Privacy Policy

The protection of your personal data is important to us. During all data processing procedures, we act in compliance with the statutory provisions. In the following text, we inform you in accordance with Art. 12, 13 and 21 of the General Data Protection Regulations (GDPR) on the handling of your personal data during the use of our website

Personal data comprises individual information on the personal or material circumstances of a certain or an identifiable natural person. This information includes the real name, the address, the telephone number and the date of birth.

I.    Responsible person

Responsible person in terms of the General Data Protection Regulations:  

Dunhills (Pontefract) PLC
26 Front Street
Pontefract, West Yorkshire
Email: [email protected]
Telephone: +44 (0) 1977 600266

II. Purposes and legal bases of the data processing

1.    Informational use of the website  

You may visit our website without stating any personal information. If you merely use our website for informational purposes, without logging in, registering or otherwise transmitting us any personal information, then we shall not process any personal data with the exception of data transmitted by your browser in order to facilitate your visit to the website and information which is transmitted within the scope of cookies for the statistical analysis of the use of our website.

a.    Technical provision of the website

For the purpose of the technical provision of this website, is necessary that we process certain automatically-transmitted information purporting to you so that your browser can display our website and so that you can use our website. This information is recorded automatically every time you access our website and is stored in our server log files. This information refers to the computer system of the computer calling up the website. The following information is processed:   

  • User’s IP address
  • Date and time of access
  • Method of access(Get/Post),
  • Request,
  • Protocol (e.g. http),
  • Status (e.g. error messages),
  • Data quantity retrieved
  • Referrer
  • User’s browser and operating system

Furthermore, we use cookies to facilitate your use of our website. Cookies are text files which are stored in the Internet browser or by the Internet browser when you call up a website on your computer system. A cookie contains a characteristic sequence string which facilitates unambiguous identification of the browser should you call up the website again. We exclusively use these cookies to provide you with our website and its technical functions. Some functions on our website cannot be offered without the use of cookies.The respective stated information is stored in the following list of cookies and transmitted to us:

Cookies for the control of the Loadbalancer:

  • rah5Rie1-%3Flv-har-de%3FHAR_world_https
  • rah5Rie1-%3Flv-har-de%3FHAR_https_haribo

The cookies for the control of the Loadbalancer ensure that a user who initially calls up and is transferred by the Loadbalancer to a certain backend service also receives their pages from this backend server during the entire session. They contain a key using which the assigned backend service can be unambiguously identified, e.g. ‘EINFEAAK’ or ‘FJNFEAAK’.

Cookie for storage of the consent for the use of cookies:  

  • privacy_agreed
  • accept

If the user accepts the cookie information, i.e. clicks on “CONSENT”, then this fact is stored in the cookies. This ensures that the user is no longer shown the information layer. The cookie privacy_agreed is placed when the user clicks on the brand platform, and contains the value ‘true’; on the corporate website it is the accept cookie which is also saved with the value ‘true’.  

Cookie for storage of the last language selection:  

  • last_locale

In this cookie, the language or country selection of the user is stored in the form of the ISO code for the country and language, meaning that the correct country version will be loaded immediately if the user visits the website again. 

Session cookie ContentManagementSystem:

  • fe_typo_user

The cookie fe_typo_user is placed by the Content Management System used, and contains a unique hash value, e.g. ‘11ee05f2869497562817be4ad4322cfd’. The cookie may be used during a frontend login for users.

Your information which we have collected through the abovementioned cookies shall not be used by us to create user profiles or to evaluate your surfing behaviour.   

We process your personal data for the technical provision of our website based on the following legal bases:

  • For the fulfilment of a contract or for the implementation of pre-contractual measures in accordance with Art. 6 Section 1 lit. b GDPR, if you visit our website to inform yourself on our products and our events, and
  • For the preservation of our legitimate interests in accordance with Art. 6 Section 1 lit. f GDPR, so that we can ensure technical provision of the website. Our legitimate interest consists of being able to provide you with an appealing, technically functional and user-friendly website and to take measures for the protection of our website against cyber risks, and to prevent cyber risks being generated through our website for third parties.

b.    Statistical analysis of the use of our website and range increase

For the purpose of the statistical analysis of the use of our website, we use analysis tools. In this way, we can improve the quality of our website and its contents. We learn about how the website is used and can thus consistently optimise our range of offers.

The information received within the scope of the statistical analysis shall not be merged with your other data collected within the scope of the website.

We process your personal data for the statistical analysis of the use of our website based on the following legal bases:

For the preservation of our legitimate interests in accordance with Art. 6 Section 1 lit. f GDPR in connection with § 15 Section 3 TMG (German Telemedia Act); our justified interest shall consist of the design of our website in line with requirements.
If you have issued your consent, then based on this consent, Art. 6 Section 1 lit. a GDPR.

2.    Active use of the website

In addition to the purely informational use of our website, you can also use our website actively in order to get in contact with us or to register for the Newsletter. In addition to the above mentioned processing of your personal data for purely informational use, we then also process further personal data which we require to process and respond to your request.

a. Contact request

To be able to process and respond to your requests to us, for example via the different contact forms, we process the personal data of which you have informed us accordingly. This data always includes your name and your email address so that we can send you a reply, as well as the other information which you send to us within the scope of your notification.

We process your personal data when responding to user requests based on the following legal bases:

For the preservation of our legitimate interests in accordance with Art. 6 Section 1 lit. f GDPR; our legitimate interest consists of the proper reponse to customer requests.

b. Newsletter, advertising emails and fan pool

With your consent, we use your data for advertising and market research purposes, such as for example the transmission of our Newsletter or your participation in the fan pool. We always process your first name and surname and your email address as mandatory information, Within the scope of the fan pool, we process the following data: form of address, place of residence, street, house number, postcode and date of birth.

You can cancel the Newsletter at any time by clicking on the link provided in the Newsletter and carrying out the cancellation.

You can deregister from the fan pool at any time on our website under Company/Service/Fan pool.

We process your personal data for the purposes stated here on the following legal basis:

  • Your consent in accordance with Art. 6 Section 1 lit. a GDPR.

III.    Links

Some sections of our website contain links to third party websites. These websites are subject to their own data protection principles. We are not responsible for their operation, including the handling of data. Should you send information to or via such third party websites, then you should inspect the Data Protection Declarations for these websites before you send them information which can be assigned to you. 

These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.

IV.    Categories of recipients

Initially, only our employees receive information on your personal data. In addition, we inform other recipients who provide services to us connected with our website, inasmuch as this is lawful or prescribed by law. Here we limit the forwarding of your personal data to the essentials. In part, our service providers receive your personal data in their function as order processors, and are then strictly bound to our instructions with regard to the handling of your personal data. In part, the recipients handle your data independently as it is transmitted to them by us.

Below is a list of the recipient categories regarding your personal data:

  • External service providers for the Newsletter dispatch via email, the response to or inspection of requests or the processing of competitions 
  • Logistics service provider in order to be able to send goods, letters or other objects 
  • Insurers in case of claims asserted against us 
  • Payment service providers and banks during the processing of payments
  • IT service providers during the administration and hosting of our website 
  • Legal consultants in case of the assertion of or defence against claims   

V.    Transfer to non-member states

Within the scope of the application of Google tools, we transmit your abbreviated IP address into the USA. The data transfer is based on the implementation decision (EU) 2016/1250 made by the EU Commission from 12th July 2016 in accordance with the Directive 95/46/EC of the European Parliament and the Council on the appropriateness of the protection offered by the EU-US data security shield.

In addition, we shall not transmit your personal data into countries outside the EU or the EEA or to international organisations.

VI.    Duration of storage

1.    Informational use of the website

In case of the purely informational use of our website, we store your personal data as follows:  

  • Server logs are stored for up to 3 months.
  • The cookies concerning the consent to the use of cookies shall be stored for one month.
  • The cookies for the selection of language or country shall be stored for three months.
  • The cookies placed by Google Analytics shall be stored as follows: The _ga cookie shall be stored for up to 2 years, the _gid cookie shall be stored for 1 day; all other Google Analytics Cookies shall be deleted at the latest 1 hour after you leave the website. 
  • The Loadbalancer cookies shall be stored for up to 10 years. 
  • Otherwise, your personal data shall be deleted without delay once you have left our website. 

In addition, you have the possibility to delete installed cookies yourself at any time.  

2.    Active use of the website  

In case of active use of our website, we shall only save your personal data as long as this is required:

  • The data transmitted by you within the scope of requests shall initially be stored for the duration of the response to your request. If applicable, we shall continue to save your personal data up until the statute of limitation for any legal claims from the relationship with you, so that we can if applicable use these as evidence. The statue of limitation shall in general total between 12 and 36 months, but can also total up to 30 years. At the begining of the statute of limitation, we shall delete your personal data unless we are subject to a statutory storage obligation. These storage obligations may total from two to ten years.
  • In case of registrations to the fan pool, your data is stored until you deregister from the fan pool.
  • In case of competitions, your data shall be deleted at the latest 4 weeks after determination of the winner.  

VII.    Automated decision-making / profiling

We do not use automated decision-making or profiling (an automated analysis of your personal circumstances).

Information on your right to object, Art. 21 GDPR

You have the right to file an objection at any time against the processing of your data which takes place due to Art. 6 Section 1 f GDPR (data processing based on a weighing of interests) or Art. 6 Section 1 e GDPR (data processing in the public interest) if reasons can be stated arising from a special situation. This shall also apply for profiling supported by this provision in terms of Art. 4 No. 4 GDPR.

Should you file an objection, we shall no longer process your personal data unless we are able to verify compelling legitimate grounds for the processing which outweigh your interests, rights and freedoms, or the processing service for the assertion or exercising of legal claims or the defence against legal claims.

We also process your personal data in individual cases in order to carry out direct advertising. Should you not wish to receive any advertising, you shall have the right at any time to file an objection against it; this also applies for profiling inasmuch as this is connected with such direct advertising. We shall then observe this objection in future.

We shall no longer process your data for the purposes of direct advertising if you object to their processing for these purposes. 
Your objection need not follow a particular form, and should if possible be addressed to: 

Data Protection Coordinator (HR)
Dunhills (Pontefract) PLC
26 Front Street
Pontefract, West Yorkshire
Email: [email protected]
Telephone: +44 (0) 1977 600266

VIII.    Changes

We reserve the right to change this Data Protection Declaration at any time. Any changes shall be announced on our website through publication of the changed Data Protection Declaration. If not otherwise determined, such changes shall take effect immediately. Please therefore check this Data Protection Declaration regularly in order to view the respective most recent version.

Status: 31st January 2020