Introduction and Purpose

Ushop by HUL Program is a loyalty program wherein consumers can enrol into the Program as members and would be eligible for various promotional schemes, offers and rewards under various promotional activities conducted and communicated under the Program. A member can earn loyalty points on purchase of HUL products and products of Ushop Partner products (as and when enlisted and communicated on the Ushop Platform) at Ushop Partner outlets. These Ushop Points earned can thereafter be redeemed by the member while purchasing HUL products and Ushop Partner Products from the Ushop Partner Outlets (offline and online). Similarly, Ushop Partner outlets can also redeem the points accumulated by them through redemption of points by members, with respective Ushop Partner for products.

Under Ushop Program, HUL and Ushop Partners aim to provide a better shopper experience to its consumers and resellers. Ushop attempts to do so by presenting a platform to HUL and any Ushop Partner to understand its consumer purchase habits, trends, etc. to run promotional activities and offer customised promotions and also loyalty rewards for purchases, etc., thus rewarding the members of the Program.

The list of Ushop Partner brands and outlets will be made available on Ushop Platform or communicated by any other means, which may be updated from time to time.

The Ushop Program is controlled and managed by Hindustan Unilever Limited along with its Program Partners Airtel and Mosambee.

We would like to state that any personal data or information collected shall be used only for the purpose of Ushop Program by Ushop, HUL, its Ushop Partners and any service providers of the Program. We collect, process and disclose your personal data only for specific and limited purposes to Ushop Partners and third parties who require the same to provide relevant services in the operation of the Ushop Program. All personal data related to members under the Program is owned and controlled by Hindustan Unilever Limited. However, all personal sensitive financial information details such as credit card number, expiration date, billing address, etc. shall be owned and controlled by Airtel, which provides the payment gateway portal under the Program.

We would therefore request you to review the Privacy Notice with respect to the type of personal and sensitive personal data being collected under the Program.

We have tried to keep this Notice as simple as possible, but if you’re not familiar with terms, such as cookies, IP addresses, and browsers, then please read about these key terms.

Categories of Personal and Sensitive Personal Data Being Collected
We collect and use various types of information to service your accounts, save your time and money, better respond to your needs, and manage risk. Customer information shall be collected under the following categories

1. Personal data you give us directly: We collect the personal data that you have shared as part of the Ushop Program or provided to us by you as part of your engagement with the Company during signing up or through other activities. Enrolment and registration into the Ushop Program would require sharing personal information, which may include any of the following information such as name, mobile number, email id, address, zip code, date of birth, gender, contact details, demographic details, marital status, mailing address, preferences, etc, which will need to be provided by the subscriber to the Program. These information about the Member helps provide services under the Program and also customize the services for Members. Such personal information may be shared by the users at the time of enrolment or during any other activity, engagement, survey, etc. under the Program.

2. Sensitive Personal Data Collected: We would also collect payment related information made under the program such as payment mode, credit card/debit card number, expiration date, card holder name, billing details, etc. that has been voluntarily provided while transacting through the Point of Sales Terminal/Machines in the store and/or online platform of Ushop Partners. In the event there are any other Payment Wallet or Gateway System adopted, then such personal financial information shall be controlled and managed by the Payment Service Provider. 3. Personal data we collect automatically: We also receive and store certain types of personal data whenever you interact with us online. For example, we use cookies and tracking technologies (to find out more, see our privacy key terms) to obtain personal data when your web browser accesses our websites or advertisements and other content served by or on behalf of Ushop on other websites. Your personal data is also collected when you search, buy, post, participate in a contest or questionnaire or communicate with our customer service teams. Examples of the types of personal data we collect include; IP address (to find out more see our privacy key terms), device ID, location data, computer and connection information such as browser type and version, time zone setting, browser plug-in types and versions, operating system, and purchase history – which Ushop sometimes aggregates with similar information from other users / consumers. During some of your internet browsing on Ushop’s websites/applications we may also use software tools to measure and collect session information, including page response times, download errors, length of visits to certain pages, page interaction information, and methods used to browse away from the page. We may also collect technical information to help us identify your device for fraud prevention and diagnostic purposes.

4. Personal data we collect from other sources: We collect personal data from other sources including our trusted partnerships with third-parties and where we operate Ushop accounts on third-party platforms: For example, when you use the “like” functionality on Facebook or the +1 functionality on Google+. Additionally, we receive information about you and other visitors’ interactions with our advertising to measure whether our advertising is relevant and successful. We also collect information about you and your activities from a third-party when we jointly offer services or products, or from third-party data enrichment providers (to find out more see our privacy key terms) who may deliver insights to Ushop about the personal data we hold.

5. Purchase Transaction Information: We would also collect details of purchase transactions, including but not limited to products purchased, prices at which purchased, date of purchase, Ushop Partner store of purchase, etc. to develop a customer profile, customize offers, schemes, etc. and extend the services under the Program.

Sharing of Aggregate Data: Ushop, HUL, Airtel or Mosambee shall never sell or share your personal data with third parties and advertisers, except for the purpose defined herein.

We may however share unidentifiable aggregate (grouped) data in pseudonymized or anonymized form with advertisers or third parties for them to assess their services/products best suited to your consumer category.

For Targeted Advertising, no personal information is shared with any third-party advertiser on the platform as Ushop contacts you on and shares the content on their behalf.

Who is collecting the Personal Data
The Ushop Program is controlled and managed by Hindustan Unilever Limited, Mosambee and Airtel (“Data Fiduciaries”) along with various authorized third parties providing various services towards the functioning of the Program. Any Personal Data shall be controlled by the Data Fiduciaries and shared with the authorized service providers to use, process and perform any task towards the Program.

The personal data of any member is controlled and collected by Hindustan Unilever Limited. This financial information collected and controlled by our Payment Partner and only limited non sensitive information such as payment methods, etc. are collected by Ushop Program. The data under the Ushop Program is stored and managed by Mosambee in India on behalf of the Program.

Marketing Communications and Targeted Advertising
By enrolling in the Program, you will automatically receive Program-related emails, including Program marketing emails and information about your Ushop account, rewards and benefits. Ushop and Ushop Partners may target advertising on the Ushop Platform based on the preferences, interest, etc. inferred from the data collected from your computer, device, web viewing behaviours on our platform or outside the platform. We may also share your non-personal data or aggregated data with Ushop Partners for them to engage and communicate with you on their products/services, offers, etc.

Consequences of Failure to provide any of the Above Data Points
Any denial of consent to share the above data, may have the detrimental effect on the any or all of the services provided under the Program, including restriction on enrolment into the Program.

Sharing of Personal Data
Ushop shares your personal data internally and with selected and authorized Ushop Partners and third-parties service providers of the Program, only for a legitimate business purpose as defined herein and pursuant to a valid contract. The Personal Data collected under the Program shall be used only for the purpose of the Program by the parties involved.

Sharing with Ushop Partners and Service Providers: Any personal data collected as part of the Program may be shared with Ushop Partners for extending services under the Program, including but not limited to earning points, customizing schemes, offers, information of promotions, etc. under the Program.

Transfer within Unilever Group: Your personal data will be used by us or shared with Unilever Group for internal reasons, primarily for business and operational purposes. HUL is part of the Unilever Group and shares various services and resources for operational efficiencies. Your data may be shared within the Unilever Group, however for the above purpose only for which you have consented.

Sharing with third party service providers: Your data is being collected by HUL and processed by Mosambee. In addition to Mosambee, HUL may share data with other third-party service providers who partner with HUL and perform functions on our behalf with respect to our business. These may be third parties who may analyse, store or perform any other processing activity with respect to personal data for the above purposes of HUL or Ushop. They have access to limited personal data needed to perform their functions but may not use it for other purposes. Further, they must process this personal data in accordance with this Privacy Notice and as permitted by applicable data protection laws and regulations and as per the guidance and instructions of HUL.

Sharing on account of Business transfers: As we continue to develop our business, we may sell or purchase assets, subsidiaries or business units. In such transactions, your personal data generally is one of the transferred business assets but remains subject to the promises made in any pre-existing Privacy Notice (unless, of course, you consent otherwise). If another entity acquires us, our businesses or substantially all or part of our assets, or assets related to Ushop Program, your personal data will be disclosed to such entity as part of the due diligence process and will be transferred to such entity as one of the transferred assets. Also, if any bankruptcy or reorganization proceeding is brought by or against us, all such personal data will be considered an asset of ours and as such it is possible they will be sold or transferred to third-parties.

How do we protect your personal data?
We take the security of your personal data very seriously. We take every effort to protect your personal data from misuse, interference, loss, unauthorised access, modification or disclosure.
Our measures include implementing appropriate access controls, investing in the latest Information Security Capabilities to protect the IT environments we leverage, and ensuring we encrypt, pseudonymise and anonymise personal data wherever possible.
Access to your personal data is only permitted among our employees, agents or third parties on a need-to-know basis and subject to strict contractual confidentiality obligations when processed by third-parties.

How long do we keep your personal data for?
We will keep your personal data for one (1) year from the termination of our business relationship for which the personal data is being collected and processed. After the termination, we shall employ all measures to either anonymize the data or delete the data.
We will actively review the personal data we hold and delete it securely, or in some cases anonymise it, when there is no longer a legal, business or consumer need for it to be retained.

What Are Your Rights? Your rights in relation to your personal data how it is processed. You can exercise these rights at any point. We have provided an overview of these rights below together with what this entails for you. You can exercise your rights by sending an email or submitting a request through the “Contact Us” form on our websites.

Where we process your personal data, you have a number of rights over how the data is processed and can exercise these rights at any point. We have provided an overview of these rights below together with what this entails for you. You can exercise your rights by sending an email or submitting a request through the “Contact Us” form on our Platform.

The right to Confirmation and Access: You have the right to access and confirmation by providing you with clear, concise and easily understandable information about whether, what and how we use your personal data.
The right to Correction: You have the right to access, correct or update your personal data we hold, at any time. We understand the importance of this and should you want to exercise your rights, please contact us.
The right to data portability: The personal data you have provided us with is portable. This means it can be moved, copied or transmitted electronically under certain circumstances and provided to you or transferred to another data fiduciary at your request.
The right to be forgotten: Under certain circumstances, you have right to request that we delete your data. If you wish to delete the personal data we hold about you, please let us know and we will take reasonable steps to respond to your request in accordance with legal requirements. If the personal data we collect is no longer needed for any purposes and we are not required by law to retain it, we will do what we can to delete, destroy or permanently de-identify it.
The right to withdraw consent: If you have given your consent to anything we do with your personal data (i.e., we rely on consent as a legal basis for processing your personal data), you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal data with your consent up to that point is unlawful). You can withdraw your consent to the processing of your personal data at any time by contacting us with the details provided below.
How to Exercise your Rights: You would be required to write to us at the address provided in this notice or through the Contact us page on our website. When writing to us, we would request you to provide a subject basis which would be able to identify it as a personal data request. You should also provide reasonable details in the request for us to be able to identify you and your personal data to enable us to execute your request.

Accuracy of Information and Data: Correct and Accurate Information is important for extending the services smoothly and ensuring such accuracy is in the interest of the member and the Program. We therefore request you share accurate and updated information with the Program and in the event of any error or update, we would request you to immediately inform us and we shall rectify such information at the earliest.

CONTACT US: How do you contact Ushop?
If you have any questions or concerns about Privacy Notice, data processing or if you would like to make a complaint about any grievance, including any possible breach of local privacy laws, please do so by sending an e-mail at or submitting a request through the “Contact Us” form on our platform.

When a privacy question or access request is received we have a dedicated team to address the specific concern or query which you are seeking to raise. Where your issue may be more substantive in nature, more information may be sought from you. All such substantive contacts receive a response. If you are unsatisfied with the reply received, you may refer your complaint to the relevant Supervisory Authority in your Country. If you ask us, we will endeavour to provide you with information about relevant complaint avenues which may be applicable to your circumstances.

How do we keep this notice up to date?
We will update this Privacy Notice when necessary to reflect customer feedback and changes in our products and services.
We will update this Privacy Notice when necessary to reflect customer feedback and changes in our products and services. When we post changes to this statement, we will revise the “last updated” date at the top of this Notice. If the changes are significant, we will provide a more prominent notice (including, for certain services, email notification of Privacy Notice changes).
We will not reduce your rights under this Privacy Notice without your consent.

Additional Privacy Terms or Notices
In addition to this Privacy Notice, there may be other specific services, campaigns or promotions which will be governed by additional privacy terms or notices. We encourage you to read these additional terms or notices before participating in any such campaigns or promotions as you will be required to comply with them if you participate. Any additional privacy terms or notices will be made prominently available to you. In the event you are accessing another platform, website or payment services through the Program, then their privacy policy and terms and conditions would govern the usage by you. We therefore request you to be review the respective terms of use if accessing third party platforms outside Ushop.
Privacy Key Terms

Key term Definition
Anonymisation The process of either encrypting or removing personal data from a database, so that the individuals whom the data describe remain anonymous. This is done for the purpose of protecting individuals’ private activities while maintaining the integrity of the data gathered and shared.
Behavioural Advertising The act of tracking users’ online activities and then delivering ads or recommendations based upon the tracked activities.
Biometric Data Personal data resulting from specific technical processing relating to the physical, physiological or behavioural characteristics of a natural person, which allow or confirm the unique identification of that natural person, such as facial images or dactyloscopy data.
Data Privacy Officer The individual appointed by Ushop to carry out certain responsibilities and functions in respect of privacy and data protection.
Cookies A small text file stored on a user machine that may later be retrieved by a web server from the machine. Cookies allow web servers to keep track of the end user’s browser activities, and connect individual web requests into a session.
Data Enrichment A process used to enhance, refine or otherwise improve existing data.
Data Processing Any operation or set of operations which is performed on personal data, such as collecting, recording, organizing, storing, adapting or altering, retrieving, consulting, using, disclosing by transmission, dissemination or otherwise making the data available, aligning or combining data, or blocking, erasing or destroying data. Not limited to automatic means.
Direct Marketing A form of advertising in which companies provide physical marketing materials to consumers to communicate information about a product or service.
Encryption The method by which plaintext or any other type of data is converted from a readable form to an encoded version that can only be decoded by another entity if they have access to a decryption key.
IP Address A unique address that identifies a device on the Internet or a local network and which allows a system to be recognized by other systems connected via the Internet protocol.
Online Behavioural Advertising Websites or online advertising services that engage in the tracking or analysis of, e.g., search terms, browser or user profiles, preferences, demographics, online activity, offline activity, location data, and offer advertising based on that tracking.
Personal Data Any information relating to an identified or identifiable individual. An identifiable individual is one who can be identified, directly or indirectly, in particular, by reference to an identification number or to one or more factors specific to his physical, physiological, mental, economic, cultural or social identity.
Processor A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Profiling Any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
Pseudonymization The processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.