Privacy Notice applicable to registration in Coca-Cola central Consumer Interaction Database
LAST REVISED: May 24th 2018
The Coca-Cola Company and its affiliates are concerned about privacy issues and want you to be familiar with how we collect, use and disclose data relating to you as an individual ("Personal Data").
NV Coca-Cola Services SA, with registered office at Chaussée de Mons 1424, 1070 Brussels (referred to as "we", "our" and "us") is the data controller responsible for processing your personal data in the context of this privacy notice (the "Privacy Notice ").
This Privacy Notice describes our practices in connection with information that we collect through activities that link to this Privacy Notice including websites (our “Websites”) and any mobile sites, applications, widgets, and other mobile interactive features (collectively, our “Apps”) (all collectively, Apps and Websites, the “Sites”).
You will have the opportunity to take notice of this Privacy Notice during the registration-process for the Sites and (ii) after the registration, by clicking on a link entitled "Privacy Notice " located at the bottom of each of the Website's page. We thank you to read this Privacy Notice carefully.
As a registered user you may use your credentials to access all Sites linked to Coca-Cola central Consumer Interaction Database.
a. The Personal Data we collect and process about you
We may collect and process the following information about you:
- First name,
- Date of birth
- User name,
- Postal address,
- Telephone number (including home and mobile phone numbers),
- Email address,
- Social media public profile,
- Location Information,
- Hobbies and interests,
- Consumption habits,
- Browser and device information,
- Server log file information,
- Information collected through cookies, pixel tags and other technologies,
- App usage data,
- Activity / Engagement Personal Data (data and time of activity on relevant Sites (logging in, entering a promotion, winning, quiz participation),
- Personal Data related to your interactions with our marketing communications (e.g. if you open them or not, if you click on them or not).
b. We ask that you not send us, and you not disclose, any Sensitive Information on or through the Sites or otherwise to us.
“Sensitive Information” is Personal Data related to sensitive aspects such as:
- racial or ethnic origin,
- political opinions,
- religion or other beliefs,
- health or medical condition,
- criminal background,
- trade union membership,
- sexual orientation.
We collect your Personal Data as follows:
- Through the Sites: We may collect Personal Data through the Sites, e.g., when you create an account in connection with our central Consumer Interaction Database.
- Offline: We may collect Personal Data from you offline, such as when you contact customer service.
Subject to applicable data privacy law, the Personal Data you provide through the Sites may be combined with Personal Data and other Information that you provide to us (via online or offline means), or that we may otherwise obtain online or offline.
We may use Personal Data for the following purposes:
a. Respond to your requests / Administrative interactions
- To respond to your inquiries, questions and comments and fulfil your requests.
Legal basis for processing: our legitimate interests to answer your queries.
- To send administrative information to you, for example, information regarding the Sites and changes to our terms, conditions, and policies.
Legal basis for processing: our legitimate interests to inform you on the evolution of our Sites.
b. Marketing communications:
- To send you or have our commercial partners (individually a "Commercial Partner" and collectively "Commercial Partners") send you direct marketing communications by email and push notifications. Direct marketing communications inform you about promotions or other similar activity, about Coca-Cola and affiliated brands' products and services (or those of our Commercial Partners), and ask you to complete questionnaires and surveys, among others.
Direct marketing communications sent by our Commercial Partners may either be:
- Fully handled and managed by our Commercial Partners. In such circumstances, the relevant Commercial Partner in charge of each direct marketing communication will act as data controller for the processing of your Personal Data. This processing will be subject to a data privacy notice, distinct from this Privacy Notice, established by such Commercial Partner;
- Handled and managed jointly by us and our Commercial Partners. In such circumstances, we and the relevant Commercial Partner will act as joint controllers for the processing of your Personal Data. We will enter into appropriate joint-controllership agreement with relevant Commercial Partner and the essence of this agreement will be made available to you.
Legal basis for processing: your consent.
You have the opportunity to accept or refuse to receive marketing communications, by using the privacy dashboard accessible on the Website, id.coke.com (you just have to click on the relevant tick-box if you want to receive marketing communications, and "de-click" the tick-box if not).
You can withdraw your consent to receive direct marketing communications, by clicking on the link "Unsubscribe" at the bottom of every marketing email, or by "de-clicking" the relevant tick-box of the privacy dashboard. You can also let us know that you wish to withdraw your consent by calling us or writing to us using the contact information listed in section 8 of this Privacy Notice.
c. Personalization of marketing communications:
- We may tailor our marketing communications to you (including personalization of ads displayed on third-party websites) based on (i) your profile information, (ii) how you interact with our Website (e.g. logging in, entering a promotion, winning, quiz participation) and / or (iii) your interactions with our marketing communications (e.g. if you open them or not, if you click on them or not).
Legal basis for processing: your consent.
You have the opportunity to accept or refuse personalization of marketing communications by providing you with a privacy dashboard accessible on the Website, id.coke.com, from which you can set your privacy preferences.
You can withdraw your consent to have your marketing communications personalized by acceding to the privacy dashboard accessible on the Website, id.coke.com, and "de-clicking" the relevant tick-box. You can also let us know that you wish to withdraw your consent by calling us or writing to us using the contact information listed in section 8 of this Privacy Notice.
d. IT administration
We use your Personal Data to diagnose server problems, administer the Sites and check that they function properly.
Legal basis for processing: our legitimate interests to administer our IT systems and networks.
e. Protection of our interests
- As we believe to be necessary or appropriate: (a) to comply with our legal obligations; (b) to respond to requests from public and government authorities which may include public and government authorities outside your country of residence; (c) to enforce our terms and conditions; (d) to protect our operations or those of any of our affiliates; (e) to protect our rights, privacy, safety or property, and/or that of our affiliates, you or others; and (g) to allow us to pursue available remedies or limit the damages that we may sustain.
Legal basis for processing: compliance with legal obligations and our legitimate interests to protect our organization.
f. Corporate / M&A operations
- To perform any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings).
Legal basis for processing: our legitimate interests to conduct our corporate strategy.
Your Personal Data may be disclosed to the following recipients:
- Coca-Cola Nordic Services ApS which helps us in the management of our Sites and in respect of our communications to you.
- Coca-Cola European Partners Ísland ehf. for support in communications
- MRM McCann, for support in communications.
- Salesforce.com, for (i) the hosting of the Customer Relationship Management system and (ii) personalization of ads displayed on third-party websites
- Janrain, for the hosting of the record system regarding consumer profile Personal Data.
- Epam, which interacts with Janrain.
- Amazon, which hosts the Sites.
- Beckon, which operates a marketing dashboard and reporting solution.
- Google, for cloud storage, big query databases and personalization of ads displayed on third-party websites.
- Our third party service providers who provide services such as support in communications, auditing and consulting.
- Our Commercial Partners with whom we may enter into a special relationship, for the conduct of their own marketing communications. Because these third parties will use your Personal Data in accordance with their own privacy practices, you should check their websites for information regarding their privacy practices.
- A third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings).
- As we believe to be necessary or appropriate relevant authorities, affiliates and third parties: (a) to comply with our legal obligations; (b) to respond to requests from public and government authorities which may include public and government authorities outside your country of residence; (c) to enforce our terms and conditions; (d) to protect our operations or those of any of our affiliates; (e) to protect our rights, privacy, safety or property, and/or that of our affiliates, you or others; and (f) to allow us to pursue available remedies or limit the damages that we may sustain.
This Privacy Notice does not address, and we are not responsible for, the privacy, information or other practices of any third parties, including any third party operating any site to which these Sites contain a link. The inclusion of a link on the Sites does not imply endorsement of the linked site by us or by our affiliates.
Please note that our online and email advertising-related vendors may use pixel tags, web beacons, clear GIFs or other similar technologies in connection with the Sites to help manage our online and email advertising campaigns and strengthen the effectiveness of such campaigns. For example, if a vendor has placed a unique cookie on your computer, the vendor may use pixel tags, web beacons, clear GIFs or other similar technologies to recognize the cookie during your visit to the Sites and to learn which of our online advertisements may have brought you to our Sites, and the vendor may provide us with such Other Information for our use. Please note we may link such Other Information provided to us by our vendors to Personal Data about you that we have previously collected.
8. What are your rights in/with regards to the processing of your Personal Data, how can you exercise them and how can you contact us?
a. Your rights in/with regards to the processing of your Personal Data
You have the right:
- to be provided with a copy of any Personal Data that we hold about you;
- to request us to update or correct any inaccurate personal data, or complete any incomplete Personal Data;
- to request that we stop processing your Personal data for direct marketing purposes.
You also have the right, in certain circumstances:
- to object to the processing of your Personal Data;
- to request us to delete your Personal Data;
- to restrict our processing of your personal data; and
- to request us to transmit certain of your Personal Data to you or to transfer or have them transferred to another data controller.
b. The exercise of your rights
If you wish to exercise any of your above rights, you can contact us using one of the options below.
- You can call us on: 525 2500
- You can write to the following postal address:
CCEP Ísland ehf.
c. Right to lodge a complaint to the competent data protection authority
You have a right to lodge a complaint with the relevant supervisory authority (in particular in the European Union Member State of your habitual residence or place of the alleged infringement).
a. We intend to keep your Personal Data accurate and up-to-date. We will delete the Personal Data that we hold about you when we no longer need it.
b. Subject to paragraph c. below,we keep your Personal Data that we use for the purposes described in this Privacy Notice for a period of 2 years maximum, except where legal requirements imposing that we keep your Personal Data longer or less longer apply.
c. Accounts in connection with our central Consumer Interaction Database that are not used during 1 month as from their creation (i.e. no consent given by you and no participation to promotions) will be deleted within 2 months as from their creation. We will retain your Personal Data as long as you are a registered user or our Sites, without prejudice to applicable mandatory retention obligations and limitation periods.
The Sites are directed to individuals who are 13 years and above with parents’ consent until 16 years old. We request that other individuals under 13 do not provide Personal Data through the Sites. We reserve the right to request evidence of parental consent at any time to permit the processing of Personal Data relating to minors.
For some Sites or App there may be age restrictions, based on what is appropriate viewing for certain ages or what is legally permitted by law. Where specific age restrictions apply, it will be clearly marked on the relevant Site and we may ask questions to verify your age before proceeding.
To achieve the purposes described in this Privacy Notice, we transfer your personal data to countries that do not ensure an adequate level of protection, such as The United States of Americea In that case, our data transfers are subject to the following appropriate safeguards in accordance with the GDPR, to guarantee that your Personal Data are adequately protected:
- Standard data protection clauses adopted by the EU Commission under article 46 paragraph 2 of the GDPR (click here to access the EU Commission's decision on standard contractual clauses for transfers to processors established in Third countries); and
- EU-U.S. Privacy Shield for transfers to entities located in the United States (click here to access to the EU Commission's decision pertaining to the EU-U.S. Privacy Shield).
To obtain any relevant information regarding any transfers of your Personal Data to Third countries (including the relevant transfer mechanisms), please contact us at this address firstname.lastname@example.org
a. You can find out when this Privacy Notice was last amended by checking "LAST REVISED" at the top of this age.
b. All considered changes to this Privacy Notice will be communicated to you well in advance of the changes actually taking effect.
You may print, download or otherwise retain a copy of this Privacy Notice (and of any revised version) for your records.
Copyright 2018 The Coca-Cola Company. All rights reserved.