PRIVACY AND COOKIES

1. Overview

2. What does Booker know about me?

3. Why do you need to know this about me?

4. Why are you allowed to use my data in this way?

5. Data collected from third parties.

6. Members of the public.

7. How does Booker look after my data?

8. Do you keep my data forever?

9. Do you share my data?

10. Service providers

11. What about other companies in the Booker/Tesco group?

12. Cookies

13. What rights do I have (including subject access)?

14. How can I contact Booker about my data?

At Booker, we’re working hard to serve our customers, communities, and planet a little better every day. To do this, we need to be able to offer you products and services that meet these goals. Looking after the data you share with us is a hugely important part of this. We want you to be confident that your data is safe and secure with us, and that you understand how we use it to offer you a better and more relevant shopping experience.

This privacy notice covers the activities of Booker Limited, Makro Self Service Wholesalers Limited, Booker Retail Partners (GB) Limited and Booker Direct Limited and all trading styles of those companies, i.e. Best Food Logistics, Budgens, Londis, Premier and Family Shopper.

The data controller is the relevant company whose services are being used (collectively referred to in this Notice as “Booker Group” or “we” “our” or “us”

1. Overview

When you shop or purchase goods with us online, via a national account, delivered service or in a branch, or when you communicate with us, we collect and create personal data about you.

Booker Group serve a variety of customers in different ways and this notice applies to you if you use our services.

To use our services, you must either be a business, trader or other organisation who wishes to use our services for the purpose of that business or enterprise and not for personal use, or you must be a Booker employee or family member (subject to our colleague terms and conditions for use).

Using our services means being a registered customer of Booker, Makro or Booker Retail Partners, Booker Direct through one or more of the following mechanisms;

• Cash and carry branches of Makro or Booker;
• Online or otherwise using any of the Websites (“our Websites” where this notice is posted)
• As a member of one of our symbol groups (Premier, Family Shopper, Budgens, Londis scheme (“Symbol Group”)
• As a member of a national account busines
• A customer of Best Food Logistics

From time to time, we may be contacted by individuals who are not the account holder or card holder. In those circumstances we will gather specific information to address the query or issue (such as name, address and contact details). 

This policy does the following: 

• sets out the different ways you interact with us and the types of personal data that we collect. 
• explains the reasons why we use the data we collect. 
• explains when and why we will share personal data within the Booker Group and with other organisations. 
• explains the rights and choices you have when it comes to your personal data (including your marketing and cookie preferences).
  
   

2. What does Booker know about me?

• Aggregated data 

  We try and remove personal data we don’t need. If we remove enough personal data, it becomes anonymous. This means that you can’t be identified.

  We might also take data we hold and remove certain information and replace it with other non-identifying information, such as an ID number or reference number. This is an extra technique we use to protect data.

• Identity and contact data (name, address, Booker account number) 

  This is information that helps us identify who you are and how we can contact you. This includes your name, title, account number, address, email, and telephone number. It also helps us mange the account(s) you hold with us in branch and online, issue membership cards, process your orders and refunds, provide additional services (for Symbol, trade clubs or classic drinks customers), deliver goods to your premises and communicate with you in emergencies or in relation to a product recall.

• When you register as a customer of  a Booker group company we will collect (where applicable);

  • Your personal details, including the name of the proposed account holder, your business address, email addresses, date of birth, photo ID (in some cases), phone number and title
  • The names and telephone numbers of any additional card holders
  • You will be given an account number which identifies your customer account with us
  • A username and password for logging into your account online.
  • Trading names, including proof of trading address and sales information.
  • Where applicable we are required to collect additional information for those customers selling alcohol in Scotland and Tobacco in England.

• Financial, ID - Identification information (passport, driving licence) and transactional data (purchase information, banking, and payment details) and credit references (where applicable)

  This is information about you, your bank account and payment card details, your credit history and other financial information via credit searches you have authorised as part of your application.

  If you pay for your purchases in cash, if this meets the thresholds for Anti Money Laundering checks then we will also need to see, validate and take copies of photo ID as well as other identification documents such as utility bills, this information along with information about your purchase of a product or service from us (this includes when, where, what and how you purchased that product or service), helps use ensure we are complying with the Anti Money Laundering regulations which are a statutory requirement in the UK.

  We produce invoices and statements and make them available online for you, including where we sent that product or service and any other benefits collected as part of the transaction), this is to ensure we are compliant with HMRC VAT requirements.

  Any financial data about you  and your business helps us to consider any application for credit, use as evidence of identity for high cash transactions and for the granting and maintaining of any credit.

• User and interaction data (how you interact with products and services, delivered, online and in-branch) 

  User data is information collected about you as a user of our branches, products, and services. This may include where you engage with us in a survey; provide feedback on your shopping experience; are captured by CCTV or other camera technologies, or number plate recognition.

  We’ll also collect information about you that allows us to create an analysis of you as a customer. This is to better judge what products and services to offer you.

  Interaction data is information about how you interact with our products and services, namely what you click on and interact with on our sites and app, or products in-branch. This includes data about the order and time you scan products when using our Scan as you Shop service in branches.

• Marketing data 

  This is information about your marketing preferences and your interaction with online marketing. For example, we can see when you open marketing emails from Booker (you can opt out of marketing at any time by telling us). This also includes if you interact with adverts from Booker while browsing the internet. This enables us to judge its effectiveness when we compare your interactions with what you’ve purchased.

• Location data

  In some cases, our app might ask for your location information to better serve you information about your local branch/site. If we’re collecting this data, we’ll make you aware of this at the time.

  We also collect and process location data about you and your business to enable us to deliver goods to you through out distribution centres and branches.

• Technical device data 

  This is information about the device you use to access our websites and app. This could be information that identifies your device, its operating system, internet address, your sign-in data, browser and plug-ins, location, where you came to our site from and where you go when you leave, as well as how often you visit. This is done via the use of cookies, which is covered further down in this notice.

• Special category data

  This is special information that the law says is more sensitive (sometimes it’s referred to as ‘sensitive personal data’) and it needs more protection.

  For Booker Group, if we collect sensitive personal data in our interactions with you (for example, if you’re making a complaint to us, or reporting an accident), we’ll clearly explain what we’re doing, and we’ll only collect the data with your consent.

3. Why do you need to know this about me?

We’ve carefully considered the reasons for collecting and/or creating this data. Here’s a summary of when and why we believe it’s appropriate. 

To make our services available to you

This means that processing your personal data allows us to: 

1. manage the accounts you hold with us, including your credit account and high cash transactions. 

2. process your orders and refunds. 

3. produce invoices and administer any Spend and Save or any other loyalty scheme.

Why do we process your personal data in this way?

We need to process your personal data so that we can manage your customer accounts, provide you with the goods and services you want to buy, and help you with any orders and refunds you may ask for. 

Why we’re using this data (legal basis) 

• Contractual necessity – at the time we collect it (purchase data, contact details, delivery/collection details) 
• Legitimate interests – following fulfilment of your order.
• Consent – when considering credit applications.
• Legal obligation – for any high cash transactions

We won’t be able to provide you with your products or services if you don’t provide us with this data. 

To manage and improve our day-to-day operations. 

1. Help to develop and improve our product range, services (digital and physical), branches, distribution centres, information technology systems, know-how and the way we communicate with you.

   Why do we process your personal data in this way? 

   We rely on the use of personal data to carry out market research and internal research and development. It also helps us to improve our information technology systems (including security), our product range, services, distribution centres and branches. This allows us to serve you better as a customer. 

2. Detect and prevent fraud or other crime.

   Why do we process your personal data in this way?

   It’s important for us to monitor how our services are used to detect and prevent fraud, other crimes, and the misuse of services. This helps us to make sure that you can safely use our services. 
   

   Why we’re using this data (legal basis)

   • Legitimate interests

To personalise your Booker experience 

1. Manage and improve our websites and mobile app.

   Why do we process your personal data in this way?

   We use cookies and similar technologies on our websites and mobile app to improve your experience. Some cookies are necessary so you shouldn’t disable these if you want to be able to use all the features of our websites and mobile app. You can disable other cookies, but this may affect your experience. For more information about cookies and how you can disable them, see the cookies and similar technologies section. 
   
   

2. Use your online browsing behaviour, as well as your in-branch and online purchases (including invoices and transactions), to help us better understand you as a customer and provide you with personalised offers and services.

   Why do we process your personal data in this way?

   We use basic data about your general shopping habits (and those of similar businesses) to group customers into different segments such as ‘Caterers. This allows us to personalise our offers and services for you (including in our marketing communications).

3. Provide you with relevant marketing communications, relating to our products and services, and those of our suppliers, partners and the Booker Group.

   If we or our supplier partners run online advertising, this may be displayed on websites across the Booker Group, non-Booker websites and other media platforms (including such as Facebook, X and TikTok).

   We may also measure the effectiveness of this advertising. To do this, we may use certain basic data about your in-branch and online purchases (for example if you bought a particular product that was featured in an advert). However, we limit this to what is necessary, and it is always obscured or anonymised to protect your identity. When we share your data in this way, it won’t be used by those platforms for their own purposes and will be deleted shortly after.

   Why do we process your personal data in this way?

   We want to make sure that we provide you with marketing communications, including online advertising, that are relevant to your interests. To achieve this, we measure your responses to marketing communications relating to products and services that we and our partners offer. This means that when you’re offered products and services, they best meet your needs as a customer. 

   Why we’re using this data (legal basis and consent)

   We will send you relevant offers and news about our products and services in several ways including by email, where you have provided consent (if applicable) or alternatively where we have collected your contact details as part of a sale where you have not otherwise opted out to receive these marketing communications (Legitimate interests).

   Changing your preferences

   You can change your marketing preferences with us at any time by either notifying us by email or telephone or at a local branch, or by unsubscribing to an email or opting out of the text services. You can also manage your marketing preferences through your online account with us if you have one.

To contact and interact with you

1. Contact you about our services, for example by phone, email, or post, or by responding to social media posts that you’ve directed at us. 

   Why do we process your personal data in this way?

   We want to serve you better as a customer, so we use personal data to provide you with clear information or help in response to your communications.
   
   

2. Manage promotions and competitions you take part in.

   Why do we process your personal data in this way? 
   
   We need to process your personal data, so that we can manage the promotions and competitions you choose to enter including those we run with our supplier and other third parties.
   
   

3. Invite you to take part in and manage customer surveys, reviews and other market research activities carried out by the Booker Group and by other organisations on our behalf.

   Why do we process your personal data in this way?

   We carry out market research including using a 3rd party to improve our services. However, if we contact you about this, you don’t have to take part in the activities. If you tell us that you don’t want us to contact you for market research, we’ll respect your choice. This won’t affect your ability to use our services. 

   Why we’re using this data (legal basis)

   • Legitimate interests

To resolve legal claims or disputes

Why do we process your personal data in this way? 

Why we’re using this data (legal basis) 

• Bringing or defending legal claims

To use CCTV to protect our colleagues, customers, members of the public and property to prevent and detect crime and anti-social behaviour. 

If you park in our car parks, we may use Automatic Number Plate Recognition Technologies (ANPR) to identify if your vehicle has complied with our parking rules. Where there’s a security or claim incident involving a vehicle, we may use CCTV and or ANPR to assist in our investigation into those incidents. 

We also use body-worn cameras and vehicle cameras to protect our colleagues and customers, and record footage in the same way as we do with other forms of CCTV. 

Why do we process your personal data in this way? 

To protect our business, the local community, customers, and colleagues. 

Why are we using this data (legal basis)

• Legitimate interests
• Exercising our legal rights

4. Why are you allowed to use my data in this way?

Whenever an organisation uses data, they must have a reason to use it. The law gives certain reasons for the use of data and Booker will always use data according to one of those reasons. In the section ‘Why do you need to know this about me’ we’ve stated the different reasons that we might hold data. 

In this section, we explain why we think those reasons are suitable and what this means for you. 

There’s often a focus on consent to use personal data but, in many circumstances, consent wouldn’t be appropriate. For example, a shoplifter withdrawing consent to be filmed with CCTV would increase risk to you and our colleagues; or for example a customer withdrawing consent to process their payment information, would increase the risk to our business. 

Therefore, in many situations, Booker relies upon other legal reasons. For example,  needing data to fulfil a ‘contract’ with you. At the point of you buying goods and services from Booker, a contract is created and any data we collect to allow us to deliver or provide those services or goods can be used and kept making sure we fulfil our contract. 

Another reason is called ‘legitimate interests’. This is when there are legitimate and reasonable reasons when Booker might collect and use data. For example, collecting information through our website is beneficial to both Booker and you because we can understand what products you’re interested in and make sure the products we offer match that need.

Our use of your personal data when based on ‘legitimate interests’ are to: 

• meet our customers’ needs, including delivering our products and services.
• promote and market our products and services, and those of our partners and service providers.
• service your account (such as your Booker account), manage complaints, and resolve any disputes.
• understand our customers including their patterns and behaviours, as well as their likes and dislikes.
• protect and support our business, colleagues, customers and shareholders.
• prevent and detect anti-social behaviour, fraud and other crime. 
• test and develop new products and services as well as improve existing ones.

We’ve assessed these fundamental reasons against the fundamental rights and freedoms provided to you under the law and balanced them up against the benefit both you and Booker might receive from this data being used. 

5. Data collected from third parties

We may also use personal data from other sources, such as specialist companies, media partners, suppliers and public registers (such as the electoral register and companies house).

When we work with specialist companies that provide us with personal data about you, they’ll have told you about this data sharing at the time it was collected. We use this and our own data to better understand our customers.

We also use this personal data to make sure we have up-to-date details about you. We don’t give personal data we’ve collected or created from you back to these companies.

6. Members of the public

From time to time, we may be contacted by individuals who are not the account holder or card holder.

In those circumstances we will gather sufficient information to address the query or issue (such as name, address and contact details). In some case’s we may need to pass that information on to a third party, such as a supplier (in the event of a product related query) or a third party advisor to address the matter in question. Any information obtained will be processed purely for the purpose of the single issue or query raised and will be deleted in line with our retention policy once the matter has been closed.

We may also capture data of members of the public on our CCTV surveillance systems, this is to protect our business, the local community, customers, and colleagues. Please see section 3 for more information.

7. How does Booker look after my data?

We know how important it is to protect and manage your personal data. This section sets out some of the measures we have in place.

• We make sure staff are trained and rules are in place to make sure that data is used properly.
• We have physical protections and digital/electronic systems in place to keep what we hold secure.
• When data is moved or transferred, we make sure it’s encrypted (scrambled)
• We use computer safeguards such as firewalls and data encryption to keep this data safe when it’s not being moved.
• We only allow access to authorised colleagues and trusted partners.
• We regularly watch our systems for possible weaknesses and attacks, and we carry out tests (penetration testing) to see what can be improved.
• We’ll ask for proof of identity before we share your personal data with you.
• We’ll reveal only the last four digits of your payment card number when confirming an order.

Your personal data may be transferred outside the UK. It may also be processed by companies outside the UK who work for us (or for one of our service providers). When we do this, your personal data will be subject to appropriate protections. If we do transfer personal data to outside of the UK, it’ll be protected in the same way as if it was being used in the UK. To do this, we use one of the following safeguards:

• We transfer to a non-UK country whose privacy laws ensure an appropriate level of protection for personal data.
• We put in place a contract with a third party that means they must protect personal data to the same standards as the UK.
• We transfer personal data to organisations that are part of specific agreements on cross-border data transfers with the UK.
• We complete a transfer risk assessment before agreeing to transfer data to any organisation who are in a country that does not have specific cross border arrangement and only if we decide the risk is low, we will progress and ensure we put in place an International Data sharing agreement with those organisations alongside a contract so that they protect the data to the same standards as the UK.