Skip to main content
Get Started

Privacy policy

1. Overview

A key driver to delivering A Better Tomorrow™ is our ethos, which sets out our values and guides our culture and behaviours across the entire BAT Group, ensuring an organisation that is future-fit for sustainable growth. These five key behaviours are bold, fast, empowered, diverse and responsible.

At BAT how we deliver our business results is fundamental to achieving our purpose of A Better Tomorrow™: acting ethically and in line with the values expressed by our ethos will deliver a long-term sustainable business that meets the expectations of our consumers, employees, investors, and society as a whole.

At BAT we are committed to protecting the privacy of our potential future talent.  We will ensure that the information you submit to us throughout your participation in the BAT Battle of Minds competition ("Battle of Minds") is only used for the purposes set out in this Privacy Notice.  We are committed to acting responsibly and with integrity with regard to protecting your privacy rights and freedoms.

Please read this document carefully as it sets out our 'Privacy Notice' which informs you what we do with your personal data and applies to all individuals who participate in Battle of Minds.  

For the purpose of this Privacy Notice and applicable data protection legislation (including but not limited to the UK Data Protection Act 2018 (“UK DPA”) and the EU General Data Protection Regulation, British-American Tobacco (Holdings) Limited whose address is Globe House, 4 Temple Place, London WC2R 2PG (“BAT Holdings”) and the BAT entity listed in Schedule 1 of Terms & Conditions as the entity registered in your country of residence (together "BAT", “us” or "we") are “joint controllers” of the processing of your personal information described in this notice. This means that we work together to decide why and how your personal information is processed.

We might not perform all processing of your personal information as joint controllers, i.e. BAT Holdings is responsible for any personal information that you provide in this site (e.g., registration details, name, email address, background details).

We also may share or transfer your details with or to other companies in the BAT Group.  This is because you may be submitting your entry for an Area or Country level round judged by another BAT Group entity and BAT Holdings has the role of initially receiving, and being responsible for, your personal data until such point it is passed to another BAT Group company. They may serve you with another Privacy Notice similar to this one if required to do so by law.

Although there may be more than one BAT Group entity responsible for your information, all relevant BAT data controller entities will only use your data in accordance with the terms and conditions of this Privacy Notice which governs our processing of data collected in connection with the competition. 

You may exercise your rights under this Privacy Notice in respect of and against each relevant BAT data controller entity that collects and uses your data.

If you need or want to get in touch with us, we have provided general contact details in the "Contact Us" section of this Privacy Notice.

We may amend this Privacy Notice from time to time and will inform you of any significant changes. 

If you are dissatisfied with any aspect of our Privacy Notice, you may have legal rights which we have described below where relevant.

2. Information we collect about you

Depending on the relevant circumstances and applicable local laws and requirements, we collect some or all of the information listed below for the reasons which we describe in this Privacy Notice: 

  • Name;
  • Email address;
  • Country of residence; 
  • Current status: graduate / student
  • Year of graduation
  • Your business case. 

Some of the personal data we collect from you are required to enable us to fulfil our duties to you or to others. For example, to provide you with information regarding your participation in Battle of Minds, we need to collect your name and email address.   

Depending on the type of personal data in question and the grounds on which we may be processing it, should you decline to provide us with such data, we may not be able to fulfil the request. For example, if you do not provide current status, you will not be able to compete in Battle of Minds. 

 

3. How do we collect your Personal data

Personal data you give to us 

The majority of the data we hold about you will be collected directly from you through the registration form on competition.bat-battleofminds.com, as well as your active participation in the competition. However, we may also collect data from you if you contact us proactively, usually by phone, email or social media or if we contact you and ask you to provide us with certain information.

Personal data collected indirectly

We may collect certain information from you indirectly as a result of your use of the Battle of Minds website, including:

Technical information such as the internet protocol (known as IP) address used to connect your computer to the internet, your log-in information, time of access, date of access, time zone setting, web page(s) visited, software crash reports, type and version of browser used, browser plug-in types and versions used, and operating system and platform to ensure the security of your account and to verify that the person operating your account is you;

Your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from the competition website (including date and time), services you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page and any phone number used to call out customer service team; and

Information about your computer or device allowing us to analyse trends, administer the website, track your web navigation, and gather broad demographic information for aggregated use. 

To do this we may use cookies (pieces of data sent by a website to your computer and stored on its hard drive). Please see our Cookie Notice for further details. 

Why do we collect your personal data?

We collect, use and disclose your personal data for the following reasons:

  • to arrange, facilitate and run the Battle of Minds competition.  For further details regarding the format and terms of the competition, please see the competition website, available here: competition.bat-battleofminds.com;
  • to provide you with information about Battle of Minds; 
  • to ensure that we can respond to any queries and contact you if you request us to do so;
  • to help us establish, exercise or defend legal claims;
  • for internal administrative purposes;
  • to maintain the Battle of Minds competition website and to assist with any trouble shooting issues which may occur or be raised.  Please see the Cookie Notice  for information about the processing of personal data in relation to the use of the site;
  • as part of the research that we conduct for statistical purposes; or

For other reasons with your consent. In such cases you will be duly advised so that your consent can be informed and freely given according to each particular situation.

4. Who do we share your information with?

We may share your information with any of the following groups:

  • Any of our BAT entities. Your personal data will be shared with the relevant member of the BAT group in the country in which you tell us you reside.  Should you be successful in progressing through the competition, your personal data may also be transferred inside and outside the UK to be shared with the relevant BAT companies responsible for judging the regional rounds and the global final of the competition (for further information regarding the regional round and global final please see the competition terms and conditions). In this situation, the information is shared on a joint controller basis based on the specific engagement on the processing of your personal data of the respective BAT entities.
  • Tax, audit, or other authorities. We may share your information with tax, audit or other authorities when we believe that the law or other regulation requires us to do so (for example, because of a request by a tax authority or in connection with any anticipated litigation) or in order to help prevent fraud or to enforce or protect the rights and properties of British American Tobacco or its subsidiaries; or protect the personal safety of British American Tobacco employees, third party agents or members of the public.
  • Third party service providers. We may share your information with third party service providers who perform functions on our behalf (including Associates in Advertising Limited` who assist BAT with the production of Battle of Minds). We will only share information with such service providers where we have an appropriate data processing agreement (or similar protections) in place. Our use of cookies on our website entails sharing personal information with Google by the use of Google Analytics and Youtube. You can read more about our use of Cookies here.
  • Professional advisors and Auditors. We may disclose your personal data to professional advisors (such as legal advisors and accountants) or auditors for the purpose of providing professional services to us.
  • If a BAT entity merges with or is acquired by another business or company in the future, we may share your personal data with the new owners of the business or company. In addition, circumstances may arise where, whether for strategic or other business reasons, British American Tobacco decides to sell, buy, merge or otherwise reorganise businesses in some countries. Such a transaction may involve the disclosure of your personal information to prospective or actual purchasers, or the receipt of it from sellers. It is British American Tobacco’s practice to seek appropriate protection for personal information in these types of transactions.

We do not share, rent or trade your information with third parties for marketing or promotional purposes.

 

5. How long do we keep your personal data for?

We will not keep your personal data for any longer than is necessary for the purposes for which we collect it. Your personal data will be deleted following the conclusion of the competition.  We retain and destroy all data (including personal data) in accordance with the terms of our Group Records Management Policy. If you would like more information regarding our data retention policies and practices, please contact us using the contact details set out at the end of this Privacy Notice.

In addition, we may be required by law to retain your data (e.g. in respect of equal opportunity claims). Where we are subject to a regulatory or other legal obligation in a specific jurisdiction which requires us to keep data for a specified period of time, we will comply with those legal/regulatory requirements with respect to the retention of such data.   

 

6. How do we keep your personal data secure?

We care about protecting your information. That is why we put in place appropriate measures that are designed to prevent unauthorised access to, and misuse of, your personal data. 

We are committed to taking all reasonable and appropriate steps to protect the personal data that we hold from misuse, loss, or unauthorised access. We do this by having in place a range of appropriate technical and organisational measures, including encryption measures and disaster recovery plans. 

Unfortunately, there is always risk involved in sending information through any channel over the internet. You send information over the internet entirely at your own risk. Although we take reasonable steps to ensure the security of the competition website and we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted over the internet and we do not warrant the security of any information, including personal data, which you transmit to us over the internet.

 

7. Your rights

You have various rights in relation to the data which we hold about you. We have set these out below. 

Right not to be subject to automated decision making

This right enables you to not be subject to a decision based solely on automated processing including profiling which produces legal effects on you or similarly affects you.  BAT does not use automated decision making technologies as part of the Battle of Minds competition.

Right to object

This right enables you to object to us processing your personal data where we do so for one of the following reasons: 

  • because it is in our legitimate interests to do so (for further information please see below); or,
  • for scientific, historical, research, or statistical purposes.

We will stop such processing unless we can demonstrate compelling legitimate grounds for the processing which overrides your interests or if the processing is necessary for the establishment, exercise or defence of legal claims.  

Right to withdraw consent

Where we have obtained your consent to process your personal data for certain activities, you may withdraw this consent at any time and we will cease to use your data for that purpose unless we consider that there is an alternative legal basis to justify our continued processing of your data for this purpose, in which case we will inform you of this condition. 

Right to access your data

You may ask us for a copy of the information we hold about you at any time, and request us to modify, update or delete such information. We will respond to your request within one month.  That period may be extended by two further months where necessary, taking into account the complexity and number of requests.  We may request proof of identification to verify your request.  If we provide you with access to the information we hold about you, we will not charge you for this unless permitted by law. If you request further copies of this information from us, we may charge you a reasonable administrative cost.  Where we are legally permitted to do so, we may refuse your request. If we refuse your request we will always tell you the reasons for doing so. 

Right to erasure

You have the right to request that we "erase" your personal data in certain circumstances. Normally, this right exists where:

the data are no longer necessary; 

you have withdrawn your consent to us using your data, and there is no other valid reason for us to continue (where the processing is based on consent); 

the data has been processed unlawfully; 

it is necessary for the data to be erased in order for us to comply with our obligations under law; or 

you object to the processing and we are unable to demonstrate overriding legitimate grounds for our continued processing. 

We would only be entitled to refuse to comply with your request for erasure in limited circumstances and we will always tell you our reason for doing so.

Right to restrict processing

You have the right to request that we restrict our processing of your personal data in certain circumstances, for example if you dispute the accuracy of the personal data that we hold about you or you object to our processing of your personal data for our legitimate interests. If we have shared your personal data with third parties, we will notify them about the restricted processing unless this is impossible or involves disproportionate effort. We will, of course, notify you before lifting any restriction on processing your personal data.

Right to rectification

You have the right to request that we rectify any inaccurate or incomplete personal data that we hold about you. If we have shared this personal data with third parties, we will notify them about the rectification unless this is impossible or involves disproportionate effort. You may also request details of the third parties that we have disclosed the inaccurate or incomplete personal data to. Where we think that it is reasonable for us not to comply with your request, we will explain our reasons for this decision.

Right of data portability

If you wish, you have the right to transfer your personal data between service providers. In effect, this means that you are able to transfer the details we hold on you to another third party, without hindrance. To allow you to do so, we will provide you with your data in a commonly used machine-readable format so that you can transfer the data.  Alternatively, we may directly transfer the data for you.

Right to complain

You also have the right to lodge a complaint with a supervisory authority. The supervisory authority for British-American Tobacco (Holdings) Limited ("BAT Holdings") is the Information Commissioner's Office ("ICO") in the UK. Contact details for the ICO are set out below:

Phone: 0303 123 1113

Email: casework@ico.org.uk

Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

The privacy regulators for BAT entities in other EU Member States are listed (along with contact details) on the following website: http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm 

If you would like to exercise any of these rights, or withdraw your consent to the processing of your personal data (where consent is our legal basis for processing your personal data), please contact us using the contact details set out at the end of this Privacy Notice. We will respond to your request within one month.  Please note that we may keep a record of your communications to help us resolve any issues which you raise.

 

8. How do we store and transfer your data internationally?

Your personal data may be transferred outside of the UK to the types of entities described in the section called ‘Who do we share your information with?’ above. In particular, if you are resident in a country outside the UK personal data will be transferred between BAT Holdings and the BAT entity located in your country of residence. 

We want to make sure that your personal data is stored and transferred in a way which is secure. We will therefore only transfer data outside of the UK where it is compliant with data protection legislation and the means of transfer provides adequate safeguards in relation to your data, for example: 

  • By way of an intra-group agreement in place between BAT entities, incorporating the current standard contractual clauses adopted by the European Commission, the UK Information Commissioner’s Office or other competent body for the transfer of personal data by controllers in the EEA to controllers and processors in jurisdictions without adequate data protection laws; or 
  • By way of a data transfer agreement with a third party, incorporating the current standard contractual clauses adopted by the European Commission, the UK Information Commissioner’s Office or other competent body for the transfer of personal data by controllers in the EEA to controllers and processors in jurisdictions without adequate data protection laws; or 
  • By transferring your data to a country where there has been a finding of adequacy by the European Commission in respect of that country's levels of data protection via its legislation; or 
  • Where it is necessary for the conclusion or performance of a contract between ourselves and a third party and the transfer is in your interests for the purposes of that contract; or
  • Where you have consented to the data transfer.

Where we transfer your personal data outside the UK and where the country or territory in question does not maintain adequate data protection standards, we will take all reasonable steps to ensure that your data is treated securely and in accordance with this Privacy Notice.  

9. Legal bases for us processing your data

The UK DPA says that we can only use your data if we have a ‘legal basis’ to do so.  The law also sets out what those legal bases are and that we should explain this to you in this Privacy Notice.

There are a number of different ways that we are lawfully able to process your personal data. We have set these out below.

Where using your data is in our legitimate interests

We are allowed to use your personal data where it is in our legitimate interests to do so, and those interests are not outweighed by any potential prejudice to you. This is what’s known as the ‘legitimate interests’ legal basis.

We believe that our use of your personal data is within the following legitimate interests:

  • to facilitate our organisation and hosting of Battle of Minds;
  • to help us identify and recruit appropriately skilled and experienced talent; 
  • to help us comply with our legal obligations;
  • to help us establish, exercise and defend legal claims; and 
  • for our internal administrative purposes.

We don't think that any of the activities set out in this Privacy Notice will prejudice you in any way. However, you do have the right to object to us processing your personal data on this basis. We have set out details regarding how you can go about doing this in the section ‘Your rights’ above. 

Where using your personal data is necessary for us to carry out our obligations under our contract with you

We are allowed to use your personal data when it is necessary to do so for the performance of our contract with you.

For example, we need to collect your email address to enable you to compete in Battle of Minds.

Where processing is necessary for us to carry out our legal obligations

As well as our obligations to you under any contract, we also have other legal obligations that we need to comply with and we are allowed to use your personal data when we need to in order to comply with those other legal obligations.

Where you give us your consent to use your personal data

We are allowed to use your data where you have specifically consented. In order for your consent to be valid: 

It has to be given freely, without us putting you under any type of pressure;

You have to know what you are consenting to - so we'll make sure we give you enough information;

You should only be asked to consent to one thing at a time - we therefore avoid "bundling" consents together so that you don't know exactly what you're agreeing to; and

You need to take positive and affirmative action in giving us your consent - for example by ticking a box. 

We currently seek your consent so that we can contact you either ask you for additional information related to your submission or notify you about the next steps of Battle of Minds competition. If we require your consent for anything in the future we will provide you with sufficient information so that you can decide whether or not you wish to consent.

You have the right to withdraw your consent at any time. We have set out details regarding how you can go about this in section ‘Right to withdraw consent’ above.

 

10. Contact Us

If you have any comments or suggestions concerning this Privacy Notice, please contact us using the following contact details:

Email: data_privacy@bat.com 

We take privacy seriously and will get back to you as soon as possible. 

Last updated 05 May 2023

Click here for privacy notice for Battle of Minds in Romania