Nutricia Limited knows that you care how your personal data is used and we recognize the importance of protecting your privacy.
This Privacy Statement explains how Nutricia Limited a subsidiary of Danone SA, (“Nutricia”, “we”, “our”, “us”), acting as the Data Controller collects and manages your personal data. It contains information on what data we collect, how we use it, why we need it and how it can benefit you.
Contact us here if you have any queries and comments, or if you want to make a request regarding any of your data subject rights.
You Can also contact us at Data Protection Officer, Nutricia Ltd. Newmarket House, Newmarket Avenue, White Horse Business Park, Trowbridge, Wiltshire, BA14 0XQ.
This privacy statement was last updated on August 12, 2021.
Nutricia Limited knows that you care how your personal data is used and we recognize the importance of protecting your privacy.
Basic principles and our privacy commitment
At Nutricia we are committed to protecting your right to privacy. We aim to protect any personal data we hold, to manage your personal data in a responsible way and to be transparent in our practices. Your trust is important to us. We have therefore committed ourselves to the following basic principles:
- You have no obligation to provide any personal data requested by us except as required by law or in order to perform any contract we have with you or plan on entering into with you. However, if you choose not to any personal data requested by us, we may not be able to provide you with some services or products
- We only collect and process your data for the purposes set out in this Privacy Statement or for specific purposes that we share with you and/or that you have consented to;
- We aim to collect, process and use as little personal data as possible for the purposes as described in this Privacy Statement
- When we do collect your personal data, we aim to keep it as accurate and up to date as possible.
- If the personal data we collect is no longer needed for any purposes and we are not required by law to retain it, we will do what we can to delete, destroy or permanently de-identify it.
- Your personal data will not be shared, sold, rented or disclosed other than as described in this Privacy Statement.
What personal data do we collect?
By personal data, we refer to any information about a person from which that person can be identified. This does not include data for which the identity has been deleted (anonymous data).
The personal data we collect varies depending upon the purpose of the collection and the product or service we are providing you.
Nutricia may collect the following types of personal data from you directly:
- Personal contact data, such as your name, email address, physical address and telephone numbers;
- Communications with us, which may include details of our conversations via chat, care lines and/or customer service lines;
- Browser history, such as pages accessed, date of access, location when accessed, and IP address;
- Information related to your health;
- Information about people other than you, such as personal data about your family members, when you provide such information directly to us;
- Social media profiles;
- If ever you apply for employment with us, we will collect additional personal data, such as your employment history, educational history and employment references.
We may also collect personal data about you indirectly when:
- you share content on social media pages, websites or applications related to our products or in response to our promotional material on social media; or
- we read or collect personal data about you by reading information collected by other websites (for instance, we may place an ad on a third party website, and when you click on that ad, we may receive information about you and other website visitors in order to measure the reach and success of that ad).
Why do we collect and use your personal data?
|Lawful basis for processing||Purpose/Activity|
|To process and answer your inquiries or to contact you in order to answer your questions and/or requests||Necessary for our legitimate interests (to detect and prevent fraud, to improve the customer service experience and management, and to protect our organisation, systems, network, and staff)|
|For internal training and quality assurance purposes To authenticate the identity of individuals contacting us by telephone, electronic means or otherwise|
|To manage our relationship with you which will include: Notifying you about changes to our Terms & Conditions or Privacy Statement Asking you to leave a review, to provide feedback or to complete a survey or market research such as when we send you a customer satisfaction survey after using the Careline or social media pages||Necessary to comply with a legal obligation.Necessary for our legitimate interests (to keep our records updated and to study how customers use our products/services)|
|To communicate marketing information to you and to manage your registration and/or subscription to our newsletter or other communications To provide personalized communications to you To make suggestions and recommendations to you about goods or services which may interest you||Consent (where required)|
|To understand and assess the interests, wants, and changing needs of customers in order to develop and improve our website, our current products and services, and/or develop new products and services||Necessary for our legitimate interests (to develop our products/services, grow our business and to inform our marketing strategy and the content displayed, to define types of audiences to develop and improve our products and services and campaigns)|
|To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the content we serve to you||Necessary for our legitimate interests (to understand how customers use our products/services, to develop our product/services and grow our business and to inform our marketing strategy)|
|To develop and improve our products, services, communication methods and the functionality of our websites To model your behaviour to identify other people with interests similar to yours, and target them with personalised advertising||Necessary for our legitimate interests (to keep our website updated and relevant, to develop our products/services, grow our business and to inform our marketing strategy and the content displayed, to define types of audiences to develop and improve our products and services and campaigns)|
|To administer and protect our business and this website including troubleshooting, data analysis, system testing, maintenance, support, reporting and hosting of data||Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security to prevent fraud and in the context of a business reorganisation or group restructuring exercise).Necessary to comply with a legal obligation|
When we collect and use your personal data on the legal basis of our legitimate interests, we believe the risk to your data protection rights in connection with personal data is not excessive or overly intrusive. We have also put in place protections for your rights by ensuring proper retention periods and security controls.
When we collect and use your personal data for other or new purposes, we will inform you before or at the time of collection unless we reasonably consider that we need to use your personal data for another reason and that reason is compatible with the original purpose of collection as detailed above.
Where appropriate, we will ask for your consent to process the personal data. Where you have given consent for processing activities, you have the right to withdraw your consent at any time. If you wish to withdraw your consent, please see the Your Rights section as set out below.
Where we process your personal data, you are entitled to a number of rights and can exercise these rights at any point. We have provided an overview of these rights below together with what this entails for you. You can exercise your rights via our contact page.
The right to access your personal data and correction
You have the right to access, correct or update your personal data at any time. We understand the importance of this and should you want to exercise your rights, please contact us via our contact page.
The right to data portability
Your personal data is portable. This means it can be moved, copied or transmitted electronically. However, this right only applies where:
- The processing is based on your consent;
- The processing takes place for the performance of a contract;
- The processing takes place by automated means;
If you wish to exercise your right to data portability, please contact us via our contact page.
The right to deletion of your personal data
You have right to request that we delete your data if:
- your personal data is no longer necessary in relation to the purposes for which we collected it; or
- you withdraw the consent that you had previously given us to process your personal data, and there is no other legal ground to process that personal data; or
- you object to us processing your personal data for direct marketing purposes; or
- you object to us processing your personal data for Danone’s legitimate interests (such as improving overall user experience on websites);
- the personal data is not being processed lawfully; or
- your personal data needs to be deleted to comply with the law.
If you wish to delete the personal data we hold about you, please let us know and we will take reasonable steps to respond to your request in accordance with legal requirements.
If the personal data we collect is no longer needed for any purposes and we are not required by law to retain it, we will do what we can to delete, destroy or permanently de-identify it.
The right to restriction of processing
You have the right to restrict the processing of your personal data if
- you do not believe the personal data we have about you is accurate; or
- the personal data is not being processed lawfully, but instead of deleting the personal data, you would prefer us to restrict processing instead; or
- we no longer need your personal data for the purposes we collected it, but you require the data in order to establish, exercise or defend legal claims; or
- you have objected to the processing of your personal data and are awaiting verification on whether your interests related to that objection outweigh the legitimate grounds for processing your data.
If you wish to restrict our processing of your personal data, please let us know and we will take reasonable steps to respond to your request in accordance with legal requirements.
The right to object
You have the right to object to the processing of your personal data at any time. Please contact us via our contact page.
The right to withdraw consent
Where legally required to do we will ask for your consent to process the personal data. When we process your personal data on the basis of your consent, you have the right to withdraw your consent at any time by informing us of your decision. However, such withdrawal does not affect the lawfulness of the processing that took place prior to this withdrawal. If you wish to withdraw your consent, please let us know.
The right to lodge a complaint with a supervisory authority
While we would be grateful if you lodged any complaints with us, you have the right to lodge a complaint directly with the UK Information Commissioner’s Office [https://ico.org.uk/for-the-public] about how we process personal data.
You can also contact the Data Protection officer at Nutricia Ltd at DPO.UKIE@danone.com.
For more information about your privacy and data protection rights, or if you are not able to resolve a problem directly with us and wish to make a complaint, please contact the Information Commissioner’s Office at:
Mailing Address: Wycliffe House Water Lane, Wilmslow Cheshire SK9 5AF
Phone Numbers: +44 303 123 1113
Email Address: email@example.com
How long do we retain your personal data?
We will only retain your personal data for the minimum time necessary to achieve the purposes for which we collected it as set out in this Privacy Statement, including to comply with any legal, regulatory, tax, accounting or reporting requirements.
Your personal data will also be retained for the duration of your contractual relationship with us, including where we maintain an ongoing relationship with you.
To determine the appropriate retention period for personal data, we take into account the quantity, nature and sensitivity of personal data, the potential risk of harm resulting from the unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and the possibility of attaining those purposes by other means, as well as the applicable legal, regulatory, tax, accounting or other requirements.
After the established deadlines, the data is either deleted or retained after being anonymized, especially for statistical purposes. It may be retained in case of pre-litigation and litigation. It should be noted that deletion or anonymization are irreversible operations, and that Nutricia is no longer able, thereafter, to restore this data.
We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.
How we protect your personal data
We understand that the security of your personal data is important. We make our best efforts to protect your personal data from misuse, interference, loss, unauthorized access, modification or disclosure. We have implemented a number of security measures to help protect your personal data. For example, we implement access controls, use firewalls and secure servers, and we encrypt personal data.
We also make sure that any third parties that we deal with keep all personal data they process on our behalf secure.
Sharing of your personal data
When we share your personal data with affiliates and other organizations, we make sure we only do so with organizations that safeguard and protect your personal data and comply with applicable privacy laws in the same or similar way that we do.
Your personal data will not be shared, sold, rented or disclosed other than as described in this Privacy Statement. We may, however, share your data when required by law and/or government authorities.
Trusted third parties may assist us in providing specific services or functions on our behalf, such as our Careline and Social Media teams as well as IT services, both internal and external. This includes platform providers, hosting services, maintenance and support on our website as well as on our software and applications that may contain data about you, or to perform on our behalf the statistical analyses associated with the use of the website.
Your personal data will be shared with the following third parties for the purposes described:
|Category of third parties:||Data type:||Purposes:|
|Marketing agencies||Facebook Messenger interactions||To communicate information to you|
|Facebook||Behavioural data||To allow Nutricia to see how well adverts perform Retargeting for the purpose of advertising to users who have been on cowsmilkallergy.co.uk or cowsmilkallergy.ie|
|Creating Lookalike audiences of users, using the key characteristics of the audience and targeting similar audiences than those who visited our website for precision purposes.|
|To process, handle and respond to complaints and queries.||Personal contact data (email, phone number, address and name)||Other UK & Ireland Nutricia / Danone internal teams|
If we decide to reorganise or to sell our business or our company, directly or indirectly through a sale, merger, or acquisition, we may share your personal data with actual or prospective purchasers of the business, or of our company. We will require that any such purchasers treat your personal data consistently with this Privacy Statement.
Sharing data internationally
Personal data may be processed outside the UK. When processed outside the UK, Nutricia will make sure that this cross-border data processing is protected by adequate safeguards.
The safeguards that we use to protect cross-border data processing include:
a) Standard Contractual Clauses approved by European Commission and approved for use in the UK. These standardized contractual clauses provide sufficient safeguards to meet the adequacy and security requirements of the European General Data Protection Regulation and UK General Data Protection Regulation; or
b) Certifications which demonstrate that third parties outside of the UK or EEA process personal data in a way that is consistent with the European General Data Protection Regulation and UK General Data Protection Regulation. These certifications are approved either by the European Commission, a competent supervisory authority or a competent national accreditation body in terms of General Data Protection Regulation.
c) An adequacy decision whereby we will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data.
Automated decision-making and profiling
For some services and products we may process your personal data using automated means. Essentially this means that decisions are taken automatically without human intervention [Facebook Chatbot].
We may also process your personal data for profiling purposes to predict your behaviour on our website or products that may be of interest to you. This means that we may collect personal data about you through cookies. We centralise this data and analyse it to evaluate and predict your personal preferences and interests. Based on our analysis, we send or display communications and/or content tailored to your interests/needs. This can be used to show you adverts for our products and services appropriate to your baby’s age while you browse on other websites. We will also use your data to send tailored communications via email and direct mail, if you have opted to receive them.
We confirm that you will not be subject to a decision based solely on automated decision-making, including profiling which produces legal effects, or which will significantly affect you. If we intend to make use of such methods, we will of course inform you and we will give you an opportunity to object to these processes in advance. You are also free to contact us for further information on such processing.
Cookies and other technologies
- Information about your device browser and operating system;
- The IP address of the device you are using;
- Web pages of ours that you view;
- Links that you click while interactive with our services.
- Adverts you view; or.
- Time and date of activity.
Please see our cookie statement for more information on this
This notice was last updated on August 12, 2021. We reserve the right to change this notice at any time (for example, to comply with changes in laws or regulations, our practices, procedures and organisational structures, requirements imposed or recommended by supervisory authorities or otherwise). Changes to this notice shall be applicable on the effective date of implementation. Please refer to our website for the latest version of this notice. We will also communicate any changes to you, where we are legally required to do so.
How to contact us
If you have any questions, comments or complaints regarding this Privacy Statement or the processing of your personal data, please contact us via our contact page.