
PRIVACY POLICY
Welcome to Heineken UK Limited’s privacy notice.
-
Heineken UK Limited and Star Pubs & Bars Limited ("we", "us", or "our") are part of the Heineken group. When we mention "we", "us" or "our" in this privacy policy, we are referring to the relevant company responsible for processing your personal data. Unless we inform you otherwise, the controller of your personal data will be Heineken UK Limited. Where Star Pubs & Bars Limited is processing personal data for its own independent purposes, that entity will be a separate controller. If you have any questions about this privacy policy or our processing activities, we can be contacted as follows:
- Mail: 3 – 4 Broadway Park South Gyle Broadway Edinburgh EH12 9JZ, marked for the attention of the Privacy Officer; or
- Email: protectingyourdata@heineken.co.uk.
It is important that you read this privacy policy together with our cookie policy and any terms of use that apply to the services or website which are presented to you. This privacy policy supplements the other policies and is not intended to override them.
-
We respect your privacy and are committed to protecting your personal data. This privacy notice describes how we look after your personal data collected when you: (a) visit our website (“Website”); (b) provide it to us in to register your interest in or join the Star Retailer scheme (“Scheme”); or (c) generally engage with us including by contacting us with an enquiry or complaint, taking part in a competition or purchasing products or services (“Engagement”).
Personal data, or personal information, means any information about an individual from which that person can be identified. We collect this information directly from you during any Engagement, as well as automatically through your use of our Website. Depending on the nature of our engagement, we collect different categories of information about you from time to time which we have grouped together as follows:
- Identity Data – your name, username, wholesaler account number or similar identifier.
- Contact Data – business address, email address and telephone numbers.
- Applicant Data – information you provide when applying to join the Scheme.
- Technical and Usage Data - information about how you use our products and Website including your IP address and details about the devices you use to access our Website. Please review the cookie policy on our Website for further information on this.
- Marketing and Communications Data - preferences in receiving communication and marketing from us.
We also collect, use and share Anonymised Data such as statistical or demographic data which is not reasonably likely to reveal your identity (directly or indirectly). For example, we may receive aggregated usage data detailing the percentage of users accessing our Website. If we combine or connect Anonymised Data with other data so that it can directly or indirectly identify you, the combined data is 'personal data' which will be used in accordance with this privacy policy.
We do not knowingly:
• process any Special Categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sexual orientation, political opinions, trade union membership, information about your health or genetics and biometric data). Nor do we process any information about criminal convictions and offences; or
• collect personal data relating to children. We have age verification processes on our Website to ensure we do not market our products or brands to anyone under the age of 18.
-
We collect the categories of personal data referred to in section 2 for the following purposes:
• to process your application to join the Scheme and to register you as a Scheme member if your application is successful;• to communicate with you – this includes where we manage our relationship with you; where we respond to complaints or enquiries; where we invite you to events, or where we make suggestions to you about various products and services that you could benefit from;
• to maintain and optimise our Website – this includes where we need to solve performance issues, including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data, to improve the availability of our Website and to secure our Website against fraud;
• to enable you to complete surveys about how we can improve the services we offer you, or to ask you for information on how we can improve our Website or our wider Engagements with you;
• to send you business-to-business marketing communications informing you of our products and services;
• to enable you to partake in a promotion including: prize with purchase promotions (including giveaways, instant wins and online, mobile, social media and app entries); loyalty and reward schemes; activity challenge; sweepstake, scratch-card and raffle style promotions (including instant wins and online, mobile, social media and app entries); and
• for data analytical purposes in order to improve our products/services, customer relationships and experiences.
Further information on the circumstances in which we collect your data is available in Annex 1.
-
Under data protection laws, we must have a legal basis under which we process your personal data. We will only use your personal data for the purposes set out in section 3, unless we reasonably consider that we have another appropriate reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the lawful basis which allows us to do so.
If you provide us with your consent to processing, you can withdraw it at any time and we will stop the processing activities that were based on consent as a lawful basis. Please note we may still process the data if we have another lawful basis for processing (in most instances, this will be for a more limited purpose e.g. back-up storage or to record a withdrawal).
Further information on the relevant purposes and linked lawful basis are set out in Annex 1.
Where we need to collect personal data due to a legal or regulatory obligation, or in relation to the performance of a contract, and you do not provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). We will notify you of this at the time. -
We may have to share your personal data with the parties set out below for the purposes set out in the table in Annex 1:
- Internal third parties - Other companies in the Heineken group based within the EEA and the UK;
- External third parties – We share your personal data with third parties which include:
- IT and system administration service providers based within the EEA and UK;
- service providers such as solicitors and accountants;
- first and third party advertising companies and media agencies for marketing and research purposes;
- marketing agencies based within and outside the EEA and UK who provide promotion services;
- prize fulfilment agencies based within the EEA and UK;
- data storage provider(s) based within the EEA and UK;
- data management platform providers, based within the EEA and UK;
- courts, parties to litigation and their professional advisers where we reasonably deem it necessary in connection with the establishment, exercise or defence of legal claims; and
- a purchaser or parties interested in purchasing any part of our business.
We require all third parties to respect the security of your personal data and to treat it in accordance with the law. Where the third parties act as processors on our behalf, we only permit them to process your personal data for specified purposes and in line with our instructions
-
Third parties we share data with may be based outside the UK or the EEA. Whenever we transfer your personal data out of the UK or the EEA, we take steps to ensure that the same level of protection is afforded to it by ensuring one of the following safeguards is put in place:
• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission and/or the UK Information Commissioner's Office, as appropriate; and
• Where we use certain service providers, we may use specific contracts approved by the European Commission and/or the UK Information Commissioner's Office, which give personal data the same protection it has in Europe or the United Kingdom, as applicable.
-
We have put in place reasonable security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know - they are subject to a duty of confidentiality. Unfortunately, no transmission of information over the internet can be completely secure, and the security of information depends in part on the security of the computer you use to communicate with us and the security you use to protect account information and passwords. Please, take care to protect this information.
Our Website include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third party websites, plug-ins or applications and are not responsible for their privacy statements. We encourage you to read the privacy policy of every website you visit and third party service/application that you use.
-
We will only retain your personal data to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, tax, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider any legal requirements, the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means. Criteria used to determine retention periods for specific data collected are detailed further in Annex 1.
-
Under data protection laws, you have various rights which are set out below. The rights available to you depend on our reason for processing your personal data. You are not required to pay any charge for exercising your rights, although we may charge a reasonable fee if your request is unfounded, repetitive or excessive. We have one month to respond to you (unless you have made a number of requests or your request is complex, in which case we may take up to an extra two months to respond). Please note that, where we ask you for proof of identification, the one-month time limit does not begin until we have received this. If we require any clarification and/or further information on the scope of the request, the one-month deadline is paused until we receive that information.
- Right of access. You have the right to ask us for copies of your personal data. This right always applies. There are some exemptions, which means you may not always receive all the information we process. You can read more about this right here.
- Right to rectification. You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies. You can read more about this right here.
- Right to erasure. You have the right to ask us to erase your personal data in certain circumstances. You can read more about this right here.
- Right to restriction of processing. You have the right to ask us to restrict the processing of your information in certain circumstances. You can read more about this right here.
- Right to object to processing. You have the right to object to processing of your personal data where we are relying on a legitimate interest or conducting direct marketing. You can read more about this right here.
- Right to withdraw consent. Where we are relying on consent to process your personal data, you may withdraw it at any time. This will not affect the lawfulness of any processing carried out before you withdraw your consent.
- Right to data portability. This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent. You can read more about this right here.
You also have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk
We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance using the details at the start of this policy.
This version was last updated in Feb 2025.
-
Purpose/Activity
Type of data Lawful basis for processing
including basis of legitmate interestRetention Period To process your application to join the Scheme.
Identity
Contact
Applicant
Necessary for our legitimate interests (recruitment of members and internal administration).
12 months after notification to you that your application was successful / unsuccessful. To register you as a Scheme member if your application is successful.
Identity
Contact
Necessary for our legitimate interests (recruitment of members and internal administration); and
Performance of a contract with you.
12 months after your membership to the Scheme ends. To maintain our Website. Identity
Contact
Profile
Necessary for our legitimate interests (to maintain the relevance of our brand and reputation and to grow our business); and
We retain information relating to the performance of our Website for 36 months and information on your use of our Website (IP address etc.), for 14 months, or, where applicable, until consent is withdrawn.
The logs of the use of our Website will be deleted 6 months after creation.
To use data analytics to improve our Website, products/services, customer relationships and experiences. Technical and Usage
LocationNecessary for our legitimate interest (to maintain and improve our website and customer relationships);
Where required by privacy laws (for example, in relation to Cookies), consent.
26 months from Website visit, or until consent is withdrawn. To enable you to partake in promotions including:
(a) Prize with purchase promotions (including giveaways, instant wins and online, mobile, social media and app entries)
(b) Loyalty and reward schemes
(c) Activity challenges
(d) Sweepstake, scratch-card and raffle style promotions (including instant wins and online, mobile, social media and app entries)
(e) Sampling and point of sales promotionsIdentity
Contact
Performance of a contract with you;
Necessary for our legitimate interests (to develop our business and to build our relationships with existing and prospective customers, including by promoting particular brands to increase sales with low investment).
6 months following prize fulfilment (in certain cases the retention period may be longer due to the nature of the prize (for e.g. flight tickets) – in such cases the personal data will be deleted when it is no longer required). To invite you to take part in and record your responses to surveys and research projects including about how we can improve the services we offer you or our wider Engagements with you.
Identity
Contact
Necessary for our legitimate interest (in order to ensure we offer a good quality service and in order to protect our business interests). Survey feedback and research responses will be retained until it has fulfilled its intended purpose (Note: please see section 7 to learn more about the things we consider when determining how long we will retain your personal data). To send you business-to-business marketing communications informing you of our products and services Identity
Contact
Marketing and CommunicationNecessary for our legitimate interests (to grow our business by issuing relevant marketing communications). We process your personal data for this purpose until your membership to the Scheme ends or, where an individual employee of a member of the Scheme opts out of receiving our marketing communications, until the date that opt-out is received.
To respond to any enquiries you have submitted via our Website. Identity
Contact
Performance of a contract with you.
3 years after the enquiry has been dealt with. To administer and protect our business and our Website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data). Identity
Contact
Technical and UsageNecessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise);
Necessary to comply with a legal obligation.
26 months from Website visit.










