HEINEKEN UK Colleague Rewards Privacy Policy

NTRODUCTION and IDENTIFYING the CONTROLLER of your personal data  

Star Pubs Trading Limited and Heineken UK Limited (collectively referred to as “we“, “us“, or “our” in this privacy policy), are responsible for processing your personal data in relation to the HEINEKEN UK Colleague Rewards Scheme (the “Rewards Scheme”). This policy is in addition to, and so to be read in conjunction with, our ‘privacy statement for employee data’ and any supplementary notices provided to you from time to time. 

Our Contact Details: 

If you have any questions about this privacy notice or our processing activities, we can be contacted as follows: 

  • Mail: 6 St Andrew Square, Edinburgh, EH2 2BD, marked for the attention of the Privacy Officer; or  

WHAT DATA do we collect about you, HOW is it collected and for WHAT PURPOSE? 

We respect your privacy and are committed to protecting your personal data.  Personal data, or personal information, means any information about an individual from which that person can be identified.  

We will collect the following personal data in connection with (i) your registration for and use of your Rewards Scheme card (your “Card”); and (ii) the general administration of the Rewards Scheme. 

  • Name and Personnel ID: obtained directly from you so that we can keep a record of cardholders. 
  • Corporate email address: obtained directly from you so that (i) we can keep a record of cardholders and send you emails from time to time with updates about the Rewards Scheme; and (ii) you can activate your Card. 
  • Leaver data: obtained from the HEINEKEN UK People Function in connection with deactivating the Cards of leavers.  
  • Card usage data: collected for us by Zonal Retail Data Systems Limited, who assist us in administering the Rewards Scheme via their data collection widget on our Colleague Rewards website and their in pub EPOS technology. The Retail Star Pubs Marketing Team will use this data to create anonymised and aggregated reports so that we can analyse usage of the Rewards Scheme, including how many issued Cards are being actively used and the regularity of such use, the times at which Cards are being used and the value of rewards claimed and the relative success of different rewards that are made available from time to time. This will assist us in developing a sustainable Rewards Scheme that offers real value and reward to colleagues.  You should note that, while we will not be routinely monitoring usage of Cards on an individual basis, we reserve the right to do so if we reasonably believe that the Rewards Scheme has been misused or abused by an employee or that the terms and conditions of the Rewards Scheme have otherwise been breached. 

 

We do not knowingly collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sexual orientation, political opinions, trade union membership, information about your health or genetic and biometric data, nor do we collect any information about criminal convictions and offences).  

We will only use your personal data for the purposes stated above, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. 

What is our LEGAL BASIS for collecting your Data? 

information on the 6 available lawful bases on the Information Commissioner’s Office website (https://www.ico.org.uk).  When we collect and use your information, we do so under one of the following:- 

  1. Performance of the terms of our contract with you – i.e. the Rewards Scheme Terms & Conditions which we have entered into with you; or 
  1. We have a legitimate interest as a business to analyse the usage and success of the Rewards Scheme so that we can develop a sustainable Rewards Scheme that offers real value and reward to colleagues. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law); or 

WHO do we share your personal data with? 

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. Where the third parties act as processors on our behalf, we only permit them to process your personal data for specified purposes and in line with our instructions. 

In relation to the Rewards Scheme, the following party processes your personal data on our behalf: 

  • Zonal Retail Data Systems Limited (“Zonal”), who assist us in administering the Rewards Scheme via (i) their data collection widget on our Colleague Rewards website and (ii) their in pub EPOS technology. 

WHERE will my personal data be stored? 

The third parties we share data with are based in the UK and are subject to UK Data Protection Laws. However, in providing their services to us, they may engage certain sub-processors who are located in the European Economic Area (EEA) and other parts of the world.  

Whenever we transfer your personal data out of the UK or the EEA, we take steps to ensure that the same level of protection is afforded to it by ensuring one of the following safeguards is put in place: 

  • We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission and/or the UK Information Commissioner’s Office; and 
  • Where we use certain service providers, we may use specific contracts approved by the European Commission and/or the UK Information Commissioner’s Office, which give personal data the same protection it has in Europe (or the United Kingdom).  

How SECURE is my data? 

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees and other third parties who have a need to know. They are subject to a duty of confidentiality. Unfortunately, no transmission of information over the internet can be completely secure.  

How LONG will my personal data be used for? 

We will retain your personal data for as long as necessary for the purposes listed in this privacy policy. Your personal data that is collected and processed in order to activate your Card will be retained until your Card is deactivated. When your Card is deactivated, your Card usage data will be retained, but it will anonymised and deleted after 13 months. In any event, all personal data will be deleted or returned to us in case our contract with Zonal is terminated. 

What are my RIGHTS? 

Under data protection laws, you have various rights which are set out below. You can also find more detailed information on the Information Commissioner’s Office website (https://www.ico.org.uk). The rights available to you depend on our reason for processing your personal data. You are not required to pay any charge for exercising your rights, although we may charge a reasonable fee if your request is unfounded, repetitive or excessive. We have one month to respond to you (unless you have made a number of requests or your request is complex, in which case we may take up to an extra two months to respond). Please note that, where we ask you for proof of identification, the one-month time limit does not begin until we have received this. If we require any clarification and/or further information on the scope of the request, the one-month deadline is paused until we receive that information.  

  1. Right of access. You have the right to ask us for copies of your personal data. This right always applies. There are some exemptions, which means you may not always receive all the information we process.   
  1. Right to rectification. You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.   
  1. Right to erasure. You have the right to ask us to erase your personal data in certain circumstances.   
  1. Right to restriction of processing. You have the right to ask us to restrict the processing of your information in certain circumstances.  
  1. Right to object to processing. You have the right to object to processing of your personal data where we are relying on a legitimate interest or conducting direct marketing.  
  1. Right to withdraw consent. Where we are relying on consent to process your personal data, you may withdraw it at any time. This will not affect the lawfulness of any processing carried out before you withdraw your consent.  
  1. Right to data portability. This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another or give it to you. The right only applies if we are processing information based on your consent.  

If you have concerns about how we used your personal data, you have the right to make a data protection complaint directly to us. Please use the contact details at the start of this privacy policy. 

We will acknowledge your complaint and investigate it without undue delay. We will keep you informed of the progress and notify you of the outcome.  

If you are not satisfied with our response, you have the right to escalate your complaint to the UK supervisory authority for data protection issues:  

Information Commissioner’s Office 

Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 

Helpline number: 0303 123 1113 

ICO website: https://www.ico.org.uk  

 

This version was last updated in July 2026.