Worldwide Privacy Notice BRITISH AMERICAN TOBACCO NORWAY AS You can read our privacy notice in English or in Norwegian. Please choose the language you prefer. Du kan lese personvernerklæringen på norsk eller engelsk. Vennligst velg det språket du foretrekker. EnglishNorsk This Privacy Notice explains how British American Tobacco Norway AS ("we", "us" or “BAT”) processes your personal information as a data controller depending on your relation to BAT. We are always committed to protecting and respecting your privacy and to process your personal data in accordance with relevant data protection legislation, i.e. the General Data Protection Regulation (the “GDPR”) and national legislation. If you have any concerns or questions regarding BAT’s processing of your personal data, please do not hesitate to contact us using the below listed contact information. 1. DATA CONTROLLER The entity responsible for the processing of your personal information is: British American Tobacco Norway AS P.O. Box 3944 Ullevaal Stadion 0806 Oslo Company registration no.: 979919042 Email: gdpr_emails@bat.com Phone: +47 22 08 10 00 2. DESCRIPTION OF THE PROCESSING In the following tables you will find information about how BAT processes your personal data depending on your relation to BAT and the purposes of which we process your personal data. In the tables you will find information on how we process your personal data, including information on our purposes with processing, the categories of personal data we process about you, how we collect your personal data, the legal basis on which we rely on when processing your personal data, information on the parties that we may share your personal data with and information on how long we retain your personal data. You can choose between information on how we process your personal data, when: you communicate with us and our customer service you are a customer, supplier or other third-party representative Please choose the table that is relevant for you. When communicating with us and our customer service When you are a customer, supplier, business partner or other third-party representative 3. TRANSFERS TO COUNTRIES OUTSIDE THE EU/EEA In some cases, we will be transferring personal data to countries outside the EU/EEA. Such transfers will take place on the basis of the following legal basis: a) The country/countries has/have been deemed by the Commission of the European Union to have an adequate level of protection of personal data, i.e. the country is a “secure/adequate third country” b) The country/countries has/have not been deemed by the Commission of the European Union to have an adequate level of protection of personal data. We will provide appropriate safeguards for the transfer: through the use of "Model Contracts for the Transfer of Personal Data to Third Countries", as published by the Commission of the European Union, or any other contractual agreement approved by the competent authorities. You may obtain a copy of the contract/agreement by contacting us at gdpr_emails@bat.com. c) In the absence of a decision that the country is secure/adequate and appropriate safeguards as mentioned above the transfer might in some, however limited cases take place if i) you have given your consent to the transfer, ii) the transfer is necessary for the performance of a contract between you as a data subject and BAT as data controller or the implementation of pre-contractual measures taken at your request, or iii) the transfer is necessary for the conclusion or performance of a contract concluded in the interest of you as a data subject between BAT as the controller and another third party. 4. AUTOMATED DECISIONS We will not use automated decision-making pursuant to GDPR article 22. 5. MANDATORY INFORMATION Some of the information we process about you might be mandatory for us to collect in order to provide you the service that you request, e.g. when buying or receiving our products it is mandatory for us to collect certain information about you to sell you the products as well as it is mandatory for you to provide us with certain information with respect to customer service. The consequence of not providing us any mandatory information is however alone that we will not be able to provide you the requested service. 6. YOUR RIGHTS You have the following rights: • You have the right to: - request access to your personal data (GDPR article 15) - request rectification of your personal data (GDPR article 16) - request erasure of your personal data (GDPR article 17) - have the processing of your personal data restricted (GDPR article 18) - receive your personal information in a structured, commonly used and machine-readable format (data portability) (GDPR article 20) If processing of your personal information is based on your consent, you have the right to withdraw your consent at any time. Your withdrawal will not affect the lawfulness of the processing carried out before you withdrew your consent. You may withdraw your consent by contacting us at gdpr_emails@bat.com and +47 22 08 10 00. If you have given your consent in relation to cookies and you wish to withdraw your consent , please also see our cookie overview and policy. Furthermore, you have the right to object to processing of your personal data as follows. If processing of your personal data is based on article 6(1)(e) or article 6(1)(f), see above regarding legal basis, you have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data. Where your personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data about you for such marketing. You can take steps to exercise your rights by contacting us at gdpr_emails@bat.com and +47 22 08 10 00. There may be conditions or limitations on these rights. It is therefore not certain that for example you have the right of data portability in the specific case - this depends on the specific circumstances of the processing activity. You may also always lodge a complaint with the local data protection supervisory authority: The Norwegian Data Protection Agency, Datatilsynet Postboks 458 Sentrum 0105 Oslo Email: postkasse@datatilsynet.no Phone: +47 22 39 69 00 Last updated: 29 December 2020 Accessibility Conditions of use Privacy Notice Cookie policy © BAT Norway