1. INTRODUCTION and IDENTIFYING the CONTROLLER of your personal data 
Star Pubs & Bars Limited and Heineken UK Limited ("we", "us", or "our") are part of the Heineken group. When we mention "we", "us" or "our" in this privacy policy, we are referring to the relevant company responsible for processing your personal data. Unless we inform you otherwise, the controller of your personal data will be Star Pubs & Bars Limited. Where Heineken UK Limited is processing personal data for its own independent purposes (for example in connection with a marketing campaign), that entity will be a separate controller.  
If you have any questions about this privacy policy or our processing activities, we can be contacted as follows:
● Mail: 3 – 4 Broadway Park South Gyle Broadway Edinburgh EH12 9JZ, marked for the attention of the Privacy Officer; or 
● Email: protectingyourdata@heineken.co.uk
If you wish to withdraw your consent to receiving marketing communications from us at any time, please email our dedicated email address: 
●  MTK-unsubscribe@heineken.co.uk
Amongst other things, this privacy policy covers our processing of personal data in connection with your use of our Just Add Talent pub websites. It is important that you read this privacy policy together with our cookie policy and any terms of use that are presented to you. This privacy policy supplements the other policies and is not intended to override them.  

2. SUMMARY and KEY POINTS you should be aware of 
Personal data is any information about an individual from which that person can be identified. We may receive your personal data directly from you, or it may be given to us by third parties where you have given permission for data sharing or if the information is publicly available. 
We use data for various purposes, including to communicate and manage our relationship with you, protect our business, ensure we comply with laws and to run competitions and promotions. Transparency is important to us, so we would particularly like to highlight the following activities we conduct where we have a lawful basis (see section 6 for more details): 

• We may use your data to create a profile of you. We may combine the data that you have provided to us with information from third parties (where you have consented to your data being shared) and publicly available sources in order to better understand your interests. We want to build a profile of you so that we can send relevant communications and market to you more effectively.
• We may use your data to send you online targeted advertisements. Based on our profile of you, we may present you with adverts when you browse online. This involves asking a platform to show our adverts to a particular group of individuals, and may involve using data purchased from third parties to help identify relevant audiences for our adverts. 
• We may use your data to conduct analytics.  For example, we may track how you respond to the emails we send you. We want to see if the email has bounced and, if not, whether you open our emails and/or click on any content; unsubscribe or mark the email as spam; share the information on social media or forward it to friends. This ensures that we can understand what really interests you and improve our approach to marketing so that you do not receive irrelevant or unwanted emails. It also allows us to use our resources efficiently. 
You have various rights regarding our use of your data, see section 10 for more detail.

3. HOW and WHAT data do we collect about you?
This privacy policy describes how we look after your personal data collected directly when you engage with us including (i) when you visit our websites; (ii) take part in a competition; (iii) attend one of our events or an event/festival that we sponsor; and/or (iv) purchase our products or services (“Engagement”). 
We also collect information indirectly: (a) from Wireless Social where you visit a venue in which we sponsor the Wi-Fi services; and (b) from social media platforms (e.g. Facebook, Instagram and LinkedIn) (“Social Media Platforms”), 2nd party vendors (e.g. supermarkets and similar retailers) where you have purchased our products, from database matching partners (see Annex 2 for more details) and from third party data brokers (together “Relevant Third Parties”). Any information we collect indirectly will be from a publicly available source or you will have consented to it being shared.  
We collect different categories of information which we have grouped together as follows:
* Identity Data – name, username, title, place and date of birth and personal characteristics including age and gender;
* Contact Data – email address, delivery address and telephone number;
* Profile Data – preferences, feedback, survey responses and interests including activities noted on Social Media Platforms (for example, your Facebook likes/groups) or collected from other Relevant Third Parties;
* Technical and Usage Data – information about how you use our products and websites including your IP address and details about the devices you use to access our websites. Please review the cookie policy on each website for further information on this;
* Marketing and Communications Data – preferences in receiving marketing and communications from us and information in terms of engagement with email communications;
* Location Data – GPS-based location information from your use of our websites or Social Media Platforms via your smartphone(s), tablet(s) or other devices; 
*Photo and Video Data - photos and/or video footage of you captured when you attend any events hosted or sponsored by us (your attention will be drawn to any photography or filming that is taking place, and your consent will be obtained where required); and
* Inferred Data – which is inferred or derived from the data we collect, for example inferences about your interests based on your Identity Data, Profile Data, Technical and Usage Data or Location Data.

We also collect, use and share Anonymised Data such as statistical or demographic data which is not reasonably likely to reveal your identity (directly or indirectly).  For example, we may receive aggregated usage data detailing the percentage of users accessing a specific website or visiting venues where we supply our products. If we combine or connect Anonymised Data with other data so that it can directly or indirectly identify you, the combined data is ‘personal data’ which will be used in accordance with this privacy policy. 

We do not knowingly:

• Process any Special Categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sexual orientation, political opinions, trade union membership, information about your health or genetics and biometric data). Nor do we process any information about criminal convictions and offences; or
• Collect personal data relating to children. We have age verification processes on our websites to ensure we do not market our products or brands to anyone under the age of 18.

4. How LONG will my personal data be used for?
We will only retain your personal data to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, tax, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider any legal requirements, the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means. Criteria used to determine retention periods for specific data collected are detailed further in Annex 1.

5. WHY do we collect your personal data?
We may collect the above categories of personal data about you for the following purposes (more specifically described in Annex 1):
• To communicate with you;
• To enable you to partake in a promotion and for prize fulfilment purposes;
• To market to you;
• To conduct market research;
• For analytical purposes;
• To maintain and optimise our websites; 
• To protect our business;
• To satisfy our legal and regulatory obligations and co-operate with regulators and government bodies; and
• To defend and exercise our legal rights, including in relation to managing actual and potential claims.

6. What is our LAWFUL BASIS for collecting your personal data?

Under data protection laws, we must have a lawful basis under which we process your personal data. We will only use your personal data for the purposes set out in section 5, unless we reasonably consider that we have another appropriate reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the lawful basis which allows us to do so. 

If you provide us with your consent to processing either in connection with your use of our websites, through a Social Media Platform or a Relevant Third Party, you can withdraw it at any time and we will stop the processing activities that were based on consent as a lawful basis. Please note we may still process the data if we have another lawful basis for processing (in most instances, this will be for a more limited purpose e.g. back-up storage or to record a withdrawal). 

Where we need to collect personal data due to a legal or regulatory obligation, or for performance of a contract and you do not provide that data when requested, we may not be able to continue our Engagement with you or perform the contract we have or are trying to enter into with you (for example, to provide you with products or allow you to participate in competitions). We will notify you of this at the time. 

Further information on the relevant purposes and linked lawful basis are set out in Annex 1.

7. WHO do we SHARE your personal data with?
We may share your personal data with the parties set out below:

a) Internal third parties - other companies in the Heineken group based within the EEA and the UK (but not for any marketing purposes without your consent);

b) External third parties which include:
*communications platform providers (i.e. vendors we use to send and manage email and SMS communications);
*marketing and advertising companies and media agencies for marketing and research purposes, and to provide promotion services, data on-boarding services, research and marketing strategy services; 
* third party providers of Social Media Platforms (including Facebook, Instagram and LinkedIn);  
* prize fulfilment agencies;
* IT and system administration service providers (including data storage providers and data management platform providers);
* service providers such as solicitors and accountants;
* regulators, local authorities and government bodies, including the Police and HMRC, to comply with any legal or regulatory requirements or formal/informal investigations;
*courts, parties to litigation and professional advisers where we reasonably deem it necessary in connection with the establishment, exercise or defence of legal claims; and 
* a purchaser or parties interested in purchasing any part of our business (and professional advisors supporting on the transaction).

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. Where the third parties act as processors on our behalf, we only permit them to process your personal data for specified purposes and in line with our instructions.

8. International transfers
Third parties we share data with may be based outside the UK or the EEA. Whenever we transfer your personal data out of the UK or the EEA, we take steps to ensure that the same level of protection is afforded to it by ensuring one of the following safeguards is put in place:
● We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission and/or the UK Information Commissioner's Office; and
● Where we use certain service providers, we may use specific contracts approved by the European Commission and/or the UK Information Commissioner's Office, which give personal data the same protection it has in Europe (or the United Kingdom). 

9. How SECURE is my data?
We have put in place reasonable security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know - they are subject to a duty of confidentiality. Unfortunately, no transmission of information over the internet can be completely secure, and the security of information depends in part on the security of the computer you use to communicate with us and the security you use to protect account information and passwords. Please take care to protect this information. 
Our websites include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third party websites, plug-ins or applications and are not responsible for their privacy statements. We encourage you to read the privacy policy of every website you visit and third party service/application that you use.

10. What are my RIGHTS?
Under data protection laws, you have various rights which are set out below. The rights available to you depend on our reason for processing your personal data. You are not required to pay any charge for exercising your rights, although we may charge a reasonable fee if your request is unfounded, repetitive or excessive. We have one month to respond to you (unless you have made a number of requests or your request is complex, in which case we may take up to an extra two months to respond). Please note that, where we ask you for proof of identification, the one-month time limit does not begin until we have received this. If we require any clarification and/or further information on the scope of the request, the one-month deadline is paused until we receive that information. 
a) Right of access. You have the right to ask us for copies of your personal data. This right always applies. There are some exemptions, which means you may not always receive all the information we process. You can read more about this right here.
b) Right to rectification. You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies. You can read more about this right here.
c) Right to erasure. You have the right to ask us to erase your personal data in certain circumstances. You can read more about this right here. 
d) Right to restriction of processing. You have the right to ask us to restrict the processing of your information in certain circumstances. You can read more about this right here.
e) Right to object to processing. You have the right to object to processing of your personal data where we are relying on a legitimate interest or conducting direct marketing. You can read more about this right here. 
f) Right to withdraw consent. Where we are relying on consent to process your personal data, you may withdraw it at any time. This will not affect the lawfulness of any processing carried out before you withdraw your consent. 
g) Right to data portability. This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent. You can read more about this right here.

You also have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues: 

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk

We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance using the details at the start of this policy. 
This version was last updated in June 2023. 

Annex 1 – PURPOSES, OUR LAWFUL BASIS, RETENTION PERIODS

Purpose/Activity	Type of data	Lawful basis for processing including basis of legitimate interest	Retention period
To communicate with you which includes:   managing our relationship with you; and     investigating and responding to complaints or enquiries.	Identity Contact Profile Marketing and Communications Technical and Usage	Necessary for our legitimate interest (to conduct and manage our business, to enable us to give you the best service and to protect, promote and grow our business).	3 years after the enquiry or complaint has been resolved.
To enable you to partake in promotions and for prize fulfilment purposes including: Prize with purchase promotions (including giveaways, instant wins and online, mobile, social media and app entries); Loyalty and reward schemes; Activity challenges; Sweepstakes, scratch-card and raffle style promotions (including instant wins and online, mobile, social media and app entries); Sampling and point of sales promotions; and Geo-targeted activities (including gamification and SMS).	Identity Contact	Performance of a contract with you.	6 months following prize fulfilment (in certain cases the retention period may be longer due to the nature of the prize e.g. flight tickets – in such cases the personal data will be deleted when it is no longer required).
To send you online advertisements or marketing which isn’t direct to you but forms part of a wider brand campaign or initiative. Note: information for this purpose may be collected indirectly. See Annex 2 for more information on our marketing and profiling activities.	Identity (limited to age and gender) Marketing and Communications Profile	Necessary for our legitimate interests (to maintain the relevance of our brand and reputation and to grow our business by serving consumers with advertising relating to our brands). Where required by privacy laws, consent.	Data will be processed until an opt-out / objection is received or consent is withdrawn as applicable.
To send you direct electronic marketing (i.e. via SMS, email or direct messaging through Social Media Platforms) relating to our brands which we consider may be of interest to you. Note: information for this purpose may be collected indirectly. See Annex 2 for more information on our marketing and profiling activities.	Identity Contact Profile Marketing and Communications	Consent.	Data will be processed until an objection is received or consent is withdrawn as applicable.
To conduct market research, we may reach out to specific customers and request an insight into developing new products or ways to improve our current products or services – we will use this information to ensure our marketing is relevant.   Note: information for this purpose may be collected indirectly. See Annex 2 for more information on our marketing and profiling activities.	Contact Identity (limited to age and gender) Profile	Necessary for our legitimate interests (to maintain the relevance of our brand and reputation and to grow our business by ensuring we understand the market in which we operate). Contractual necessity, where you are asked to sign up to terms as part of the market research product.	We will retain your data until an opt-out / objection is received.
To conduct data analytics to improve our marketing strategies, customer relationships and experiences and enrich existing profiles using third party data, so that we can issue relevant marketing content and offers and analyse email engagement. This includes: creating individual profiles and profiled audience segments (including custom audiences), so that we can issue tailored marketing content and offers; sending you targeted content based on your location and interests; ‘matching’ data we have collected, such as your e-mail address, with your profile on a Social Media Platform or data collected by Relevant Third Parties so that we can show you marketing content which may be of interest to you (for example, by using Facebook Custom Audiences and database matching); using tracking technologies to understand how you respond to our emails (for example, whether you open the email, click-through links and/or unsubscribe); identifying what subjects are of most interest to you; and assessing the success of our marketing campaigns and communications. Note: information for this purpose may be collected indirectly. See Annex 2 for more information on our marketing and profiling activities.	Identity Profile Marketing and Communications Technical and Usage Inferred Location	Consent.	Data will be processed until an opt-out / objection is received or consent is withdrawn as applicable. The cookie policy on the relevant website you are viewing provides more information on specific cookie retention periods.
To maintain, improve and optimise our websites and to keep them relevant - this includes data analytics and solving performance issues including troubleshooting, testing, system maintenance, support and reporting and hosting of data in order to improve the availability and functionality of the websites.	Identity Contact Profile Technical and Usage	Necessary for our legitimate interests (to maintain the relevance of our brand, products and reputation, run our business, operate administration and IT services, protect network security and to prevent fraud). Necessary to comply with a legal obligation.	We retain information relating to the performance of our websites for 2 years.
To protect our business through compliance with contractual or regulatory obligations, prevention / detection of crime and satisfaction of our legal obligations / defence of our legal rights, including: Securing our website against fraud; Detecting and preventing spam, fraudulent activity, network exploits and abuse on our website(s); Investigation of security/fraud related incidents on our website; and Investigation of fraudulent activity in relation to / breach of any competition terms and conditions/promotion entry requirements.	Identity Contact Technical and Usage	Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise). Necessary to comply with a legal obligation.	The cookie policy on the relevant website provides more information on specific cookie retention periods. Otherwise, your personal data will be retained for 6 years.