provision of such data is mandatory. If such data is not provided Kraft Heinz will not be able to manage the employment or engagement relationship, or to meet legal obligations placed on us. In all other cases, provision of requested Personal Data is optional. 4. IF YOU HAVE CONCERNS ABOUT YOUR PERSONAL DATA
For any concerns or questions about how Kraft Heinz processes your Personal Data or have any questions in relation to your rights in respect of your personal data, please contact the Data Privacy Team
In the first instance you should raise all data concerns with the Data Privacy Team but you also have the right to complain directly to data protection authorities at any time. The relevant data protection authority will be the supervisory authority in the same country as your country of residence
Please see here
for details of national data protection authorities in the European Union and here
for details of the Information Commissioner’s Office in the UK. 5. CHANGES TO THIS NOTICE
We may change this Notice at our discretion and in the event we do so we will make the revised Notice available via our websites.
Previous versions of this Notice are archived here Publication Date: 05 May 2023.