BOOKER GROUP PRIVACY NOTICE

What this Privacy Notice covers

This Privacy Notice cover the activities of Booker Limited, Makro Self Service Wholesalers Limited, Booker Retail Partners (GB) Limited and Booker Direct Limited and all trading styles of those companies. The data controller is the relevant company whose services are being used (collectively referred to in this Notice as "Booker Group" or "we" "our" or "us").

We are committed to doing the right thing when it comes to how we collect, use and protect your personal data. That's why we've developed this Privacy Notice which:

• sets out the types of personal data that we collect
• explains how and why we collect and use your personal data
• explains when and why we will share personal data within the Booker Group companies and with other organisations; and
• explains the rights and choices you have when it comes to your personal data

Booker Group companies serve a variety of registered customers in different ways and this Notice applies to you if you use our services (referred to in this Notice as "our Services").

To use our Services you must be a business, trader or other organisation who wishes to use our Services for the purpose of that business or enterprise and not for personal use. Using our Services means being a registered customer of Booker, Makro or Booker Retail Partners through one or more of the following mechanisms:

• cash and carry branches of Makro or Booker;
• online or otherwise using any of the websites ("our Websites") where this Notice is posted; or
• as a member of one of our symbol groups (Premier, Family Shopper, Budgens, Londis) scheme ("Symbol Group")

Some other parts of our Group, or additional services provided by us may need to collect and use personal data to provide you with their products and services and for certain other purposes not covered in this Privacy Notice. They have their own privacy policies that explain how they use your personal data in relation to that function.

What Personal Data Do We Collect?

This section tells you what personal data we may collect from you when you use our Services.

When you register as a customer of a Booker Group company we will collect:

• Your personal details, including the name of the proposed account holder, your business address, email addresses, data of birth, photo ID (in some cases) phone numbers and title.
• The names and telephone numbers of any additional card holders.
• You will be given an account number which identifies your customer account and used by us.
• Trading names, including proof of trading address and sales information will also be captured.
• CCTV images of you may be captured on our premises.
• Where applicable we are required to collect additional information for those customers selling alcohol in Scotland.

In addition to the above, if you shop with us online via our Websites we may collect:

• Your account password
• Information about your purchases (for example, what you have bought, when and where you bought it and how you paid for it)
• Google analytics information regarding URL, Java and flash enabling, and other browser information;
• Information about your online browsing behaviour on our Websites and information about when you click on one of our adverts (including those shown on other organisations' websites)
• Information about any devices you have used to access our Services (including the make, model and operating system, IP address, browser type and mobile device identifiers); and
• Location information based on IP address and language.

We will also collect additional information from customers' who apply for and/or obtain credit accounts including:

• Your bank account details (or those of the payer);
• Your credit history and other financial information either via credit searches you have authorised as part of your application or that you have provided as part of your application.

Whenever your account is used we will collect transactional information regarding the goods purchased, payment method, date and time of purchase.

When you contact us or we contact you or you take part in promotions, competitions, surveys or questionnaires about our Services, we may collect:-

• Personal data you provide about yourself anytime you contact us about our Services including by phone, email or post or when you speak with us through social media
• Details of the emails and other digital communications we send to you that you open, including any links in them that you click on
• Your feedback and contributions to customer surveys and questionnaires

Other sources of personal data

We may also use personal data from other sources, such as specialist companies that supply information.

We may also obtain personal information from credit or reference agencies, the Land Registry and Companies House in respect of any credit applications or where other guarantees are required.

Members of the Public.

From time to time we may be contacted by individuals who are not the account holder or card holder.

In those circumstances we will gather sufficient information to address the query or issue (such as name, address and contact details). In some cases we may need to pass that information on to a third party, such as a supplier (in the event of a product related query) or a third party advisor in order to address the matter in question. Any information obtained will be processed purely for the purpose of the single issue or query raised and will be deleted in line with our retention policy once the matter has been closed.

How and why we use personal data

This section explains in detail how and why we use personal data.

We use your personal data to ensure we can deliver our Services to you as follows:

• Manage the account(s) you hold with us;
• Process your orders and refunds;
• Provide the additional Services we perform for Symbol group members or Classic Drinks customers;
• Administer 'Spend and Save' or any other loyalty scheme;
• Deliver goods to your premises;
• Communicate with you about your account or the services required;
• Produce invoices and statements and make them available on line for you;
• Consider any application for credit;
• Maintain your credit account;
• Communicate with you in emergencies or in relation to a product recall;
• As evidence of identity for high cash transactions and for the granting of credit;
• Review your purchase history to enhance the online shopping experience via tools such as your Recent Purchases and Copy Previous Order;
• CCTV images are obtained to ensure security and safety; and
• Issue membership cards

We need to process your personal data so that we can manage your customer accounts, provide you with the goods and services you want to buy and to help you with any orders and refunds you may request. Processing your data in this way is necessary to enable us to fulfil our obligations to you as your supplier.

We will also use your data to:

Manage and improve our websites, branches, distribution depots, product ranges and deliveries for example:-

Data is used to help develop and improve our product range, services, stores, information technology systems, know-how and the way we communicate with you. We rely on the use of personal data to carry out internal and external market research which enables us to serve you better as a customer.

Detect and prevent fraud or other crime.

We have an obligation to ensure that our Services are safe and consequently, if required your data may be processed in order to detect and prevent fraud, other crimes and the misuse of our Services. This helps us to make sure that you can safely use our Services.

Personalise your customer experience

On Booker Group websites we may also use your online browsing behaviour as well as your in-store and online purchases to help us better understand you as a customer and provide you with personalised offers and services.

Looking at your browsing behaviour and purchases allows us to personalise our offers and services for you – such as allowing you to place the same order again and to personalise communications to your business type and local area. This helps us meet your needs as a customer. We can then provide you with relevant marketing communications (including by email, phone, post and text where permitted), relating to our products and services, and those of our suppliers, third parties and other companies within Booker Group and affiliate companies. We may also measure the effectiveness of our marketing communications.

We want to ensure that we provide you with marketing communications, including online advertising, that are relevant to your business needs.

Changing your preferences

You can state your marketing preferences when you register with us as a customer and can change these at any time after that by notifying us either by telephone or at your local branch, or by unsubscribing to an email, or opting out of the text service.

You also have choices when it comes to online advertising. We set out below your choices when it comes to cookies, and how you can control your online behavioural advertising preferences.

Contact and interact with you

We may contact you about our Services, for example by phone, email, text or post or by responding to social media posts that you have directed at us.

We want to serve you better as a customer so we use personal data to provide clarification or assistance in response to your communications and to respond to your queries.

Manage promotions and competitions

Manage any competitions or promotions you take part in, including those we run with our suppliers and other third parties.

We need to process your personal data so that we can administer the promotions and competitions you choose to enter.

Invite you to take part in and manage customer surveys, questionnaires and other market research.

We'd like to involve you in activities carried out by the Booker Group companies, our wider affiliated companies within the same group of companies and by other organisations on our behalf.

Why do we process your personal data in this way? We carry out market research to improve our Services. However, if we contact you about this, you do not have to take part in the activities. If you tell us that you do not want us to contact you for market research, we will respect this choice.

Sharing personal data within the Booker Group and with other companies within our wider group of companies.

This section explains how and why we share personal data with other companies within the Booker Group and our wider corporate group of companies.

We may share the personal data we collect with other companies in the Booker Group. For example, we may share your customer data amongst Booker Group companies to enable us to deliver your goodsand services from the most convenient location to you.

Sharing personal data with Third Parties and Service Providers

This section explains how and why we share personal data with third parties and Service Providers.

When we share personal data with these companies we require them to keep it safe.

Third Parties

We work with a number of Third Parties who –

• sell products through our Services, for example our suppliers; or
• offer products, services that may be of interest to you and your business or organisation.

In the main we will share only anonymised aggregated data with suppliers. However in some circumstances we may also share personal data (psuedonymised or anonymised where possible) to enable those suppliers to deliver their services such as:-

• Central billing suppliers who will need your information to deliver goods and to communicate directly with you about your order or delivery or cellar management services.
• We may share personal information of Symbol Group members or other customer groups to suppliers in order to verify purchasing habits, membership, promotions and range compliance and other information with a view to obtaining benefits which can be passed on to those customers.
• Enable those Third Parties to market their goods and services to you in accordance with your marketing preferences.
• Those undertaking market research, surveys or gathering other industry related information relating to the Service we provide to you.

Service Providers

We work with carefully selected Service Providers that carry out certain functions on our behalf. These include, for example, companies that help us with technology services, storing and combining data, processing payments, credit checking and those who provide service on our behalf such as delivering orders to your premises, erecting signage, sending communications on our behalf or market research. We only share personal data necessary to enable our Service Providers to provide their services.

Sharing personal data with other organisations

This section explains how and why we share personal data with other organisations.

We may share personal data with other organisations in the following circumstances:

• if the law or a public authority says we must share the personal data;
• if we need to share personal data in order to establish, exercise or defend our legal rights (this includes providing personal data to others for the purposes of preventing fraud and reducing credit risk);
• to an organisation we sell or transfer (or enter into negotiations to sell or transfer) any of our businesses or any of our rights or obligations under any agreement we may have with you to. If the transfer or sale goes ahead, the organisation receiving your personal data can use your personal data in the same way as us;
• any company within our parent company's group of companies;
• to any other successors in title to our business.

How we protect personal data

We know how important it is to protect and manage your personal data. This section sets out some of the measures we have in place.

• We use computer safeguards such as firewalls,data encryption, a private network and we enforce physical access controls to our buildings and files to keep this data safe. We only authorise access to employees who need it to carry out their job responsibilities.
• We protect the security of your information, while it is being transmitted to Third Party Suppliers and Service Providers, using secure Peer to Peer Encryption (P2PE), Virtual Private Networks (VPN) or Transport Layer Security (TLS)

We enforce physical, electronic and procedural safeguards in connection with the collection, storage and disclosure of personal data. We may occasionally ask for proof of identity before we share your personal data with you.

However, whilst we take appropriate technical and organisational measures to safeguard your personal data, please note that we cannot guarantee the security of any personal data that you transfer over the internet to us.

When we send any data to any third party we will take steps to ensure the safety of your data.

The personal data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA"). It may also be processed by companies operating outside the EEA who work for us or for one of our service providers. We will put in place appropriate protection to make sure your personal data remains adequately protected and is treated in line with this Notice.

Marketing and Market Research

This section explains the choices you have when it comes to receiving marketing communications and taking part in market research.

We will send you relevant offers and news about our products and services in a number of ways including by email, but only if you have previously agreed to receive these marketing communications. When you register with us we will ask if you would like to receive marketing communications, and you can change your marketing choices online, in branch, over the phone or in writing at any time.

We also like to hear your views to help us to improve our Services, so we may contact you for market research purposes. You always have the choice about whether to take part in our market research.

We will also give your details to carefully selected third parties to enable them to contact you about goods and service they offer which may be of interest to you and your business.

Cookies and Similar Technologies

We use cookies and similar technologies, such as tags and pixels ("Cookies"), to personalise and improve your customer experience as you use our Websites and Mobile Apps and to provide you with relevant online advertising. This section provides more information about Cookies, including how we use them and how you can exercise your choices about our use of Cookies.

A list of the cookies that we use: Cookie List and Definitions.

How we use Cookies

Cookies are small data files that allow a website to collect and store a range of data on your desktop computer, laptop or mobile device.

Cookies help us to provide important features and functionality on our Websites and Mobile Apps, and we use them to improve your customer experience. For example, we use Cookies to do the following:

Improve the way our Websites work

Cookies allow us to improve the way our Websites and Mobile Apps work so that we can personalise your experience and allow you to use many of their useful features.

For example, we use Cookies so we can remember your preferences and the contents of your shopping basket when you return to our Websites and Mobile Apps.

Improve the performance of our Websites

Cookies can help us to understand how our Websites and Mobile Apps are being used, for example, by telling us if you get an error messages as you browse.

These Cookies collect data that is mostly aggregated and anonymous.

Deliver relevant online advertising

We use Cookies to help us deliver online advertising that we believe is most relevant to you on our Websites and other organisations' websites.

Cookies used for this purpose are often placed on our Websites by other organisations, and always with our permission. These Cookies may collect information about your online behaviour, such as your IP address, the website you arrived from and information about your purchase history or the content of your shopping basket. This means that you may see our adverts on our Websites and on other organisations' websites. You may also see adverts for other organisations on our Websites.

Measuring the effectiveness of our marketing communications, including online advertising

Cookies can tell us if you have seen a specific advert or message, and how long it has been since you have seen it. This information allows us to measure the effectiveness of our online advertising campaigns and control the number of times you are shown an advert.

We also use Cookies to measure the effectiveness of our marketing communications, for example by telling us if you have opened a marketing email that we have sent you

Your choices when it comes to Cookies

You can use your browser settings to accept or reject new Cookies and to delete existing Cookies. You can also set your browser to notify you each time new Cookies are placed on your computer or other device. You can find more detailed information about how you can manage Cookies at the All About Cookies and Your Online Choices websites.

If you choose to disable some or all Cookies, you may not be able to make full use of our Websites. For example, you may not be able to add items to your shopping basket, proceed to checkout, or use any of our products and services that require you to sign in.

Your Rights

Under the General Data Protection Regulation, you have the right to see the personal data we hold about you. This is called a Subject Access Request.

If you would like a copy of the personal data we hold about you, please write to:

Data Privacy Officer, Legal Department, Booker Group, Equity House, Irthlingborough Road, Wellingborough, NN8 1LT or at dsar@booker.co.uk

We want to make sure that the personal data we hold about you is accurate and up to date. If any of the details are incorrect, please let us know and we will amend them.

Changes to this Privacy Notice

We reserve the right to make changes to this Privacy Notice from time to time, so please take the time to review periodically.

Last reviewed May 2018