TWININGS

Privacy Policy

Welcome to Twinings

Twinings is committed to ensuring that your privacy is protected and that we comply with all applicable data protection rules (including applicable marketing and cookies laws, together with associated guidance) (the "Data Protection Laws").

This policy explains how we collect, use, store and share the personal information we collect about you, how you can exercise your rights in respect of that information and the procedures that we have in place to safeguard your privacy. This policy supplements any other fair processing or privacy notice that may be provided to you from time to time. Please contact us using the contact details set out at the end of this policy if you have any questions, comments or concerns about this policy or how we handle your personal information, or if such information changes at any time.

This website (the "Website") is run by R.Twining and Company Limited (company no. 525071 with registered office at Weston Centre, 10 Grosvenor Street, London, W1K 4QY) ("Twinings", "we" and "us"). For the purpose of the Data Protection Laws, we are the controller of the personal information processed for the purposes set out below and we are responsible for looking after it.

When we refer to "processing" in this policy, we mean any activity concerning your personal information, including collecting, using, disclosing, deleting and anonymising.

Please note: this policy does not cover third party websites that we may link to from our Website, unless specifically mentioned in this policy. We are not responsible for the privacy policies and practices (including use of cookies) of such third parties even if you accessed the third party website using links from our Website. We recommend that you check the policy of each website you visit and contact the owner or operator of such website if you have concerns or questions.

Any changes to this policy in the future will be posted on this page and, where appropriate, notified to you by email. We will also post a notice on the Website landing page and on appropriate pages on the Website. Please check back frequently to see any updates or changes to this policy.

The information we collect and how we use it
Under the Data Protection Laws, we are required to explain what information we collect from you and how and why we use your personal information (the "processing activity"). We are also required to have a "lawful basis" on which to process your personal information. This is summarised in the table below.

Where required under applicable data protection laws, we have determined, acting reasonably and considering the circumstances, that we are able to rely on legitimate interests as the lawful basis on which to process your personal information in certain circumstances (we have stated this above and set out our legitimate interests). We have reached this decision by carrying out a balancing exercise to make sure our legitimate interest is not overridden by your privacy rights as an individual.

We consider that it is reasonable for us to process your information for the purposes of our legitimate interests outlined above as: (a) we process your information only so far as is necessary for such purpose; and (b) it can be reasonably expected for us to process your information in this way. 

Where we process your personal information on the legal basis of consent (as indicated in the above table), you may refuse consent to our processing and you may also withdraw your consent at any time: (i) in respect of cookies and other tracking mechanisms on our Website, by using the cookie consent manager in our cookie notification banner, (ii) in respect of marketing communications, by clicking 'unsubscribe' in the footer of the relevant emails, or (iii) in respect of other matters, by using the contact details below. This would not affect your ability to use any features of our Website. Withdrawing consent does neither affect any processing carried out without your consent (i.e. where we rely on another legal basis), nor the lawfulness of processing based on consent before its withdrawal.

Cookies

Some of the information identified in the table above, is collected by us through the use of cookies or similar technology when you visit our Website, or other websites or social media sites where we have included a cookie. In some cases, we will need your consent in order to place such cookies on your device. More information on the specific types of cookies we collect, our lawful basis and how to manage them can be found in our Cookies Policy.

Marketing and Promotional Materials

We may use your information to provide you with marketing and promotional materials (as stated above). In such instances, we will use your information to deliver promotional information that you have requested, or that we feel may interest you (unless you have previously told us that you do not wish to receive marketing communications from us).

The personalisation of advertisements displayed on social media platforms may be based on information you have provided directly to us (for example when browsing our Website or purchasing our products) or based on other information attributed to you via cookies, including cookies set by third parties.

You may opt-out of receiving marketing and promotional materials from us at any time by emailing us at twinings.direct@twinings.com, using the 'unsubscribe' link in the marketing or promotional email, or by phone to +44 (0)1264313444. You may also update your preferences to receive marketing or promotional materials by visiting our Website.

Please see below, Sharing your Personal Information, for further information regarding the third parties we share your information with for marketing and advertising purposes.

Competition, Prize-draws and Promotions

We may process your personal information in connection with competitions, prize draws and promotions (as stated above) you may enter from time to time. Please refer to the relevant terms and conditions of such competition, prize draw or promotion for further information.

Unless you ask us not to, we may (subject to the laws applicable in your country of residence) make your surname and county of residence available: (a) on request to anyone who sends us a self-addressed envelope within 10 weeks of the closing date of the competition; and (b) to any relevant regulator if they ask us (in the UK, this would be the Advertising Standards Authority (ASA)). We do this because it is necessary for the purpose of our legitimate interests in complying with the laws, regulatory codes and guidelines in force from time to time.

You have the right to object to our publication of your information. To do so, please contact us as soon as possible, and within a week of receiving your winner’s notification should wish you wish to object.

If we haven’t heard from you within a week, and we are asked to publish your information, we will do so. If you object later, we may have already published your information.

Where we are asked to disclose your information to a relevant regulator, and you object before we have done so, we will consider your reasons for objecting and aim to comply with your request (where we are able to do so). However, please note that we may still be required by law or regulation to disclose your information, if for example, we are required to demonstrate that a valid award took place.

Should you win one, we may also write to you to request your agreement to reasonable publicity and the use of your initial, surname, county of residence and any photograph provided by you as part of that publicity on our Website and any of our social media accounts. We may also write to request your agreement to the creation of further materials based on competition entries which will be hosted on our Website. We use your information in this way on the basis of your consent. You can withdraw your consent at any time after you’ve agreed but please bear in mind that, due to the nature of social media, once your information has been made publicly available for promotional purposes, it will be public and potentially copied or otherwise further distributed beyond our control.

Security

We have in place appropriate policies, rules and technical and organisational measures to protect your personal information from unauthorised or unlawful processing, and against accidental loss, destruction or damage.

We also have procedures in place to deal with any data security breach. We will notify you and any applicable regulator of a data security breach where we are legally required to do so.

However, the internet and email are not secure. Your communications may route through a number of countries before being delivered, may be intercepted by third parties and may not always reach the intended recipient – this is the nature of the World Wide Web/Internet. We cannot accept responsibility for any such unauthorised access or loss of personal information that is beyond our control.

You are responsible for protecting your username and password and must not share it with, or disclose it, to anyone.

If you want you to learn more about how to protect your data and your devices against fraud, identity theft, viruses and many other online problems, please visit www.getsafeonline.org. Get Safe Online is supported by HM Government and leading businesses.

Sharing your personal information  

We will only disclose your personal information to:

• companies within the Twinings group for internal business purposed such as management, accounting and marketing;
• e-commerce platform providers (see below regarding Shopify), payment gateway and payment service providers and suppliers of cookie-consent management solutions;
• other third-party suppliers, including business partners and sub-contractors for business administration, support, processing, services, or IT purposes;
• our third-party logistics and delivery providers who deliver products to you on our behalf;
• analytics or search engines, that enable us to optimise and improve your experience of our Website;
• third-party suppliers for marketing and advertising purposes (including (but not limited to) those as set out below), and agents who (on our behalf) tailor our marketing communications and offer you products we believe you would be interested in;
• our regulators, law enforcement or fraud prevention agencies, as well as our legal advisers, courts, the police and any other authorised bodies, for the purposes of investigating any actual or suspected criminal activity or other regulatory or legal matters;
• our professional advisors (including without limitation tax, legal, insurance, or other corporate advisors who provide professional services to us); and
• HMRC or other tax bodies or agencies to comply with our legal and regulatory obligations.

To the extent authorised by applicable laws, we will disclose your personal information to third parties:

• in the event that we consider selling or buying any business or assets, merging with another business, financing our business, granting a charge over our assets or leasing or licensing our assets, we may disclose your personal information to any prospective sellers or buyers of such business or assets;
• in the event we are the subject of any insolvency situation (e.g., the administration or liquidation);
• if we, or substantially all of our assets, are acquired by a third party, in which case personal information held by us about our customers will be one of the transferred assets;
• in order to enforce or apply our terms and conditions;
• to protect our rights, property, or safety, or that of our staff, our customers, or others. This includes exchanging information with other companies and organisations (including without limitation HMRC, the local police or other local law enforcement agencies) for the purposes of staff and customer safety, crime prevention, fraud protection and credit risk reduction; and
• if we are under a duty to disclose or share your personal information in order to comply with any legal obligation or regulatory requirements, or otherwise for the prevention or detection of fraud or crime.

We share your name, phone number, email address, gender, age, transaction history, social media account name, and any information we collect about your use of our Website or social media accounts with the parties set out below for the purpose of providing you with marketing and promotional materials:

• AWIN Inc. (our affiliate marketing networks). Awin Privacy Policy;
• NextRoll Inc NextRoll. NextRoll Privacy Policy;
• Advertising and social media platforms (who may process your personal data as joint controllers with Twinings for these purposes), including:
  • Google Privacy Policy;
  • Facebook, and Instagram. Meta Privacy Policy;
  • Pinterest Privacy Policy;
  • YouTube Privacy Policy;
  • LinkedIn Privacy Policy;
  • Privacy Policy;
  • Snapchat Privacy Policy;
  • Twitch Privacy Policy.

(together our Ad Partners).

We process this information based on our legitimate interest in promoting our business and our products, or with your consent. We rely on your consent where the data is collected via a cookie (save for strictly necessary cookies).

Once we have shared your personal data with our Ad Partners, they are responsible for ensuring your personal data is processed in accordance with Data Protection Laws. Please ensure you review their privacy policies (as set out above) carefully for further information. We will, however, take reasonable steps in the circumstances to ensure our Ad Partners afford a similar degree of protection to your personal information.

Meta. Where you have consented for us to do so, we will collect and share your personal data with Meta Platforms Ireland Limited (Meta Ireland) in order to advertise to you via Facebook, and Instagram, and in certain instances we are the joint controller of your personal data with Meta Ireland.

We have entered into an agreement with Meta Ireland to ensure that your information is protected, and the steps we each shall take to comply with Data Protection Laws with regard to the joint processing of your information.

To exercise your rights in relation to your information, Meta Ireland will be your primary contact. Please contact Meta Ireland directly to:

• request access to your personal data;
• request correction of your personal data;
• request erasure of your personal data;
• object to the processing of your personal data;
• request restriction to the processing of your personal data; and/or
• request the transfer of your personal data.

Further information regarding how to exercise your rights, together with the following further information, may be found in Meta Ireland's Privacy Policy and Terms of Service, including:

• how Meta Ireland processes your personal data in the capacity of a joint controller, including the legal basis that Meta Ireland relies upon for such use;
• how to exercise your data protection rights against Meta Ireland; and
• the name and contact details of Meta Ireland's data protection officer.

TikTok Shop:

We use TikTok Shop platform to enable you to purchase our products.  To do this, TikTok collects your personal information and shares it with us – for example, your name, email address, and delivery address.  TikTok shall handle your personal information in accordance with TikTok’s Privacy Policy.

Stripe:

TikTok use Stripe to facilitate payment transactions when you purchase our products from the TikTok Shop and make a payment.  To do this, Stripe collects your personal data – for example, your name, credit or debit card details – and shares this with your payment method provider.  Stripe also shares transaction data from those transactions facilitated by Stripe with us and with TikTok.  Stripe shall handle your personal information in accordance with Stripe’s Privacy Policy.    

Pinterest. Where you have consented for us to do so, we will collect and share your personal data with Pinterest Europe Ltd (Pinterest Europe) in order to advertise to you via Pinterest, and in certain instances we are the joint controller of your personal data with Pinterest Europe.

We have entered into an agreement with Pinterest Europe to ensure that your information is protected, and the steps we each shall take to comply with Data Protection Laws with regard to the joint processing of your information, pursuant to this:

• we will be responsible for confirming the purpose for which the collection and transmission of personal data takes place, please see The information we collect and how we use it section above.
• Pinterest Europe is responsible for enable you to exercise the rights set out above with regard to th personal data stored by Pinterest Europe after the joint processing.

Further information regarding how to exercise your rights, together with the following further information, may be found in Pinterest Europe's Privacy Policy.

Shopify. We use the Shopify platform to power our e-commerce business, provide you with an enjoyable customer experience and better enable you to browse our Website and purchase our products. To do this, Shopify collects your personal information on our behalf, and shares this with us – for example, your name, email address, and delivery address. Shopify shall handle your personal information in accordance with Shopify's Privacy Policy. Further information regarding how we use Shopify's cookies can be found within our Cookies Policy.

The parties to which we may disclose your personal information (as summarised in this section) may be located in various countries within the European Economic Area.

International transfers of your personal information

We may transfer personal information to countries other than the country in which the data was originally collected (for example, outside the UK) in order to provide you with our products. These countries may not have the same data protection laws as the country in which you initially provided the information and may not provide the same level of protection. Your personal information may be subject to the laws of such foreign jurisdiction and may be accessible without notice to you by the courts, law enforcement and national security authorities of such foreign jurisdiction.

If we transfer personal information to countries outside of the UK, we will ensure (in accordance with applicable laws) an adequate degree of protection is afforded to your personal information by ensuring at least one of the following safeguards is implemented:

• we may transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data;
• for transfers to the US, any transfers would be under the UK Extension to the EU-US Data Privacy Framework. Further information about the UK Extension to the EU-US Data Privacy Framework can be found here.;
• we may use specific contracts approved for use in the UK which give personal data the same protection it has in the UK. Further information regarding such contracts are available on the ICO's website here.

Personal data collected via cookies set by our Ad Partners may be transferred by those Ad Partners outside of the UK and/or EEA. Please refer to the relevant third-party privacy policy for further information.

Your rights

You have the following rights in respect of the personal information we hold about you:

Right	Description
To be informed	A right to be informed about the personal information we hold about you.
Of access	A right to access the personal information we hold about you.
To rectification	A right to require us to rectify any inaccurate personal information we hold about you.
To erasure	A right to ask us to delete the personal information we hold about you. This right will only apply where (for example): ·       we no longer need to use the personal information to achieve the purpose we collected it for; ·       where you withdraw your consent if we are using your personal information based on your consent; or ·       where you object to the way we process your data (in line with Right 6 below).
To restrict processing	In certain circumstances, a right to restrict our processing of the personal information we hold about you. This right will only apply where (for example): ·       you dispute the accuracy of the personal information held by us; ·       where you would have the right to ask us to delete the personal information but would prefer that our processing is restricted instead; or ·       where we no longer need to use the personal information to achieve the purpose we collected it for, but you need the data for the purposes of establishing, exercising or defending legal claims.
To data portability	In certain circumstances, a right to receive the personal information you have given us, in a structured, commonly used and machine readable format. You also have the right to require us to transfer this personal information to another organisation, at your request.
To object	A right to object to our processing of the personal information we hold about you where our lawful basis is for the purpose of our legitimate interests, unless we are able to demonstrate, on balance, legitimate grounds for continuing to process the personal information which override your rights or which are for the establishment, exercise or defence of legal claims.
In relation to automated decision making and profiling	A right for you not to be subject to a decision based solely on an automated process, including profiling, which produces legal effects concerning you or similarly significantly affect you. We do not carry out any automated processing or profiling.
To withdraw	A right to withdraw your consent, where we are relying on it to use your personal information (for example, to provide you with brochures and newsletters).
To complain	A right to lodge a complaint with a supervisory authority, in particular in your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes applicable data protection laws. Please see below for further details.

You can opt-out of Google's use of cookies or device identifiers by visiting Google's Ad Settings.

We welcome your views about our Website and this policy. If you would like to contact us with any queries or comments, request further information or exercise any of your available rights set out above, please email us at: twinings.direct@twinings.com, write to us at: Weston Centre, 10 Grosvenor Street, London, W1K 4QY or call us on +44 (0)1264313444.

If you would like this notice in another format (for example audio, large print, braille) please contact us using the details above.

We encourage you to contact us first if you have any queries, comments, complaints or concerns about the way we handle your personal information. We will take any privacy complaint seriously and any complaint will be assessed with the aim of resolving any issue in a timely and efficient manner.  We request that you cooperate with us during this process and provide us with any relevant information that we may need.

However, if you are not satisfied with our handling of any request by you in relation to your rights or concerns, you (as set out above) also have the right to make a complaint to our supervisory authority, which is:

• if you reside in the UK, the UK's Information Commissioner's Office. Their address is: First Contact Team, Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF or you can contact them by other methods as set out at https://ico.org.uk/global/contact-us/contact-us-public/.
• if you reside in Ireland, the Data Protection Commission. Their address is 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland or you can contact them by other methods as set out at https://www.dataprotection.ie/en/contact/how-contact-us.

Last updated: [December 2023]