Privacy Policy (October 2021)

Our Commitment to Protect Your Privacy


Swire Coca-Cola (“SCC”, “we”, “our” or “us”) highly values your personal data and privacy and is committed to preserving the confidentiality and security of all personal information. When you use our services, you entrust us with your personal information. This Privacy Policy sets out the standards and expectations on SCC’s commitment to safeguarding your personal data in terms of what information we gather about you, how we use and process that information and who we give that information to. It also defines your rights in relation to your personal data and who you can contact for more information or queries.

To ensure that you feel comfortable and confident about providing your personal data for us, please read this Privacy Policy carefully to understand how and why we collect and process your personal data.

We will notify you when there are any changes to our Privacy Policy, including by posting the revised policy on our website. The changes will be effective from the date of posting.

1. What this Privacy Policy covers and Who it applies to


We recognise the indispensability of your personal data and are committed to protecting your privacy and handling your personal information in an open, transparent and secure manner.

This Privacy Policy outlines how we will collect, handle, use, store, share and protect your personal data when you:
  1. Making a purchase for our products and services;
  2. Engaging with us in relation to employment or experience opportunities at SCC, including when you apply for a role with SCC or participate in any assessment programme relating to such a role;
  3. Visiting and/or using our website; or
  4. Participating in our promotion events, activities, or register as our loyalty program member.
This Privacy Policy applies to any personal information collected on or through SCC websites and mobile apps. Under specific circumstances, we will provide a separated privacy notices, with detailed rationales and purposes that this Privacy Policy does not cover.

2. What Personal Data we collect


There are 3 broad categories of personal data held by us. They comprise of personal data contained in the following:

A. Consumer Data including, but not limited to:-
  1. Personal Information: full name, contact number, email address, delivery address;
  2. Feedback after purchasing our products and services;
  3. Personal interests and preferences.
B. Employee records
  1. Your personal information including but not limited to full name, National ID / Passport Number, home address, date-of-birth, nationality, sexuality, phone number, and email address;
  2. Other relevant data including but not limited to financial background, educational background, personal data of spouse and family members, and professional qualification.
C. Customer/Business Partner Data
  1. Your personal information, which is limited to the primary contact person as the communication channel for business interactions or activities, or for the customer to register an account on our customer portal, including but not limited to full name, contact number, email address, and delivery address.
  2. Information collected from you about others in situations where you decide to invite a third party to conduct business with SCC. We will collect your and third party’s names, phone number and email addresses in order to make contact and follow up with the third party.
D. Sensitive Personal Data
Under specific scenarios, we may also collect “sensitive”, or “special categories” of personal data that are fit for purpose, such as the following:
  1. Unique Personal Identifier
    1. Social Security Number / Identification Number,
    2. Passport Number, and
    3. Driver’s License Number .
  2. Medical and/or Healthcare data
  3. Personal Data revealing the following:
    1. Financial Data,
      1. Financial records
      2. Credit/Debit card and
      3. Any other form of payment methods and their details
    2. Racial,
    3. Ethnic,
    4. Political opinions,
    5. Religious views,
    6. Philosophical beliefs,
    7. Trade union membership, or
    8. Sex life or orientation
  4. Biometrics features and data,
  5. Precise Geolocation data,
  6. Criminal Records
The above-mentioned definition are broad categories that can be found in multiple jurisdiction, under the specific circumstances, we will provide more detail under the specific privacy notice on the types of sensitive personal data, purpose and subsequent handling requirements that would be expected from us. An explicit consent would also be required if you wish to provide us with the sensitive personal data. If the provision of such sensitive personal data is mandatory for the purpose of collection, we will clearly indicate to you that the provision of this information is mandatory, and the consequences if you choose not to provide the relevant information.

3. How we will collect and use your Personal Data


We will primarily collect personal data directly from you, however, in some cases we may also collect your personal data indirectly from the following sources:
  1. Recruitment agencies;
  2. Background check providers;
  3. Third party service providers that assist us to operate and run our business;
  4. Publicly available sources such as business and employment-oriented social network services (such as LinkedIn) and jobs boards (such as JobsDB);
  5. Insurance agencies.
  6. SCC’s Affiliates, Subsidiaries, or Business Partners such as Coca-Cola Company Limited.
Such collection from external sources will be notified and stated in the specific privacy notice prior to the engagement and collection from such sources. We will collect and process your personal data primarily in the following scenarios:
  1. Placing an order for any of our products or services;
  2. Registering as a member online or mobile apps;
  3. Completing any customer survey or provide feedback for us;
  4. Submitting employment-related application online or via email and mobile apps;
  5. Browsing or using our website via your browsers with cookies enabled;
  6. Participating in our promotion events or activities

4. Purposes of collecting your Personal Data


SCC may use your personal data for the following purposes:

A. For personal data collected from the consumer
  1. To register our loyalty membership, promotion activities such as the lucky draw and other mini-apps, etc;
  2. To provide our products and services for you, to contact you in relation to logistic arrangements of delivering the products and services to you, and to send you service-related communications;
  3. To tailor and personalise our products and services to you, to better match your preferences and interests, and to provide or facilitate any special assistance you may have asked for;
  4. To record and facilitate your payment for purchasing our products and services;
  5. To carry out your instructions, to respond to your enquiries, and to provide customer services and assistance;
  6. To notify you about our new products, special offers and other special promotions with your explicit consent;
  7. To perform investigation, research or statistical analysis in order to improve our products and services, and benefit our customer;
  8. To ensure safety and security of our consumers, and to undertake any necessary activities during emergency events; or
  9. To comply with any legal, governmental or regulatory requirements in relevant jurisdiction including but not limited to verifying and processing payment, screening against fraud, screening against abusive purchasing, money laundering and other criminal or unlawful activities.
B. For personal data collected from customer/business partners
  1. To conduct business activities, to contact you in relation to communicating about the products, services and relevant requests, and maintain the business relationships;
  2.  To process payment instructions;
  3. To conduct customer surveys; or
  4. To access customer portal and provide corresponding services.
C. For personal data collected from employees
  1. To undertake recruitment activities, such as processing your employment application and checking for any existing or potential conflicts of interest or any other restrictions which may otherwise restrict or prevent employment with any entity of SCC;
  2. To undertake matters relating to or in connection with your employment including but not limited to the purposes of payroll, benefit, administration, transfer and other career-related matters such as transfer of employment and secondment, promotion and career development activities;
  3. To conduct reference check with previous employers; or
  4. Any other purposes directly or indirectly relating to the compliance by SCC or any of the employment or statutory obligations.
D. For personal data collected via our websites and mobile apps
  1. To manage and improve any services provided via our websites and mobile apps;
  2. To manage and improve our websites and mobile apps including drawing up statistics on the usage of our websites and mobile apps;
  3. To tailor the content of our websites and mobile apps to provide you with a more personalized experience and draw your attention to information about products and services that may be of interest to you;
  4. To manage and respond to any request you submit through our websites and mobile apps; or
  5. To help us learn more about you, the products and services that you receive, and other products and services that you might be interested in receiving.
SCC will process your personal data following the requirement of applicable laws on an appropriate legal basis, including:
  • Provision of your explicit consent;
  • Necessary for the performance of a contract;
  • Necessary for any legal obligations;
  • Necessary to protect the vital interest that are essential for someone’s life;
  • Necessary for the performance of a task in public interest;
  • Processing based on the legitimate interest of SCC or a third party when we use your personal data to contact you, conduct direct marketing or make a survey, improve our products and services. Legitimate interest includes enabling us to more effectively manage and operate our business and provide our products and services; protecting the security of our businesses, systems, products, services, customers, consumers, business partners, employees and internal management, complying with internal policies and processes; and other legitimate interest described in this policy.
We will not intentionally use, share or sell your personal data in ways which are unrelated to the above purposes (or purposes as specified in Personal Information Collection Statement or Privacy Notice when we collect your Personal Data) without your prior consent. We will notify you when there are any changes to our purpose of collecting your personal data, we might need to re-obtain your consent if there is any alteration beyond the processing purpose as mentioned above.

5. Who we share your Personal Data with


To facilitate the purposes mentioned in 4. Purposes of collecting your Personal Data, we may transfer, disclose, grant access to or share your Personal Data under specific scenarios, with third-parties for the following purposes (whether within or outside the country in which you are located):
  1.  Third-party service providers engaged by us to assist with providing you with our products and services;
  2. Third-party service providers engaged by SCC to assist processing your Personal Data such as payroll providers, background check providers or recruiters;
  3. SCC direct and indirect subsidiaries, holding companies and associated companies or affiliates
  4. Other business partners such as website, mobile app and loyalty programme operators;
  5. Marketing partners who provide marketing services or conduct marketing or social interaction activities including campaigns, contests, sweepstakes, market research, customer surveys and data analytics;
  6. Credit reference agencies, credit, debit and/or charge card companies and/or banks; or
  7. Law enforcement agencies, government and regulatory bodies, and other organisations.
Details of such external sharing of personal data would be specified in the individual Privacy Notice(s) or Personal Information Collection Statement(s) prior to your collection. Depending on your region, explicit consent may be required for such processing or sharing to take place.

We may also share aggregated data, provided that your identity will be sanitized and unable to be reidentified, with third parties for the specified purposes, and to better understand your needs to improve our products and services.

As SCC cannot control the privacy practices and data protection policies of third parties that are not subject to this Privacy Policy. SCC will conduct due diligence such as inclusion of contractual terms in the respective agreements, conduct periodic assessment(s) and audit(s) with such third-parties. When we share your personal information with the respective third-parties, you are also encouraged to read the Privacy Policy of such third-parties.

6. Use of Personal Data in Direct Marketing


We will not use your personal data for marketing and promotional purposes unless we have obtained your explicit and prescribed consent, including but not limited to:
  • For sending or showing you updates on latest news, offers and promotions in connection with our products and services
  • For sending or showing you joint marketing offers about our products and services; or
  • For tailoring and tracking your interactions with advertisements and links from third-party websites to our website.

You may unsubscribe or opt-out of receiving such direct marketing communications from us by contacting us as set out in 12. Your rights and contacting us.

7. Use of Cookies on Swire Coca-Cola websites


SCC website will use cookies which, among other things, help us to improve your experience of our websites and to ensure that they perform as you expect them to.  For detailed information on how we use cookies and the purposes for which we use them, please see our Cookies Policy.

8. Transmission, storage and security of your Personal Data


We use a range of physical, electronic and managerial safeguards to protect your personal data in accordance with the requirements of data protection legislation and ensure that we keep your personal data secure, accurate and up to date. These measures include:
  • Education and training to relevant staff to ascertain that they are aware of corporate privacy obligations when handling and processing personal information;
  • Administrative and technical controls to restrict access to personal information on a need-to-know and need-to-have basis;
  • Technological security measures, including but not limited to firewalls, encryption, data anonymization and anti-virus software; and
  • Physical security measures, such as staff security badges to access our premises
Since no system or platform is impenetrable, and no information provided over the Internet is completely secure, therefore we could not guarantee the security of any information you transmit to us or receive from us over the Internet. However, SCC will take due care in updating our latest practices to ensure that the most appropriate forms of protection have been instilled.

9. Usage of your Personal Data for Statistical Analysis


We may also use your personal data to analyse our customers’ and consumers’ preferences to establish market trends and derive insights. This may involve combining personal data that we hold about your purchased records with information that we have collected about your web usage. Similar to 5. Who we share your Personal Data with, the aggregated data that are used for statistical analysis are not personally identifiable.

10. Retention of your Personal Data


Your personal data will be retained for as long as the purpose(s) for which it was collected and any other permitted associated purpose(s). Our retention periods are based on the actual business needs and your information will either irreversibly anonymised or securely disposed of once the purpose of collection has been fulfilled.

11. How your Personal Data is transferred globally


In principle, personal data collected will be processed, accessed or stored in the country in which you are located or country/region where SCC or its affiliates, subsidiaries, service providers or business partners operates or functions at. As we provide our products and services through resources and servers throughout the world, this means that we may export your personal data outside of your country with legitimate reasons. These jurisdictions may have different data protection laws. In such circumstances, SCC will take measures to ensure that data is processed as required by this Privacy Policy and applicable laws. We will ensure that all transfers of your personal data will be protected with appropriate security measures.

12. Your rights and contacting us


You control the personal data shared with us, and have the right to exercise any of your entitled Data Subject Rights based on the respective jurisdiction or statutory requirements within the specific region. As such Data Subject Rights differ from different jurisdiction, please refer to the Appendix for more details.

If you wish to exercise any of your Data Subject Rights, please contact us at:

Data Privacy Protection Office

33/F, Dorset House, Taikoo Place, Quarry Bay, Hong Kong

dpo@swirecocacola.com

SCC may request additional personal data from you when responding to such request to ensure the authenticity and validity of such request. We will make every endeavour to ensure that the compliance and respondence of such request are done within the period set under the statutory requirements within the specific region.

A reasonable amount of fee may also be charged for the processing of any data subject request. You are also entitled to the right for raising complaint(s) about our data processing activities to regulatory bodies in your jurisdiction.

13. Changes to this Privacy Policy


This Privacy Policy was last updated on October 2021.

This Privacy Policy does not extend to third-party websites that may be linked from our website, or from any other broadcast affiliated with us.

It may be subject to amendments. Any future changes or additions to the processing of personal information as described in this policy affecting you will be communicated to you through an appropriate channel, depending on how we normally communicate with you.

Swire Coca-Cola Privacy Policy – Appendix



This Appendix applies if you are based in the following countries/regions during your interactions with us

1. Mainland China


1.1 Transference of Persona Data overseas, or to external parties

By referring to 5. Who we share your personal data with, and 11. How your Personal Data is transferred globally, SCC will obtain your explicit consent prior to the collection of your personal data.


1.2 Children

Other than the information required to complete a purchase, we do not knowingly collect personal identifiable information from children under the age of 14. If we learn that we have collected Personal Data from a child under the age of 14, we will take reasonable steps to delete that information. Where required by applicable law, we may ask a parent or guardian for consent before we provide a product or service to a minor.


1.3 Purposes of collecting your Personal Data

In connection with our business, we will use your personal data to make various decisions about you and your eligibility to access our services, to prevent abusive use of our services, to ensure the security of our systems, or to detect fraud. Some of these decisions may be taken on an automated basis including, by matching your personal data against information in certain risk models that we have created based on the behaviour of other individuals and using your personal data to further enhance such models. Under certain circumstances, you may have the right to restrict how we process your personal data for these decision-making process.


1.4 Your Data Subject Rights

Please note that your exercise of these rights is subject to limitations and we may reject your request.
    
Access and correction: You may access the information we maintain about you.  You may request access to correct any errors in your personal information.
Deletion: You may request that we delete your personal information.  Please note, we may be required by legal or other reasons to retain your personal information.
Withdraw: You may request to withdraw any previously provided consent. We may require you to furnish specific information that would assist us with complying to such request.
Portability: You may request that your personal data to be transferred to another Data Controller. When exercising such right, kindly provide details on what specific data set that you wish to transfer, as well as the target audience.
Restrict Automated Decision Making and Opt-Out from Personalization: You may request to opt-out from any personalized content from specific platforms or services.

If you have any concerns or questions about how we are collecting, using or disclosing your personal data, or are not satisfied with how we resolve your questions or concerns, please contact our Data Privacy Protection Office.

1.1. Hong Kong Special Administrative Region


1.1.1 Your Data Subject Rights

Please note that your exercise of these rights is subject to limitations and we may reject your request.

Access and correction: You may access the information we maintain about you.  You may request access to correct any errors in your personal information.

Withdraw: You may request to withdraw any previously provided consent. We may require you to furnish specific information that would assist us with complying to such request.

1.2. Taiwan Region


1.2.1 What Personal Data we collect

We will collect and handle sensitive Personal Data, for example, when we handle requests for special medical or access assistance or your specific dietary requirements that may indicate your health issues. We will ask you for your written consent when collecting and handling this type of Personal Data, unless we are otherwise permitted to collect, process or use such Personal Data under Taiwan Region Personal Data Protection Law.

1.2.2 How we will collect and use your Personal Data

Your Personal Data may be used in electronic form and/or hard copy form or in any appropriate manner.

1.2.3 Your Data Subject Rights

Please note that your exercise of these rights is subject to limitations and we may reject your request.
Access and correction: You may access the information we maintain about you.  You may request access to correct any errors in your personal information.

Deletion: You may request that we delete your personal information.  Please note, we may be required by legal or other reasons to retain your personal information.

Withdraw: You may request to withdraw any previously provided consent. We may require you to furnish specific information that would assist us with complying to such request.

Restrict: You may request to restrict the usage of your personal data to specific purposes or scenarios.

In addition to the above, you have the right (subject to exceptions and in accordance with Taiwan Region Personal Data Protection Law) to request a copy of your Personal Data held by us or require us to delete or cease the collection, processing or use of your Personal Data. You may exercise these rights by contacting our Data Privacy Protection Office.

2. United States of America (California)

2.1 California Privacy Rights

Under California Civil Code sections 1798.83-1798.84, California residents are entitled to request a notice that identifies the categories of Personal Data which we share with our affiliates and/or third parties for marketing purposes and provides contact information for such affiliates and/or third parties. If you are a California resident and would like a copy of this information, please submit a written request by contacting us at the contact details in 12. Your rights and contacting us.

2.2 Children

Other than the information required to complete a purchase, we do not knowingly collect personal identifiable information from children under the age of 13. If we learn that we have collected Personal Data from a child under the age of 13, we will take reasonable steps to delete that information. Where required by applicable law, we may ask a parent or guardian for consent before we provide a product or service to a minor.

2.3 Your Data Subject Rights

You may have additional rights and choices regarding how we process your personal information.  Those additional rights and choices are listed below.

We reserve the right to verify your identity in connection with any requests regarding personal information to help ensure that we provide the information to the individuals to whom it pertains and allows only those individuals or their authorized representatives to exercise rights with respect to that information.  We will try to comply with your request as soon as reasonably practicable.

Please note that your exercise of these rights is subject to limitations and we may reject your request.

Access and correction: You may access the information we maintain about you.  You may request access to correct any errors in your personal information.

Deletion: You may request that we delete your personal information.  Please note, we may be required by legal or other reasons to retain your personal information.

Withdraw: You may request to withdraw any previously provided consent. We may require you to furnish specific information that would assist us with complying to such request.

Portability: You may request that your personal data to be transferred to another Data Controller. When exercising such right, kindly provide details on what specific data set that you wish to transfer, as well as the target audience.

Do Not Sell My Personal Information: To the extent that we sell customer data, you may have the right to direct us to stop selling your personal information if we are doing so.

Limit the use of Sensitive Personal Data: You may request to limit the use of Sensitive Personal data to a limited set of purpose.

Please contact us using the contact details in 12. Your rights and contacting us of this Privacy Notice if you would like to exercise any of these rights or request more information.  Where required by applicable law, we will notify you if we reject your request and notify you of the reasons why we are unable to honour your request.

2.4 Use of Cookies on Swire Coca-Cola websites

In relation to web browser-based do-not-track (“DNT”) signals, because there is not yet a consensus on how companies should respond to web browser-based DNT mechanisms in Europe, the US and California, we do not explain how we respond to web browser-based DNT signals at this time.