These terms set out how we may use the personal data you provide or which we collect about you when you use www.jtiadvance.co.uk.

1. Information about Gallaher

   This website is owned and operated by, or on behalf of, Gallaher Limited (registered number 01501573), a company incorporated in England and Wales whose registered office is at 1 Werter Road, Putney, London, SW15 2LL, UK and whose VAT registration number is 689398450 ("Gallaher", "we", "us" or "our"). Gallaher Limited is the registered trading company for JTI in the UK.

   We comply with the General Data Protection Legislation ("GDPR") and any applicable data protection legislation in force from time to time ("Data Protection Legislation") and for the purposes of the Data Protection Legislation, where relevant, we are the data controller.

   This policy may vary from time to time so please check back regularly.

2. The personal data we collect

   We may collect the following personal data about you:

   • personal data you provide when you complete the verification process to access the website (including your name, email address, contact number and store address);
   • personal data you provide if you contact us via our website;
   • personal data you provide if you contact us (including by telephone) to request details of products or any other information;
   • personal data gathered using cookies;
   • details of your visits to our website including but not limited to traffic data, location data, weblogs and other communication data;
   • information about your computer including where available your IP address, operating system and browser type and for system administration. This is statistical data and does not identify any individual.

   It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

3. How we use personal data collected and how long we hold your data for

   We will only use your information where the law allows us to. Most commonly, we will use your information in the following circumstances:

   • Where we need to perform the contract we are about to enter into, or have entered into, with you
   • Where we need to comply with a legal or regulatory obligation
   • Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
   • Where we require your consent to process your data.

   These are known as "lawful grounds". Note that we may process your information for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us at ukcustomer.careline@jti.com or by calling 0800 163503* if you need details about the specific legal ground we are relying on to process your personal data.

   Specifically, we may use and process the personal data you provide for the purposes outlined below:

   • to determine whether or not to grant you access to the website;
   • to implement and manage security controls and to prevent and detect fraud.
   • to send you information you have requested;
   • to deal with your enquiries;
   • to contact you by email with information that you have requested;
   • to develop, deliver and improve our products or services;
   • to help us develop this website to be more useful to you;
   • for website user processing research or analysis including to collect statistics, responses to any surveys and questionnaires, traffic patterns and related site information. (We aggregate this data and it does not identify any website users); and/or
   • for internal purposes for research, analysis, testing, monitoring, risk management and administrative purposes;
   • to send email communications including but not restricted to offers, information and competitions if you have opted into this communication via the website.

   We will only keep your information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

   To decide the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your information, the purposes for which we process your information, and whether we can achieve those purposes through other means, and the applicable legal requirements.

4. Disclosure of your personal data

   We shall only disclose the personal data to our selected third party business partners where necessary. These third parties include, digital agencies, card providers, call centre support agencies, logistics agencies.

   We may share your personal information with any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries, as defined in section 1159 of the UK Companies Act 2006.

   We may disclose your personal data to third parties in the following circumstances:

   • to undertake the activities listed above;
   • to conform to legal requirements or comply with legal process;
   • to assist in the investigation of suspected illegal or wrongful activity. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction;
   • to protect and defend our rights or property; and/or
   • to deal with any misuse of the website
   • in the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets.
   • if JTI or substantially all of its assets are acquired by a third party, in which case personal data held by it about its customers will be one of the transferred assets.
   • To implement and manage security controls and to prevent and detect fraud (e.g. access controls)).

5. Your rights

   Under certain circumstances, you have rights under data protection laws in relation to your information, as follow:

   • Request access to your personal data (known as a "data subject access request")
   • Request correction of your personal data where there is incomplete or inaccurate information.
   • Request erasure of your information where there is no good reason for us to be processing your information, or where you have successfully exercise your right to object to processing of information.
   • Object to processing of your information where we are relying on legitimate interest (or those of a third party) and you believe this impacts on your fundamental rights and freedoms. (Note, we may have compelling legitimate grounds to process information which override your rights and freedoms).
   • Request restriction of processing your information in the following circumstances: (a) if you want us to establish the accuracy of your information; (b) where our use of the information is unlawful but you do not want us to erase it; (c) where you need us to hold the information even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your information but we need to verify whether we have overriding legitimate grounds to use it.
   • Request transfer of your information to you or a third party.
   • Right to withdraw consent where we are relying on consent to process your data.

   You have the right to ask us not to process your personal data for marketing purposes. If you do not wish to receive marketing materials from us any longer, please either: i) update your contact preferences on your account; ii) opt out of future email communications at any time by clicking on the opt out link contained within the footer of emails that are sent out to you; or iii) by contacting us on the below contact details.

   You can exercise any of these rights by contacting us at ukcustomer.careline@jti.com or by 0800 163503*.

6. Transferring personal data overseas

   The data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA"). It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff maybe engaged in, among other things, the fulfilment of your order, the processing of your payment details and the provision of support services. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this policy.

7. Links to other websites & news feeds

   Our site may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this Privacy Policy. You should exercise caution and read the Privacy Policy applicable to the website in question before proceeding to use that website.

8. Data Security

   Once we have received your information, we will use appropriate procedures and security features to try to prevent unauthorised access, and to prevent your information being accidentally lost. We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your information on our instructions and they are subject to a duty of confidentiality.

   Unfortunately, the transmission of information via the Internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site. We have put in place procedures to deal with any suspected data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

9. How users can contact us

   If you have any questions and comments about this privacy policy or this website, we would be happy to hear from you. Please contact us.

*calls to this number may be recorded