Employee Privacy Notice

Bacardi is committed to the protection of its employees’ personal data, in line with the data protection principles set out in the European Union General Data Protection Regulation 2016 (“GDPR”) and other country specific data protection regulations.

This Notice describes the steps that the Bacardi Group of Companies (“company”, “we” or “us”), takes to protect your personal data, as a Bacardi employee. This Notice applies to all company employees’ personal data, whether in electronic format or in a paper structured filing system, such as a personnel file, or which is intended to form part of a Filing System. This Notice may be amended from time to time and available on our company’s intranet site. Depending on local regulations requirements, country specific employee notices may be implemented and take precedence over this global employee notice.

1. Why do we process your Personal data?

In connection with your employment, the company collect, store, use and otherwise process personal data about you for various business purposes. Being responsible for processing your personal data makes the company the Data Controller.

Personal data are collected and processed for the following purposes:

• for the performance of our employment agreement with you, including the administration of the employment relationship (payroll, employment benefits or maintaining an employee directory);
• for us to pursue our legitimate interests1 , which mainly relates to business process and internal management (travel and expense management, business reporting, systems reporting and access, archiving, analyses, performance review purposes, training, administering compensation programs, disciplinary purposes and other business purposes related to the management of BACARDI’s workforce, for facilities and IT systems and infrastructure management, safeguarding the security of our infrastructure, premises, assets and office equipment, including for the prevention of illegal and criminal activity); and •
• to meet our legal obligations as your employer under applicable tax, social security and employment laws (health, safety & security)

2. Categories and Sources of Personal data that we process

The categories of personal data that the company processes for these purposes are set out in Annex1. Most of the personal data we process on you have been provided directly to us. Other personal data may be provided by your managers, HR, benefits providers or others.

In some cases, we need to process Special Categories of personal data. We only process these data in order to comply with our legal obligations (employment, health and safety, security and social security laws or pursuant to collective agreements). Processing of Special Categories may also be necessary to protect the vital interests of individuals and the business (e.g. health and safety) or for the establishment, exercise or defense of legal claims.  

3. Sharing and transferring your personal data

a) Intra-group transfers

As a multinational company operating under a matrixed management structure, we share employee personal data with other members of the Bacardi group of companies (Annex 2), for the purposes set out in Section 1 of this Notice. These transfers are protected by the obligations set out in intra-group agreements2 between the various legal entities comprising the Bacardi group of companies. These agreements cover:

• transfers of personal data between Bacardi entities within the EU (Annex 2) and
• transfers to Bacardi affiliates outside the EEA (Annex 2)

b) Third Party Suppliers

Our company shares personal data with external vendors or service providers or suppliers that we engage to perform services or functions on our behalf and under our instructions. Where these vendors are located within the EU, we ensure these parties process your personal data in accordance with our instructions, with high standards of confidentiality and protection, in line with the GDPR requirements

Some of the vendors that we engage to process your personal data are located outside the European Economic Area. When applicable, these transfers are governed by the EU Commission-approved Standard Contractual Clauses for Processors. You may request a copy of the EU Standard Contractual Clauses for Processors by contacting us at dataprotection@bacardi.com.

For the purposes set out in section 1 of this Notice, we may also disclose employee Personal data to our auditors, lawyers, consultants, law enforcement and other public authorities (such as tax and social security bodies), the police, prosecutors, courts and tribunals. We may also disclose your employee personal data to current or previous employers; credit or employment reference agencies; banks; pension and benefits administrators and insurance companies; hotels, travel agencies, airlines telecommunications operators, providers of HR systems, providers of training services and payroll agencies. Where necessary, we will ensure that appropriate contractual measures are in place to ensure the protection of your personal data.

c) Selling your personal data

The Bacardi Intra Group Agreement dated 20 August 2019 ensures that the processing and transferring of personal data of employees (including payroll data) is handled in accordance with applicable data protection laws 014-4077-0550/1/GLOBAL Bacardi will not sell, rent, release, disclose, disseminate, make available, transfer, or otherwise communicate orally, in writing, or by electronic or other means, employee’s personal information for monetary or other valuable consideration.

4. How long we keep your personal data

We will keep and process your personal data only for as long as is necessary for the purposes for which it was collected in connection with your employment with the company, unless the company has a legal right or obligation to retain the data for a longer period, or the data is necessary for the establishment, exercise or defense of legal claims.

5. Compliance Monitoring, Security and Systems Use 

When permitted by law, we measure the performance of Bacardi’s IT systems by monitoring employee usage of Bacardi systems; this includes analyzing times, locations and activities whilst users are logged into the network.

We may also, conduct auditing, monitoring, investigation, and compliance monitoring activities in relation to Bacardi policies, the Bacardi Code of Conduct, applicable law, the prevention and detection of illegal or criminal activity and to protect Bacardi’s assets and premises.

    In response to legal and regulatory requests, we will comply with lawful requests by public authorities, disclosure requests, or where otherwise required or authorized by applicable laws, court orders, government regulations, or regulatory authorities (including without limitation data protection, tax and employment), whether within or outside your country.

6. WhatsApp

WhatsApp is a messaging app that allows users to text, chat, and share media, including voice messages and video, with individuals or groups. WhatsApp was never specifically designed for enterprise use, and the security risks of using a tool like this for official company business is welldocumented. Due to the lack of transparency on the processing and transfer of personal data by WhatsApp, several European regulators are discouraging its use in a business environment. Therefore, when possible, alternative tools for collaboration purposes will be considered, particularly in Europe.

Risks of Using WhatsApp

The potential risks to the data protection rights of employees are as follows;

a) WhatsApp’s scanning of Contacts (including on Outlook) and uploading this data to its servers - such scanning cannot be turned off,

b) WhatsApp’s sharing of personal data with its parent company Facebook for further use,

c) International transfers of personal data to the US. 

Use of WhatsApp

If the use of WhatsApp for communicating between Primos is required, please note the following.

1. The use of WhatsApp as a communication tool is voluntary
2. All-important announcements and decisions should not solely be distributed through WhatsApp but also communicated via email or through One Bacardi. Discussion on WhatsApp should relate to topics which do not require preservation or record-keeping in the company system
3. When legally required, we will seek consent from employees on the use of WhatsApp. If refused, this would have no impact on the employment relationship with Bacardi. The consent must be freely given, informed, specific and unambiguous
4. When possible or legally required, sign up to WhatsApp by only using a corporate device and the work phone number.
5. Remove any personal contacts from the corporate device to avoid WhatsApp’s access to such data
6. Limit discussions to issues that do not involve sensitive or decision-making situations on individual employees
7. Avoid distributing important documents over WhatsApp i.e. avoid sharing documents that have a legal requirement for record-keeping
8. Data deletion: delete communication every week or so to avoid keeping any personal data on the tool. 

7. Your Rights

National laws provide you with certain rights in relation to the processing of your personal data. These rights are not absolute and are subject to applicable data protection and privacy legislation. 014-4077-0550/1/GLOBAL

They may include:

• Request access to personal data about you. This enables you to receive information on how we process your personal data and a copy of the personal data we hold about you.
• Request rectification, correction, or updating to any of the personal data that we hold about you.
• Request personal data on you to be transferred in machine-readable format (“data portability”)
• Request erasure of your Personal data. This enables you to ask us to delete or remove Personal data where there is no good reason for us continuing to process it, for example, once your employment with us ends.
• Request the restriction of the processing of your personal data. This enables you – under specific conditions - to ask us to suspend the processing of personal data about you.
• Object to the Processing of your Personal data in certain circumstances. 

Should you wish to exercise these rights, please contact us at dataprotection@bacardi.com. When prescribed by law, you can also lodge a complaint with your local data protection Authority if you are not happy with how we process your personal data or/and address your request.

8. Contact us 

If you have any questions about this Notice, please contact us at dataprotection@bacardi.com

9. Definitions

The following terms used within this Notice are defined as follows:

“Binding Corporate Rules” are internal rules for data transfers within multinational companies. They allow multinational companies to transfer personal data internationally within the same corporate group to countries outside of the European Economic Area

“Data Controller” means the legal entity which, alone or jointly with others, determines the purposes and means of the processing of Personal data

“Data Processor” means a legal entity (or public authority) which processes personal data on behalf of the Data Controller.

“Employees” means temporary, full-time and part-time contract employees, interns, apprentices, contingent workers, retirees.

“Employee personal data” means any personal data related to employees

"European Economic Area" or "EEA" means the Member States of the European Union, plus Norway, Iceland and Lichtenstein.

“Filing System” means any structured set of Personal data which are accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis.

“GDPR" means the EU General Data Protection Regulation 2016/679 including national laws implementing or supplementing the GDPR.

“Personal data” means any information relating to an employee, including a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Special Categories of Personal data” are Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, a trade union membership or sexual orientation.

“Process” or “Processing” means any operation or set of operations which is performed on Personal data or on sets of Personal data, whether or not by automated means, such collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. 

_________________________________________________________________________________________________________________________________________________________________________________

Annex 1: Categories of Personal data and Grounds for Processing

Company will Process the following categories of data based on legitimate grounds for Processing:

1. Personal data necessary for the performance of your employment agreement with the company: 

2. Personal Details Processed where necessary for the purposes of pursuing our company’s legitimate interest

Legitimate interests are our business management or commercial reasons for using your personal data. When relying on our legitimate interests, we will not unfairly put our interests above yours

3. Personal Details necessary to comply with our company’s legal obligations

4. Special Categories of Personal data Processed in accordance with GDPR Article 9.2(b) or (h)

• data concerning health:
• medical or health conditions
• occupational health reports
• blood or urine sample
• criminal record

Annex 2 – Bacardi entities part of the Bacardi Intra Group Agreement

The Bacardi Intra Group Agreement dated 20 August 2019 ensures that the processing and transferring of personal data of employees (including payroll data) is handled in accordance with applicable data protection laws

_________________________________________________________________________________________________________________________________________________________________________________

1 . According to the law, legitimate interests of our business can be an appropriate reason. Legitimate interests are our business management or commercial reasons for using your personal data. When relying on our legitimate interests, we will not unfairly put our interests above yours