Contents
1. Introduction
2. About Us and Contact Details
3. Where Do We Collect Your Data from?
4. Why Do We Collect Your Personal Data and What Types?
5. Marketing (Withdrawing Your Consent)
6. With Whom Do We Share Your Personal Data?
7. How do we protect your Personal Data?
8. International Transfers of Personal Data
9. How Long Do We Store Your Personal Data
10. Your Rights:
11. How to Lodge a Complaint
12. Updates to the Privacy Notice
13. Glossary
Welcome to our Privacy Notice for Johnson & Johnson Ltd, part of Kenvue (“we, us, our”). We are committed to protecting your Personal Data, this Privacy Notice outlines our practices regarding the processing of your Personal Data when you interact with our website and use our services (together “Services”).
We have organised this Privacy Notice into sections and included a Glossary at the end where you can find explanation of any defined terms we have used. We will update this Privacy Notice from time to time. Any changes will be available on the Privacy Notice accessible from the website and will include the last reviewed date. If we make any significant changes, we will notify you and provide you with additional information. We encourage you to check this Privacy Notice regularly to stay informed about how we use your Personal Data.
Links on our website may direct you to other brands or services we offer, each with its own privacy notice distinct from this one. We encourage you to review the specific privacy notices of these sites to understand how they use your personal data.
Johnson & Johnson Ltd, part of Kenvue (“Kenvue”) is registered in the United Kingdom, 50-100 Holmers Farm Way, High Wycombe, HP12 4EG. Under Applicable Data Protection Laws, we are the Controller of your Personal Data.
We have designated a Data Protection Officer (DPO). You can contact our DPO and the EMEA DPO Team at emeaprivacy@kenvue.com
We will collect Personal Data about you from the following sources:
Directly From you:
- When you visit our website or register to use our services.
- Through cookies we use on our website, for more information please visit our Cookie Policy
- Via surveys and feedback forms e.g. data collected when you participate in surveys, feedback forms, or market research initiatives.
- Your devices e.g. when you use your device to browse our website. For more information about our use of Personal Data which we collect from your device see our Cookie Policy
Third Parties:
- Companies that are part of Kenvue to assist us with the services we offer you or for internal administrative purposes.
- During collaborative events with other organisations.
The table below outlines what activities we carry out, the type of Personal Data we use and our legal basis for processing your Personal Data.
Why We Collect Your Personal Data |
Personal Data Processed |
Our Legal Basis |
To provide you with access to our Services e.g. to browse our website, download reports, presentations |
Device information, IP address. Please see our see our Cookie Policy |
It is necessary to perform a contract with you or to take steps prior to forming a contract with you. |
To improve, personalise, and expand our Services |
Browsing history, user preferences, device information (device type, Operating system, unique Identifiers), location data, interaction with the website. Please see our Cookie Policy |
Legitimate Interest. (our legitimate interest in enhancing our services and offerings). Where we have your consent (to improve user experience and ensure the content is relevant and engaging) |
For Event Management, to organise and manage events and webinars |
Name, email login details, username, password, and preferences related to the registration |
Performance of a contract (for event registration) Legitimate Interest (providing training/ webinar content to you) |
To monitor, understand and analyse trends, and how you use our Services. |
IP address, web analytics data, user behaviour data, device type, browser type. Please see our Cookie Policy |
Where we have your consent |
To provide you with surveys to develop new brand products, services, features and functionality. |
Feedback and interaction data. |
Where we have your consent |
To send email alerts about financial news, quarterly reports, annual reports, SEC filings, end of day stock quotes, events and presentations. |
Where we have your consent |
|
To provide you with information you have requested, including without limitation, brochures, and responses to applications |
Email, phone number, request details, any personal data provided in forms or applications. |
Where we have your consent |
To communicate with you, either directly or through one of our partners, including for customer services, to provide you with updates and other information relating to the Services, and for marketing and promotional purposes. |
Email, phone number, communication preferences, interaction and engagement data, marketing preferences. |
Where have your consent (for marketing communication) It is necessary to perform a contract with you or to take steps prior to forming a contract with you. Legitimate Interest (for service-related communications). |
To respond to any enquiries from you regarding our products and Services. |
Name, Email, phone number, enquiry details, any personal data provided during communication. |
To provide the contracted Service. |
To meet our legal and regulatory obligations. |
Email, phone number, digital usage data - Information collected through digital platforms such as website visits, browser type, version, usage and pattern, and interactions with online content. Please see our Cookie Policy |
To comply with our legal obligations. |
To find, investigate and prevent fraudulent activities. |
Email, phone number, digital usage data - Information collected through digital platforms such as website visits, browser type, version, usage and pattern, and interactions with online content. Please see our Cookie Policy |
Legitimate Interest, to prevent fraudulent activities. |
For claims, legal disputes, investigations, enforcement of terms and conditions, for the defense of our rights. |
Email, phone number, transaction data, communication records, legal documents. |
Legitimate Interest for the purpose of establishing, exercising, or defending legal claims. |
We may process and disclose your Personal Data to comply with legal process or applicable law, which may include laws outside your country of residence. |
As required by the specific legal request or obligation, which could include a wide range of data, Contact details (email, phone number), As account details, transaction history, and communication records. |
Legitimate Interest (for the purpose of complying with local and foreign laws (where applicable)). |
If you have consented to receive (opted-in) direct marketing, you can withdraw your consent (opt-out) and not receive marketing communication from us anytime. You can do this by clicking unsubscribe in our marketing emails or contact us at consumer-gb@kenvue.com. Please note that if you withdraw your consent to receive marketing related messages from us, we may still send you important transactional and administrative messages, from which you cannot opt out from.
Marketing from our other parties
If you have previously consented to receiving marketing from our affiliates or third-party partners, each with its own unique offerings, you will receive messages and promotions directly from them. Our affiliates and third-party partners manage their own marketing activities. They will handle your Personal Data and any consent withdrawals as set out in their privacy notices.
Where you have consented but no longer wish to receive marketing from our affiliates or third-party partners, you should contact them directly to stop their marketing messages.
Your Personal Data may be shared with various recipients for the purposes outlined under section 4. You can find the categories of recipients below:
- IT services providers, in the field of image optimization, analytics, hosting services, logs management, security and performance for the browser.
- Website Development Companies.
- Data Analysis Firms to improve our services and user experiences.
- Customer Service that assists in handling customer inquiries and issues.
- Data enrichment service providers e.g. social media platforms (Facebook, Instagram).
- Marketing agencies and advisors.
- Kenvue Affiliates acting as our processor, to help us provide our services to you e.g. our customer service function to handle your enquiries.
- Our external professional advisors e.g., legal advisors, our auditors.
- Our Kenvue Affiliates, to send direct marketing about their services and products where you have consented to them doing so.
· Where permitted by applicable law, a third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).
· We may also disclose your Personal Data when necessary or appropriate, especially in response to laws enforcement agencies, fraud prevention bodies, legal counsel, public or government authorities. This may include authorities outside your country of residence. Such disclosures are made to protect our rights, privacy, safety, or property, and/or that of our affiliates, you, or others.
We seek to use effective organisational, technical, and administrative measures designed to protect Personal Data under our control. For example, we implement robust security measures to protect your information, which include encryption of transmitted data and secure password practices. If you have a reason to believe that your interaction with us is no longer secure (for example, you believe that the security of your account with us has been compromised), please immediately notify us via the “Contact Details” section above.
To ensure your data is protected in the countries we transfer to outside the UK, we either:
- Transfer your Personal Data to countries recognised by the UK as providing adequate data protection, please see list here; or
- Transfer your Personal Data by contractually ensuring that the recipient is bound by the UK International Data Transfer Agreement or the UK Addendum to the EU’s Standard Contractual Clauses.
You may obtain a copy of these adequate measures by contacting our Data Protection Officer and the EU DPO Team in accordance with the “Contact Details” section above.
We will retain your Personal Data for as long as needed or permitted considering the purpose(s) for which it was obtained. The criteria used to determine our retention periods include: (i) the length of time we have an ongoing relationship with you and provide our services to you; (ii) whether there is a legal obligation to which we are subject; and (iii) whether retention is advisable considering our legal position (such as in regard to applicable statutes of limitations, litigation, or regulatory investigations).
You have various rights regarding your data, as detailed in the table below:
Your Rights |
Description |
The right to object to the processing of your Personal Data |
You can object to the use of your Personal Data for certain purposes. You have the right to stop your Personal Data being used for direct marketing at anytime |
The right to be informed |
You have the right to know if and how we process your Personal Data, as detailed in this Privacy Notice. |
The right of access |
You can request access to and a copy of your Personal Data we have unless legal exceptions and exemptions apply. |
The right to rectification (correct) |
You can ask us to complete or correct any incomplete or incorrect Personal Data. |
The right to Erasure (also known as the “right to be forgotten”) |
You have the right to ask us to delete your Personal Data in certain circumstances, for example, we cannot delete if there is a legal or regulatory obligation on us to keep it. |
The right to restrict the processing |
You can request that we limit processing your Personal Data in specific situations: a) when its accuracy is contested, b) the processing is unlawful, but you do not require the deletion of your Personal Data c) your Personal Data is no longer needed for processing, but you need it for the establishment, exercise or defence of legal claims d) If you object to processing of your Personal Data occurring based on our Legitimate Interest. |
The right to data portability |
You can request your Personal Data in a machine-readable format, only when processing is based on your consent or contract and is carried out by automated means. |
The right to withdraw consent |
If you gave consent for processing your Personal Data, you can withdraw it anytime. Withdrawing consent will not affect the lawfulness of past processing, and we will inform you if we can no longer provide you with your chosen service. |
We will keep a record of your requests. In cases of manifestly unfounded, vexatious or excessive request, we may charge a reasonable fee or refuse the request. If you make a request, we will need to confirm your identity and may ask for additional information to help us with your request. We will respond to your request without undue delay, but it may take up to one month to respond. If your identity cannot be verified, we cannot process your request. You can exercise your rights by emailing consumer-gb@kenvue.com. Please note that for a complex request, timelines may extend up to two months. In such case you will be promptly informed accordingly.
If you have any questions, concerns or complaints about this Privacy Notice, please contact consumer-gb@kenvue.com
You may also lodge a complaint with a data protection supervisory authority in particular where you reside, you work or the matter you are complaining about took place.
The competent data protection supervisory authority in the UK is the Information Commissioner’s Office (ICO), Make a complaint | ICO
Terms |
Definitions |
Applicable Data Protection Laws |
means all applicable EU legislation and regulation relating to data protection and privacy including without limitation UK’s version of the EU GDPR (the “UK GDPR”) and the UK’s ePrivacy rules (“PECR”). |
Controller |
is a person(s) or company (either alone or jointly or in common with other persons) who decides how Personal Data will be processed. |
Legitimate Interest |
This is a legal basis which we are able to rely on where we are processing Personal Data for our activities and needs or the activities and needs of others, including providing you with the best service and experience we can offer. We will balance our interests against any potential impact on your rights or freedom. |
Personal Data |
This refers to any Information relating to an identified or identifiable individual, who can be directly or indirectly identified by reference to identifiers (e.g. name, email, demographic information, and online identifiers). |
Privacy Notice |
Also referred to as a Fair Processing Notice or a Privacy Policy – informs individuals what Personal Data is processed and how and why a company will process it. This document is the Privacy Notice for the Services. |