privacy notice

How we collect personal information

We collect your personal information to provide you with our Rizla services, so that we can stay in touch with you, to improve and personalise our Rizla services for you, to handle any questions or complaints you may have, and to comply with our regulatory obligations. This involves:

Information you provide to us

We collect information from you when you register an account with us and when you make a purchase through our website.  This includes the information we need to identify you to comply with our regulatory obligations.  See the age restrictions section for more.

We collect information you voluntarily provide to us, such as your name and contact details, when you make an enquiry or complaint, sign up for information relating to Rizla products and services, and when you participate in our surveys or attend events where we are.  You volunteer information when you leave us feedback or post about yourself on our social media accounts or any public areas of our website.

Information we collect automatically or that is generated when you use Rizla services

We collect some information about you automatically, such as information collected by cookies, web beacons and similar technologies when you use, access or interact with us via our website.

Information we collect from third-parties

Some of the information we collect about you comes from third-parties such as analytics service providers, social media providers and marketplaces. If you sign up for a Rizla account using your Facebook or Instagram account, we receive information from that service depending on the settings of your social media account.  You can change how the information is shared with us by other services by changing your settings with that service.

What personal information we collect

Identity Data is information that specifically identifies you.  It includes your first name, last name, username or similar identifier, title, address, date of birth and gender.  We use this information to register and create your account.

Contact Data includes billing address, delivery address, email address and telephone numbers.  We use these details to deliver our Rizla Services to you.

Financial Data includes your bank account and payment card details.  Using our website, you submit these details to our payments service provider, when you buy Rizla products online.

Transaction Data is generated as a record of your purchases through our website and includes details about payments to and from you and other details of products you have purchased from us.

Account Profile Data is the personal information contained in your account.  It includes your username and password details as well as your Identity Data, Contact Data and Communications Data.  It is also a record of your engagement with us through your feedback and survey responses.

Communications Data includes your preferences in receiving product information from us and your communication preferences to ensure we engage with you as you wish.

Image Data includes photographs and video footage captured by us or our representatives at festivals or events either in clearly signposted designated areas or where we obtain your consent via a consent form.

Technical Data is the information behind the technology and the devices you use to connect to our website.  It tells us how our products and services are performing and we use this data to make our Rizla services operate better. 

Technical data includes your internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website

Usage Data  is the information generated, including using cookies, as you use our Consumer Services.  We use third-party analytics providers to analyse how you are using those Rizla services.  This data, especially when we use it as Aggregated Data, tells us how the Rizla experience could be improved and what we can do to enhance the services we offer.

We use a third-party service, Google Analytics, to collect standard internet log information and details of your behaviour patterns as you navigate around our website.  It does this using information from cookies.  This helps us to find out the number of users to the various parts of our website and how they interact with the content on the site.  We also use this information to maintain and monitor the performance of our website, and to look for ways of improving our website and the services it offers you.  This information does not identify any individuals. For more information about our use of cookies, please see our cookies policy here.

Third-Party Data is the information we receive from analytics providers as mentioned above under Usage Data and, for instance, when we analyse your feedback on review sites.  We also receive information about you from social media providers when you register for a Rizla account via your social media accounts like Facebook or Instagram. 

This might include information on your interests, comments and content you have posted on social media, user name, and other online activities.  You can find information on the data sharing policies and practices of the social media providers on their websites, and we encourage you to read this information and adjust your settings to your personal preferences.

Location Data is used in some features of our Services.  Precise location is generated from GPS signals, device sensors, Wi-Fi access points, and cell tower IDs.  We may also derive approximate location from your IP address. 

Aggregated Data is derived from your personal information but is not considered “personal data” in law as it is anonymous and the data does not directly or indirectly reveal your identity.  This data is used for statistical research and to inform business strategy.

  We collect, use and share Aggregated Data, such as statistical or demographic data. Aggregated Data may be derived from personal information (for example, we may aggregate all our website visitors’ website usage to calculate the percentage of them accessing a specific website feature) but it does not identify individuals. However, if we combine or connect this Aggregated Data with your personal information in a way that directly or indirectly identifies you, we treat the combined data as “personal data” which will be used in line with this Privacy Notice.

Cookies

We collect website usage data and technical data automatically from your mobile or other device using cookies, web beacons, and similar technologies. A cookie is a small file of numbers and letters which allow us to distinguish you from other visitors to our website and tells us how you are using our website. Some cookies are necessary to provide you with a good experience as you browse; others help us to gather information that informs how we can improve our website for you.   Our cookies help to:

• Make our website work as you would expect;
• Remember your settings during and between visits;
• Improve your and other users' experiences;
• Allow you to sign up to receive product information and updates; and
• Improve the speed/security of our website.

You can reject unnecessary cookies either by rejecting them on our website’s cookie settings pop-up or at any time by activating the setting on your browser that allows you to refuse some or all cookies. If you refuse cookies, there may be parts of our website that you cannot access or that will not function properly.   For more information about our use of cookies, please see our cookies policy here.

Age-restrictions

You must be at least 18 years of age to use our website. This is to ensure that we meet our legal obligations.  Before you enter our website you will be asked to verify you are 18+ age. 

Not agreeing that you are 18+ will obstruct your interactions with us.

Our website is not intended for children and we do not knowingly collect data relating to children.

How we use your personal information

Your personal information is used for the following purposes:

• Account creation

  If you sign up for an account with us, we use your personal information to register your account.



• Delivering your Rizla products and services

  We use your personal information to deliver our products and services to you.  This includes contacting you about your orders, managing payments, fees and charges, collecting and recovering money owed to us, delivering products and services to you, and providing you with information about the products you have purchased, including any product safety information.

  When you submit your Financial Data via Shopify, your details are held on their platform and payments service provider.  We do not store your Financial Data.



• Account Management

  We use your personal information to administer your account and to manage our relationship with you, which will include notifying you about any changes to our terms or Privacy Notice, enabling you to use promotional codes or discounts and responding to your queries.



• Providing customer service

  If you contact us, we will save your contact details to respond to your query, to ensure you receive the correct support from our Customer Service team and to inform our understanding of your Rizla experience.



• Personalising your Rizla experience

  We use information about your behaviour on our website (including, with your agreement, your location) to personalise your Rizla experience by tailoring our communications to your preferences.

  If you are registered to receive product information communications, we use information about your online activity to inform the updates you receive from us with news and product information. You can opt out of receiving these communications in the preference centre in your account. You can also unsubscribe through a link in every communication we send out.

  We use information about your online activity together with your response to our product information communications to personalise your online browsing and shopping experience on our website to ensure you will see content that is relevant for you.

  In some instances, on an ad hoc basis we may send you a gift voucher as a thank you for bringing to our attention an error or improvement in our systems or communications or simply as a celebration for an important milestone in your life.



• Events

  We use your personal information when we invite you to events hosted by us or on our behalf. If you participate in an event, we collect information about you to better understand your preferences. Offline data collection may be part of a promotional initiative, such as a prize draw or competition.

  We also collect, use, store and transfer different kinds of personal information about you when you attend an event that we are present at, for example, festivals. If you are in the designated area at the events, where we or our authorised representatives will be taking photographs and video footage of the event, your image may be captured in those photographs and video footage. We will only collect this personal information if you are within the designated area that we are operating from, and this area will be clearly sign posted to confirm that photographs and video footage may be taken in the area.

  If you do not want your image to appear in the photographs or video footage that we are collecting, please do not enter the area.

  We may also approach you at events and ask you to sign a consent form where we intend to capture your image either outside of the designated area or outside the designated times or where the image clearly identifies you.

  Where your image has been captured in the designated area or where you have consented for us to use your image – from an event or festival, we will use your image for internal and external promotional purposes which will appear on our website and/or other publications, including social media accounts.

  The images will only be used and stored for 18 months after which they will be deleted. Where we rely on consent to use your image, you have the right to withdraw this consent at any time by getting in contact with us using the contact details below.

  Withdrawing your consent means that Imperial will thereafter not use your image in any future publications or for any further purpose, but you should be aware that your image may continue to appear in publications already in circulation or previously published for the permitted purposes.



• Conducting Surveys

  Occasionally we invite you to fill out a questionnaire. You are free to choose if you would like to fill out the questionnaire. The information you provide will be used to better understand your preferences and to serve you better.



• Providing product information

  If you are an existing customer or if you have made a sales enquiry, we may contact you by email or post with product information about our products which are similar to the products previously provided to you, unless you have told us you do not want to hear from us.  Otherwise, we will only contact you if you have agreed we can.

  Where appropriate and where you have provided your consent to receive production information from us (i.e. when you opt-in to receiving product information during or at any time after the registration process and by setting your preferences in the preference centre), we may pass your information to our affiliate Imperial companies so that you receive further personalised information and services that might be of interest to you. You may ask us at any time not to use your information by contacting us using the contact details below.

  In order to provide you with a personalised shopping experience, we will send you product information based on your preferences. These preferences can be based on your online behaviour and/or surveys that you have participated in. Based on this, personalised emails will be sent out (if you are subscribed). Based on your online behaviour and preferences, our website might also be adjusted accordingly. In certain cases, your personal information will be matched to personal information received from third-parties to build up a profile. This profile will give us insight on how we can personalise your experience with us.

  You can ask us to stop sending you product information messages at any time by logging into the website and unchecking the relevant boxes to adjust your preferences or by following the opt-out links on any product information message sent to you. You can also opt-out by contacting us at any time.  Where you opt-out of receiving these product information messages, this will not apply to personal information provided to us as a result of a product purchase, product experience or other transactions. Therefore, if you opt-out of product information messages, we will still need to send you service communications from time to time, such as information about changes to our services or product recalls.



• Research and analysis

  We use all the data we collect (largely as Aggregated Data), including your feedback, your responses to surveys, and your online behaviour to conduct research and analysis to improve and develop our business.

  We carry out research and analyse the data we have (usually in aggregated form, to improve our Rizla Services, our marketing strategy and our customer relationships and experiences.  We also use and share our statistical data and the results of our research and analysis to improve our business and develop new products and services.



• Administering and protecting our business

  We use all the data we collect to administer and protect our business, our Rizla products, our website, and our information and systems.  This includes carrying out activities like trouble-shooting, data analysis, testing, system maintenance, system security, support, reporting and hosting data.



• When you purchase Rizla products in a market place

  If you buy Rizla product in a market place, we will receive information about your purchase and personal information held by the market place.

The lawful basis that allows us to use your personal information

We need to tell you the lawful basis that permits us to use your personal information.

We may use your personal information under more than one lawful basis depending on the specific reasons for using it. Please contact us - consumer.services@impbrands.com, if you need more details about the specific lawful basis we are relying on to process your personal information.

If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we will only process your personal information without your knowledge or consent where this is required or permitted by law.

The lawful bases we rely on in order to use your personal information are as follows:

• with your permission (for example, where you opt-in to receiving product information from us);
• where we need your personal information to enter into a contract with you (for example, when your make a purchase via our website);
• where we perform tasks in the public interest or to comply with a legal obligation (for example, where we need verify your age or your identity); and/or
• where it is necessary for our legitimate interests (or those of a third-party) and your interests and fundamental rights do not override those interests (for example, when we use your information to help us improve and develop our Rizla Services).

The table below provides more detail about the personal information we use and the legal basis that we rely on in each case.

We take appropriate steps to ensure that while we are doing this your information and your rights are protected.

If you do not provide the personal information

We need some of your personal information by law, to respond to your enquiries, or to enter into a contract with you (for example, to make sure we can deliver the products/services you asked for to you).  Without this information, we may not be able to continue with the process that you want us to. We’ll explain when this applies where we collect your personal information if it is not clear why we need it.

How we look after your personal information

information sent via the internet is not always secure. We cannot guarantee the security of the information while it is being transmitted to our website as you register your account; any transmission is at your own risk.  However, once we’ve received it, we take appropriate security measures to keep it safe.

We limit access to your personal information to those who have a business need to know. Where we use service providers, we require them to take appropriate security measures to protect your personal information from an accidental or unlawful destruction, loss, or alteration and unauthorised access or disclosure.  They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We take the security of your data extremely seriously. We have procedures in place to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are required to do so.

Who we share your personal information with

We will treat all your personal information as confidential and in accordance with applicable data protection legislation. We may, however, need to share your personal information with our affiliates that are part of the Imperial Brands group and with third parties who provide us with services.

We limit the amount of third parties that have access to your personal data to only what is needed to provide the Rizla Services.

To do so, there are certain categories of processors (i.e. those third parties who process your personal information on our behalf) that have access to your personal information, which include:

• Shopify. Contact, Financial Info:EU
• Magic Number. Contact Info: UK
• Tracking solutions. Location: EU.
• Data collection tool. Location: EU.
• Analytics solutions. Location: EU & US.
• Fulfilment and delivery of product providers. Location: UK & EU.
• Marketing agencies and similar service providers: Location: UK & EU
• Where we use third parties to process your personal information on our behalf, we will always carry out checks to ensure that there are appropriate protections for the safeguarding your personal information. We will also monitor the performance of these third parties (and their approved subcontractors) to ensure that your personal information remains secure.
• We require all third parties to respect the security of your personal information and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal information for their own purposes and only permit them to process your personal information for specified purposes and in accordance with our instructions.
• We share your personal information with some of our Imperial Brands affiliates in order to provide us with sales, marketing and customer care services. Where you have opted in to receive product information from affiliates in our Imperial Brands group, we may also share your personal information with our affiliates to facilitate your request.
• We also share information (usually Aggregated Data) with our relevant affiliates for business administration and reporting purposes, and for product and services development purposes.  For instance, we share statistical customer feedback and survey data with our affiliate responsible for product innovations.

We will not usually disclose your personal information other than as set out above. However, there are certain circumstances where we need to share personal information, for instance:

• where we are legally required to disclose the information, for example, because a court orders us to do so;
• where the disclosure of the personal information is required for the purposes of the prevention and detection of crime. This includes sharing the personal information with tax authorities and law enforcement agencies;
• where we need to disclose the personal information for or in connection with any legal proceedings, or for obtaining legal advice, or the disclosure is otherwise necessary for the purposes of establishing, exercising or defending legal rights;
• where disclosure is necessary to protect your vital interests (for example if you are unwell at one of our events, we may need to seek medical assistance); and
• where we share your personal information with third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets if we reorganise our business. Alternatively, we may seek to acquire other businesses or merge with them.

Cross-border transfers

Your personal information will only be transferred to countries outside of the UK and/or European Economic Area (the “EEA”) or where the recipient has confirmed an adequate level of protection for it, for instance, by contractual agreement. You can ask us about the arrangements we have in place.

In some cases, we work with third parties, including our Imperial Brands affiliates, based outside of the UK and EEA who store, host or transfer your personal information outside the UK or EEA.

If we transfer your personal information out of the UK and/or EEA, we will ensure that a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• we will ensure the countries that we transfer your personal information to have been deemed to provide an adequate level of protection for personal information by the European Commission; or
• we will use data processing agreements or specific contracts approved by the European Commission which give personal information the same protection it has in Europe

Please contact us if you want further information on the specific mechanism used by us when transferring your personal information out of the UK or EEA.

How long we hold personal information for

We keep your personal information for as long as is necessary to fulfil the purposes for which it was collected. After that we will delete or de-identify your personal information unless we hold it to comply with our legal obligations, resolve disputes and enforce our agreements.

We will keep any personal information in your account for as long as you have an account with us and generally for a period of 27 months following your last purchase of a product or when you last accessed your account, provided that you are not subscribed to receive exclusive product information from us.

We may need to keep your personal information for a longer period under certain limited circumstances (for example, where we have a legal reason to keep the personal information for a longer period or in case of a legal claim or dealing with on-going queries or complaints. .

Links to third -party websites

Our website and emails may include links to third-party websites, plug-ins, and applications (such as Facebook and Instagram.) Clicking on those links or enabling those connections may allow third parties to collect or share data about you.  We do not control these third-party links and are not responsible for how they handle your personal data. When you leave our website, we encourage you to read the privacy notice of every website you visit.  

Your information rights

You have a number of rights in relation to your personal information. If you wish to exercise the rights set out in this section, please make your request in writing using the contact details in the Who we are and how to contact us section below.  We will respond to any requests to exercise your rights as soon as we can and in any event within one month of receiving your request and any necessary proof of identity or further information we need.

In summary, you have the right, within certain legal parameters, to ask us:

• for details about how we use your personal information;
• to see what personal information we hold about you;
• to correct your personal information;
• to erase your personal information in certain circumstances;
• not to use your personal information in a particular way;
• to port your personal information in a commonly used electronic format;
• to restrict how we use your personal information;
• not to send you product information materials by withdrawing your consent (where applicable); and
• not be subject to automated decisions about you and to request human intervention.

Sometimes you will be able to exercise your rights through your account settings. We have noted where this is possible in the further information provided below.

• For details about how we use your personal information.
  This Privacy Notice tells you this and in any further updates to it;



• To see what personal information we hold about you.
  You can access your personal information through your account settings or you can ask us to provide you with it.



• To correct your personal information.
  You can ask us to correct inaccurate information that we hold about you. If we are satisfied that the new data you have provided is accurate, we will correct it on our systems as soon as possible. You can also update your own personal information at any time through your account settings via the Rizla website. The only personal information you cannot change directly through your account settings is your date of birth; you will need to contact us to do this.



• To erase your personal information in certain circumstances.

  You can ask us to delete your personal information in certain circumstances (for example, if we have processed your personal information unlawfully or if we no longer need it for the purposes set out in this Privacy Notice). If you ask us to delete your personal information but you do not want to close your account, we will usually need to keep processing your data in a personally identifiable form, so you should be aware that we may not be able or obliged to anonymise your personal information. If you ask to delete your account, we will stop using your account but we will retain some details for legal or evidential purposes.



• Not to use your personal information in a particular way.

  You can object to us processing any personal information that we process where we are relying on legitimate interests as the legal basis of our processing. If we have compelling legitimate grounds to carry on processing your personal information, we will be able to continue to do so. Otherwise, we will stop processing your personal information.



• To port your personal information in a commonly used electronic format.

  You can ask us to send you a copy of the personal information that we hold about you in a commonly used electronic format.



• To restrict how we use your personal information.

  You can ask us to restrict the processing of your personal information in some circumstances (for example, if you think the personal information is inaccurate and we need to verify its accuracy, or if we no longer need the information but you require us to keep it so that you can exercise your own legal rights).  This means that we only store your personal information and we won’t carry out any further processing on it unless you give us consent or we need to process the information to exercise a legal claim or to protect a third-party or the public.



• Withdrawing your consent.

   Where you have provided your consent to opt-in to a particular service (such as to receive product information or Rizla Care), you can ask us not to send you direct communications by withdrawing your consent. You can do this by opting out of what you no longer want to receive in the preferences section of your account settings. You can also opt-out by using the "unsubscribe" option in any of our communications with you.



• Not be subject to automated decisions about you and to request human intervention.

   You can object to automated decisions being made about you and to request human intervention.



• If you have given us permission to use your personal information in any particular way, you have the right to withdraw that permission at any time.  You can do this in the preference centre in your account or by contacting us.

Changes to the Privacy Policy

We will keep this Privacy Notice up to date and you can find the date it was last updated at the top of the page. If there are any changes to the way in which your personal information is used, we will update this Privacy Notice and, where appropriate, notify you of the changes by email. We recommend that you check this page from time to time to ensure that you are aware of any changes.

Who we are and how to contact us 

The data controller of all personal information collected from your use of the Rizla Services is Imperial Tobacco Limited, 121 Winterstoke Road, Bristol BS3 2LL (company registration: 01860181).

If you have any queries about this Privacy Notice or complaints about the way we use your personal information, please contact us at: dataprotection@uk.imptob.com and we will assist in resolving the issue.

Lodging a complaint 

If we cannot resolve your complaint or you are unhappy with how we have processed your personal information, you have a right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues(www.ico.org.uk).