Capital Jingle Bell Ball Chatbot Privacy Policy

 

Privacy Notice applicable to the chatbot on Facebook associated to https://register.coca-cola.com/gb/jbb18

 

LAST REVISED: [11/10/2018]

1. What is this Privacy Notice about?

2. What Personal Data do we collect about you?

3. How do we collect your Personal Data?

4. How do we use your Personal Data?

5. To whom your Personal Data are disclosed?

6. What transfers of Personal Data outside the European Economic Area do we carry out?

7. What about links to other websites, applications, platforms and alike?

8. What are your rights as regards our processing of your Personal Data, how can you exercise them and how can you contact us?

9. Your Personal Data's retention periods

10. Use of the Platform by minors and warning for the parents

11. Applicable Law

12. Updates to this Privacy Notice

1. What is this Privacy Notice about?

1.1 The Coca-Cola Company and its affiliates respect your privacy. They want you to be familiar with how they collect, use and disclose information directly or indirectly relating to you as an individual ("Personal Data"), and the rights that you have in this regard.

1.2 This privacy notice (the "Privacy Notice") describes how NV Coca-Cola Services SA, a company with registered office at Chaussée de Mons 1424, 1070 Brussels ("CCS", "we", "our" and "us"), processes your Personal Data collected in relation to chatbot that we activated on Facebook (the “Platform”) in order to help and inform about the contest provided on https://register.coca-cola.com/gb/jbb18 (the “Contest”).

1.3 The Platform simulates a conversation on your Facebook Messenger, enables you to enter the promotion and answers questions that will be submitted to you on the Platform.

1.4 CCS is the data controller (within the meaning of the EU Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, hereinafter referred to as the "General Data Protection Regulation") responsible for the processing of your Personal Data described in the Privacy Notice.

1.5 On the Platform you can receive invitations to visit the Contest website (and its country variations), which is available on https://register.coca-cola.com/gb/jbb18. In this case, the privacy

policy available until 23.59 on 28/11/18. We encourage you to read this privacy policy carefully as well.

1.6 You can contact us by using the contact information provided in section 8 of this Privacy Policy.

 

2. What Personal Data do we collect about you?

a. The Personal Data we collect and process about you

When you use the Platform, we collect and process your page-scoped user ID (the "PSID") and your name. The PSID is a unique ID that you are assigned to for each Facebook page you start a conversation with.

In addition to your PSID and name, we collect the following Personal Data:

•                 The conversation flow between you and the Platform and the responses you submit to the Platform. Only quick replies will be collected. Quick replies mean the replies that comply with the predetermined model conversation flow on the Platform and that allow the conversation on the Platform to be carried on. Replies different from the abovementioned quick replies will be automatically ignored, in order not to collect data that are not necessary to the functioning of the Platform. Messages that the platform doesn’t understand can be used in order to optimize the system but remain anonymous.

•                 Information pertaining to your use of the Platform (e.g. when, how many times and for how long you interact with the Platform, how many times you click on an item, if you download items).

•                 Timezone and locale, to personalize the conversations and be able to send you messages if you wish to be notified.

•                  JWT Authorization Code provided by Facebook

We do not access and collect any other personal data than those set out above.

b. Sensitive Personal Data

We do not collect and process Personal Data pertaining to your:

•                  racial or ethnic origin;

•                  political opinions;

•                  religion or philosophical beliefs;

•                  health or medical condition;

•                  criminal background;

•                  trade union membership;

•                  genetic or biometric data;

•                  sexual life or orientation;

(referred to as "Sensitive Personal Data").

We ask that you not send us, and not to disclose, any Sensitive Personal Data through the Platform or otherwise to us.

 

3. How do we collect your Personal Data?

We collect your Personal Data as follows:

a. through the Platform: we collect your Personal Data when you access and use the Platform;

4. How do we use your Personal Data?

a. Respond to your inquiries and requests:

•                 To respond to your inquiries, complaints and suggestions regarding the Platform, that you send us.

Legal basis for processing: our legitimate interests to handle, adequately and in a timely manner, customers' inquiries, complaints and suggestions regarding the Platform.

b. Inform you about changes to this Privacy Notice:

•                To send you information about the changes to the Platform's terms and conditions and to this Privacy Notice.

Legal basis for processing: our legitimate interests to inform you well in advance of those changes taking effect.

c. Games, submitting responses, promotional and advertising messages, interacting with the chatbot:

•                To allow you to play games on the Platform also for promotional and marketing purposes, answer questions that will be submitted to you on the Platform, receive promotional and advertising messages, interact with the chatbot on the Platform.

Legal basis for processing: your consent.

You can let us know that you wish to withdraw your consent by email, by calling us or writing to us using the contact information listed in section 8 of this Privacy Notice. All Personal Data will be deleted.

d. Data analytics to derive trends & improve Coca-Cola products and services:

•                We collect your Personal Data to measure your engagement with the Platform (e.g. to know how you use the Platform, when you use it, if the conversation flow and the game you play on the Platform are successful for you) and derive consumption trends and patterns from this analysis. This helps us to know the Platform's users better and adapt our Platform to the identified preferences of the users, but also more generally Coca-Cola products and services.

Legal basis for processing: your consent

You can also let us know that you wish to withdraw your consent by email, by calling us or writing to us using the contact information listed in section 8 of this Privacy Notice. All Personal Data will be deleted.

e. Technical functioning of the Platform

•                We collect and use your Personal Data to technically administer the Platform and ensure that it functions properly.

Legal basis for processing: our legitimate interests in ensuring that the Platform properly functions from a technical / IT point of view.

f. Compliance with our legal obligations:

•                To comply with our legal obligations, legal proceedings or government authorities' orders which can include orders from government authorities outside your country of residence, when we reasonably believe that we are legally required to do so and when disclosing your Personal Data is strictly necessary to comply with the said legal obligations, proceedings or government orders.

Legal basis for processing: compliance with our legal obligations.

g. Lawful protection of our interests:

•                To lawfully enforce our terms and conditions, protect our operations or those of any of our affiliates, protect our rights, privacy, safety or property, and/or that of our affiliates, and allow us to pursue available legal remedies or limit the damages that we may sustain.

Legal basis for processing: our legitimate interests to lawfully protect our organization.

h. Mergers, acquisitions and other corporate operations:

•                To perform any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings), and in that context transfer your Personal Data from our organisation to another organisation.

Legal basis for processing: our legitimate interests to conduct the corporate strategy.

5. To whom your Personal Data are disclosed?

Your Personal Data are disclosed to the following recipients

a. SaaStory (Itsalive.io): which collects and manages your Personal Data and, in particular, your PSID, the replies you submit to the Platform and the conversation flow between you and the chatbot on the Platform.

b. Amazon Web Services (AWS) : we use AWS servers located in Ireland, for cloud storage of Personal Data.

c. CCA International which is handling the Chatbot.

d. Google Ireland Limited (Chatbase) that handles analytics.

e. Competent authorities: we can disclose your Personal Data to the extent strictly required by the law to competent authorities.

 

6. What transfers of Personal Data outside the European Economic Area do we carry out?

6.1 We do not transfer your Personal Data outside the European Economic Area.

 

7. What about links to other websites, applications, platforms and alike?

7.1 When using the Platform, you can come across links to other websites, applications and platforms that are not provided by us but by other companies. We are not responsible for such websites, applications and platforms, and this Privacy Notice does not apply to them. You should read the policies and rules that such companies have posted on their websites, applications and platforms to understand how they protect your privacy.

7.2 We are also not responsible for the collection, usage and disclosure policies and practices (including data security practices) of other organizations, such as Facebook, Twitter, Instagram, Pinterest, Apple, Google, Microsoft, RIM or any other app developer, app provider, social media platform provider, operating system provider, wireless service provider or device manufacturer, including any Personal Data you disclose to other organizations through or in connection with the Platform.

 

8. What are your rights as regards our processing of your Personal Data, how can you exercise them and how can you contact us?

a. Your rights as regards our processing of your Personal Data

As regards our processing of your Personal Data described in this Privacy Notice, you have the right under certain circumstances:

•                to be provided with a copy of any Personal Data that we hold about you, and receive information about our processing of your Personal Data;

•                to require us to update or correct any inaccurate Personal Data, or complete any incomplete Personal Data;

•                to require that we stop processing your Personal Data for the purpose of performing data analytics to derive consumer behaviours’ trends and patterns and improve the Platform and Coca-Cola products and services.

You also have the right, in certain circumstances:

•                 to object to the processing of your Personal Data;

•                 to require us to delete your Personal Data;

•                 to restrict our processing of your Personal Data; and

•                to require us to transmit certain of your Personal Data to you or to transfer or have them transferred to another data controller.

b. Contacting us to exercise your rights

If you wish to exercise any of your above rights, you can contact us using one of the options below.

•                You can send us an email to the following address: [gbcic@coca-cola.com]

•                 You can call us on: [0800 22 7711]

•                You can write to the following postal address: [Consumer Interaction Centre, PO Box 73229, LONDON, E14 1RP

Please specify clearly which information you would like us to provide you with, review, amend, stop processing, or delete.

You can also contact us if you have any questions or queries as regards our processing of your Personal Data, using the contact options above.

c. Our Data Protection Officer (DPO) contact details

You can contact our Data Protection Officer (DPO) at the following address: DPO-Europe@coca-cola.com

d. Right to lodge a complaint to the competent data protection authority

You have a right to lodge a complaint with the relevant supervisory authority (in particular in the Member State of your habitual residence, place of work or place of the alleged infringement), if you are of the opinion that any of your Personal Data is processed in a manner constituting an infringement of the EU General Data Protection Regulation n°2016 / 679 dated 27 April 2016.

 

9. Your Personal Data's retention periods

9.1 We keep your Personal Data accurate and up-to-date. Once the purposes for which we have collected and processed your Personal Data have been attained, we delete your Personal Data.

9.2 Personal Data will be retained for a period appropriate to the purpose for which it was collected and is, by default, destroyed at the end of a 24 months period following the last interaction with the chatbot.

 

10. Use of the Platform by minors and warning for the parents

The Platform is directed to individuals who are 13 years and above with parents’ consent until 16 years old. We request that other individuals under 13 do not provide Personal Data through the Platform. We reserve the right to request evidence of parental consent at any time to permit the processing of Personal Data relating to minors.

For some sites or apps where you may be redirected there may be age restrictions, based on what is appropriate viewing for certain ages or what is legally permitted by law. Where specific age restrictions apply, it will be clearly marked on the relevant site and we may ask questions to verify your age before proceeding.

 

11. Applicable Law

This Privacy Notice is governed by and shall be construed in accordance with the laws of Belgium and any other mandatory provisions of applicable laws in the European Union.

 

12. Updates to this Privacy Notice

You can find out when this Privacy Notice was last amended by checking "LAST REVISED" at the top of this page.

All contemplated changes to this Privacy Notice will be communicated to you well in advance of the changes actually taking effect.

You can print, download or otherwise retain a copy of this Privacy Notice (and of any revised version) for your records.

Copyright 2018 The Coca-Cola Company. All rights reserved.