私隐政策

Our Commitment to Protect Your Privacy


Swire Coca Cola (“SCC”, “we”, “our” or “us”) highly values your personal data and privacy and is committed to preserving the confidentiality and security of all personal information. When you use our services, you entrust us with your personal information. This Privacy Notice sets out the policies and practices of SCC’s commitment to safeguarding your personal data in terms of what information we gather about you, how we use and process that information and who we give that information to. It also defines your rights in relation to your personal data and who you can contact for more information or queries.

To ensure that you feel comfortable and confident about providing your personal data for us, please read this Privacy Notice carefully to understand how and why we collect and process your personal data.

We will notify you when there are any changes to our Privacy Notice, including by posting the revised policy on our website. The changes will be effective from the date of posting.

1. What this Privacy Notice covers and Who it applies to


We recognise the indispensability of your personal data and are committed to protecting your privacy and handling your personal information in an open, transparent and secure manner.

This privacy notice outlines how we will collect, handle, use, store, share and protect your personal data when you:
  1. make a purchase for our products and services;
  2. engage with us in relation to employment or experience opportunities at SCC, including when you apply for a role with SCC or participate in any assessment programme relating to such a role;
  3. visit and use our website;
  4. participate in our promotion events/activities or register as our loyalty program member
This privacy notice applies to personal information collected on or through SCC websites and mobile apps. Under specific circumstances, we will provide separated privacy notices for you with detailed rationales and purposes that this privacy notice does not cover.

You are responsible for checking whether we have a specific privacy notice for you when engaging with us. If so, please refer to that specific privacy notice for your reference. Otherwise, this privacy notice will be applied.

2. What Personal Data we collect


There are 3 broad categories of personal data held by us. They comprise personal data contained in the following:

A. Consumer Data including but not limited to:-
  1. Personal Information: full name, contact number, email address, delivery address;
  2. Financial information: your payment records and account information relating to other payment services like online or mobile payment services.
  3. Feedback after purchasing our products and services;
  4. Personal interests and preferences.
B. Employee records
  1. Your personal information including but not limited to full name, National ID / Passport Number, home address, date-of-birth, nationality, sexuality, phone number, and email address;
  2. Other relevant data including but not limited to financial background, educational background, personal data of spouse and family members, and professional qualification.
C. Customer/Business Partner Data
  1. Your personal information, which is limited to the primary contact person as the communication channel for business interactions or activities, or for the customer to register an account on our customer portal, including but not limited to full name, contact number, email address, delivery address and National ID/Passport Number.
  2. Information collected from you about others in situations where you decide to invite a third party to conduct business with SCC. We will collect your and third party’s names, phone number and email addresses in order to make contact and follow up with the third party.
In some cases, the personal information we collect may also include so-called 'sensitive' or 'special categories' of personal information, such as details about your medical background, ethnicity, race, religious beliefs, facial image or and any criminal convictions you may have. Usually this is because you volunteer this information to us. If we are indeed required to gather such sensitive personal information, we will clearly indicate to you that the provision of this information is mandatory, and the consequences if you choose not to provide the relevant information.

If you fail to provide the above-mentioned information as requested, it may result in that we may not be able to provide (or continue to provide) the products or services as requested by you, your application will not be further processed or it may lead to dismissal.

By providing your personal data for us, you acknowledge that the provision is fair and reasonable.

3. How we will collect and use your Personal Data


You are responsible for providing most of the personal data directly for us. We will collect and process your personal data when you:
  1. place an order for any of our products or services;
  2. register as a member online or mobile apps;
  3. complete any customer survey or provide feedback for us;
  4. submit employee application online or via email and mobile apps;
  5. use or view our website via your browsers with cookies enabled;
  6. participate in our promotion events/activities
In some cases, we may also collect your personal data indirectly from the following sources:
  1. recruitment agencies;
  2. background check providers;
  3. third party service providers that assist us to operate and run our business;
  4. publicly available sources such as business and employment-oriented social network services (such as LinkedIn) and jobs boards (such as JobsDB);
  5. insurance agencies.

4. Purposes of collecting your Personal Data


SCC may use your personal data for the following purposes:

A. For personal data collected from the consumer
  1. To register our loyalty membership, promotion activities such as the lucky draw and other mini-apps, etc;
  2. To provide our products and services for you, to contact you in relation to logistic arrangements of delivering the products and services to you, and to send you service-related communications;
  3. To tailor and personalise our products and services to you, to better match your preferences and interests, and to provide or facilitate any special assistance you may have asked for;
  4. To record your payment for purchasing our products and services;
  5. To carry out your instructions, to respond to your enquiries, and to provide customer services and assistance;
  6. To notify you about our new products, special offers and other special promotions with your explicit consent;
  7. To perform investigation, research or statistical analysis in order to improve our products and services, and benefit our customer;
  8. To ensure safety and security of our consumers, and to undertake any necessary activities during emergency events; and
  9. To comply with any legal, governmental or regulatory requirements in relevant jurisdiction including but not limited to verifying and processing payment, screening against fraud, screening against abusive purchasing, money laundering and other criminal or unlawful activities.
B. For personal data collected from customer/business partners
  1. To conduct business activities, to contact you in relation to communicating about the products, services and relevant requests, and maintain the business relationships;
  2. To process payment instructions;
  3. To conduct customer surveys;
  4. To access customer portal and provide corresponding services.
C. For personal data collected from employees
  1. To undertake recruitment activities, such as processing your employment application and checking for any existing or potential conflicts of interest or any other restrictions which may otherwise restrict or prevent employment with any entity of SCC;
  2. To undertake matters relating to or in connection with your employment including but not limited to the purposes of payroll, benefit, administration, transfer and other career-related matters such as transfer of employment and secondment, promotion and career development activities;
  3. To conduct reference check with previous employers;
  4. Any other purposes directly or indirectly relating to the compliance by SCC or any of the employment or statutory obligations.
D. For personal data collected via our websites and mobile apps
  1. To manage and improve any services provided via our websites and mobile apps;
  2. To manage and improve our websites and mobile apps including drawing up statistics on the usage of our websites and mobile apps;
  3. To tailor the content of our websites and mobile apps to provide you with a more personalized experience and draw your attention to information about products and services that may be of interest to you;
  4. To manage and respond to any request you submit through our websites and mobile apps;
  5. To help us learn more about you, the products and services that you receive, and other products and services that you might be interested in receiving.
SCC will process your personal data following the requirement of applicable laws on an appropriate legal basis, including:
  • Processing your personal data to fulfil the contract when responding to a service request;
  • Processing your personal data with your explicit consent;
  • Processing based on the legitimate interest of SCC or a third party when we use your personal data to contact you, conduct direct marketing or make a survey, improve our products and services. Legitimate interest includes enabling us to more effectively manage and operate our business and provide our products and services; protecting the security of our businesses, systems, products, services, customers, consumers, business partners, employees and internal management, complying with internal policies and processes; and other legitimate interest described in this policy.
  • Processing your personal data as necessary to comply with and fulfil legal obligations.
We will not intentionally use, share or sell your personal data in ways which are unrelated to the above purposes (or purposes as specified in Personal Information Collection Statement when we collect your Personal Data) without your prior consent. We will notify you when there are any changes to our purpose of collecting your personal data, we might need to re-obtain your consent if there is any alteration beyond the processing purpose as mentioned above.

5. Who we share your Personal Data with


To facilitate the purposes mentioned in section [4], we may transfer, disclose, grant access to or share your Personal Data with the following third parties (whether within or outside the country in which you are located):
  1. Third-party service providers engaged by us to assist with providing you with our products and services;
  2. Third-party service providers engaged by SCC to assist processing your Personal Data such as payroll providers, background check providers or recruiters;
  3. SCC direct and indirect subsidiaries, holding companies and associated companies or affiliates
  4. Other business partners such as website, mobile app and loyalty programme operators;
  5. Marketing partners who provide marketing services or conduct marketing or social interaction activities including campaigns, contests, sweepstakes, market research, customer surveys and data analytics;
  6. Credit reference agencies, credit, debit and/or charge card companies and/or banks;
  7. Law enforcement agencies, government and regulatory bodies, and other organisations
We may also share aggregated data, provided that your identity will not be disclosed by such sharing, with third parties for various purposes including marketing and advertising and may use this data in order to better understand your needs and to improve our products and services.

SCC cannot control the privacy practices and data protection policies of third parties that are not subject to this Privacy Policy. When you submit personal information to such a third party, please read and refer to the privacy protection policy of the third party.

6. Use of Personal Data in Direct Marketing


We may not use your personal data for marketing and promotional purposes unless we have received your explicit and prescribed consent including
  • for sending or showing you updates on latest news, offers and promotions in connection with our products and services
  • for sending or showing you joint marketing offers about our products and services; or
  • for tailoring and tracking your interactions with advertisements and links from third-party websites to our website.
We may also use your personal data to analyse our customers’ and consumers’ preferences to establish market trends and derive insights. This may involve combining personal data that we hold about your purchased records with information that we have collected about your web usage.

You may unsubscribe or opt-out of receiving such direct marketing communications from us by contacting us as set out in section [11] below.

7. Use of Cookies on Swire Coca Cola websites


SCC website will use cookies which, among other things, help us to improve your experience of our websites and to ensure that they perform as you expect them to.  For detailed information on how we use cookies and the purposes for which we use them, please see our Cookies Policy.

8. Transmission, storage and security of your Personal Data


We use a range of physical, electronic and managerial safeguards to protect your personal data in accordance with the requirements of data protection legislation and ensure that we keep your personal data secure, accurate and up to date. These measures include:
  • education and training to relevant staff to ascertain that they are aware of corporate privacy obligations when handling and processing personal information;
  • administrative and technical controls to restrict access to personal information on a need-to-know and need-to-have basis;
  • technological security measures, including but not limited to firewalls, encryption, data anonymization and anti-virus software;
  • physical security measures, such as staff security badges to access our premises
Since no system or platform is impenetrable, and no information provided over the Internet is completely secure, therefore we could not guarantee the security of any information you transmit to us or receive from us over the Internet.

9. Retention of your Personal Data


Your personal data will be retained for as long as the purpose(s) for which it was collected and any other permitted associated purpose(s). Our retention periods are based on business needs and your information will either irreversibly anonymised or securely disposed of when it is no longer needed.

For country/region specific retention requirements, please refer to Appendix section.

10. How your Personal Data is transferred globally


In principle, your personal data we collect and generate will be processed, accessed or stored in the country in which you are located or country/region where SCC or its affiliates, subsidiaries, service providers or business partners have a presence. As we provide our products and services through resources and servers throughout the world, this means that we may export your personal data outside of your country with legitimate reasons. These jurisdictions may have different data protection laws. In such circumstances, SCC will take measures to ensure that data is processed as required by this Privacy Policy and applicable laws. We will ensure that all transfers of your personal data will be protected with appropriate security measures.

11. Your rights and contacting us


You have the rights to access personal data held about you, correct any inaccuracies and request deletion of your personal data, subject to exceptions and in accordance with data protection authorities.

A reasonable amount of fee may be charged for the processing of any data access request. You are also entitled to the right for raising complaint(s) about our data processing activities to regulatory bodies in your jurisdiction.

We will take reasonable steps to ensure that your personal data is accurate. You are also responsible for notifying us of any changes of your personal data.

If you would like to access, correct or delete any your personal data held by us, please contact us at:

Data Privacy Protection Office
33/F, Dorset House, Taikoo Place, Quarry Bay, Hong Kong
dpo@swirecocacola.com

SCC will, upon satisfying itself of the authenticity and validity of the access, correction or deletion request, make every endeavour to comply with and respond to the request within the period set by the statutory requirements.

12. Changes to this Privacy Notice


This notice was last updated on Nov 2020.

This Privacy Notice does not extend to third-party websites that may be linked from our website, or from any other broadcast affiliated with us.

It may be subject to amendments. Any future changes or additions to the processing of personal information as described in this notice affecting you will be communicated to you through an appropriate channel, depending on how we normally communicate with you.

Appendix


This Appendix applies if you are based in the following countries/regions during your interactions with us

1. US


1.1 California Privacy Rights
Under California Civil Code sections 1798.83-1798.84, California residents are entitled to request a notice that identifies the categories of Personal Data which we share with our affiliates and/or third parties for marketing purposes and provides contact information for such affiliates and/or third parties. If you are a California resident and would like a copy of this information, please submit a written request by contacting us at the contact details in section [11] of the Privacy Notice.

1.2 Children
Other than the information required to complete a purchase, we do not knowingly collect personal identifiable information from children under the age of 13. If we learn that we have collected Personal Data from a child under the age of 13, we will take reasonable steps to delete that information. Where required by applicable law, we may ask a parent or guardian for consent before we provide a product or service to a minor.

1.3 Your Rights and Choices
You may have additional rights and choices regarding how we process your personal information.  Those additional rights and choices are listed below.

We reserve the right to verify your identity in connection with any requests regarding personal information to help ensure that we provide the information to the individuals to whom it pertains and allows only those individuals or their authorized representatives to exercise rights with respect to that information.  We will try to comply with your request as soon as reasonably practicable.

Please note that your exercise of these rights is subject to limitations and we may reject your request.
  • Access and correction: You may access the information we maintain about you.  You may request access to correct any errors in your personal information.
  • Deletion: You may request that we delete your personal information.  Please note, we may be required by legal or other reasons to retain your personal information.
  • Do Not Sell My Personal Information: To the extent that we sell customer data, you may have the right to direct us to stop selling your personal information if we are doing so.
Please contact us using the contact details in section [11] of the Privacy Notice if you would like to exercise any of these rights or request more information.  Where required by applicable law, we will notify you if we reject your request and notify you of the reasons why we are unable to honour your request.

1.4 The following sentence shall be added to section [7]
"In relation to web browser-based do-not-track ("DNT") signals, because there is not yet a consensus on how companies should respond to web browser-based DNT mechanisms in Europe, the US and California, we do not explain how we respond to web browser-based DNT signals at this time."

2. Taiwan


2.1 The following paragraph shall be added to section [2]:
"We will collect and handle sensitive Personal Data, for example, when we handle requests for special medical or access assistance or your specific dietary requirements that may indicate your health issues. We will ask you for your written consent when collecting and handling this type of Personal Data, unless we are otherwise permitted to collect, process or use such Personal Data under Taiwan Personal Data Protection Law."

2.2 The following paragraph shall be added to section [4]
'Your Personal Data may be used in electronic form and/or hard copy form or in any appropriate manner."

2.3 The following paragraph shall be added to section [11]:
"In addition to the above, you have the right (subject to exceptions and in accordance with Taiwan Personal Data Protection Law) to request a copy of your Personal Data held by us or require us to delete or cease the collection, processing or use of your Personal Data. You may exercise these rights by contacting our Data Privacy Protection Office"

3. China


3.1 The following sentence shall be added as a final paragraph in the introductory section of the Privacy Notice before the start of clause 1:
"You consent to the collection, use and disclosure of your Personal Data as described in this Privacy Policy."

3.2 The following paragraph shall be added to section [4]:
"In connection with our business, we will use your personal data to make various decisions about you and your eligibility to access our services, to prevent abusive use of our services, to ensure the security of our systems, or to detect fraud. Some of these decisions may be taken on an automated basis including, by matching your personal data against information in certain risk models that we have created based on the behaviour of other individuals and using your personal data to further enhance such models. Under certain circumstances, you may have the right to restrict how we process your personal data for these decision-making process."

3.3 The following paragraph shall be added to section [11]:
"In addition to the above, you have the right to:
  1. subject to certain conditions, request deletion of your Personal Data;
  2. where processing is based on consent, withdraw the consent;
  3. where services are provided to you via an account, cancel your account; and
  4. request a copy of your Personal Data;
You may exercise these rights by contacting our Data Privacy Protection Office"

3.4 The following paragraph shall be added to section [11]:
"If you have any concerns or questions about how we are collecting, using or disclosing your personal data, or are not satisfied with how we resolve your questions or concerns, please contact our Data Privacy Protection Office"

4. Hong Kong SAR


4.1 By referring to section [9], the data retention policy for Hong Kong will be as following:
"Retention of Employment-related Data:
  1. no longer than two years in respect of recruitment-related data held about a job applicant from the date of rejecting the applicant;
  2. no longer than seven years in respect of employment-related data held about an employee from the date the employee leaves employment;
Unless
  1. the individual concerned has given express consent for the data to be retained for a longer person; or
  2. there is a subsisting reason that obliges the employer to retain the data for a longer period"