Fonterra Group Privacy Statement

1. Introduction

This privacy statement provides information on the processing of personal data by Fonterra Co-operative Group Limited and its group companies (referred to as “Fonterra”, “we”, “our” or “us”).

“Personal data” means any information relating to an identified or identifiable individual.  This privacy statement is not applicable to data about companies.

At Fonterra we take your privacy seriously.  When you purchase our goods, use our services or interact with us, you may share some personal data with us. The purpose of this privacy statement is to be up front about the information we collect, how we use it, who we share it with and how you can exercise your privacy rights and all other privacy-related information that may be relevant to you.

Please read this privacy statement carefully in conjunction with our website terms and conditions, for example, at https://www.fonterra.com/nz/en/terms-and-conditions.html or  https://nzfarmsource.co.nz/business/my-business/terms.  Please also read privacy notices on other websites owned and operated by Fonterra (such as www.anchor.co.nz), and the privacy terms governing any specific campaigns, promotions and terms of contract that you enter into with us, so that you have a full picture of how we treat your personal data when you choose to share it with us, when we create it about you, or when we receive it from a third party. 

If you have any questions about our privacy practices or wish to access or request correction to any personal data we hold about you, please contact us (see ‘How can you contact us’ below).

There may be times where we need to update or revise this privacy statement at any time. Any changes to this statement will always be reflected here, and will take effect either immediately or when we tell you.  The continued use of our digital channels, or continuing to engage with us, after such changes are published indicates that you agree to be bound by this privacy statement.  This statement applies from May 2018 and was last updated on 1 May 2020.  

2. When does this privacy statement apply?

The commitments in this privacy statement apply to personal data we process of our farmers, consumers, customers, vendors and other business partners.  Interactions may be with us in person, via our digital channels (such as websites, mobile applications and/or email), by phone or otherwise. 

This privacy statement does not address the processing of personal data of applicants or employees in the context of their employment relationship with Fonterra. 

3. Who is responsible for your personal data?

Fonterra and its group companies are the controllers of all personal data that falls within the scope of this privacy statement. This privacy statement indicates what personal data is collected and used (processed) by Fonterra and for what purpose, and to which persons or entities the data will or may be provided. Fonterra may share your personal data with other companies for certain purposes. To read more about that, see ‘Who has access to your personal data?’.            

4. What purposes do we collect and use your personal data for?

 

4.1. We collect and use your personal data in a number of situations, for example:

 

4.1.1. When you do business with us:

(a) For the assessment and acceptance of a customer, supplier or business partner

When you get in contact with us, either via our website, telephone, offline or otherwise, we may process your personal data for assessment and acceptance purposes, for example, to confirm and verify your identity. We may further process your personal data for other administrative purposes such as due diligence and screening against publicly available government and/or law enforcement agency sanctions lists.  In addition, we may collect personal data about your credit arrangements in order to assess any credit application you make, this may include collecting your personal data from credit reporting agencies or other third parties for credit assessment and debt collection purposes. 

(b) For the conclusion, execution and performance of agreements with us     

When you have purchased or ordered a product or service from us as a customer or consumer, either online through an online shop, via telephone or offline, or when you work together with us as a vendor, supplier or business partner, we may process your personal data for administrative and customer service purposes, including sending invoices, processing payments, providing you with order status, dealing with your enquiries and requests, assessing and handling complaints, and otherwise communicating with you regarding an order that you have placed with us, or a product/service you are using (including critical updates and announcements).

(c) For relationship management and marketing       

We may use the information stored in our customer database for marketing purposes, including to send you suitable offers and newsletters, supply you with further information concerning products or services which may be of interest to you, and to invite you to take part in competitions, sales promotions, surveys or events. We will also use it to provide customer services, provide and maintain customer loyalty schemes (where you have registered), perform account management and communicate recalls. We may also use your personal data for the analysis, usage, trends and statistics of our digital channels, and development, execution and analysis of market surveys and marketing strategies.

(d) For internal management

We process your personal data in the performance and organisation of our business. This includes general management, order management and management of our assets, and the improvement of our services including monitoring the quality and standard of services provided by our Farm Source stores. We have central processing facilities which conduct audits and investigations, implement business controls, and manage and use consumer, customer, vendor and business partner directories. Also, we process your personal data for finance, accounting, archiving and insurance purposes, legal and business consulting, and to maintain the security of our data and systems.

(e) For management reporting analysis and acquisition and divestitures        

We process your personal data in the preparation and performance of management reporting and analysis (including in the context of mergers, acquisitions and divestitures, and management of such transactions). We use aggregated and anonymised personal data to create management reports and to analyse our business and report on certain metrics, either to comply with reporting regulations or to improve our processes and services. We may conduct customer, supplier and business partner surveys to learn more about your views and opinions in preparation of our management reporting.

(f) To comply with mandatory legal and regulatory obligations         

In some cases, we process your personal data to comply with laws and regulations (including tax and accounting requirements), which are subject to strict Fonterra Group Policies and Group Standards (such as retention periods).

We also monitor our IT systems to check for compliance with regulations, laws and Fonterra policies (including fraud).  Personal data we hold about you may be accessed and viewed for compliance monitoring purposes.  The personal data that is accessed and viewed for this purpose will not be stored following such monitoring unless we need it to further investigate potential non-compliant behaviour.

Where a specific jurisdiction imposes other obligations in relation to the collection, processing and use of your personal data we will comply with the requirements as per our obligations under that jurisdiction.

(g) (In the case of Fonterra farmers) to facilitate your compliance with your legal and regulatory farm management obligations.

(h) To facilitate the Trading Among Famers programme.

(i) For other purposes relating to the dairy industry.

(j) Any other purposes authorised by you or that are notified to you at the time of collection.

 

4.1.2. When you interact with Fonterra (online using our website or mobile applications or offline):

(a) Responding to questions and correspondence from you

If you get in touch with us via our customer services centres, corporate email addresses, phone numbers, physical address or via a contact form on a Fonterra website, we will use your personal data as set out in this privacy statement, including to reply to and answer your question or to provide other customer services or commercial support. Accordingly, we process your name, contact details, correspondence with us, your question and all other personal data which is necessary to respond to your communication.

(b) To allow you to connect with us (for example, via social media)     

We are active on social media platforms like Facebook, Twitter, and Instagram. When you contact us via social media, we process your personal data to answer your questions, to respond to your messages, and to provide customer services support.

(c) To deliver you our websites’ and/or apps' and for their technical and functional management        
If you use our digital channels such as websites or apps, we process technical data to offer you our digital channels’ functionalities, and to allow our administrators to manage and improve the performance of these services. If you enter data in our digital channels (such as a product preference, a photo or your location to receive relevant information or functionalities), we process this data to: (a) provide you with the requested information or functionalities; (b) allow you to save your data (such as preferences and products) to your saved items; (c) allow you to share these with others using the sharing options you have configured on your device; and (d) customise our digital channels to suit your preferences and interests. Fonterra also uses cookies to ensure you can retrieve information from our digital channels quickly and easily.  Read our cookies policy by visiting www.fonterra.com/cookiesstatement.

(d) If you open a user account with us, to administer the account and to ensure confidentiality and security of your transactions       

When you choose to register with one of Fonterra’s websites, apps or online portals, you need to provide personal data so that we can create a personal account for you. Upon creating your account, we will send you your personal login information. This personal data enables us to administer your account and verify your identity, ensure confidentiality and to maintain the security of your transactions, data or use of the account (including providing you with a replacement password when you forget your username or password for any account you have with us). We are, however, not able to view your password.

(e) For the development and improvement of products and/or services

We process your personal data to assess, analyse and improve our products and services for our farmers, customers and consumers. We use aggregated personal data to analyse consumer and customer behaviour and to adjust our products and services accordingly. When you use a website, app, or online portal, enter or search data through this website or app, we also process your personal data to compile analytics reports. We use aggregated personal data to analyse customer behaviour and to adjust our products and services accordingly, to ensure that it is relevant to our customers.  This means that we may analyse how often you read our newsletters, how often you visit our website, apps or portals, which pages you click on, and what transactions you make. We may purchase supplementary data from public sources to complement our database for the above purposes.

(f) To protect health, safety, security and to ensure integrity

At Fonterra, we value your health, safety, security and integrity highly. We process your personal data to safeguard our employees, customers, suppliers and business partners. As such, we authenticate your access rights to our premises. We also process your personal data to protect Fonterra and employee and customer assets.

               

4.2. The types of information we may collect and process are, where applicable:

· Your contact details such as your title, name, address, phone number, email address, contact preferences, and personal details such as your date of birth, gender, payment and credit information, tax and GST or VAT details.

·  Your correspondence with us, such as a note or recording of a call you make to a customer service centre, or with any of our employees, a live chat log, an email or letter sent, or other records of any contact or correspondence with us including the completion of forms on our digital channels (including surveys, search forms, registration forms, and other forms).

·  Where you have a personal account with us, your account information such as order history, payment history, account numbers, login data, correspondence with us, account management information or other information that you have added to your account.

·  Credential information – we’ll collect passwords, hints and similar security information used for authentication and access to any accounts and services.

· Your preferences for particular products, services and activities when you tell us what they are (for example by completing a survey), or we assume what they are, based on how you use any of our products and services.

· Data generated during the performance of the agreement(s) between you and Fonterra, and other data stored in our customer, supplier and business partner databases, including Farm Source.

· We process the personal data you have entered into our websites, apps or online portals or that is generated by the functionalities you have used in these forums and the technical data from your device such as its IP address, the internet browser you use, the pages you have visited on our websites, portals or apps, your click and surf behaviour and the length of your session. We process the communication channel you may have chosen to use to connect with us (such as Facebook or Twitter) and the personal data you supply to us. We may gather more extensive information if we are concerned, for example, about abnormal website usage patterns or website security breaches.

· See the 'Cookies' section for details on what we collect using cookies and visit www.fonterra.com/cookiesstatement for our full Cookies Statement.

· Your location data. This may be precise such as where you enable location-based services or features on our websites, apps or online portals, or less precise where, for example, a location is derived from your IP address or data such as an address.

· If you physically visit our premises, we may also collect information about you on CCTV as part of our security and crime prevention measures, we may also collect your name and contact details and, where applicable, car registration for security and health and safety purposes, and your visiting history to our premises, and to provide facilities such as wifi.

· Information we obtain from other third-party sources, such as credit agencies, fraud-prevention agencies, debt collection agencies and from other data providers that may relate to your interactions with us.

If you provide personal data to us about another person, you must ensure that person is aware of this privacy statement and you warrant that the person has authorised us, through you, to collect, use, process and disclose personal data about that person, for the purposes described in this privacy statement.

 

4.3. Lawful bases we rely on for processing this information

We comply with applicable privacy laws including the General Data Protection Regulation (GDPR). The lawful bases we rely on for processing information of data subjects subject to GDPR are: (a) your consent - you are able to remove your consent at any time by contacting us (see ‘How can you contact us’ below); (b) we have a contractual obligation; (c) we have a legal obligation; (d) we have a vital interest; (e) we need it to perform a public task; or (f) we have a legitimate interest.

5. Who has access to your personal data?

5.1. Transferring your personal data

As a global organisation, personal data we collect may be transferred internationally throughout our worldwide organisation.

If your personal data is transferred to a recipient in a country that does not provide the same level of protection for personal data that the New Zealand or the European Union privacy laws do, we will take measures to ensure that your personal data is adequately protected as required by applicable law.

 

5.2. Access to your personal data by third parties

When third parties are given access to your personal data, we will take the required contractual, technical and organisational measures to ensure that your personal data is only processed to the extent necessary, and in accordance with applicable law.

We may share your personal data with our related companies and the following types of third parties, where relevant, for the purposes set out in section 4 of this privacy statement:

· Partners, related bodies corporate, franchisees, or contractors, suppliers or agents involved in delivering the products and services you’ve ordered from us;

· Companies who are engaged to perform services for, or on behalf of, Fonterra or Fonterra’s group companies including web hosting providers, IT system administrators, couriers, payment processors, data entry service providers, electronic network administrators, and professional advisors such as accountants, solicitors, business advisors and consultants;

· Debt-recovery organisations, credit reference, fraud-prevention or business-scoring agencies, or other credit scoring agencies;

· Third parties for joint promotions with that third party. They’ll be responsible for their own compliance with applicable privacy laws;

· Third parties that we use for marketing, for example, approved media agencies, and third parties that we advertise with, such as Facebook, to serve you advertisements online; and

· other third parties with your express consent.

In the case of Fonterra farmers, we may also disclose your personal data to:

· approved auditors (including, without limit, QCONZ and AsureQuality); and

· related companies or joint ventures involved in providing farm data analysis services.

We may disclose your personal data to regulatory authorities, tax authorities and/or investigating authorities, where:

·  we are obliged to do so by law or regulation; or

·  we are responding to a request, including where there is a significant health and welfare issue (including for animals); or

·  you have provided instructions to Fonterra to allow this information to be disclosed.

5.3. The use of your personal data by data processors

When a third party processes your personal data solely following Fonterra instructions, it acts as a data processor. Where applicable, we enter into an agreement with such a data processor for the processing of personal data. In this agreement, we include obligations to ensure that your personal data is protected and processed by the data processor solely to provide services to us.

6. Cookies

To assist with the performance of our website, cookies may be installed on your computer. Cookies are small text files that are placed on your computer by websites that you visit.  Cookies are useful because they allow a website to recognise a user’s device. They are widely used to make websites work, or work more efficiently, as well as to provide information to the owners of the site.

Most cookies we use on this website collect information about how visitors use the website, for instance which pages visitors go to most often. These cookies do not collect information that identifies a visitor. All information collected by these cookies is aggregated and therefore anonymous.

Our website also uses cookies to ensure that users of the website are taken to their local version of the website each time they visit. The information these cookies collect may be anonymised and they cannot track your browsing activity on other websites.

Most internet browsers give you the option to reject all cookies, accept all cookies, erase cookies stored on your computer or be notified before a cookie is stored on your computer. However, if you reject or erase the cookies referred to above some of our website features or services will not function properly or may not be fully available. Please refer to your internet browser instructions if you want to find out more about rejecting or erasing cookies.

Please visit www.fonterra.com/cookiesstatement for our full Cookies Statement.

7. How is your personal data stored and secured?

We make all reasonable efforts to secure our systems to ensure the confidentiality and security of your personal data. We have implemented appropriate technical, physical and organisational measures to protect personal data against accidental or unlawful destruction or accidental loss, damage, alteration, unauthorised disclosure or access as well as all other forms of unlawful processing (including, but not limited to, unnecessary collection) or further processing.  Examples are specialised security teams, IT security policies, employee training and secure servers.

8. How long is your personal data retained?

We will keep your personal data for as long as it is required for the purpose for which it was collected, considering our need to answer queries or resolve problems, provide improved and new services, and comply with legal requirements. 

This means that we may retain your personal data for a reasonable period after your last interaction with us. 

If you would like to know specific retention periods for a certain type of information we collect, please contact us.  

9. How can you exercise your privacy rights?

You have the right to request access to your personal data, and in certain circumstances, rectification, amendment and/or erasure of your personal data.  In addition, depending on your jurisdiction, you may also have the right of restriction of processing concerning your personal data, or the right to object to processing as well as to data portability.

To invoke any of these rights, please contact us by using the contact details at the bottom of this privacy statement. Please keep in mind that we may ask for additional information to verify your identity and where you are located when processing your request as well as information about how you have previously interacted or engaged with Fonterra.

If you have given your consent to a certain purpose, you can withdraw your consent at any time. Please keep in mind that withdrawal will not have retrospective effect, and may affect what services we can provide you with.

It is important to us that your personal data held by us is accurate, complete and current.  If you are a registered user of a Fonterra company website account, you may log in to your account and (functionality permitting) update your personal data. 

10. Do you have a complaint?

If you want to contact us about any of your rights or complain about how we use your information, you can contact us on the details set out below. We’ll do our best to help but if you are still not satisfied, you can lodge a complaint with your local data protection supervisory authority.

11. Your privacy rights and how you can contact us

If you have any questions about the way we process your personal data, or want to request access to, deletion of, or correction of your personal data held by us, or want to make a complaint about breach of your privacy rights, please contact our Privacy Officer in writing at:

Fonterra, Privacy Officer
Private Bag 92032
Auckland 1142
New Zealand

Or by email at: privacy.officer@fonterra.com

If we cannot resolve your concerns, then you have the right to complain to the New Zealand Privacy Commissioner (or another applicable Data Protection Authority) about our actions.