Privacy Notice governing [www.coca-cola.co.uk]

LAST REVISED: [21/05/2018]

I. General Privacy statement

The following privacy notice (the "Privacy Notice") sets out our policy for processing your personal data that we collect through our website at www.coca-cola.co.uk (the "Website").

NV Coca-Cola Services SA, with registered office at Chaussée de Mons 1424, 1070 Brussels ("CCS"), is the data controller (within the meaning of EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, hereinafter referred to as the "General Data Protection Regulation"), responsible for processing your personal data in connection with the Website (hereinafter referred to as "we", "us" and "our").

II. What personal data do we process and why?

We process personal data collected via the Website. Personal data shall mean any information relating to an identified or identifiable natural person (in the sense of the General Data Protection Regulation).

1.       Website visits

We collect the following personal data when you visit the Website, whether you are a registered user of the Website or not:

  • IP address
  • information on your device (e.g. screen size)
  • (social) network user ID, if you use social network plug-ins (e.g. “Like” button)
  • location
  • Website's usage (i.e. how you interact with our Website)
  • public content you may have posted on, or through the Website

We will use your IP address, as well as cookies, to collect this personal data:

  • IP address: Your IP (internet protocol) address is a number unique to your computer which is automatically allocated to it by your Internet-Service Provider (ISP). Every time you visit the Website, your IP address is automatically logged and recorded in our server log files, which show the time(s) at which you visited the Website and the individual page(s) you viewed. The processing of your IP address is explained in our Cookie Policy accessible here www.coca-cola.co.uk/cookie-policy.
  • Cookies: the processing of your personal data obtained via the use of cookies is explained in our Cookie Policy accessible here www.coca-cola.co.uk/cookie-policy. Except when the processing of your personal data collected via the use of cookies is strictly necessary to ensure that the Website properly functions, or to provide you services you have asked for, you can accept or refuse our use of cookies by clicking on the pop-up link when you log in to our website.

You will not be requested to log in or provide personal details in order to access the Website. You can be required to log in to access certain features.

2.       Special features, options and other purposes

We also process the following personal data in addition to that specified under 1. Above, for the purposes described hereafter:

  • basic personal details (first name / surname / age)
  • address for dispatch
  • Marketing communications' usage (e.g. whether you open them or not, on which links you click)
  • email address
  • telephone no.
  • photo, information on life events

We use your personal data for the following purposes:

a.     Respond to your requests / Administrative interactions

  • Respond to your inquiries, questions and comments, and fulfil your requests

You have the option of contacting us via the Website. If you send us a message via the Website, we will use your personal data to help us deal with any enquiries, suggestions and complaints you may have.

We will not generally forward any requests or enquiries to third parties, except in the case of product-related complaints, which we will pass on to the relevant bottler, Coca-Cola European Partners.

Legal basis for processing: our legitimate interests to answer your queries.

  • To send administrative information to you, for example, information regarding the Website and changes to our terms, conditions, and policies

We use your personal data to provide you with important information relating to the Website, your transactions and any changes in our terms and conditions, our policies or this Privacy Notice ("Important Emails").

Legal basis for processing: our legitimate interests to inform you by email about the evolution of our Website, our terms and conditions, our policies, and this Privacy Notice.

b.    Sending of marketing communications

We use your personal data to send you direct marketing communications by email and push notifications. Direct marketing communications inform you about promotions or other similar activity, about Coca-Cola and affiliated brands' products and services, and ask you to complete questionnaires and surveys, for example.

Among our marketing communications is our newsletter, to which you can subscribe. We use a "double opt-in" system for registering for our newsletter. This means that we will send a confirmation to the email address you give asking you to confirm that you wish to subscribe to the newsletter. If you fail to confirm within 48 hours, your application will be automatically deleted. You will need to provide your email address and age before we can send you our newsletter. This information will only be used in this regard. We will use your age information to check that you are over 16 (art. 8 (1) EU General Data Protection Regulation). Unfortunately, we cannot send our newsletter to anyone under the age of 16. Your age information will be deleted immediately after you have registered. We will store your email address until such time as you unsubscribe from the newsletter, and delete it afterwards.

Legal basis for processing: your Consent

If you have registered for marketing communications using the "double opt-in" system, you can withdraw your consent to receive direct marketing communications, by clicking on the link "Unsubscribe" at the bottom of every marketing email.

You can also let us know that you wish to withdraw your consent by email, by calling us or writing to us using the contact information listed in section VII of this Privacy Notice.

c.     Data analytics to derive trends & improve Coca-Cola services

We collect your personal data in an aggregated form, to measure your engagement with the Website (e.g. to know how you use our Website, when do you use them, using what device) and with our marketing communications (e.g. whether you open them or not, on which links you click), and derive general consumption trends and patterns from this analysis. This analysis helps us to know the Website' users better and adapt our Website to the identified preferences of the users, but also more generally to adapt Coca-Cola services to users' general preferences.

Legal basis for processing: your consent

You can accept or refuse this collection and use of your personal data for the purpose of performing data analytics to derive trends and improve our Website and more generally Coca-Cola products and services by contacting us using the contact information listed in section VII of this Privacy Notice.

You can also withdraw your consent to the collection and use of your personal data for the abovementioned purpose using the contact information listed in section VII of this Privacy Notice.

You can also let us know that you wish to withdraw your consentby  using the contact information listed in section VIII of this Privacy Notice. Once you withdraw your consent, we will stop the processing for the concerned purpose.

d.    Competitions, prize draws, surveys and other special offers/promotions

We will offer competitions, prize draws, surveys and similar special offers/promotions via the Website which can require online registration (including your email address, user ID and password). We will generally ask you for certain personal information if you register for or win a competition, prize draw, survey or other special offer/promotion, in order to carry out the event until its completion, and keep you informed about it.

Legal basis for processing: the processing of the personal data that you provide us to register to competitions, prize draws, surveys and other special offers/promotions for the purposes stated above is based on performance of the relevant promotion terms and conditions.

You should carefully read the terms and conditions (including any data protection provisions) for any competitions, prize draws, surveys or other special offers/promotions you may take part in via the Website as they may contain other important information on the use of your personal data by us or any sponsor. If those terms and conditions and personal data provisions are not consistent with those set out in this Privacy Notice, those other provisions shall take precedence.

e.     Corporate / M&A operations

We use your personal data to perform any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings).

Legal basis for processing: our legitimate interests to conduct our corporate strategy.

f.      IT administration

We use your personal data to diagnose server problems, administer the Website and check that it properly functions.

Legal basis for processing: our legitimate interests to administer our IT systems and networks and ensure the Website technically functions.

IiI. With whom do we share YOUR personal DATA?

We share your personal data with the following recipients:

  • Amazon Web Services, which hosts the Website's platform;
  • Adobe Experience Manager, which is the Content Management System of the Website;
  • Adobe for Campaign Manager, which is the email and newsletter management system;
  • Mulesoft Support, which provides technical support and maintenance for the platform in which responses to "contact us" inquiries are kept;
  • MSBI Support, which provides technical support and maintenance for the platform in which responses to "contact us" inquiries are kept;
  • MSTR Support, which provides technical support and maintenance for the platform in which responses to "contact us" inquiries are kept;
  • MRM McCann, which (i) supports and manages newsletter subscription lists and (ii) manages our Website databases and (iv) performs data analytics maintenance;
  • Google Analytics and Google Doubleclick, which track your engagement with the Website (e.g. to know how you use our Website, when do you use them, using what device), derive general consumption trends and patterns from this analysis, to allow us improve Coca-Cola products and services
  • Qualtrics, which administers our surveys;
  • Opinion Lab, which administers our surveys;
  • Salesforce, which hosts the platform in which responses to "contact us" inquiries are kept;
  • Triscal, which handles data processing tasks submitted via the “contact us” inquiries form;
  • CCA international, which supports the Customer Interaction Center activities;
  • CCC Information Services, which supports the Customer Interaction Center activities;
  • Findasense, which supports the Customer Interaction Center activities;
  • Social Media SL, which helps in the management of the newsletters;
  • Teneo, which helps in the management of the newsletters;
  • Burson Marsteller, which helps in the management of the newsletters;
  • Hakuhodo, which helps in the management of the newsletters;
  • IMJ, which helps in the management of the newsletters;
  • The Coca-Cola Company, which supports in the management, technical support and result monitoring of the website
  • Wayin, a campaign plugin platform that supports with the running of promotions
  • Sticky Content, which supports with the creation and tracking of content on the Website
  • Coke Studios, which supports with management the Content Management System of the Website

Iv. What transfers of personal data outside the European Economic Area do we carry out?

To achieve the purposes described in this Privacy Notice, we transfer your personal data to the following countries outside the European Economic Area ("Third countries") that are deemed to ensure an adequate level of protection under article 45 of the GDPR: The US

- Standard data protection clauses adopted by the EU Commission under article 46 paragraph 2 of the GDPR (click here to access the EU Commission's decision on standard contractual clauses for transfers to processors established in Third countries); and

- EU-U.S. Privacy Shield for transfers to entities located in the United States (click here to access to the EU Commission's decision pertaining to the EU-U.S. Privacy Shield).

To obtain any relevant information regarding any transfers of your personal data to Third countries (including the relevant transfer mechanisms), please contact our Data Protection Officer (DPO) at the following address: Viale T. Edison 110/B – Sesto San Giovanni (MI), Italy, privacy@coca-cola.com.

V.       Other important notes concerning our data protection compliance

1.     A special note for parents

We take our responsibilities to children and young people under the age of sixteen (16) under online privacy laws very seriously. The Website is not intended for use by any persons in this age group and anyone under 16 is requested not to share any personal data through the Website.

2.     Security

We have instituted a number of security measures and tools for ensuring that personal data under our control is protected against loss, misuse or modification. Even though we do our best to protect your personal data, we cannot guarantee the safety of all of the information you provide via the Website or in connection with it. If you have reason to believe that your interaction with us is no longer secure (e.g. if you are worried about the security of any user account you have with us), you will need to inform us immediately about any issues you may be experiencing by contacting us using any of the options under "Contact Us" in the Website. Please note that contacting us by post will delay us in dealing with the problem and may therefore also delay our response.

Vi.      Third-party websites

The Website is linked to third-party websites. Linked sites hosted by third parties, including sites belonging to our affiliates, are outside our control and we do not therefore assume any responsibility for the data protection practices applied by those third parties. Such links are provided purely for your convenience and do not imply that the relevant third-party site is endorsed by us. Whenever you provide payment information or other personal data through one of these third-party websites, the relevant transaction will take place on the relevant third-party website and not on ours and any personal information provided by you will be collected and checked in accordance with the relevant third party's data privacy policy. It is therefore important that you are aware of the data privacy policies and practices of those third parties.

The Website also uses software components like plug-ins from social and other networks, such as Facebook, Brightcove, Twitter, LinkedIn and Pinterest. The plug-ins are identifiable by a logo or an additional "Like" button (Facebook). Whenever you visit websites using this type of plug-in, your browser will automatically create a direct connection to the networks' servers, sending the contents of the plug-ins to your browser and then integrating them into the Website. As a result, the information that you visited our website will be forwarded to the relevant network.

If you click the "Like" button, the information will be transferred directly to Facebook and stored there.

The data privacy policies of those networks provide further information on the purpose and scope of their collection, processing and use of data, on your rights and on settings which may help you protect your privacy.

ViI.     What are your rights as regards our processing of your personal data, how can you exercise them and how YOU can you contact us?

You have the right:

  • to be provided with a copy of any personal data that we hold about you, with certain related information;
  • to require us to update or correct any inaccurate personal data, or complete any incomplete personal data;
  • to require that we stop processing your personal data for direct marketing purposes.
  • You also have the right, in certain circumstances:
  • to object to the processing of your personal data;
  • to require us to delete your personal data;
  • to "restrict" our processing of your personal data, so that it can only continue subject to very tight restrictions; and
  • to require personal data which you have provided to us, and which are processed based on your consent or the performance of a contract between you and us, to be "ported" to you or to any recipient designated by you.

If you wish to exercise any of your above rights to information, correction, deletion of data, restriction of data processing, rights to objection, to have your data transferred or processing of your data blocked, you can contact us using one of the options below.

1.     You can send us an email to the following address: gbcic@coca-cola.com

2.     You can call us on 0800 22 7711

3.     You can write to the following address:

Consumer Interaction Center

PO Box 73229

LONDON

E14 1RP

4.     Please specify clearly which information you would like us to review or amend.

5.     In accordance with article 77 of the General Data Protection Regulation, you will continue to have a right to lodge a complaint with the relevant supervisory authority (in particular in the Member State of your habitual residence, place of work or place of the alleged infringement) if you are of the opinion that any of your personal data is processed in a manner constituting an infringement of the General Data Protection Regulation [or the new Federal Data Protection Act (BDSG-neu)]

ViII.    How long do we keep your Personal Data?

We intend to keep your personal data accurate and up-to-date. We will delete the personal data that we hold about you when we no longer need it.

We keep your personal data that we use for the purposes described in this Privacy Notice for a period of 2 years maximum, except where legal requirements imposing that we keep your personal data longer or less longer apply

To know how long we keep cookies in your terminal equipment, please refer to our Cookie Policy www.coca-cola.co.uk/cookie-policy

IX.      Changes to this PRIVACY NOTICE

You can find out when this Privacy Notice was last amended by checking at the top of this page.

All considered changes to this Privacy Notice shall be communicated to you well in advance of the changes actually taking effect.

This Privacy Notice is the sole authorised notice of CCS concerning its approach to the collection of personal data through the Website and for the use made of such personal data by us. Any summaries of this Privacy Notice generated by third-party software or in any other way (for example, in connection with "Platform for Privacy Preferences" or "P3P") shall have no legal effect and are in no way binding upon us. They may not be used as a substitute for this Privacy Notice and shall not supersede or modify it.

X.       Applicable law

This Privacy Notice is governed by and shall be construed in accordance with the laws of Belgium and any other applicable laws in the European Union.