Privacy Policy

In this policy "we" means Wm Morrison Supermarkets Limited.

We are registered with the Information Commissioner’s Office as a data controller, meaning we are responsible for how your personal information is handled.

Information we collect from you:

Some information you give us directly, such as when you open an online account with us, when you apply for a More Card and when you pay for goods and services in-store or online. You may also give us your personal information when you contact customer services, engage with our social media channels, enter competitions, respond to surveys or provide feedback or product reviews on our website. This will include your name, contact details, date of birth and usernames, and your marketing preferences.

We may also collect, store and use "special categories" of more sensitive personal information such as your racial or ethnic origin, religious beliefs or other beliefs of a similar nature and your physical condition (e.g. if you're pregnant, and join our baby club). We collect some of this on forms you fill in, and you can choose whether or not you want to provide it. At the time we collect this data, we will explain clearly why we are asking for it, how we will use it, and the lawful basis on which we will use it.

Information we collect when you shop with us:

When you shop with us, we will collect your financial and transaction details. If you have a More Card, we will collect your Morrisons More Card number in order to update your account, and we will keep a record of what you buy from us to allow us to provide you with relevant offers in the future.

If you visit a store, your car registration plate may be captured by our car parking cameras which monitor the acceptable use of our car parks. Your image may be captured on our CCTV cameras within store.

Information we collect from your device:

As you interact with our website(s), we may automatically collect technical data about your equipment, browsing actions and patterns. This will include your IP address, your phone’s IMEI number, your browser type and your location. We also track how often you visit and use our websites and mobile apps. We collect this personal data by using cookies, server logs and other similar technologies. We may receive technical data about you if you visit other websites employing our cookies.

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, please click here.

Information we collect from third parties

We may receive personal data about you from third parties, such as:

• Technical Data from the following parties:
  • analytics providers such as Google;
  • advertising networks; and
  • search information providers.

• Information from providers of technical, payment and delivery services such as Mastercard, Barclaycard, American Express, Experian based inside and outside of the EEA.

We use data from third parties to assist in our data accuracy. We use Experian’s Mosaic customer classification, which places you into one or more defined behavioural and socio-economic groups, to understand our customer database and to assist in location planning and purchasing decisions. We use UK Changes, for the limited purposes of removing deceased individuals from our database and for removing incorrect home addresses.

Occasionally, we obtain lists of potential customers from companies that collate these details and make them commercially available for marketing purposes. We only deal with reputable companies that take privacy as seriously as we do and will only ever use this information in a way which you would expect based on what you were told by the organisation who collected your data. You will always be able to opt out of receiving further marketing from us.

We use your personal information in a number of different ways, but these will always fall under one of these categories:

• When you consent to us doing so;
• Where we need to in order to perform the contract we have entered into with you;
• Where we have to comply with a legal obligation;
• Where it is necessary for our legitimate interests, and your interests and fundamental rights do not override those interests. We do not use your personal data for activities where our legitimate interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).

Purpose/ activity, type of data and lawful basis for processing

We have set out below, in a table format, a description of all the ways we may use your personal data, and which of the lawful bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Within the Morrisons Group

We share information from our online food business with Morrisons.com and there are similar arrangements between our other online and store-based businesses. This is because we hope to have a relationship with you across all our different brands and businesses, and we want to be able to provide you with the same value-for-money, high quality experience whenever and however you shop with us. It’s also the only way we can provide you with the full benefits of our More card.

With external third parties

On occasion we will share your personal data with organisations who work with us, to support the activities listed above. We make sure that these companies enter into contracts which require them to protect your privacy and respect data protection laws. We do not allow third parties to use your personal information for their own purposes. These organisations include:

• IT and system administration service providers.
• Professional advisers (including legal, audit, compliance and insurance)
• Web hosting, online content services and data storage
• Market research and collecting or analysing customer feedback
• Payment Service Providers
• Other people who help us provide our websites, mobile apps, in-store WIFI networks, stores, More card and related services to you
• Credit reference agencies for fraud prevention
• Social media companies such as Meta and X as advertisers
• Ad service and ad measurement providers such as Google & Youtube

Digital Marketing and Media Partners

Morrisons work with selected media partners in relation to our digital marketing and advertising activities. These partners display Morrisons products and offers on digital platforms that you may use, for example, Meta or Google. Morrisons also work with our media partners to create and find audiences who 'look like' our existing customer base. This is so we can display our products and offers to potential new Morrisons shoppers. To achieve this, we use data such as your product purchases to create customer groups which are then shared with the platforms to identify potential new customers to advertise to. The data shared is always encrypted and pseudonymised, meaning that while the digital platform receives data, they cannot identify you or any other person from the data received. If you do not wish to be included in the lookalike audience pools, you can do this updating your preferences to opt out of all marketing via your Morrisons Online Account.'

ROKT

If you consent via our cookie tool, we may provide limited personal data to Rokt, our third party partner, who provide custom offers from other brands. You can prevent this data sharing by not accepting advertising or analytics cookies on our website. To learn more about Rokt, you can visit www.rokt.com/privacy-policy or follow the links in the ads displayed.

Some of our external third parties are based outside the European Economic Area (EEA) so their processing of your personal data will involve a transfer of data outside the EEA.

Whenever we transfer your personal data out of the EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• transferring your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission, including the Privacy Shield in the US.
• using specific contracts approved by the European Commission which give personal data the same protection it has in Europe.

Please contact us if you want further information on how we transfer your personal data out of the EEA.

A lot of the information we receive reaches us electronically, originating from your devices, and is then transmitted by your telecoms network provider. Where it's within our control, we put measures in place to ensure this 'in flight' data is as secure as it possibly can be. Once it arrives at Morrisons, you can be sure we take the security of your information very seriously.

We use appropriate procedures and technical security measures (including strict encryption, anonymisation and archiving techniques) to safeguard your information across all our computer systems, networks, websites, mobile apps, offices and stores.

In particular, we follow internationally recognised security standards including the Payment Card Industry's Data Security Standards (PCI-DSS).

To make sure we meet our data protection and privacy obligations, we only hold on to your information for as long as we actually need it for the purposes we acquired it for in the first place which includes providing you with the services you have requested, meeting our legal and regulatory obligations, resolving disputes and enforcing our agreements.

In most cases, this means we will keep your information for as long as you continue to shop with us or use our services, and for a period of time afterwards for tax purposes and just in case you begin shopping with us again.

After that we will either delete it or anonymise it so that it cannot be linked back to you.

In some circumstances you can ask us to delete your data: see Request erasure below for further information.

Informing us of changes

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes by keeping your details up to date on your More Card and online shopping accounts.

Your rights in connection with your personal information

Under certain circumstances, you have the right to:

Request access

To your personal information (commonly known as a "subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.

You will not usually have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also ask you for further information in relation to your request to speed up our response.

We will respond to all requests within one month. Occasionally it may take us longer than a month to provide your personal data if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Request correction

Of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected. We may need to verify the accuracy of any new data you provide to us.

Request erasure

Of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. We may not always be able to comply with your erasure request for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Object to processing

Of your personal information where we are relying on a legitimate interest and you want to object to processing on this ground. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which means we can continue to process your personal information. You also have the right to object where we are processing your personal information for direct marketing purposes and if your personal information is automatically processed or profiled. You can ask us to stop sending you marketing messages at any time through our preference centre, or by contacting us directly.

Request the restriction of processing

Of your personal information. This enables you to ask us to suspend the processing of your personal data.

Request the transfer

Of your personal information to another party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Right to withdraw consent at any time

Where we are relying on consent to process your personal data. This will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

The Morrisons Data Protection Officer (DPO) oversees compliance with this privacy notice. If you have any questions or concerns about this Privacy Notice, how we handle your personal information, or would like to exercise any of your rights under the GDPR, please contact the DPO at dataprotection@morrisonsplc.co.uk. You have the right to make a complaint at any time to the Information Commissioner's Office (ICO) https://ico.org.uk/, the UK supervisory authority for data protection issues.

In some Morrisons stores, we’re trialling a new way for customers to verify that they are old enough to purchase age restricted products at the self checkouts. Use of this technology is based on your consent and is entirely optional. You can ask a colleague to attend at any time. The trial is being conducted in conjunction with the Home Office and the Government Office for Product Safety & Standards (OPSS). The technology is provided by Yoti, a digital age verification service.

If you choose to use the age estimation technology, you can do this in one of two ways:

1. An image of your face can be taken by the self-checkout and used to automatically estimate your age. The image will be analysed securely by Yoti’s software, and if the software deems you old enough to proceed without a colleague, you will be able to proceed.

   If the software deems you younger than our set requirements, a colleague will come along to verify your ID.

   The photo is not used to identify you, and it does not use facial recognition software. The image is not stored once the age estimation has taken place. Morrisons is the controller in this instance, and Yoti processes the image on our behalf.

2. You can choose to use Yoti’s app to verify your identity. To do so, you will have to create a profile on Yoti’s app, where their privacy information will be provided to you. Yoti will be the data controller in this instance. They will only provide us with your date of birth for our records, not your identity.

We reserve the right to update this Privacy Policy at any time, and we will provide you with a new Privacy Policy when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

If you have any questions about this Privacy Policy, please contact the Data Protection Officer dataprotection@morrisonsplc.co.uk.