Heineken UK and Star Pubs Consumer Privacy Policy

Heineken UK Limited (“Heineken UK”) and Star Pubs Trading Limited (“Star Pubs”) ("we", "us", or "our") are part of the Heineken group. When we mention "we", "us" or "our" in this privacy policy, we are referring to the relevant company responsible for processing your personal data.

Where you have consented to receiving marketing communications from, or entered a competition being promoted by, Heineken UK, that company is the controller of your personal data collected and processed for such purposes.

Where you have consented to receiving marketing communications from, or entered a competition being promoted by, Star Pubs, that company is the controller of your personal data collected and processed for such purposes.

For all other data processing purposes covered by this privacy policy, Heineken UK is the data controller, unless we inform you otherwise.

If you have any questions about this privacy policy, our processing activities or wish to raise a complaint, we can be contacted as follows:

• Mail: 6 St Andrew Square, Edinburgh, EH2 2BD, marked for the attention of the Privacy Officer; or 

• Email: protectingyourdata@heineken.co.uk

If you wish to withdraw your consent to receiving marketing communications from Heineken UK or Star Pubs at any time, please do so via the unsubscribe link in the footer of the relevant company’s marketing emails. You can also email our dedicated email addresses: 

• Heineken UK: MTK-Unsubscribe@heineken.co.uk
• Star Pubs: UK1-Star-Unsubscribe@starpubs.co.uk

Personal data is any information about an individual from which that person can be identified. We may receive your personal data directly from you, or it may be given to us by third parties where there is a lawful basis for data sharing or if the information is publicly available. 

We use data for various purposes, including to communicate with you, market to you, run promotions, protect our business and ensure we comply with laws.. Transparency is important to us, so we would particularly like to highlight the following activities we conduct where we have a lawful basis (see section 6 for more details): 

• We may use your data to create a profile of you. We may combine data that you have provided to us with information obtained from third parties in order to better understand your interests. We want to build a profile of you so that we can personalise the communications and content that you receive, meaning that we can market to you more effectively.
• We may use your data to send you online targeted advertisements. Based on our profile of you, we may present you with adverts when you browse online, watch TV or use audio services (such as streaming platforms). This involves asking a platform to serve our adverts to a particular group of individuals and may involve using aggregated and anonymised data purchased from third parties to help identify relevant audiences for our adverts.
• We may use your data to conduct analytics.For example, we may track how you respond to the emails we send you. We want to see if the email has bounced and, if not, whether you open our emails and/or click on any content; unsubscribe or mark the email as spam. This ensures that we can understand what really interests you and improve our approach to marketing so that you do not receive irrelevant emails or other marketing content. It also allows us to use our resources efficiently.

You have various rights regarding our use of your data, see section 10 for more detail.

This privacy policy describes how we look after your personal data collected directly when you engage with us including (i) when you visit our websites; (ii) when you interact with us via one of our AI powered assistants / chatbots on one of our websites or through instant messaging services made available through our social media accounts; (iii) take part in a promotion; (iv) consent to receive marketing communications from us; or (v) attend one of our events or an event that we sponsor. (“Engagement”). 

 We also collect information indirectly: (a) from Access UK Limited where you visit a venue in which we sponsor the Wi-Fi services; and (b) from (i) social media platforms (e.g. Facebook, Instagram and Pinterest) (“Social Media Platforms”); (ii) 2nd party vendors (e.g. supermarkets and similar retailers) where you have purchased our products; (iii) database matching partners utilising data clean room technology (see Annex 2 for more details); and (iv) third party data brokers (e.g. Experian) (see Annex 2 for more details) (together “Relevant Third Parties”). Any information we collect indirectly will either come from a publicly available source or will be shared with us on an appropriate lawful basis, typically consent or legitimate interest. See section 6 for more detail.

• Identity Data – name, username, social media handle, title, place and date of birth and personal characteristics including age and gender;
• Contact Data – email address, home address, delivery address and telephone number;
• Profile Data – preferences, feedback, survey responses and interests including activities noted on Social Media Platforms (for example, your Facebook likes/groups) or collected from other Relevant Third Parties;
• Technical and Usage Data – information about how you use our websites including your IP address and details about the devices you use to access our websites or emails that we send to you. This may also include information about your interactions with chatbot functionality on our websites or social media accounts (for example, usage patterns and technical data relating to chatbot performance), which we use to help operate, improve and refine that functionality. Please review the cookie policy on each website for further information;
• Marketing and Communications Data – preferences in receiving marketing and communications from us and information in terms of engagement with email communications;
• Location Data – GPS-based location information from your use of our websites or Social Media Platforms or when you open emails that we send to you via your smartphone(s), tablet(s) or other devices;
• Photo and Video Data - photos and/or video footage of you captured when you attend any events hosted or sponsored by us (your attention will be drawn to any photography or filming that is taking place, and your consent will be obtained where required); and
• Inferred Data – which is inferred or derived from the data we collect, for example inferences about your interests based on your Identity Data, Profile Data, Technical and Usage Data or Location Data.

We do not knowingly:

• Process any Special Categories of personal data (i.e. sensitive data) about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sexual orientation, political opinions, trade union membership, information about your health or genetics and biometric data). Nor do we process any information about criminal convictions and offences; or
• Process personal data relating to children or market to children. We operate age verification processes on our websites and work with third party platforms to seek to ensure that advertising for our alcohol products and brands, including any 0.0 variants, is not shown to individuals under the age of 18.

We will only retain your personal data to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, tax, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider any legal requirements, the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means. Criteria used to determine retention periods for specific data collected are detailed further in Annex 1.

We may collect personal data about you for the following purposes (more specifically described in Annex 1):

• To communicate with you;
• To enable you to partake in a promotion and for prize fulfilment purposes;
• To market to you;
• To conduct market research;
• For analytical purposes;
• To maintain and optimise our websites;
• To protect our business;
• To satisfy our legal and regulatory obligations and co-operate with regulators and government bodies; and
• To defend and exercise our legal rights, including in relation to managing actual and potential claims.

Under data protection laws, we must have a lawful basis under which we process your personal data. You can find detailed information on the 6 available lawful bases on the Information Commissioner's Office website (https://www.ico.org.uk).  We will only use your personal data for the purposes set out in section 5, unless we reasonably consider that we have another appropriate reason and that reason is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the lawful basis which allows us to do so. 

If you provide us with your consent to processing, including via one of our websites, when you use Wi-Fi that we sponsor or through a Social Media Platform or a Relevant Third Party, you can withdraw it at any time and we will stop the processing activities that were based on consent as a lawful basis. Please note we may still process the data if we have another lawful basis for processing (in most instances, this will be for a more limited purpose e.g. back-up storage or to record a withdrawal). 

Where we need to collect personal data due to a legal or regulatory obligation, or for performance of a contract and you do not provide that data when requested, we may not be able to continue our Engagement with you or perform the contract we have or are trying to enter into with you (for example, to  allow you to participate in promotions). We will notify you of this at the time. 

Further information on the relevant purposes and linked lawful basis for our data processing are set out in Annex 1.

We may share your personal data with the parties set out below:

a) Internal third parties - other companies in the Heineken group based within the EEA and the UK (but not for any marketing purposes without your consent);

b) External third parties which include:

• communications platform providers (i.e. vendors we use to send and manage email, mobile and social media instant messaging communications, including SalesForce, OneTrust and Airship);
  
  
• marketing and advertising companies and media agencies for marketing and research purposes, and to provide promotion services, data on-boarding services, research and marketing strategy services;
  
  
• third party providers of Social Media Platforms, digital TV channels, audio channels and other advertising channels (including Meta, Pinterest, TikTok, Amazon, Sky, ITV, Spotify and Quantcast);
  
  
• prize fulfilment agencies;
  
  
• data clean room providers who provide data matching services (InfoSum);
  
  
• IT and system administration service providers (including data storage providers and data management platform providers);
  
  
• service providers such as solicitors and accountants;
  
  
• regulators, local authorities and government bodies, including the Police and HMRC, to comply with any legal or regulatory requirements or formal/informal investigations;
  
  
• courts, parties to litigation and professional advisers where we reasonably deem it necessary in connection with the establishment, exercise or defence of legal claims; and
  
  
• a purchaser or parties interested in purchasing any part of our business (and professional advisors supporting on the transaction).

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. Where the third parties act as processors on our behalf, we only permit them to process your personal data for specified purposes and in line with our instructions.

Third parties we share data with may be based outside the UK. Whenever we transfer your personal data out of the UK, we take steps to ensure that we comply with our legal and regulatory obligations in relation to personal information and that the same level of protection is afforded to it as in the UK. We do this in two ways: 

• we will transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK Information Commissioner's Office (for example, all countries in the EEA are deemed “adequate”); or
• we will use specific contracts for international transfers approved by the UK Information Commissioner's Office. 

We have put in place reasonable security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know - they are subject to a duty of confidentiality. Unfortunately, no transmission of information over the internet can be completely secure, and the security of information depends in part on the security of the computer you use to communicate with us and the security you use to protect account information and passwords. Please take care to protect this information.

Our websites include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third party websites, plug-ins or applications and are not responsible for their privacy policies. We encourage you to read the privacy policy of every website you visit and third party service/application that you use.

Under data protection laws, you have various rights which are set out below. You can also find more detailed information on the Information Commissioner's Office website (https://www.ico.org.uk). The rights available to you depend on our reason for processing your personal data. You are not required to pay any charge for exercising your rights, although we may charge a reasonable fee if your request is unfounded, repetitive or excessive. We have one month to respond to you (unless you have made a number of requests or your request is complex, in which case we may take up to an extra two months to respond). Please note that, where we ask you for proof of identification, the one-month time limit does not begin until we have received this. If we require any clarification and/or further information on the scope of the request, the one-month deadline is paused until we receive that information. 

a) Right of access. You have the right to ask us for copies of your personal data. This right always applies. There are some exemptions, which means you may not always receive all the information we process. 

b) Right to rectification. You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.

c) Right to erasure. You have the right to ask us to erase your personal data in certain circumstances.

d) Right to restriction of processing. You have the right to ask us to restrict the processing of your information in certain circumstances.  

e) Right to object to processing. You have the right to object to processing of your personal data where we are relying on a legitimate interest or conducting direct marketing.

f) Right to withdraw consent. Where we are relying on consent to process your personal data, you may withdraw it at any time. This will not affect the lawfulness of any processing carried out before you withdraw your consent. 

g) Right to data portability. This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent. 

If you have concerns about how we used your personal data, you have the right to make a data protection complaint directly to us. Please use the contact details at the start of this privacy policy.

We will acknowledge your complaint and investigate it without undue delay. We will keep you informed of the progress and notify you of the outcome. 

If you are not satisfied with our response, you have the right to escalate yourcomplaint to the UK supervisory authority for data protection issues: 

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
ICO website: https://www.ico.org.uk

This version was last updated in June 2026.

Purpose/Activity	Type of data	Lawful basis for processing including basis of legitimate interest	Retention period
To communicate with you which includes:  · managing our relationship with you; and  · investigating and responding to enquiries or complaints. Note: We use automated tools, including AI powered assistants / chatbot functionality, to respond to queries and provide information. These tools may generate responses based on the information you provide	· Identity · Contact · Profile · Marketing and Communications · Technical and Usage	Necessary for our legitimate interest (to conduct and manage our business, to enable us to give you the best service and to protect, promote and grow our business).	3 years after the enquiry or complaint has been resolved. Where communication is via an AI powered assistant / chatbot, 2 years.
To enable you to partake in:  · promotions and for prize fulfilment purposes;  · loyalty and reward schemes; · sampling and point of sales promotions; and  · geo-targeted activities (including gamification and mobile messaging).	· Identity · Contact	Performance of a contract with you.	6 months following prize fulfilment (in certain cases the retention period may be longer due to the nature of the prize e.g. flight tickets – in such cases the personal data will be deleted when it is no longer required).
To serve you indirect digital advertisements or marketing (i.e.  online adverts via websites, Social Media Platforms, digital TV or audio platforms or other advertising channels channels) where you are part of an aggregated or non-identifiable audience as part of a wider brand campaign or initiative.   Note: information for this purpose may be collected indirectly. See Annex 2 for more information on our marketing and profiling activities.	· Identity (limited to age and gender)  · Marketing and Communications  · Profile	Necessary for our legitimate interests (to maintain the relevance of our brand and reputation and to grow our business by serving consumers with advertising relating to our brands).   Where required by privacy laws, consent.	Data will be processed until an opt-out / objection is received or consent is withdrawn as applicable.
To send you direct electronic marketing (i.e. via mobile messaging, email, direct messaging or online targeted adverts via Social Media Platforms, digital TV or audio platforms or other advertising channels) which we consider may be relevant and of interest to you.   Note: information for this purpose may be collected indirectly. See Annex 2 for more information on our marketing and profiling activities.	· Identity · Contact · Profile · Marketing and Communications	Consent.	Data will be processed until an objection is received or consent is withdrawn as applicable.
To analyse and improve our marketing strategies, consumer relationships and overall experience, and to develop and enrich consumer profiles using data we collect directly from you (e.g. via surveys or data analytics) and from third parties, including Relevant Third Parties. This enables us to serve relevant marketing content and measure engagement with our communications.   This includes:  · creating and enhancing individual profiles and profiled audience segments (including custom audiences) to support tailored marketing;  · using information such as your location, preferences and interests to personalise content;  · combining data collected directly from you (e.g. your email address) with information from Social Media Platforms and Relevant Third Parties (either directly from such Relevant Third Parties or using data clean rooms) to enhance your profile and display relevant marketing content;  · using tracking technologies to understand how you interact with our communications (e.g. opens, click-throughs and unsubscribes) and serve online targeted advertising to you;  · identifying which topics and content are of most interest to you; and  · measuring and evaluating the performance of our marketing campaigns and communications.   Note: information for this purpose may be collected indirectly. See Annex 2 for more information on our marketing and profiling activities.	· Identity  · Profile  · Marketing and Communications  · Technical and Usage  · Inferred  · Location	Necessary for our legitimate interests (to maintain the relevance of our brand and reputation and to grow our business by serving consumers with advertising relating to our brands).   Where required by privacy laws, consent.	Data will be processed until an opt-out / objection is received or consent is withdrawn as applicable.   The cookie policy on the relevant website you are viewing provides more information on specific cookie retention periods.
To conduct market research, we may reach out to specific consumers and request an insight into matters such as developing new products or ways to improve our current products or services. We will use the information obtained to ensure our marketing is relevant.   Note: information for this purpose may be collected indirectly. See Annex 2 for more information on our marketing and profiling activities.	· Contact · Identity · Profile	Necessary for our legitimate interests (to maintain the relevance of our brand and reputation and to grow our business by ensuring we understand the market in which we operate).   Contractual necessity, where you are asked to sign up to terms as part of the market research project.	We will retain your data until an opt-out / objection is received.
To maintain, improve and optimise our websites and AI powered assistants / chatbots and to keep them relevant - this includes carrying out data analytics and addressing performance issues (including troubleshooting, testing, system maintenance, support and reporting and data hosting), as well as analysing technical and usage data relating to how users interact with our chatbot functionality, in order to help improve the availability, performance and functionality of our websites and AI‑powered assistants / chatbots.	· Identity · Contact · Profile · Technical and Usage	Necessary for our legitimate interests (to maintain the relevance of our brand, products and reputation, run our business, operate administration and IT services, protect network security and to prevent fraud).   Necessary to comply with a legal obligation.	We retain information relating to the performance of our websites and AI powered assistants / chatbots for 2 years.
To protect our business through compliance with contractual or regulatory obligations, prevention / detection of crime and satisfaction of our legal obligations / defence of our legal rights, including: Securing our website against fraud; Detecting and preventing spam, fraudulent activity, network exploits and abuse on our website(s); Investigation of security/fraud related incidents on our website; and Investigation of fraudulent activity in relation to / breach of any competition terms and conditions/promotion entry requirements.	· Identity · Contact · Technical and Usage	Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise).   Necessary to comply with a legal obligation.	The cookie policy on the relevant website provides more information on specific cookie retention periods. Otherwise, your personal data will be retained for 6 years.

A. Marketing

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.

We will only send direct electronic marketing (e.g. via emails, mobile message, direct social media messages or online targeted adverts directed to specific individuals) where:

• we have your consent; or
• you have solicited certain information (for example to receive one-off correspondence in relation to a promotion you have entered or an event that we are sponsoring).

You may also receive indirect marketing from us as part of an aggregated or non-identifiable audience by way of online advertisements, Social Media Platforms, digital TV or audio platforms, or other advertising channels. There are various methods we may use in order to indirectly market to you online, as follows: 

1. Contextual advertising on particular types of websites - we buy space on these third party websites and our adverts are shown based on other content displayed on the page: it is not targeted to particular individuals.
   
   
2. Advertising to people signed up with an online platform (such as Facebook, Instagram, Google or Amazon) based on what the platform owner knows about them, e.g. we may ask Meta to show a particular advert to people aged 25 to 35 who are interested in beer and sport and living in South London or people interested in certain competitions / events. This may involve use of ‘custom audiences’ where we send a list of hashed email addresses of consumers who have consented to receive marketing from us to the online platform, and the online platform then matches these email addresses to users and presents our advertising to them. Hashing is a security measure whereby the information is turned into a code.  
   
   
3. Database matching We securely match the identities of consumers who have consented to receive marketing from us with the customer/consumer databases of third parties we partner with (such as ITV, Channel 4, Sky, Nectar360, and dunnhumby/Tesco). This enables us to identify individuals who appear in both or multiple datasets and to show adverts to those audiences. 
   
   To do this, we typically use a data clean room provider (InfoSum). InfoSum uses secure technology that allows each party to upload its data into a separate “bunker”, which cannot be accessed by other parties or by InfoSum itself. The platform allows each party to control permissions over its own data, including whether it can be matched.
   
   Where matching is permitted, InfoSum identifies overlapping users across datasets without sharing raw personal data. The resulting matched audience can then be used to activate advertising campaigns and to measure their effectiveness, including conversion uplift.
   
   For example, Heineken UK may partner with ITV and dunnhumby/Tesco by matching individuals in our consumer database with Tesco Clubcard customers, delivering advertising via ITV, and measuring the resulting impact on purchases using dunnhumby/Tesco data.
   
    
4. ‘Look-alike” / ‘Similar’ audiences to identify relevant audiences comprising people who aren’t existing customers or in our first party consumer database to whom our adverts / marketing might be of interest where we do the following:
   (a) use our “custom audiences” (see point 2 above) to find and advertise to a group of people with similar characteristics to our existing consumer base; or
   (b) we ask Social Media Platforms or digital TV or audio platforms to present adverts to individuals that they believe will like our products or brands based on audience data within their platforms so that we reach the right audiences and ensure our marketing efforts are efficient. We would direct the third parties to target individuals in certain age categories and locations with certain interests; or
   (c) as an expansion of the activities described in point 3, we ask our database matching partners to identify customers / consumers that share similar characteristics of those in the matched users group, such as interests, viewing habits or buying habits – so that we can target them with the same ad campaign in order to reach the right audiences and ensure our marketing efforts are efficient.
   
    
   In each case, we only receive anonymised reporting (e.g. number of impressions) and you won’t receive direct marketing from us (e.g. mobile message/emails) unless you have consented to that.
   
   In this type of indirect marketing, the platforms and Relevant Third Parties act as a data controller. The exception to this is our data clean room provider (InfoSum), which acts as our data processor. Further information about how the platforms, including Facebook Ireland, and Relevant Third Parties process your personal data can be found in their respective privacy policies.
   
   
   

B. Profiling

We may use your Identity Data, Contact Data, Profile Data, Technical and Usage Data, Marketing and Communications Data and Location Data, together with Inferred Data, to form a view on what we think you may want or what may be of interest to you and to understand your purchasing trends. 

We may also use data which has been collected from third parties to enrich the data we hold relating to you in order to build a fuller picture of what may be of interest to you. This may include information obtained from Experian. Further information about how Experian collects and uses personal data, including the lawful basis Experian relies on, can be found Experian’s consumer information portal here: Experian Consumer Information Portal – Legal Basis.

These profiling activities inform how we decide which brands, products, outlets and offers may be relevant to you. By building a profile of you, we can send you tailored communications and make personalised recommendations, inform you of special offers we think you will be interested in, and customise promotions & special offers that are most relevant to you across a variety of channels. 
 
When you visit one of our websites, you can use the cookie consent tool to accept or reject non-essential cookies, including advertising cookies. If you accept them, these cookies will record information about how you interact with our websites and this information will then be used to serve you with relevant adverts on other sites based on the content that you have clicked on or interacted with. We may use information collected via cookies when you visit our websites and aggregate this with information gathered via the relevant websites to understand your preferences/interests and ensure marketing/remarketing is relevant. Please see our relevant cookie policy on the website you browse when accepting cookies for more detail on this and how to control your preferences.

Please note that whilst we carry out the profiling activities described here, we do not carry out any automated decision-making processes which could have a legal or significant impact on you.