PRIVACY POLICY – NEW ZEALAND

PURPOSE

The below policy sets out how Imperial Brands ("IB") complies with New Zealand laws when it retains personal information it has obtained from you.

References to “we”, “us” and “our” throughout this document are all references to IB.
OVERVIEW

At IB, we believe an individual's right to keep their personal information safe and secure is of paramount importance.

IB is committed to protecting and maintaining the privacy, accuracy, and security of your personal and financial information.

When IB collects and stores personal information about you, it does so in compliance with New Zealand privacy legislation, in particular:

• the Privacy Act 2020 (NZ); and
• the information principles (“Principles”) which form part of the Privacy Act.
MORE INFORMATION

If you would like to know more about privacy law in New Zealand:

• Contact the Office of the Privacy Commissioner on 0800 803 909 or enquiries@privacy.org.nz; or
• Access the Office of the Privacy Commissioner’s website: https://www.privacy.org.nz

If you would like to know more about this privacy policy, or wish to discuss a privacy related issue or complaint, please contact IB’s Privacy Officer at anzprivacy.officer@impbrands.com or on +64 4 587 1583.

HOW THE PRINCIPLES APPLY TO IB

The application of the Principles to our business and our relationship with you is summarised in this privacy policy.

1.1 How we collect your personal information
• Personal information refers to information that identifies you and otherwise includes information maintained by the Registrar-General under the Births, Deaths, Marriages, and Relationships Registration Act 1995. However, we only collect information relevant to our business relationship with you. The information we collect will include contact details, personal details, financial information and information about your dealings with our company (“personal information”).
• We will collect personal information directly from you where possible. If we collect persona information about you from external sources we will let you know as soon as practicable. We do not collect sensitive information from you or about you, such as information relating to your health.
• We also use automatic data collection tools including cookies and session tools in connection with our website. The information collected may include the IP address you are using and the pages accessed on our website. We use this information to maintain, secure and improve our website and to enhance your experience when using it. If you would like to know more about this, please read our Cookie Policy.
• If we receive personal information about you that we did not ask for we will assess whether retention of this information is permitted under the Principles. If it is not permitted we will destroy the information or ensure that it is de-identified.
• If the information that we request from you is not provided, we may not be able to process your request for products and services, or any request for further information.

1.2 How we use your information
We will limit the use of your personal information to:
• Recommending to you, or providing you with, products and services that you request from time to time.
• Carrying out our business, including marketing, sales, and distribution and all activities that relate to this.
• Fulfilling our legal requirements (for example, disclosure to law enforcement agencies or the courts).
• Any use and disclosure with your consent and for any other purposes disclosed to you at or around the time of collection.
• Offering you products and services that we believe meet your needs. If you do not wish to receive these offers please email us at anzprivacy.officer@impbrands.com and request to opt out or call our Privacy Officer on +64 4 587 1583. We will act promptly on any such request.

1.3 Who will use your information?
• We provide your personal information to other select organisations that perform certain functions or operations for us with your consent.
• These organisations include, but are not limited to: legal representatives, accountants and third party service providers. Some of our third party service providers are located outside New Zealand.
• We bind our legal representatives, accountants, local and overseas service providers to the same high standard of care as we do ourselves and enforce these requirements through contractual agreements. These organisations are not permitted to provide your personal information to anyone else or to store it.
• We also share your personal information with companies in the Imperial Tobacco Group ("ITG").

1.4 Overseas Recipients
• We share your personal information in a de-identified form to our global parent in the United Kingdom. Our global parent is bound by strict UK data protections laws and our UK privacy policy which can be accessed at: https://www.imperialbrandsplc.com/privacy-and-cookies.
• Our global parent is also bound by the Principles when dealing with personal information relevant to our New Zealand business.
• We may disclose your personal information to other overseas entities and third party service providers in the course of providing our products and services to you. We will only disclose your personal information to a third party service provider that is located in another country, if we believe they are subject to a law or binding scheme that provides overall comparable safeguards to your personal information as those afforded by the Principles. We also ensure that such entities are bound by and agree to comply with our privacy standards.
• Before we disclose your information to an overseas recipient, we will take reasonable steps to ensure that the overseas recipient will not breach the Principles.
• Under the Privacy Act, should we disclose your personal information to an overseas recipient and that recipient breaches the Principles, we accept that we are accountable for that breach.

1.5 Withdrawing your consent

• Please contact our Privacy Officer if you wish to withdraw your consent to any use or disclosure of your personal information at any time. We will act promptly upon receiving notice that you withdraw your consent.
• Once your consent is withdrawn we can no longer rely on your past consent for any future use or disclosure.

1.6 Your information is secure

• We will use up-to-date techniques and processes which meet current industry standards to ensure that your personal information is securely stored, and we take steps to ensure that your personal information is protected from misuse, loss, or unauthorised access or disclosure. Personal information is stored in secured premises or in electronic databases requiring logins and passwords. If you would like to know more about this, please contact us.
• Only our employees and where relevant employees of ITG and those who perform services on our behalf will have access to and are authorised to handle your personal information.

1.7 Retention of your personal information
• We will not retain any of your personal information for any longer than is required by us, except to fulfil our legal obligations.
• We are generally legally required to retain account information for eight years after an account is closed. However, we may retain some information for shorter or longer periods than this to comply with any legal requirements and meet the needs of our business.

1.8 You have access to your information
• We will, with your help, keep your personal information accurate, complete and up to date.
• You can access most of the personal information we hold about you and request corrections in the event that you believe it is incorrect. We will process such a request within a reasonable time. This right is subject to some exceptions. For example, you may not obtain access to information relating to existing or anticipated legal proceedings.
• You can request access to your information by visiting any of our branches or contacting the Privacy Officer on +64 4 587 1583. This service is free unless the information you request access to requires significant research or preparation time. Before we act upon requests of this nature, we will tell you how much this service will cost.
• If we refuse access or refuse to make a correction, you may contact our Privacy Officer and ask that they review the decision.

1.9 What to do if you think we've made an error?
• IB is committed to the protection of your privacy, and our policies, processes and systems have been developed with this intention. We have developed strict guidelines in order to be better placed to protect your personal information.
• If you identify an error or inaccuracy in the personal information we hold about you, we will take all reasonable steps to correct the error, or delete the information where it is no longer required by us for business or legal purposes.
• Sometimes human errors occur. If you think we have not lived up to our commitment, we invite you to contact our Privacy Officer on +64 4 587 1583.

1.10 Complaints and data breaches
• Our objective is to respond to any complaint or concern relating to the personal information we hold about you, within five working days.
• In the event of a data breach, we have systems and processes in place which are designed to mitigate the impact of the breach. In the event of a ‘privacy breach’, we are required to comply with mandatory reporting requirements set out in the Privacy Act 2020 (NZ). These requirements include reporting the breach of your personal information to you, and to the Office of the Privacy Commissioner.
• For more information about our commitment to securing your personal information, contact our Privacy Officer on +64 4 587 1583.
• If you remain dissatisfied with our response to any complaint or request, formal complaints can be made to the Office of the Privacy Commissioner at 0800 803 909 or enquiries@privacy.org.nz or via their website: https://www.privacy.org.nz

1.11 Things you should know

The information in this Privacy Policy is current as at February 2023 and is subject to change.

This policy reflects updates to the law in New Zealand brought about by the Privacy Act 2020, which commenced in December 2020.
This policy incorporates the relevant provisions of the Privacy Act 2020 and the Principles.
If our policy surrounding the release of personal information to overseas entities changes, this policy will be amended with notice to you.