HUL USHOP PROGRAM
Introduction and Purpose
• Ushop by HUL Program is a loyalty program wherein consumers can enrol into the Program as
members and would be eligible for various promotional schemes, offers and rewards under various
promotional activities conducted and communicated under the Program. A member can earn loyalty points on
purchase of HUL products and products of Ushop Partner products (as and when enlisted and communicated
on the Ushop Platform) at Ushop Partner outlets. These Ushop Points earned can thereafter be redeemed
by the member while purchasing HUL products and Ushop Partner Products from the Ushop Partner Outlets
(offline and online). Similarly, Ushop Partner outlets can also redeem the points accumulated by them
through redemption of points by members, with respective Ushop Partner for products.
• Under Ushop Program, HUL and Ushop Partners aim to provide a better shopper experience to its
consumers and resellers. Ushop attempts to do so by presenting a platform to HUL and any Ushop Partner
to understand its consumer purchase habits, trends, etc. to run promotional activities and offer
customised promotions and also loyalty rewards for purchases, etc., thus rewarding the members of the
• The list of Ushop Partner brands and outlets will be made available on Ushop Platform or
communicated by any other means, which may be updated from time to time.
• The Ushop Program is controlled and managed by Hindustan Unilever Limited along with its
Program Partners Airtel and Mosambee.
We would like to state that any personal data or information collected shall be used only for the purpose of
Ushop Program by Ushop, HUL, its Ushop Partners and any service providers of the Program. We collect,
process and disclose your personal data only for specific and limited purposes to Ushop Partners and third
parties who require the same to provide relevant services in the operation of the Ushop Program. All
personal data related to members under the Program is owned and controlled by Hindustan Unilever Limited.
However, all personal sensitive financial information details such as credit card number, expiration date,
billing address, etc. shall be owned and controlled by Airtel, which provides the payment gateway portal
under the Program.
We would therefore request you to review the Privacy Notice with respect to the type of personal and
sensitive personal data being collected under the Program.
We have tried to keep this Notice as simple as possible, but if you’re not familiar with terms, such as
cookies, IP addresses, and browsers, then please read about these key terms.
Categories of Personal and Sensitive Personal Data Being Collected
We collect and use various types of information to service your accounts, save your time and money, better
respond to your needs, and manage risk. Customer information shall be collected under the following
1. Personal data you give us directly:
We collect the personal data that you have shared as part of
the Ushop Program or provided to us by you as part of your engagement with the Company during signing up or
through other activities. Enrolment and registration into the Ushop Program would require sharing personal
information, which may include any of the following information such as name, mobile number, email id,
address, zip code, date of birth, gender, contact details, demographic details, marital status, mailing
address, preferences, etc, which will need to be provided by the subscriber to the Program. These
information about the Member helps provide services under the Program and also customize the services for
Members. Such personal information may be shared by the users at the time of enrolment or during any other
activity, engagement, survey, etc. under the Program.
2. Sensitive Personal Data Collected:
We would also collect payment related information made under
the program such as payment mode, credit card/debit card number, expiration date, card holder name, billing
details, etc. that has been voluntarily provided while transacting through the Point of Sales
Terminal/Machines in the store and/or online platform of Ushop Partners. In the event there are any other
Payment Wallet or Gateway System adopted, then such personal financial information shall be controlled and
managed by the Payment Service Provider.
3. Personal data we collect automatically:
We also receive and store certain types of personal data
more, see our privacy key terms) to obtain personal data when your web browser accesses our websites or
advertisements and other content served by or on behalf of Ushop on other websites. Your personal data is
also collected when you search, buy, post, participate in a contest or questionnaire or communicate with our
customer service teams. Examples of the types of personal data we collect include; IP address (to find out
more see our privacy key terms), device ID, location data, computer and connection information such as
browser type and version, time zone setting, browser plug-in types and versions, operating system, and
purchase history – which Ushop sometimes aggregates with similar information from other users / consumers.
During some of your internet browsing on Ushop’s websites/applications we may also use software tools to
measure and collect session information, including page response times, download errors, length of visits to
certain pages, page interaction information, and methods used to browse away from the page. We may also
collect technical information to help us identify your device for fraud prevention and diagnostic purposes.
4. Personal data we collect from other sources:
We collect personal data from other sources including
our trusted partnerships with third-parties and where we operate Ushop accounts on third-party platforms:
For example, when you use the “like” functionality on Facebook or the +1 functionality on Google+.
Additionally, we receive information about you and other visitors’ interactions with our advertising to
measure whether our advertising is relevant and successful. We also collect information about you and your
activities from a third-party when we jointly offer services or products, or from third-party data
enrichment providers (to find out more see our privacy key terms) who may deliver insights to Ushop about
the personal data we hold.
5. Purchase Transaction Information:
We would also collect details of purchase transactions,
including but not limited to products purchased, prices at which purchased, date of purchase, Ushop Partner
store of purchase, etc. to develop a customer profile, customize offers, schemes, etc. and extend the
services under the Program.
Sharing of Aggregate Data: Ushop, HUL, Airtel or Mosambee shall never sell or share your personal data with
third parties and advertisers, except for the purpose defined herein.
We may however share unidentifiable aggregate (grouped) data in pseudonymized or anonymized form with
advertisers or third parties for them to assess their services/products best suited to your consumer
For Targeted Advertising, no personal information is shared with any third-party advertiser on the platform
as Ushop contacts you on and shares the content on their behalf.
Who is collecting the Personal Data
The Ushop Program is controlled and managed by Hindustan Unilever Limited, Mosambee and Airtel (“Data
Fiduciaries”) along with various authorized third parties providing various services towards the functioning
of the Program. Any Personal Data shall be controlled by the Data Fiduciaries and shared with the authorized
service providers to use, process and perform any task towards the Program.
The personal data of any member is controlled and collected by Hindustan Unilever Limited. This financial
information collected and controlled by our Payment Partner and only limited non sensitive information such
as payment methods, etc. are collected by Ushop Program. The data under the Ushop Program is stored and
managed by Mosambee in India on behalf of the Program.
Marketing Communications and Targeted Advertising
By enrolling in the Program, you will automatically receive Program-related emails, including Program
marketing emails and information about your Ushop account, rewards and benefits. Ushop and Ushop Partners
may target advertising on the Ushop Platform based on the preferences, interest, etc. inferred from the
data collected from your computer, device, web viewing behaviours on our platform or outside the platform.
We may also share your non-personal data or aggregated data with Ushop Partners for them to engage and
communicate with you on their products/services, offers, etc.
Consequences of Failure to provide any of the Above Data Points
Any denial of consent to share the above data, may have the detrimental effect on the any or all of the
services provided under the Program, including restriction on enrolment into the Program.
Sharing of Personal Data
Ushop shares your personal data internally and with selected and authorized Ushop Partners and
third-parties service providers of the Program, only for a legitimate business purpose as defined herein and
pursuant to a valid contract. The Personal Data collected under the Program shall be used only for the
purpose of the Program by the parties involved.
Sharing with Ushop Partners and Service Providers:
Any personal data collected as part of the
Program may be shared with Ushop Partners for extending services under the Program, including but not
limited to earning points, customizing schemes, offers, information of promotions, etc. under the Program.
Transfer within Unilever Group:
Your personal data will be used by us or shared with Unilever Group
for internal reasons, primarily for business and operational purposes. HUL is part of the Unilever Group and
shares various services and resources for operational efficiencies. Your data may be shared within the
Unilever Group, however for the above purpose only for which you have consented.
Sharing with third party service providers:
Your data is being collected by HUL and processed by
Mosambee. In addition to Mosambee, HUL may share data with other third-party service providers who partner
with HUL and perform functions on our behalf with respect to our business. These may be third parties who
may analyse, store or perform any other processing activity with respect to personal data for the above
purposes of HUL or Ushop. They have access to limited personal data needed to perform their functions but
may not use it for other purposes. Further, they must process this personal data in accordance with this
Privacy Notice and as permitted by applicable data protection laws and regulations and as per the guidance
and instructions of HUL.
Sharing on account of Business transfers:
As we continue to develop our business, we may sell or
purchase assets, subsidiaries or business units. In such transactions, your personal data generally is one
of the transferred business assets but remains subject to the promises made in any pre-existing Privacy
Notice (unless, of course, you consent otherwise). If another entity acquires us, our businesses or
substantially all or part of our assets, or assets related to Ushop Program, your personal data will be
disclosed to such entity as part of the due diligence process and will be transferred to such entity as one
of the transferred assets. Also, if any bankruptcy or reorganization proceeding is brought by or against us,
all such personal data will be considered an asset of ours and as such it is possible they will be sold or
transferred to third-parties.
How do we protect your personal data?
We take the security of your personal data very seriously. We take every effort to protect your personal
data from misuse, interference, loss, unauthorised access, modification or disclosure.
Our measures include implementing appropriate access controls, investing in the latest Information Security
Capabilities to protect the IT environments we leverage, and ensuring we encrypt, pseudonymise and anonymise
personal data wherever possible.
Access to your personal data is only permitted among our employees, agents or third parties on a
need-to-know basis and subject to strict contractual confidentiality obligations when processed by
How long do we keep your personal data for?
We will keep your personal data for one (1) year from the termination of our business relationship for which
the personal data is being collected and processed. After the termination, we shall employ all measures to
either anonymize the data or delete the data.
We will actively review the personal data we hold and delete it securely, or in some cases anonymise it,
when there is no longer a legal, business or consumer need for it to be retained.
What Are Your Rights?
Your rights in relation to your personal data how it is processed. You can exercise these rights at any
point. We have provided an overview of these rights below together with what this entails for you. You can
exercise your rights by sending an email
or submitting a request through the “Contact Us” form on our
Where we process your personal data, you have a number of rights over how the data is processed and can
exercise these rights at any point. We have provided an overview of these rights below together with what
this entails for you. You can exercise your rights by sending an email
or submitting a request
through the “Contact Us” form on our Platform.
The right to Confirmation and Access: You have the right to access and confirmation by providing
you with clear, concise and easily understandable information about whether, what and how we use your
The right to Correction: You have the right to access, correct or update your personal data we
hold, at any time. We understand the importance of this and should you want to exercise your rights, please
The right to data portability: The personal data you have provided us with is portable. This means
it can be moved, copied or transmitted electronically under certain circumstances and provided to you or
transferred to another data fiduciary at your request.
The right to be forgotten: Under certain circumstances, you have right to request that we delete
your data. If you wish to delete the personal data we hold about you, please let us know and we will take
reasonable steps to respond to your request in accordance with legal requirements. If the personal data we
collect is no longer needed for any purposes and we are not required by law to retain it, we will do what we
can to delete, destroy or permanently de-identify it.
The right to withdraw consent: If you have given your consent to anything we do with your personal
data (i.e., we rely on consent as a legal basis for processing your personal data), you have the right to
withdraw your consent at any time (although if you do so, it does not mean that anything we have done with
your personal data with your consent up to that point is unlawful). You can withdraw your consent to the
processing of your personal data at any time by contacting us with the details provided below.
How to Exercise your Rights: You would be required to write to us at the address provided in this
notice or through the Contact us page on our website. When writing to us, we would request you to provide a
subject basis which would be able to identify it as a personal data request. You should also provide
reasonable details in the request for us to be able to identify you and your personal data to enable us to
execute your request.
Accuracy of Information and Data: Correct and Accurate Information is important for extending the services
smoothly and ensuring such accuracy is in the interest of the member and the Program. We therefore request
you share accurate and updated information with the Program and in the event of any error or update, we
would request you to immediately inform us and we shall rectify such information at the earliest.
CONTACT US: How do you contact Ushop?
If you have any questions or concerns about Privacy Notice, data processing or if you would like to make a
complaint about any grievance, including any possible breach of local privacy laws, please do so by sending
an e-mail at Mobility.Support22@unilever.com
or submitting a request through the “Contact Us”
form on our platform.
When a privacy question or access request is received we have a dedicated team to address the specific
concern or query which you are seeking to raise. Where your issue may be more substantive in nature, more
information may be sought from you. All such substantive contacts receive a response. If you are unsatisfied
with the reply received, you may refer your complaint to the relevant Supervisory Authority in your Country.
If you ask us, we will endeavour to provide you with information about relevant complaint avenues which may
be applicable to your circumstances.
How do we keep this notice up to date?
We will update this Privacy Notice when necessary to reflect customer feedback and changes in our products
We will update this Privacy Notice when necessary to reflect customer feedback and changes in our products
and services. When we post changes to this statement, we will revise the “last updated” date at the top of
this Notice. If the changes are significant, we will provide a more prominent notice (including, for certain
services, email notification of Privacy Notice changes).
We will not reduce your rights under this Privacy Notice without your consent.
Additional Privacy Terms or Notices
In addition to this Privacy Notice, there may be other specific services, campaigns or promotions which will
be governed by additional privacy terms or notices. We encourage you to read these additional terms or
notices before participating in any such campaigns or promotions as you will be required to comply with them
if you participate. Any additional privacy terms or notices will be made prominently available to you. In
the event you are accessing another platform, website or payment services through the Program, then their
Privacy Key Terms
The process of either encrypting or removing personal data from a database, so that
the individuals whom the data describe remain anonymous. This is done for the
purpose of protecting individuals’ private activities while maintaining the
integrity of the data gathered and shared.
The act of tracking users’ online activities and then delivering ads or
recommendations based upon the tracked activities.
Personal data resulting from specific technical processing relating to the physical,
physiological or behavioural characteristics of a natural person, which allow or
confirm the unique identification of that natural person, such as facial images or
|Data Privacy Officer
The individual appointed by Ushop to carry out certain responsibilities and
functions in respect of privacy and data protection.
A small text file stored on a user machine that may later be retrieved by a web
server from the machine. Cookies allow web servers to keep track of the end user’s
browser activities, and connect individual web requests into a session.
A process used to enhance, refine or otherwise improve existing data.
Any operation or set of operations which is performed on personal data, such as
collecting, recording, organizing, storing, adapting or altering, retrieving,
consulting, using, disclosing by transmission, dissemination or otherwise making the
data available, aligning or combining data, or blocking, erasing or destroying data.
Not limited to automatic means.
A form of advertising in which companies provide physical marketing materials to
consumers to communicate information about a product or service.
The method by which plaintext or any other type of data is converted from a readable
form to an encoded version that can only be decoded by another entity if they have
access to a decryption key.
A unique address that identifies a device on the Internet or a local network and
which allows a system to be recognized by other systems connected via the Internet
|Online Behavioural Advertising
Websites or online advertising services that engage in the tracking or analysis of,
e.g., search terms, browser or user profiles, preferences, demographics, online
activity, offline activity, location data, and offer advertising based on that
Any information relating to an identified or identifiable individual. An
identifiable individual is one who can be identified, directly or indirectly, in
particular, by reference to an identification number or to one or more factors
specific to his physical, physiological, mental, economic, cultural or social
A natural or legal person, public authority, agency or other body which processes
personal data on behalf of the controller.
Any form of automated processing of personal data consisting of the use of personal
data to evaluate certain personal aspects relating to a natural person, in
particular to analyse or predict aspects concerning that natural person's
performance at work, economic situation, health, personal preferences, interests,
reliability, behaviour, location or movements.
The processing of personal data in such a manner that the personal data can no
longer be attributed to a specific data subject without the use of additional
information, provided that such additional information is kept separately and is
subject to technical and organisational measures to ensure that the personal data
are not attributed to an identified or identifiable natural person.