Privacy Policy - Social Media

  1. INTRODUCTION
    BAT is committed to protecting your privacy, so we will ensure that any data you provide to us when you visit BAT’s social media pages or when you participate in competitions we organize and in which you participate through BAT’s social media pages (such as Instagram, Facebook or YouTube) (“Competition”) is used only for the purposes set out in this “Privacy Statement”. 
    This Privacy Statement informs you of how we collect and use your personal data and informs you of your privacy rights. This Privacy Statement applies to all visitors to BAT’s social media pages or to those who participate in Competitions we organize by visiting these pages.
    For the purposes of this Privacy Statement, the legal entity responsible for the processing of your personal data is the company with the name “British American Tobacco HELLAS S.A.”, a member of the British American Tobacco group (collectively referred to as “BAT”, “we”, “our” or “us”).
    If you wish to contact us, you can go to the “Contact” section of this Privacy Statement or you can send an email to the email address dpo@bat.com
    We inform you that we may update this Privacy Statement at any time, without informing you. For this reason, please check this page frequently. If you have difficulty finding future versions of this Privacy Statement, please let us know, using the contact details above.
  2. INFORMATION WE COLLECT ABOUT YOU
    Depending on the case and in accordance with applicable law and the conditions in force, we may collect the information detailed below. In the following sections of this Privacy Statement you can learn about the reasons why we collect your data.
    1. If you visit BAT's social media pages and like our posts, if you include BAT in a hashtag or mention BAT or tag us in a post, we will collect your account username, as well as other information related to the relevant post (content, time and date of publication),
    2. If you send us a private message, we will collect your username (i.e. your social media account name) as well as any other information you provide within the content of the communication you send us,
    3. In cases where you are required to provide personal data in order to participate in a Competition (such as a selfie or written post) we will collect the content of your participation in the Competition,
    4.  If you enter the Competitions held on BAT's social media pages and win, we may collect the following personal data:
      1. a) Full name
      2. b) Contact details: mailing address (including city and country of residence), email address, telephone number
      3. c) Information necessary for the competition/draw: date of birth, documents for age verification (including a copy of passport or driving license, where necessary)
      4. d) Username or other user identifier of your social media account (for example, on Instagram). We may process the username of your social media account by publishing the names of the winners on our vuse_greece account on Instagram and/or tagging the Instagram accounts of the winners in a post or Instagram story. Please note that if you win a prize in our competition, we may ask a third party to process your personal data on our behalf.

  3. HOW WE COLLECT YOUR PERSONAL INFORMATION
    Most of the information we hold about you is information you provide to us when you interact with BAT’s social media pages, when you contact us by email, when you send us a private message or when you enter our Competitions. We may use third parties (companies we work with) to help us run our Competitions, for example, to collect your data on our behalf, to carry out age verification checks and to send prizes to your home address. We only provide these companies with the data they need to provide services for specific purposes, in accordance with the instructions we give them, as described below.
    We may also collect some of your personal information indirectly. For example, we may collect your personal information when you interact with content we post on our accounts. This data may include the time you sent us a private message or posted a comment or liked one of our posts.
    We may collect information about your visit, including Uniform Resource Locators (URL) navigation data to, through and from the contest page (including date and time) and collect general demographic information for aggregate use.
  4. HOW WE LEGALLY USE YOUR PERSONAL INFORMATION
    The law allows us to process (i.e. use) your personal data in certain circumstances. These circumstances are explained below, depending on the type of data:
    • When the use of your data is necessary in order for us to enter into a contract with you,
    • for your participation in competitions, for example, for sending personal messages and transmitting personal data to our partners who are responsible for sending the competition prizes,
    • when we have a legitimate interest in using your data
    • We may process your personal data where we have a “legitimate interest” that is not detrimental to you. This occurs in the following cases:
      • In order to communicate with you via BAT's social media pages,
      • for the establishment, establishment, and defense of legal claims and
      • for internal management purposes.
    • We believe that none of the actions mentioned in this Privacy Statement will be in any way detrimental to you. However, you have the right to object to the processing of your data and, in the section below entitled Your Rights, there are details regarding the relevant procedure you must follow.
    • When it is necessary for us to use your data in order to fulfill our legal obligations.
    • Where we have legal obligations to which we must comply, we may use your personal data in order to comply with them (for example, to verify your age, as required by law).
    • In cases where you have given us your consent to use your personal data.
    • We may use your data where you have expressly given us your permission, under certain circumstances. For example, where we ask you to use your name and image in the material we publish.
      Your consent is also necessary in order for us to process your social media account username, by publishing the names of the winners of the competitions we organize, on the vuse_greece account we maintain on Instagram and/or to tag the Instagram accounts of the winners in a post or in an Instagram story.   
      You have the right to withdraw your consent at any time. In the section below entitled Your Rights, there are details regarding the relevant procedure you must follow.

    • SHARING YOUR PERSONAL DATA WITH THIRD PARTIES
      We sometimes share your data with third parties for various reasons, which we list below. We may share your personal information with:
    1. Other BAT Group entities. Your personal data may be shared with other members of the BAT group, for example, in the country where you have indicated your residence, if circumstances so require (for example, if you wish to connect to BAT’s local e-commerce websites or if it is necessary to send you prizes you have won in a competition or even if it is necessary to process a complaint you or a third party have made or for legal reasons relating to your personal data).
    2. Regulatory authorities. We may share your data with authorities where we believe we are required to do so by law or other regulation (for example, upon request in connection with anticipated legal proceedings or to prevent fraud or to enforce or protect the rights and property of BAT or its affiliates).
    3. Organizations that support our business. We may share your personal information with other companies (such as third party service providers) that provide services on our behalf (for example, ensuring that competition entrants are over 18 years old or that send prizes to winners, companies that manage our social media, advertising and communications companies). We will only share data with these companies if we have a relevant contract with them (usually called a “data processing agreement” or similar name) that sets out how they will use your personal information, which is legally consistent with our instructions.
    4. Professional advisors and auditors. We may share your personal data with professional advisors (such as legal advisors and accountants) or auditors for the purpose of providing professional services to us.
    5. Acquisition. If any BAT entity merges with or is acquired in the future by another business or company, we may share your personal data with the buyer or prospective buyer of the business or company (and its agents and advisors).

      • HOW WE PROTECT YOUR PERSONAL INFORMATION
        We are committed to protecting your personal information. For this reason, we take appropriate measures designed to prevent unauthorized access to your personal data and unlawful use thereof.
        To this end, we have taken a series of appropriate technical and organizational measures, including encryption and disaster recovery plans. We update and test our security technology on an ongoing basis and allow limited access to your personal data only to the extent necessary.
      • WHERE WE STORE YOUR PERSONAL INFORMATION
        When using your personal data, we process it using various technical systems, networks and facilities, some of which may be located outside Greece. When we transfer someone's personal data outside the European Union, we do so in ways permitted by data protection law, such as under contractual terms between us and the recipient organization, or we transfer your data only to countries that have been pre-approved, from a legal perspective, to receive personal data transferred from the European Union, because their legislation is as strict as that of the European Union.
      • HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?
        We retain your data for as long as is strictly necessary and only where there is an ongoing legitimate business need (for example, to comply with applicable legal requirements, such as to verify your age, to comply with strict age-restriction legislation or to establish, exercise and/or defend legal claims arising from a contract).
        Where the processing of your data is based on your consent, your personal data will be retained until you withdraw that consent. You may withdraw your consent at any time.
        If we do not have a legitimate business interest in retaining your personal data, we will either permanently delete it or anonymize it or, if this is not possible (because, for example, your personal data has been stored in security files, which we must retain for one year or longer, if required by law), then we will securely store your personal data and block it from further processing until it is possible to delete it.
        For more information about our data retention policy and practices, please contact us using the details in the “Contact” section at the end of this document.
      • YOUR RIGHTS 
        You have various rights regarding the data we hold about you.
        You can
        • Object
          If you exercise this right, you have the possibility to object to our processing of your personal data. If you object, we will stop using your data unless we demonstrate compelling legitimate grounds (which override your interests) or if the use of your data is necessary for the establishment, exercise or defence of legal claims. 
        • Withdraw your consent
          Where we have obtained your consent to process your personal data for certain activities, you have the right to withdraw that consent at any time. If you withdraw your consent, we will stop using your data unless we consider that there is another legitimate reason that justifies us continuing to process your data for that purpose, in which case we will inform you. However, it is important to note that withdrawing your consent does not affect the lawfulness of any processing we carried out before the withdrawal. 
        • Access your data
          You have the right to ask us at any time to confirm that we are processing your personal data or to receive a copy of the personal information we hold about you. We will respond to your request within one month. This period may be extended by two months if necessary, taking into account the complexity and number of requests submitted. We may request evidence of your identification in order to confirm your request. If you ask us for more copies of your personal information, we may charge you reasonable administrative costs. Where permitted by law, we have the right to refuse to comply with your request. In such a case, we will inform you of the reasons for our refusal.
        • Request the permanent deletion of your personal data
          In certain circumstances, you have the right to request the deletion of your personal data. We have a limited right to refuse to comply with your request and, if we do, we will inform you of the reasons.
        • Request restriction of the use of your personal data
          You have the right to request that we restrict the processing of your personal data in certain circumstances, for example, if you contest the accuracy of the personal data concerning you that we hold or if you object to their processing based on your legitimate interest. If we have shared your personal data with third parties, we will inform them of the restricted processing, unless this is impossible or involves disproportionate effort. Of course, we will inform you before we lift any restriction on the processing of your personal data.
        • Request the correction of your personal data
          You have the right to request the correction of inaccurate or untrue personal data concerning you that we hold. If we have shared your personal data with third parties, we will inform them of the correction, unless this is impossible or involves disproportionate effort. You can also request the details of the third parties to whom we have shared your inaccurate or incomplete personal data. In cases where we consider it reasonable not to satisfy your request, we will explain the reasons.
        • Exercise your right to data portability
          If you wish, you have the right to transfer your personal data to service providers. Essentially, this means that you have the ability to transfer the data we hold about you to third parties. In order to achieve this, we will provide your data in a format compatible with widely used software, so that you can transfer it to third parties. Alternatively, we may transfer your data directly to third parties on your behalf, if this is feasible.
        • Submit a complaint
          You have the right to submit a complaint to the supervisory authority if you have concerns about the way BAT processes your personal data. In Greece, the supervisory authority is the Personal Data Protection Authority with the following contact details:
          Address: 1-3 Kifisias, PC 115 23, Athens, Greece
          Tel. Center: 210 6475600
          E-mail: complaints@dpa.gr
        • CONTACT
          For questions regarding this Privacy Statement, including your rights regarding your personal data, you can send us a private message on BAT’s social media account or on our website (as applicable) or an email to dpo@bat.com.