The Coca‐Cola Company Privacy Policy
1. Policy Summary
The Coca-Cola Company and wholly-owned direct and indirect subsidiaries ("TCCC") respects the privacy of individuals and wants to ensure that all Personnel are familiar with its practices and procedures for protecting all Personal Information that TCCC collects, uses and discloses. This Privacy Policy ("Policy") sets out the uniform minimum standard TCCC will take with respect to the worldwide Processing of Personal Information, and provides appropriate and consistent safeguards for the handling of Personal Information by its Personnel.
2. Policy Applies To / Eligibility
This policy applies to all employees of The Coca-Cola Company and its worldwide subsidiaries, including officers, directors, and agents.
3. Policy Details
3.1. Purpose of Data Processing
TCCC Personnel will only process Personal Information for legitimate business needs, or as otherwise required or authorized by law. TCCC's legitimate business needs include:
- providing products and services requested by its customers and consumers;
- protecting security and safety of TCCC and Individuals including its customers, consumers, business partners, and Personnel;
- marketing of products and services including running contests and promotions;
- protecting TCCC's economic and financial interests;
- managing its workforce including providing benefits and entitlements (such as compensation and benefits) to Personnel;
- communicating with Individuals including Personnel, business partners, consumers and customers;
- safeguarding uninterrupted continuity of business operations;
- carrying out an (intended) sale, merger, or acquisition or other corporate transaction;
- preventing, detecting, and prosecuting (including cooperation with public authorities) of suspected fraud and security, other breaches of (criminal) law, breaches of the terms of employment or other rules or codes, including internal controls, audit, or lawful investigations by a governmental body or public authority and related internal investigations;
- protecting the rights and freedoms of TCCC, its customers, consumers, business partners, and Personnel; and
- complying with legal requirements.
3.2. Security and Confidentiality
TCCC and its Personnel will take appropriate and commercially reasonable technical and organizational measures to protect Personal Information against unauthorized or accidental access, acquisition, loss, disclosure, destruction or damage.
Access to internal TCCC systems that contain Personal Information is limited to a select group of authorized TCCC users who have a business need to access particular Personal Information. TCCC users are given access to such systems through the use of a unique identifier and password and other access control mechanisms.
Personnel who need permanent or regular access to Personal Information are bound by contract, code of conduct, work rules, or policies that protect the confidentiality of the Personal Information.
3.3. Notice
TCCC entities will provide each Individual with information as to the Personal Information collected from him or her, the purposes for which such information is collected, the identity of the entity responsible for the collection, as well as other information such as access and correction rights, unless the Individual already has such information. Such information may be provided in written or electronic form or by providing a link to a website in accordance with applicable law. The information will be easily accessible, for example, published on the TCCC website for customers or on the TCCC intranet for TCCC Personnel.
Where the Personal Information has not been obtained directly from Individuals, Individuals will be informed as appropriate and in compliance with local law. If personal information is disclosed to a Third Party, Individuals will be informed as appropriate.
The TCCC Global Privacy Council (see section 13) may allow exemptions in case of compelling business interests, or where informing all Individuals is impossible or disproportionate.
3.4. Choice
When appropriate and as required by law, TCCC entities will provide customers, consumers and Personnel with the right to choose how, when, and for what purpose(s) their Personal Information will be Processed. This choice will vary depending on the types of information to be Processed, the proposed purpose(s) of Processing, and the extent to which misuse of such information is likely to result in severe harm or damage to the Individual. For example, TCCC will provide Individuals with the opportunity to opt out when their Personal Information is to be disclosed to a Third Party for marketing purposes. If, however, third party disclosures are necessary in order to provide a product or service requested by the Individual, or if third party entities have been hired by TCCC to perform services, then the Individual may not be given the opportunity to opt out, except where required by law. In such instances, TCCC will remain accountable for the handling of the Personal Information by its Agents and Service Providers.
TCCC does not collect Sensitive Personal Information, except in specific and limited cases. In such cases, the information is Processed in compliance with applicable law.
3.5. Access and Correction Rights
TCCC entities will ensure that Individuals may request information regarding the Personal Information stored or Processed about them by any TCCC entity. When requested, Individuals will be provided with reasonable access to Personal Information as required by applicable law.
If any TCCC Personal Information is inaccurate or incomplete, Individuals may request that their Personal Information be corrected.
Requests for access, correction, or deletion may be denied in some instances, such as where required by law, if the request is unreasonable, if the request will receive personal information regarding someone else, or for other compelling reasons. Where a request is denied, consistent with applicable law, TCCC will inform the Individual about its reasons for such denial, except where compelling business interests require otherwise.
3.6. Data Quality
Reasonable steps will be taken to maintain accuracy of Personal Information based on the intended purposes of use.
3.7. Cross-Border Transfers
Your personal information will be shared with affiliates that are in other countries including the US, which may have different data protection laws than in the country in which you work.
3.8. Retention of Personal Information
TCCC will retain Personal Information consistently with its legal obligations and consistently with its data retention policies and procedures. See "InfoAccess: Managing Records and Information", available at
https://partner.coca-cola.com/sites/infoaccess/default.aspx
In addition, TCCC will dispose of Personal Information that is no longer needed in a responsible manner.
3.9. Service Providers
At times, TCCC entities may share Personal Information with selected Service Providers that deliver products and services. Service Providers are selected to: (i) process Personal Information only to deliver products and services as instructed by TCCC; (ii) not disclose or transfer Personal Information to or allow access by any Third Party (including affiliates and subcontractors) without TCCC's prior permission; (iii) put in place appropriate security standards to ensure that the Personal Information is kept confidential and secure; (iv) inform TCCC of any inspection, audit, or inquiry made by any supervisory authority with regard to the Personal Information under its control; (v) notify TCCC promptly when it reasonably believes that there has been any unauthorized or accidental access, acquisition, loss, disclosure, destruction or damage of Personal Information ("Security Breach; and (vi) to return or destroy the Personal Information to TCCC upon termination or expiration of the relationship or upon request.
3.10. Third Parties
TCCC may disclose certain Personal Information to unaffiliated third parties as a matter of law, to protect
TCCC's rights, or in an emergency, to the extent necessary for the purposes permitted by this Policy or
where the TCCC Global Privacy Council has authorized the disclosure.
In certain circumstances, TCCC may not remain accountable for this sharing. For example an unaffiliated
third party for whom TCCC is not accountable includes mortgage companies, Individuals seeking a reference,
credit bureaus, collection agencies, or government entities. If an Individual expressly requests that TCCC
transfers data to a specific unaffiliated third party,
TCCC will do so with no further obligation to ensure that the Personal Information are Processed properly, or that the unaffiliated third party destroys the Personal Information once the Processing has been completed.
3.11. Direct Marketing
TCCC will not process Personal Information to conduct direct marketing, unless Individuals are given an opportunity to opt out of receiving direct marketing communications, or, where required by law, have provided their prior express consent.
3.12. Children
TCCC will specifically instruct children not to submit Personal Information and/or will take reasonable steps to ensure that parental consent is obtained for such submission. In the consumer context, TCCC will specifically instruct children under 13 not to submit Personal Information and/or will take reasonable steps to ensure that parental consent is obtained for such submission.
3.13. Training
Appropriate training will be provided to Personnel who have permanent or regular access to Personal Information or who are involved in the collection of Personal Information.
3.14. Complaint Handling/Enforcement Process
TCCC has appointed Global Privacy Council, which ensures compliance with this Policy.
All TCCC entities and Personnel will ensure that this Policy is observed. Non-compliance with this Policy may result in disciplinary sanctions, dismissal, or any other type of sanction permitted by applicable law.
If at any time any person subject to this Policy believes that Personal Information are or have been Processed in violation of this Policy, he or she may report the concern to the TCCC Chief Privacy Officer by e-mail at privacypolicy@coca-cola.com ; the local Legal office; the local Human Resources office; or the Ethics & Compliance Office
Ethics & Compliance Office
The Coca-Cola Company
One Coca-Cola Plaza
Atlanta, Georgia 30313 USAEmail: compliance@coca-cola.com
Phone: +1-404-676-5579
Fax: +1-404-598-5579
If any Worker believes that he or she is not able to comply with this Policy because of legal requirements or instructions given to him or her, he or she should also report that information. The TCCC Global Privacy Council, in cooperation with other appropriate Personnel, will take the necessary and appropriate steps and inform the relevant person about the outcome of the process.
3.15. Audit
TCCC will periodically monitor compliance with this policy.
3.16. Obligations Towards Data Protection Authorities
TCCC will respond diligently and appropriately to inquiries from data protection authorities and other regulators with jurisdiction about this Policy or compliance with applicable data protection and privacy laws and regulations.
All inquiries relating to this Policy should be directed to TCCC Global Privacy Council:
privacypolicy@coca-cola.com
3.17. Relationship between this Policy and national law
TCCC recognizes that certain laws may impose requirements stricter than those described in this Policy. TCCC will handle Personal Data in accordance with applicable local law. Where applicable local law provides a lower level of protection of Personal Data than that established by this Policy, then the requirements of this Policy will apply.
3.18. Implementation of and Modifications to this Policy
This Policy was enacted January 2007; amendments to this Policy will become effective February 2013. This Policy shall be published on the TCCC Intranet.
TCCC reserves the right to modify this Policy as needed, for example, to comply with changes in laws, regulations, TCCC practices and procedures, or requirements imposed by data protection authorities. TCCC will post all changes to this Policy on relevant internal websites.
4. Policy Purpose
This Privacy Policy ("Policy") sets out the uniform minimum standard TCCC will take with respect to the worldwide Processing of Personal Information, and provides appropriate and consistent safeguards for the handling of Personal Information by its Personnel.
5. Key Terms and Definitions
When used in this Policy,
"Personal Information" means any information Processed by TCCC that relates to an identifiable Individual. An identifiable Individual ("Individual") can be, for example an employee, independent contractor, temporary employee, agent, consumer, or any employee of customers, distributors, and service provider.
"Sensitive Personal Information" means Personal Information that reveals, directly or indirectly, the racial or ethnic origin, political or philosophical opinions, religious beliefs, trade union membership, physical or mental health or sexual life or the judicial data of an Individual or personal financial information such as an individuals bank account number, credit card number, government issue ID (including Social Security number), driver's license number or biometric data.
"Processing" or "Processed" means any action that is performed on Personal Information, such as collecting, recording, organizing, storing, using, disclosing, transmitting, disseminating, blocking, or deleting such information.
"Personnel" means any Individual performing work for TCCC such as a current or former employee, independent contractor, and temporary agent.
"Service Provider" means any company which is not a subsidiary or affiliate of TCCC, which processes Personal Information on behalf of, or as directed by TCCC.
6. Related Policies, Processes, and Guidelines
- IPP
- Data Classification Guide
- Personal Information
- Privacy FAQ
Last Reviewed/Revised Date : August 2016
Original Effective Date : January 2007
For questions or clarification, please contact:
Katherine Fithen
Chief Privacy Officer
+1 404 676 3151
kfithen@coca-cola.com
privacypolicy@coca-cola.com
Disclaimers:
Notice of Disclaimer – Right to Vary, Terminate or Amend Policy
The Coca-Cola Company ("the Company," "TCCC") intends to notify associates of changes to
its policies and procedures. However, TCCC reserves the right to change, revise, withdraw, or add to its
policies, processes, procedures, or guidance at any time, at its sole discretion, with or without notice if
necessary, in accordance with applicable law and regulations by providing such notice as may be required by
applicable law. If there is any discrepancy between local law, labor agreements, including works council
agreements, or custom and the content of this policy, then local law, labor agreements and/or custom will
always govern. This policy does not create any contractual rights or obligations, whether express or
implied.
Notice of Disclaimer – Contract of Employment
TCCC's policies and associated processes, procedures, and guidance are not contracts of employment nor are
they intended to create contractual rights or obligations for TCCC. The terms of this policy do not create a
contract of employment or alter the at-will employment relationship between the Company and Employees in all
jurisdictions where employment at-will is permitted. In instances where a contract of employment exists the
terms of this policy are not incorporated into an associate's contract of employment with the Company.
It is important to note that for most policies the original language is English. In the event that the
original language is not English, the original language will govern. If there is some discrepancy between
the original language version and any other version, then original language version governs.
