Privacy and Cookies Policy

Transcription

1 Privacy and Cookies Policy At Tesco Mobile, we re working hard to serve shoppers a little better every day. Looking after the personal data you share with us is a hugely important part of this. We want you to be confident that your data is safe and secure with us, and understand how we use it to offer you a better and more personalised experience. What this Policy covers The Data Controller is Tesco Mobile Limited (referred to in this policy as we or us ). We are committed to doing the right thing when it comes to how we collect, use and protect your personal data. That s why we ve developed this privacy and cookies policy ( Policy ), which: sets out the types of personal data that we collect; explains how and why we collect and use your personal data; explains when and why we will share personal data within the Tesco Group and with other organisations; and explains the rights and choices you have when it comes to your personal data. We offer different products and services, so we want you to be clear about what this Policy covers. This Policy applies to you if you use our services (referred to in this Policy as our Services ). Using our Services means: shopping with us over the phone, or online or otherwise use any of the websites ( our Website ) or mobile applications ( our Mobile Apps ) where this Policy is posted; or using our mobile communications network (the Network ) This Policy also applies if you contact us or we contact you about our Services. Some other parts of our business and other Tesco Group companies may need to collect and use personal data to provide you with their products and services and for certain other purposes. They have their own privacy policies that explain how they use your personal data. Our Website or Mobile Apps may contain links to other websites operated by other organisations that have their own privacy policies. Please make sure you read their terms and conditions and privacy policy carefully before providing any personal data on a website as we do not accept any responsibility or liability for websites of other organisations. Personal data we collect This section tells you what personal data we may collect from you when you use our Services and what other personal data we may receive from other sources. When you register for our Services, you may provide us with: Your personal details, including your postal and billing addresses, addresses, phone numbers and date of birth and title; Your debit or credit card details, bank details and other payment information; Your Clubcard number; Your account login details, such as your username and the password that you have chosen. When you shop with us ( in our stores, over the phone or online) or browse our Website or use our Mobile Apps, we may collect: Information about your purchases (for example, what you have bought, when and where you bought it and how you paid for it) Information about your online browsing behaviour on our Website and Mobile Apps and information about when you click on one of our advertisements (including those shown on other organisation s websites); Information about any devices you have used to access our Services (including the make, model and operating system, IP address, browser type and mobile device identifiers). Information about when and how much you top up and pay your bill or how often and why you access your account with us. 1

2 When you use Clubcard to shop with us, or redeem Clubcard vouchers or coupons, we may collect: When you contact us or we contact you or you take part in promotions, competitions, surveys or questionnaires about our Services, we may collect: When you use our Network: Transaction information, including the in-store and online purchases for which you earn Clubcard points. Personal data you provide about yourself anytime you contact us about our Services, (for example, your name, username and contact details)including by phone, or post or when you speak with us through social media Details of the s and other digital communications we send to you that you open, including any links in them that you click on Your feedback and contributions to customer surveys and questionnaires Your call, text, surfing and billing records and your usage records from our Tesco Mobile named apps - this includes the date and time you use them, how long for, where you use them and how much it costs. We don't look at the content of your messages or listen to your calls (unless you are talking to one of our customer service advisors) Your location when you make or receive phone calls, messages or use the internet over our Network (we call this Network Location). Network Location finds you through phone masts nearby and only knows roughly where you are; we need to know your Network Location so we can connect you to the Network to put calls and texts through or connect you to the Internet. Other sources of personal data We may also use personal data from other sources, such as specialist companies that supply information, online media channels, our Retail Partners and public registers. For example, this other personal data helps us to: review and improve the accuracy of the data we hold; improve and measure the effectiveness of our marketing communications, including online advertising. We also access Clubcard information from Tesco Stores and may access information where permissible from Tesco Bank. We may take this information into account when assessing credit risk. For example, we may take into account a Clubcard holder s loyalty reflected in Clubcard transactions. This means that Clubcard information can improve your eligibility for our credit and insurance products. How and why we use personal data This section explains in detail how and why we use personal data We use personal data to Make our services available to you This means that processing your personal data allows us to Manage the accounts you hold with us, check whether you qualify for credit or our products are appropriate for you, and process your orders and refunds Please see further information below about how we use and share your data with credit reference agencies. Why do we process your personal data in this way? We need to process your personal data so that we can manage your customer accounts, provide you with the goods and services you want to buy (including assessing and deciding on whether we can give you and members of your household credit, credit-related services, or insurance) and to help you with any orders and refunds that you may request. 2

3 Manage your connection to our Network and to get in touch with you if we need to tell you about any problems with the Network We need to process your personal data so that we can connect you to and improve the operation of the Network. We also need to process your network usage data (calls, texts, and data usage) to generate accurate monthly bills or accurately decrement from any prepayments made for the use of our services. Manage and improve our day-to-day operations Personalise your Tesco Manage and improve our Websites and Mobile Apps Help to develop and improve our product range, services, stores, information technology systems, know-how and the way we communicate with you Detect and prevent fraud, money laundering or other crime See further information below about how we use and share your data with fraud prevention agencies Recover any money you might owe us including assigning your debt to permitted debt collection agencies. Use your online browsing behaviour as well as your instore and online purchases We use cookies and similar technologies on our Websites and Mobile Apps to improve your customer experience. Some cookies are necessary so you should not disable these if you want to be able to use all the features of our Websites and Mobile Apps. You can disable other cookies but this may affect your customer experience. For more information about cookies and how you can disable some of them, see the Cookies and similar technologies section. We rely on the use of personal data to carry out market research and internal research and development, and to improve our information technology systems (including security) and our product ranges, services and stores. This allows us to serve you better as a customer. It is important for us to monitor how our Services are used to detect and prevent fraud, other crimes and the misuse of services. This helps us to ensure that you can safely use our Services. We also need to comply with laws that apply to us. Obtaining payment for our Services ensures we can continue to meet our obligations to our customers and cover our costs for providing the Services. Looking at your browsing behaviour and purchases allows us to personalise our offers and 3

4 Mobile experience Contact and interact with you (including Clubcard transactions) to help us better understand you as a customer and provide you with personalised offers and services. Provide you with relevant marketing communications (including by text, , post or online advertising), relating to our products and services, and those of our suppliers, Retail Partners and Tesco Group. As part of this, online advertising may be displayed on websites across the Tesco Group and on other organisations websites and online media channels. We may also measure the effectiveness of our marketing communications and those of our suppliers and Retail Partners. Contact you about our Services, for example by phone, , online or post or responding to social media posts that you have directed at us. services for you. This helps us meet your needs as a customer. We want to ensure that we provide you with marketing communications, including online advertising, that are relevant to your interests. To achieve this we also measure your responses to marketing communications relating to your products and services we offer, which also means we can offer you products and services that better meet your needs as a customer. You can change your marketing choices, both when you register with us, and at any time after that. You also have choices when it comes to online advertising. We set out below your choices when it comes to cookies, and how you can control your online behavioural advertising preferences. We want to serve you better as a customer so we use personal data to provide clarification or assistance in response to your communications. Manage promotions and competitions you take part in, including those we run with our suppliers and Retail Partners. Invite you to take part in and manage customer surveys, questionnaires and other market research activities carried out by the Tesco Group and by other organisations on our behalf. We need to process your personal data so that we can manage the promotions and competitions you choose to enter. We carry out market research to improve our Services. However, if we contact you about this, you do not have to take part in the activities. If you tell us that you do not want us to contact you for market research, we will respect this choice. This will not affect your ability to use our Services or your Clubcard. 4

5 Credit Reference Agencies This section explains how and why we share personal data with Credit Reference Agencies. We and our service providers will search your record at credit reference agencies who will supply us with credit information, as well as information from the Electoral Register, about you. We may use credit scoring or other automated decision-making systems when assessing your application and to verify your identity. Credit searches and other information which is provided to us and/or the credit reference agencies, about you and those with whom you are linked financially may be used by us and other companies on an ongoing basis to make other credit decisions about you, or other members of your household to support responsible lending. This information may also be used for debt tracing and the prevention of fraud and money laundering as well as the management of your account. Information held about you by the credit reference agencies may already be linked to records relating to one or more of your partners and you may be treated as financially linked, which means your application will be assessed with reference to any associated records. Prior to such an assessment you will first need to get your partner s consent before their information is disclosed. More information about Credit Reference Agencies and how they use personal information is available at Fraud Prevention Agencies This section explains how and why we share personal data with Fraud Prevention Agencies. To verify your identity and to help prevent fraud and money laundering, we and our service providers may work with fraud prevention agencies to access, use and share your information that s held and has been collected by us or them. This could be for checking credit applications, debt recovery, insurance applications and claims, and checking details of job applicants and employees. If fraud is found, you could be refused services, finance or employment. To find out more about your rights and how we collect, use and share your personal data, please read the relevant sections of our privacy policy. Full Fraud Prevention Notice GENERAL Before we provide services, goods or financing to you, we undertake checks for the purposes of preventing fraud and money laundering, and to verify your identity. These checks require us to process personal data about you. The personal data you have provided, we have collected from you, or we have received from third parties will be will be used to prevent fraud and money laundering, and to verify your identity. Details of the personal information that will be processed, for example: name, address, date of birth, contact details, financial information, employment details, device identifiers including IP address and vehicle details. We and fraud prevention agencies may also enable law enforcement agencies to access and use your personal data to detect, investigate and prevent crime. We process your personal data on the basis that we have a legitimate interest in preventing fraud and money laundering, and to verify identity, in order to protect our business and to comply with laws that apply to us. Such processing is also a contractual requirement of the services or financing you have requested. Fraud prevention agencies can hold your personal data for different periods of time, and if you are considered to pose a fraud or money laundering risk, your data can be held for up to six years. AUTOMATED DECISIONS As part of the processing of your personal data, decisions may be made by automated means. This means we may automatically decide that you pose a fraud or money laundering risk or if our processing reveals your behaviour to be consistent with money laundering or known fraudulent conduct; or is inconsistent with your previous submissions; or you appear to have deliberately hidden your true identity. You have rights in relation to automated decision making: if you want to know more please contact us using the details provided. CONSEQUENCES OF PROCESSING 5

6 If we, or a fraud prevention agency, determine that you pose a fraud or money laundering risk, we may refuse to provide the services and financing you have requested, or to employ you, or we may stop providing existing services to you. A record of any fraud or money laundering risk will be retained by the fraud prevention agencies, and may result in others refusing to provide services, financing or employment to you. If you have any questions about this, please contact us on the details provided. DATA TRANSFERS Whenever fraud prevention agencies transfer your personal data outside of the European Economic Area, they impose contractual obligations on the recipients of that data to protect your personal data to the standard required in the European Economic Area. They may also require the recipient to subscribe to international frameworks intended to enable secure data sharing. YOUR RIGHTS Your personal data is protected by legal rights, which include your rights to object to our processing of your personal data; request that your personal data is erased or corrected; request access to your personal data. For more information or to exercise your data protection rights please, please contact us using the contact details provided. You also have a right to complain to the Information Commissioner's Office which regulates the processing of personal data. Sharing personal data within the Tesco Group This section explains how and why we share personal data with other companies within the Tesco Group. We may share the personal data we collect with other companies in the Tesco Group. For example, we share personal data with the following Tesco Group companies. Tesco Bank We may make information that we have collected about you available to Tesco Bank. This helps them to improve their service and make their communications more relevant to you. Tesco Bank may use information we provide to determine the level of discounts offered on premiums for some insurance products. You can find more information about the way in which Tesco Bank uses data in its Privacy & Cookies Policy at Tesco Stores We provide Clubcard information we have collected from you with Tesco Stores so they can allocate your Clubcard points which relate to your spend with us. We may also make information that we have collected about you available to Tesco Stores. This helps them to improve their sales and customer services. Tesco Stores explains how it uses Clubcard information and other personal data in its own privacy and cookies policy which can be found here dunnhumby dunnhumby, part of the Tesco Group, is also one of our main service providers. dunnhumby help us to use personal data to help improve our understanding of customers and personalise your customer experience. You can find out more about what dunnhumby do here Sharing personal data with Retail Partners and Service Providers This section explains how and why we share personal data with Retail Partners and Service Providers. 6

7 When we share personal data with these companies we require them to keep it safe, and they must not use your personal data for their own marketing purposes. Retail Partners We work with a number of Retail Partners who sell products through our Services, for example when you use the Tesco Mobile Xtras app powered by Unlockd; offer products, services and/or the ability to earn points through Clubcard; provide insurance when you take purchase a device contract with us; or provide cash for your old phones when you use our trade in services. We only share personal data that enables our Retail Partner to provide their services. For example, we may share information about your purchases at Tesco to facilitate the delivery of personalised offers. Whilst Retail Partners can market their products and services to you via our Services, they must not use the personal data for their own direct marketing, and we require them to keep your personal data secure. Service Providers We work with carefully selected Service Providers that carry out certain functions on our behalf. These include, for example, companies that help us with customer care services, network and technology services, storing and combining data, credit checking, processing payments and delivering orders. We only share personal data that enable our Service Providers to provide their services. Some of the Service Providers we work with operate online media channels, and they place relevant online advertising for our products and services, as well as those of our suppliers and our Retail Partners, on those online media channels on our behalf. For example, you may see an advertisement for our products and services as you use a particular social media site or watch television through your pay TV account. Sharing personal data with other organisations This section explains how and why we share personal data with other organisations. We may share personal data with other organisations in the following circumstances: if the law or a public authority says we must share the personal data; if we need to share personal data in order to establish, exercise or defend our legal rights (this includes providing personal data to others for the purposes of preventing fraud and reducing credit risk); to an organisation we sell or transfer (or enter into negotiations to sell or transfer) any of our businesses or any of our rights or obligations under any agreement we may have with you to. If the transfer or sale goes ahead, the organisation receiving your personal data can use your personal data in the same way as us; or to any other successors in title to our business. credit reference agencies: We will share details of your credit agreement with us, the payments you make under it and any default or failure to keep to its terms. The credit reference agency will record details of our search of their database, whether or not your application proceeds. fraud prevention agencies: If when placing an order with us false or inaccurate information is provided by you and fraud is identified or suspected, your details may be passed to fraud prevention agencies. Law enforcement agencies may access and use this information. How we protect personal data We know how important it is to protect and manage your personal data. This section sets out some of the measures we have in place. 7

8 We use computer safeguards such as firewalls and data encryption, and we enforce physical access controls to our buildings and files to keep this data safe. We only authorise access to those employees who need it to carry out their job responsibilities. We protect the security of your information while it is being transmitted by encrypting it using Secure Sockets Layer (SSL). We enforce physical, electronic and procedural safeguards in connection with the collection, storage and disclosure of personal data. We will ask for proof of identity before we share your personal data with you. We will reveal only the last four digits of your credit card number when confirming an order. However, whilst we take appropriate technical and organisational measures to safeguard your personal data, please note that we cannot guarantee the security of any personal data that you transfer over the internet to us. The personal data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA"). It may also be processed by companies operating outside the EEA who work for us or for one of our service providers. If we do this we ensure that your privacy rights are respected in line with this Policy. The most common way we do this is to put in place a specific type of contract, a sample copy of this type of contract can be found here ec.europa.eu/justice/data-protection/international-transfers/transfer/index_en.htm How long we use personal data for We will not keep your personal data longer than we need to, how long this is depend on several factors, including: a) Why we collected it in the first place; b) How old it is; c) Whether there is a legal/regulatory reason for us to keep it; d) Whether we need it to protect you or us. Marketing and market research This section explains the choices you have when it comes to receiving marketing communications and taking part in market research. We will send you relevant offers and news about our products and services in a number of ways including by , post or text, but only if you have not objected to receiving marketing communications. When you register with us we will ask if you object to receive marketing communications, and you can change your marketing choices at anytime by calling 282 from your Tesco Mobile phone or visiting your We also like to hear your views to help us to improve our Services, so we may contact you for market research purposes. You always have the choice about whether to take party in our market research. Cookies and similar technologies We use cookies and similar technologies, such as tags and pixels ( Cookies ), to personalise and improve your customer experience as you use our Websites and Mobile Apps and to provide you with relevant online advertising. This section provides more information about Cookies, including how we use them and how you can exercise your choices about our use of Cookies. How we use Cookies Cookies are small data files that allow a website to collect and store a range of data on your desktop computer, laptop or mobile device. Cookies help us to provide important features and functionality on our Websites and Mobile Apps, and we use them to improve your customer experience. For example, we use Cookies to do the following: 8

9 Improve the way our Websites and Mobile Apps work Cookies allow us to improve the way our Website and Mobile Apps so that we can personalise your experience and allow you to use many of their useful features. For example, we use Cookies so we can remember your preferences and the contents of your shopping basket when you return to our Website and Mobile Apps. Improve the performance of our Websites and Mobile Apps Cookies can help us to understand how our Website and Mobile Apps are being used, for example, by telling us if you get an error message as you browse. These Cookies collect data that is mostly aggregated and anonymous. Deliver relevant online advertising Measuring the effectiveness of our marketing communications, including online advertising We use Cookies to help us deliver online advertising that we believe is most relevant to you on our Websites and other organisations websites. Cookies used for this purpose are often placed on our Website by other organisations, and always with our permission. These Cookies may collect information about your online behaviour, such as your IP address, the website you arrived from and information about your purchase history or the content of your shopping basket. This means that you may see our adverts on our Websites and other organisations websites. You may also see adverts for other organisations on our Website. To help us to deliver online advertising that is relevant to you, we may also combine data we collect through Cookies in the browser of your desktop computer or other devices with other data that we have collected, for example your use of Clubcard and in-store purchases. Cookies can tell us if you have seen a specific advert, and how long it has been since you have seen it. This information allows us to measure the effectiveness of our online advertising campaigns and control the number of times you are shown an advert. We also use Cookies to measure the effectiveness of our marketing communications, for example by telling us if you have opened a marketing that we have sent to you. Your choices when it comes to Cookies You can use your browser settings to accept or reject new Cookies and to delete existing Cookies. You can also set your browser to notify you each time new Cookies are placed on your computer or other device. You can find more detailed information about how you can manage Cookies at the All About Cookies and YourOnlineChoices websites If you choose to disable some or all Cookies, you may not be able to make full use of our Website. For example, you may not be able to add items to your shopping basket, proceed to checkout, or use any of our products and services that require you to sign in. Where we display personalised adverts on other organisations websites, the AdChoices icon will usually be displayed. Clicking on this icon will provide you with specific guidance on how to control your online advertising preferences. Further information is available on the YourAdChoices website Subject Access Rights You have a right to see the personal data we hold about you. This is called a Subject Access Request. If you would like a copy of the personal data we hold about you, please write to: Data Protection Officer Tesco Mobile Communications, 9

10 Hardy s Gate, Dumers Lane, Bury, Lancashire BL9 9QL You can call us at: As the information held by the Credit Reference Agencies operating in the UK may differ, you may want to contact each agency at the contact information set out below: CallCredit, Consumer Services Team, PO Box 491, Leeds, LS3 1WZ or call Equifax PLC, Credit File Advice Centre, PO Box 3001, Bradford, BD1 5US or call or log on to Experian, Consumer Help Service, PO Box 8000, Nottingham NG80 7WF or call or log on to Other Data Protection Rights In relation to your personal data, you also have the right to: In some circumstances, to receive some of your information in a useable format and/or request we transmit that data to a third party where this is technically feasible. Please note that this right only applies to information which you have provided to us. Ask that we update your information if it is inaccurate or incomplete. Ask that we erase your information in certain circumstances. Please note that there may be circumstances where you ask us to restrict the processing of your information, but we are legally entitled to refuse the request. The right to make a complaint with the Information Commissioner if you think that any of your rights have been infringed. The ICO website contains more detail on the data protection rights mentioned above. Or if you would like to speak to us about these rights in more detail, see the how to contact us section below. How to contact us If you have any questions about how we collect, store and use personal data please contact us. Phone: or 4455 from a Tesco Mobile phone Mail: Customer Care, Tesco Mobile Limited, Dumers Lane, Radcliffe, Bury BL9 9QL Footnote: Policy last updated April We reserve the right to change the policy at any time, so please check back regularly to keep informed of updates to this Policy 10