7/4/2019

Notice

For site terms of use please click here and for cookie policy please click here

To read this privacy notice in another language, please click on the relevant language below:

Bulgarian/български Italian/italiano
Croatian/hrvatski Polish/polsku
French/français Romanian/romaneste
German/Deutsch Slovenian/slovenščino
Hungarian/magyarul Spanish/español

Recruitment Privacy Notice

At BAT we are committed to protecting the privacy of our candidates and users of this eRecruitment Site
("Site"). We want to provide a safe and secure user experience. We will ensure that the information you
submit to us via this Site is only used for the purposes set out in this Privacy Notice. We are committed to
acting responsibly and with integrity with regard to protecting your privacy rights and freedoms.

Please read this document carefully as it sets out our 'Privacy Notice' which informs you what we do with
your personal data and applies to all individuals who are registering as a user on the Site.

For the purpose of this Privacy Notice and applicable data protection legislation (including but not limited to
the General Data Protection Regulation (Regulation (EU) 2016/679) (the "GDPR"), the data controller and
the company responsible for your personal data that you provide initially is British-American Tobacco
(Holdings) Limited whose address is Globe House, 4 Temple Place, London WC2R 2PG. When you apply
for a specific job then your personal data will be transferred to the legal entity stated in the specification for
that job which shall then be a 'second' data controller of your personal data provided prior to that application,
and the sole data controller for all other personal data provided subsequently in connection with that
application. In this Privacy Notice we refer to each data controller as ("BAT", "us" or "we"). Details for each
of the BAT legal entities are available on the Site here.

We may amend this Privacy Notice from time to time. Please visit this page if you want to stay up-to-date as
we will post any changes here.

If you are dissatisfied with any aspect of our Privacy Notice, you may have legal rights which we have
described below where relevant.

Information we collect about you

BAT will collect, use and/or process your personal data in order to provide you with information about job
opportunities relevant to you (if you have subscribed to such communications on registration) and
recruitment processes within BAT. We also may share your personal data with other members of the BAT
group of companies worldwide for recruitment purposes.

Depending on the relevant circumstances and applicable local laws and requirements, we collect some or all
of the information listed below for the reasons which we describe in this Privacy Notice:

· Name;

· Contact details;

· Country of residence;

· Background i.e. education history, employment history, vocation/profession; and

1/9
7/4/2019

· Extra information that you choose to tell us.

The above list details some of the personal details that may we collect from you.

· Some of the personal data we collect from you are required to enable us to fulfil our duties to you or to
others. For example, to provide you with information about job opportunities and the recruitment process
within BAT, we need to collect your email address, name and country to be able to process your
request. Other items may simply be needed to ensure that our relationship can run smoothly, such as when
we contact you to organise a step in the recruitment process.

· Depending on the type of personal data in question and the grounds on which we may be processing it,
should you decline to provide us with such data, we may not be able to fulfil the request. For example, if you
do not provide contact details we cannot communicate progress on a recruitment process applicable to you.

· In order to process your personal data, we need a lawful reason to do so. For details of the legal bases
that we rely on to be able to use and process your personal data, please see the below section entitled "Legal
bases for us processing your data".

How do we collect your Personal data?

1. Personal data that you give to us;

2. Personal data that we receive from other sources; and

3. Personal data we collect automatically.

Personal data you give to us:

There are numerous ways that you can share your information with us. These include:

• Where you register with on this recruitment website (for example when you sign up to be a registered
user);

• Where you contact us proactively, usually by phone, email or via social media; and/or

• Where we contact you, either by phone or email you may provide us with information during such
communication.

Personal data we receive from other sources

We may seek more information about you from other sources generally including from third parties. For
example, we may receive information on you from those organizations that you have asked us to use for
professional or academic references such as a previous employer or a college or university.

In addition, if you choose to apply or submit information using Facebook or similar social media sites, we
import the requested information from your social media account and we make it part of your profile. This
Privacy Notice pertains to this Site only. For details on how your personal data is handled and processed by
the social media Site that you have used to submit your information, please consult the Privacy Notice on
that social media site.

2/9
7/4/2019

Personal data we collect automatically

When you visit the Site, we collect technical information, including the Internet protocol (IP) address used to
connect your computer to the Internet, browser type and version, time zone setting, browser plug-in types
and versions, operating system and platform. We use the information for statistical reporting and do not link
it to any named individuals.

BAT will not intentionally collect any information about registered users to this Site who are under eighteen
years of age. If BAT becomes aware that a child has provided any information this will immediately be
deleted from BAT's records.

Why do we collect your personal data?

We collect, use and disclose your personal data for a number of reasons, including:

· to ensure that we can respond to any queries and contact you if you request us to do so

· for storing your details (and updating them when necessary) on our database and to enable you to
submit your CV for general applications

· to allow you to apply for specific jobs or to subscribe to our job alerts

· so that we can contact you in relation to job opportunities or respond to any query you have asked us to
answer

· to assess your qualifications for a particular job or task

· to verify information we have received, using third party resources (such as psychometric evaluations
or skills tests), or through information requests (such as references, qualifications and potentially any
criminal convictions, to the extent that this is appropriate and in accordance with local laws)

· as part of the research that we conduct for statistical purposes

· to administer our website for internal operations, including troubleshooting, data analysis, testing,
research, statistical and survey purposes

· to ensure the effective operation of software and IT services procured by us (including disaster
recovery)

· for other reasons with your consent.

Who do we share your information with?

We will share your personal data primarily to ensure we provide you with the most relevant and up to date
news, content and events, or to ensure we can respond to any query quickly and expeditiously. Unless you
specify otherwise, we may share your information with any of the following groups:

o Any of our BAT entities. As identified in this Privacy Notice, your personal data will be shared with the
BAT entity responsible for the job that you are applying for. You may apply for several different jobs.
Depending on the location of the job that you choose to apply for your personal data could be transferred
inside and outside the European Economic Area for such purposes as enable them to continue any local
recruitment services to you worldwide.

o Tax, audit, or other authorities, when we believe that the law or other regulation requires us to share this
data (for example, because of a request by a tax authority or in connection with any anticipated litigation) or
in order to help prevent fraud or to enforce or protect the rights and properties of British American Tobacco
or its subsidiaries; or protect the personal safety of British American Tobacco employees, third party agents
or members of the public.
3/9
7/4/2019

o Third party service providers who perform functions on our behalf (including local recruitment agents,
email communications service providers and professional advisers such as lawyers, auditors and accountants,
technical support functions and IT consultants carrying out testing and development work on our business
technology systems), third party outsourced IT providers where we have an appropriate data processing
agreements (or similar protections) in place;

o If a BAT entity merges with or is acquired by another business or company in the future, we may share
your personal data with the new owners of the business or company (and provide you with notice of this
disclosure); and

Circumstances may arise where, whether for strategic or other business reasons, British American
Tobacco decides to sell, buy, merge or otherwise reorganise businesses in some countries. Such a
transaction may involve the disclosure of your personal information to prospective or actual
purchasers, or the receipt of it from sellers. It is British American Tobacco's practice to seek
appropriate protection for personal information in these types of transactions.

We do not share, rent or trade your information with third parties for marketing or promotional purposes.

How long do we keep your personal data for?

We will not keep your personal data for any longer than is necessary for the purposes for which we collect it.
If you are not successful for a job application we may retain your details and CV so that your information is
available already in your profile. You are able to delete your profile and registration at any time.

In addition, we may be required by law to retain your data e.g. in respect of equal opportunity claims. Where
we are subject to a regulatory or other legal obligation in a specific jurisdiction which requires us to keep
data for a specified period of time, we will comply with those regulatory requirements with respect to the
retention of such data.

How do we keep your personal data secure?

We care about protecting your information. That is why we put in place appropriate measures that are
designed to prevent unauthorised access to, and misuse of, your personal data.

We are committed to taking all reasonable and appropriate steps to protect the personal data that we hold
from misuse, loss, or unauthorised access. We do this by having in place a range of appropriate technical and
organisational measures, including encryption measures and disaster recovery plans.

Unfortunately, there is always risk involved in sending information through any channel over the internet.
You send information over the internet entirely at your own risk. Although we will do our best to protect
your personal data, we cannot guarantee the security of your data transmitted over the internet and we do not
warrant the security of any information, including personal data, which you transmit to us over the internet.

If you suspect any misuse or loss of or unauthorised access to your personal information please let us know
immediately. Please raise your concern by contacting us (using the details below) or by using the Contact us
section of this website, in the first instance, and we will investigate the matter and update you as soon as
possible on next steps.

Your rights

You have various rights in relation to the data which we hold about you. We have set these out below.

4/9
7/4/2019

Right not to be subject to automated decision making

This right enables you to not be subject to a decision based solely on automated processing including
profiling which produces legal effects on you or similarly affects you. If you are asked as part of the
application process to complete certain tests the results of these tests will be recorded and we may use
automated decision-making processes however BAT does not make recruiting or hiring decisions based
solely on automated decision-making.

Right to object

This right enables you to object to us processing your personal data where we do so for one of the following
reasons:

· because it is in our legitimate interests to do so (for further information please see the section below
"Legal bases for us processing your data"); or

· for scientific, historical, research, or statistical purposes.

We will stop such processing unless we can demonstrate compelling legitimate grounds for the processing
which overrides your interests or if the processing is necessary for the establishment, exercise or defence of
legal claims.

Right to withdraw consent

Where we have obtained your consent to process your personal data for certain activities, you may withdraw
this consent at any time and we will cease to use your data for that purpose unless we consider that there is
an alternative legal basis to justify our continued processing of your data for this purpose, in which case we
will inform you of this condition.

Data Subject Access Requests

You may ask us for a copy of the information we hold about you at any time, and request us to modify,
update or delete such information. We will respond to your request within one month. That period may be
extended by two further months where necessary, taking into account the complexity and number of
requests. We may request proof of identification to verify your request. If we provide you with access to the
information we hold about you, we will not charge you for this unless permitted by law. If you request
further copies of this information from us, we may charge you a reasonable administrative cost. Where we
are legally permitted to do so, we may refuse your request. If we refuse your request we will always tell you
the reasons for doing so.

Right to erasure

You have the right to request that we "erase" your personal data in certain circumstances. Normally, this right
exists where:

· The data are no longer necessary;

· You have withdrawn your consent to us using your data, and there is no other valid reason for us to
continue (where the processing is based on consent);

· The data has been processed unlawfully;

· It is necessary for the data to be erased in order for us to comply with our obligations under law; or

· You object to the processing and we are unable to demonstrate overriding legitimate grounds for our
continued processing.

We would only be entitled to refuse to comply with your request for erasure in limited circumstances and we
will always tell you our reason for doing so.

5/9
7/4/2019

Right to restrict processing

You have the right to request that we restrict our processing of your personal data in certain circumstances,
for example if you dispute the accuracy of the personal data that we hold about you or you object to our
processing of your personal data for our legitimate interests. If we have shared your personal data with third
parties, we will notify them about the restricted processing unless this is impossible or involves
disproportionate effort. We will, of course, notify you before lifting any restriction on processing your
personal data.

Right to rectification

You have the right to request that we rectify any inaccurate or incomplete personal data that we hold about
you. If we have shared this personal data with third parties, we will notify them about the rectification unless
this is impossible or involves disproportionate effort. You may also request details of the third parties that we
have disclosed the inaccurate or incomplete personal data to. Where we think that it is reasonable for us not
to comply with your request, we will explain our reasons for this decision.

Right of data portability

If you wish, you have the right to transfer your personal data between service providers. In effect, this means
that you are able to transfer the details we hold on you to another third party, without hindrance. To allow
you to do so, we will provide you with your data in a commonly used machine-readable format so that you
can transfer the data. Alternatively, we may directly transfer the data for you.

Right to complain

You also have the right to lodge a complaint with a local supervisory authority, in particular in the Member
State of your residence, place of work or place of an alleged infringement if you consider that the processing
of your personal data infringes the GDPR. In the EU, the privacy regulators for each Member State are listed
(along with contact details) on the following website: http://ec.europa.eu/justice/article-29/structure/data-
protection-authorities/index_en.htm

If you would like to exercise any of these rights, or withdraw your consent to the processing of your personal
data (where consent is our legal basis for processing your personal data), please contact us using the Contact
Us form on the website. We will respond to your request within one month. Please note that we may keep a
record of your communications to help us resolve any issues which you raise.

How do we store and transfer your data internationally?

Your personal data may be transferred outside of the European Economic Area or EEA (i.e. the Member
States of the European Union, together with Norway, Iceland and Liechtenstein) to the types of entities
described in the section called 'Who do we share your information with?' above and any BAT Entities

We want to make sure that your personal data is stored and transferred in a way which is secure. We will
therefore only transfer data outside of the EEA where it is compliant with data protection legislation and the
means of transfer provides adequate safeguards in relation to your data, for example:

· By way of an intra-group agreement between BAT entities, incorporating the current standard
contractual clauses adopted by the European Commission for the transfer of personal data by controllers in
the EEA to controllers and processors in jurisdictions without adequate data protection laws;

· By way of a data transfer agreement with a third party, incorporating the current standard contractual
clauses adopted by the European Commission for the transfer of personal data by controllers in the EEA to
controllers and processors in jurisdictions without adequate data protection laws; or

· By transferring your data to an entity which has signed up to the EU-U.S. Privacy Shield Framework
for the transfer of personal data from entities in the EU to entities in the United States of America or any
equivalent agreement in respect of other jurisdictions; or

6/9
7/4/2019

· By transferring your data to a country where there has been a finding of adequacy by the European
Commission in respect of that country's levels of data protection via its legislation; or

· Where it is necessary for the conclusion or performance of a contract between ourselves and a third
party and the transfer is in your interests for the purposes of that contract (for example, if we need to transfer
your data to a benefits provider based outside the EEA); or

· Where you have consented to the data transfer.

Where we transfer your personal data outside the EEA and where the country or territory in question does
not maintain adequate data protection standards, we will take all reasonable steps to ensure that your data is
treated securely and in accordance with this Privacy Notice. Please contact us if you wish to obtain
information concerning such safeguards (Contact Us below).

Legal bases for us processing your data

There are a number of different ways that we are lawfully able to process your personal data. We have set
these out below.

Where using your data is in our legitimate interests

We are allowed to use your personal data where it is in our interests to do so, and those interests are not
outweighed by any potential prejudice to you.

We believe that our use of your personal data is within a number of our legitimate interests, including but not
limited to:

· To identify and recruit appropriately skilled and experienced talent;

· To ensure that we administer an efficient recruitment process to attract appropriate talent to our
organisation;

· To provide an easy and simple way for applicants to apply for jobs at BAT;

· To help us understand visitors to the Site better and provide more relevant information and services to
them;

· To ensure that the Site runs smoothly; and

· To help us keep our systems secure and prevent unauthorized access or cyber-attacks.

We don't think that any of the activities set out in this Privacy Notice will prejudice you in any way.
However, you do have the right to object to us processing your personal data on this basis. We have set out
details regarding how you can go about doing this in the section 'Your rights' above.

Where you give us your consent to use your personal data

We are allowed to use your data where you have specifically consented. In order for your consent to be valid:

· It has to be given freely, without us putting you under any type of pressure;

· You have to know what you are consenting to - so we'll make sure we give you enough information;

· You should only be asked to consent to one thing at a time - we therefore avoid "bundling" consents
together so that you don't know exactly what you're agreeing to; and

7/9
7/4/2019

· You need to take positive and affirmative action in giving us your consent - we're likely to provide a
tick box for you to check so that this requirement is met in a clear and unambiguous fashion.

When you register on our website, we may ask you for specific consents to allow us to use your data in
certain ways. If we require your consent for anything else in the future we will provide you with sufficient
information so that you can decide whether or not you wish to consent.

You have the right to withdraw your consent at any time. We have set out details regarding how you can go
about this in section 'Right to withdraw consent' above.

Where using your personal data is necessary for us to carry out our obligations under our contract
with you

We are allowed to use your personal data when it is necessary to do so for the performance of our contract
with you.

For example, we need to collect your email address in order to be able to provide you with any email alerts
that you have requested.

Where processing is necessary for us to carry out our legal obligations

As well as our obligations to you under any contract, we also have other legal obligations that we need to
comply with and we are allowed to use your personal data when we need to in order to comply with those
other legal obligations.

Contact Us

If you have any comments or suggestions concerning this Privacy Notice please contact us using the contact
details stated in the job specification relating to the vacancy for which you have applied, as identified in any
Specific Country Notice Terms below or at [email protected]. We take privacy seriously and will
get back to you promptly.

Specific Country Notice Terms

In the event that you have applied for a job in any of the countries listed below then the following addition
Privacy Notice provisions shall apply.

Australia

For the purposes of this Privacy Notice, 'personal data' means any information or an opinion about an
identified individual, or an individual who is reasonably identifiable, whether or not the information or
opinion is true, and whether or not the information or opinion is recorded in a material form.

Nothing in this Privacy Notice restricts, excludes or modifies or purports to restrict, exclude or modify any
statutory rights under any applicable law including the Competition and Consumer Act 2010 (Cth).

Korea, Malaysia, Singapore

Terms used in this Privacy Notice shall have the meanings assigned to them by the Personal Data Protection
Act 2010 (also known as the PDPA).

Germany and Austria

8/9
7/4/2019

If you wish to exercise your rights under "Your rights" or if you have any questions about data protection at
BAT or about this privacy notice, you can also contact our data protection officer directly by e-mail to
[email protected] or by telephone under +49(0)40 4151 2790.

Hungary

Terms used in this Privacy Notice shall have the meanings assigned to them by the Act CXII of 2011 on the
right to information self-determination and freedom of information.

9/9