What is Personal and Sensitive Data?

Personal data means any information that may be used to identify you on its own or, when combined with other information, will enable identification. Sensitive data may include data revealing racial or ethnic origin, or data concerning your health.

We may collect, use, store and transfer different kinds of personal and sensitive data about you including the following:

• Identity Data including first name, last name, username or similar identifier, date of birth and gender.
• Contact Data including your address, phone number and email address.
• Health Data including any information about your physical or mental health from how you shop with us or use our services.
• Technical Data including internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access our website, apps, and services.
• Profile Data including your username and password.
• Usage Data including information about how you use our website, apps, and services.
• Referral Data including the person you referred or have been referred by 

Security – Keeping your Data Safe
 

Data security is never taken for granted and H&B invest significantly in security to constantly update our systems and procedures. Our security team works with a dedicated Data Protection Officer to ensure your personal data remains a top priority.
When you shop with us, your personal data is securely stored on Amazon AWS servers located in Dublin, Ireland. All data is encrypted during transmission and storage according to the highest industry security standards and is PCI/DSS compliant.
If you want more details about what we do to keep your data secure, please contact the GDPR team on GDPR@hollandandbarrett.com

Sharing Data within the Group

The H&B group comprises a number of separate legal entities. We will responsibly share data between the group where the reason for doing so is defined and aligned to the original purpose for which we collected your data, and for their digital services and for analysis purposes.

Data retention – How Long do you Keep my Data?

Your personal information will only be retained for as long as necessary to fulfil the purposes for which it was collected, including for purposes of satisfying any legal, accounting, or reporting requirements. Sometimes we might have a Legitimate Interest to hold your data for longer than normal, such as in the case of a dispute or where it is necessary to retain account and order information for any periods required by law (including local tax requirements).

To determine the appropriate retention period for personal data, we follow the guidelines where they are available, including from the supervisory authorities in the relevant country. We take into consideration additional factors such as legal requirements, exceptions, and the potential risk of retaining your personal data.

Anonymous data is not personal data. Our anonymisation process follows guidance and best practice methods to ensure that the data is truly anonymous.

We are Holland & Barrett International Limited (company registration number 04515115). Our address is Samuel Ryder House, Barling Way, Eliot Park, Nuneaton, Warwickshire, CV10 7RH

Our Group Companies include:

• Holland & Barrett Limited (Republic of Ireland)
• Holland & Barrett Retail Limited
• Holland & Barrett BV
• Holland & Barrett NV

We have websites that trade under a brand but are ‘Powered by Holland & Barrett’. If you are uncertain if a website is a genuine Holland & Barrett brand, contact gdpr@hollandandbarrett.com with the name of the website in question and we will confirm its authenticity.

We are registered with the Information Commissioner’s Office in the United Kingdom (the UK supervisory authority for data protection issues. Our registration number is Z5145046.

We have hired a GDPR team who pursue best practices with GDPR and applicable privacy law and ensure that we only collect and process the minimal amount of data necessary. When we process your personal data, it is only used for the same, or compatible reason, that we collected it in the first place.
 

We have appointed a GDPR team. Please contact the GDPR team using the details set out below. Our GDPR team will be happy to help with any questions that you may have.

You have several rights in relation to your personal and sensitive data as provided by the UKGDPR, the Data Protection Act 2018 and the General Data Protection Regulation 2016 (GDPR).

• The right to be informed: This relates to what information we are required to provide you about data processing. This Privacy Notice provides this information.
• The right of access: You have the right to access personal and sensitive information that we hold about you.  This is known as a Subject Access Request. You can make your request with us on our website using this link. Subject Access Request
• The right to rectification: You have the right to obtain from us, without undue delay, the rectification of inaccurate or incomplete personal data that we hold concerning you.
• The right to erasure: You have the right to request the deletion or removal of personal data where there is no compelling reason for its continued processing. We have the right to refuse to comply with a request for erasure and if this applies, we will tell you the reason why. You can make this request on our website using this link. Erasure Request
• The right to restrict processing: Subject to exemptions, you shall have the right to restrict processing in various areas.
• The right to Data Portability: You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format.
• The right to Object: You have the right to object to processing on grounds relating to your personal circumstances. In such cases we will stop processing unless we can demonstrate (a) compelling legitimate grounds which override your interests, rights, and freedoms and (b) the processing is for the establishment, exercise, or defence of legal claims. This right extends to processing for the purposes of direct marketing (including profiling) which must be stopped outright.
• The right to object to automate decision making including profiling where there may be a legal or materially similar impact on you
• The right to Withdraw your Consent for Data Processing
• The right to make a complaint: You can make a complaint at any time to the supervising authorities below. We would, however, appreciate the opportunity to deal with your concerns directly before you approach them, so please contact us in the first instance.

We have several stores, online shopping websites and apps which you may use to buy products or services from us, or simply browse for information.

When you purchase from us, we need to collect information about you to process the order. We may also use that information to learn more about your browsing and buying habits so that we create tailored products and services we think you’ll be interested in.

We want to make this as clear as possible, so we’ve made a brief list below that summarises the personal data we collect. We also set out the "legal basis for processing", i.e., to tell you on what grounds we are allowed to use your information. The legal basis for each purpose is that (a) we have your consent for the use of your personal information, or (b) that we need to use your personal information to perform a contract with you, or (c) that the use of your personal information is necessary for our legitimate interests (in which case we will explain what those interests are).

As part of our recruitment process, we collect and process your personal information. We are committed to protecting your privacy and ensuring your data is handled in accordance with the UK General Data Protection Regulation (UK GDPR).

Lawful Basis for Processing: The primary lawful basis under the UK GDPR for processing your general personal data (such as your name, contact details, work experience, and education) is Article 6(1)(b) - 'contract'. This is because processing your application is a necessary step at your request prior to potentially entering into an employment contract with us.

Special Category Personal Data: To help us ensure equality of opportunity and to monitor diversity, we may also ask you to provide certain special category personal data. This may include information relating to your ethnicity, racial origin, and/or sexuality. We will only process such special category personal data with your explicit consent, in line with Article 9(2)(a) of the UK GDPR. You are not obliged to provide this information, and it will not affect your application if you choose not to. If you do provide explicit consent for us to process this special category data, please be aware that you have the right to withdraw your consent at any time. You can do this by [Specify how they can withdraw consent – e.g., contacting a specific email address]. Withdrawing your consent will not affect the lawfulness of any processing carried out before you withdrew your consent.

International Data Transfers: To support the systems and services used for our recruitment process, some of your personal information may be transferred to, stored, or processed in countries outside the United Kingdom, including Australia. We want to assure you that we have taken all necessary measures required to ensure that your information remains protected and your rights are upheld when it is transferred internationally. This includes implementing appropriate safeguards, such as [e.g., Standard Contractual Clauses approved by the UK Information Commissioner's Office or an International Data Transfer Agreement], to ensure your data receives an equivalent level of protection as it would within the UK.
  
Data Security and Your Rights: We are dedicated to keeping your personal information secure. We have implemented comprehensive technical and organisational security measures designed to protect your data from unauthorised access, alteration, disclosure, or destruction. We have taken all the necessary measures required to ensure that your information and your rights under data protection law are robustly protected throughout our processing activities.
 

Holland & Barrett are working with a supply chain mapping tool which tracks our products right down to farm level to ensure we have visibility and traceability within our supply chains.

So that you can make full use of the interactive features on our website, your computer, mobile phone or other device (all referred to here as device) will need to accept cookies. 

Here you can see what cookies may be sent to your device by hollandandbarrett.com and what we use each cookie for. You can set your browser to reject cookies (see the 'Help' menu of your browser to find out how to do this), but please bear in mind that if you do this, certain personalised features of this website cannot be provided to you. 

When you visit our website or apps, we’ll ask you what data we can collect about you. We use five principal types of cookies: 

Using cookies and mobile Ad identifiers, we share information with Google for the purpose of delivering personalised and non-personalised advertising. You can read more about how Google uses your data here.

Strictly Necessary

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information. 

Performance

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site and will not be able to monitor its performance. 

Functional

These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies, then some or all these services may not function properly. 

Targeting

We may set these cookies on our site or through our advertising partners. These are used to build a profile of your interests.  

Using information that identifies you, such as your IP address or client ID, we will track which pages you visit, transactions you make, and ads you click. In addition to your email address, we can share information with third parties, such as Google, to determine which advertising brought you to our website. If you do not allow these cookies, you will experience less targeted advertising.  

You can see the full list of partners that we share data with here. You can also manage or withdraw consent for part or all optional cookies here: Cookie Settings. 

Strictly Necessary

Performance 

Functional  

Targeting 

Unknown Cookies

 

Many of our external third parties are based outside the European Economic Area (EEA) so their processing of your personal information will involve a transfer of data outside the EEA.Whenever we transfer your personal information out of the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

We will only transfer your personal information to countries that have been deemed to provide an adequate level of protection for personal information by the European Commission.
For further details, see European Commission: Adequacy of the protection of personal information in non-EU countries.

Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal information the same protection it has in Europe.
For further details, see European Commission: Model contracts for the transfer of personal information to third countries.

Where we use processors in countries outside of the UK and EEA, we first see if they have a adequacy decision from the EC, which means data subjects whose data are processed in those countries enjoy the same level of protection as in the EU. If no adequacy decision exists, we ensure those same levels of protection are in place through legal transfer mechanisms such as Standard Contractual Clauses or the UK’s International Data Transfer Agreement (IDTA).

Please contact gdpr@hollandandbarrett.com if you want further information on the specific mechanism used by us when transferring your personal information out of the EEA.

All Holland & Barrett Services operate under H&B Retail Limited who is the Data Controller. Our address and contact details under the ‘Who We Are’ section at the beginning of this notice.

Our services online and through mobile apps empower you to better understand your health and wellness. Using technology, subject matter experts and helpful tips and recommendations, the app works to help you achieve your wellness goals.

H&B &Me analyses your health and lifestyle data in order to support wellness goals, for example, it calculates your biological age, and monitors activities such as sleep and exercise to present insightful trends.

To deliver the service, we need to collect a wide range of health data about you. H&B only uses the health data collected to provide this service, and we never sell or share this information with third parties that are not participating in the delivery of the service.

If you book a blood test through us we will share personal information, limited to only that which is strictly necessary, with the third party qualified nurses who collect the blood samples on our behalf.

Where we partner with other companies, such as a laboratory for testing samples & technical for calculations of biological age and tracking, the partner may have a legal or regulatory obligation to be an Independent Controller for some information provided. and may, as a result, have their own retention obligations they need to comply with for personal data.

To use The Service, you must have an account, which you can create inside the app. When you do this, we’ll ask you to give us consent so we can use your personal data for one or more specific purposes. We acknowledge that consent must be freely given, but without consent for processing your health information, delivery of the intended service will not be possible.

Withdrawing Consent

If you decide you want to withdraw your consent from the service, you can do this easily through the settings menu in the App. Withdrawing consent will result in the erasure of any data we hold about you, which we are not legally obliged to retain. If the option in our app exists to delete your data, this is also considered equivalent to withdrawing consent.

Where you receive emails about the service, they will have instructions on how to unsubscribe or withdraw consent.

Sharing Data to Deliver the Service

To deliver the service, we rely on partners that are experts in their field, such as phlebotomy (blood testing). When we enter into agreements with those partners, we put technical and organisational measures in place that ensure they only have the minimum data necessary to fulfil their purpose, and that the data is processed securely and in line their obligations under the agreement.
We share some data with partners that may operate under a legal requirement to process and retain personal data, and in those cases, they will be an Independent Controller, along with Holland & Barrett.

Data We May Process When You Use this Service

How Long we Hold Your Data

Health Data is a ‘Special Category’ under the GDPR, meaning that we must consider carefully how we capture and use this data. Here’s what we do in a nutshell.

1. We ask for your ‘Explicit Consent’. This means the requests collecting health data look different than other requests for consent. We want it to be clear when we are asking for any sensitive data and be sure to explain how we use it, and why we need it.
2. Any partners we use in processing health data must pass our internal comprehensive security and compliance tests. We only share your data with leading companies in their field, and only when we are satisfied that they meet our standards.
3. We commit to you that your data is never sold on, rented out, or shared with third parties for financial advantage. We respect that you’ve trusted us to do the right thing, so we’re committed to earning and retaining that trust.