Gallaher Limited (trading as "JTI UK") is a company incorporated in England and Wales with company registration number 01501573 and whose registered office is at 1 Werter Road, Putney, SW15 2LL England ("JTI", "we", "us", "our"). We are committed to protecting and respecting your data protection and privacy rights.

This Privacy Policy sets out the basis on which we process any personal data collected through this microsite (the “Site”), which has been developed as part of our public awareness campaign against illicit tobacco trade. Please read the following carefully to understand our practices regarding your personal data and how we will treat it.

For the purposes of the UK General Data Protection Regulation, and any other applicable data protection legislation, the data controller is JTI.

Scope of this Privacy Policy

This Privacy Policy applies solely to the Site and does not apply to other JTI websites or platforms. The Site is intended to provide information to the public about the harms of illicit tobacco and to direct users to third-party reporting services.

This Site does not collect personal data directly from users. However, it uses cookies and analytics tools to understand how the Site is used and to improve its performance.

Questions, comments and requests regarding this Privacy Policy and the personal data that we process about you are welcomed and you can contact us at Itcostsmorethanyouthink@jti.com.

Please be aware that if you choose to contact us via this email address, your message may include personal data (e.g. if you submit a query, concern, or tip-off). Any such personal data will be processed by JTI for the purposes of reviewing and responding to your communication, and in accordance with this Privacy Policy. Depending on the nature of your message, it may also be handled in line with JTI's broader data protection policies, including for the purposes of investigation or compliance.

Information we may collect

This Site does not collect personal data directly through forms or registrations.

However, we may collect information in the following ways:

Information you provide to us voluntarily
If you choose to contact us via the email address provided on the Site (e.g. to submit a query, concern, or tip-off), you may provide personal data such as your name, contact details, or other information relevant to your message. This information will be processed by JTI for the purposes of reviewing and responding to your communication, and in accordance with this Privacy Policy.

Information collected automatically
When you visit the Site, we may collect certain technical and usage information automatically, including:

• Device and browser information, such as your IP address, browser type and version, operating system, and device type;
• Usage data, including pages visited, time spent on the Site, and interactions with content;
• Referral data, such as the website or platform that referred you to the Site;
• Cookie and tracking data, collected via Google Analytics 4 (GA4), which may include anonymised identifiers and aggregated usage statistics.

This information is collected to help us understand how the Site is used, improve its performance, and ensure it is functioning as intended. We do not use this data to identify you personally, and we do not combine it with other data sources.

For more information on how we use cookies and similar technologies, please refer to our Cookies Policy.

Lawful grounds and purposes for which we use your information

We will only use your information where the law allows us to do so. In the context of this Site, we rely on the following lawful grounds:

We do not use your information for direct marketing purposes through this Site, nor do we collect personal data for profiling or automated decision-making.

Links to Third-Party Websites

The Site contains links to third-party websites, including Crimestoppers, Citizens Advice, and HMRC, for the purpose of reporting illicit tobacco activity. These websites are not operated or controlled by JTI. Once you leave our Site, we are not responsible for the protection and privacy of any information you provide to those third parties. We encourage you to read the privacy policies of any external websites you visit.

Data Sharing and international transfers

We do not collect or share personal data through this Site. Any data collected via cookies is processed in accordance with our legitimate interests in monitoring and improving the Site's performance.

If any data collected via cookies is transferred outside the UK or EEA, we ensure that appropriate safeguards are in place, such as standard contractual clauses or adequacy decisions, to protect your data.

If you want more information on the specific mechanisms used when transferring your data outside the UK or EEA, please contact us atItcostsmorethanyouthink@jti.com.

Where your personal data is stored

If you contact us via the email address provided on the Site and include personal data in your message (e.g. in a query or tip-off), that data may be stored on JTI's internal systems and servers located in the United Kingdom or the European Economic Area (EEA). Access to this data is restricted to authorised personnel and handled in accordance with JTI's internal data protection procedures.

Any technical and usage data collected through this Site (such as via Google Analytics 4) may be stored on servers located in the United Kingdom, the European Economic Area (EEA), or other jurisdictions where our service providers operate.

Where data is transferred outside the UK or EEA, we ensure that appropriate safeguards are in place to protect your information, including the use of standard contractual clauses or reliance on adequacy decisions, where applicable.

If you want more information on the specific mechanisms used when transferring your data outside the UK or EEA, please contact us at Itcostsmorethanyouthink@jti.com.

Data security

We are committed to ensuring that your information is secure. If you choose to contact us via the email address provided on the Site and include personal data in your message, we will take appropriate technical and organisational measures to protect that data from unauthorised access, disclosure, alteration, or destruction.

Although this Site does not collect personal data directly through forms, we implement appropriate technical and organisational measures to safeguard any data processed through cookies and analytics tools.

Access to analytics data is restricted to authorised personnel and service providers who require it for the purposes outlined in this Privacy Policy. All such parties are subject to confidentiality obligations.

Please note that while we take reasonable steps to protect your information, the transmission of data over the internet is not completely secure. We cannot guarantee the security of data transmitted to the Site and any transmission is at your own risk.

How long we will keep your information

We retain analytics and technical data collected through this Site for as long as necessary to fulfil the purposes for which it was collected, including monitoring Site performance, ensuring security, and improving user experience.

Although the data collected is limited and pseudonymised (e.g. device identifiers, IP addresses with anonymisation enabled), it may still be considered personal data under applicable data protection laws. This data is retained indefinitely on the analytics platform in an aggregated or pseudonymised form, and is not used to identify individual users.

If you contact us via the email address provided on the Site and submit personal data (e.g. in a query or tip-off), we will retain that data only for as long as necessary to respond to your communication and to comply with our legal or regulatory obligations. The specific retention period may vary depending on the nature of the information and the context in which it was provided.

If you would like more information about specific retention periods or how this data is managed, please contact us at Itcostsmorethanyouthink@jti.com.

Your legal rights

If you submit personal data to us via the contact email address provided on the Site (e.g. in a query or tip-off), or if we process pseudonymised data through analytics tools (such as Google Analytics 4), you may have certain rights under the UK General Data Protection Regulation (UK GDPR) and, where applicable, the EU General Data Protection Regulation (EU GDPR). These rights may include:

• The right to request access to any personal data we may hold about you;
• The right to request correction or erasure of your personal data;
• The right to object to or request restriction of processing;
• The right to data portability;
• The right to withdraw consent, where processing is based on consent;
• The right to lodge a complaint with a supervisory authority, such as the Information Commissioner’s Office (ICO) in the UK.

Note, that these rights are subject to exemptions.

If you believe that any data processed through this Site relates to you personally, or if you wish to exercise any of your rights, please contact us at Itcostsmorethanyouthink@jti.com. We will respond in accordance with applicable data protection laws.

For more information on your rights, or to lodge a complaint, you can contact the ICO at: https://ico.org.uk/make-a-complaint/.

Changes to our Privacy Policy

Any changes we may make to our Privacy Policy in the future will be posted on this page and, where appropriate, notified to you by e-mail. Please check back frequently to see any updates or changes to our Privacy Policy.

EFFECTIVE 19/06/2025