privacypolicy

General

PepsiCo, Inc - Malaysia (“PepsiCo”), values the privacy of all of our customers. We take very seriously the need to respect and protect your privacy and the security of any information you may share with us. This Privacy Policy (“Policy”) provides information on the personal data PepsiCo may collect from you, the basis on which PepsiCo may process your personal data and for what purpose, and when PepsiCo may disclose or transfer your personal data.

Please carefully read and understand this Policy.

PepsiCo’s website may contain hyperlinks to websites owned and operated by third parties. These third party websites are subject to their own privacy policies and are also likely to use cookies.PepsiCorecommend that you review these policies which will govern the use of your personal data which be collected when visiting these websites, including but not limited to cookies, personal data that you may provide, and IP addresses.PepsiCodoes not accept any liability arising from your use of such third party websites.

Collection of your Personal Data

When you engage in any business or transaction with PepsiCo or participate in, access or sign up to any of PepsiCo’s services, activities or online contents (including on social media and messaging applications), such as newsletters, promotions, live chats, message boards, website and mobile notifications or votes, PepsiCo may collect or receive personal data about you. This may include your name and surname, email address, postal address, telephone or mobile number, gender, nationality, date of birth, educational background, occupation, marital status, identification card number, passport number, driving license number, photo, bank account detail, as well as information collected about your use of PepsiCo services, such as what you read, watched or did on our website, app or when using our other services.

Please note that sometimes you may decide to provide us with additional personal data, and sometimes sensitive personal data (e.g. information about your racial or ethnic origin, religious or philosophical beliefs, criminal records, health data or disability condition, biometric data). If you do this,PepsiCo will provide further information about how PepsiCo will use your collected personal data and may seek your explicit consent at the time.

Some of our services enable you to sign-in via third party service providers, such as Facebook, Twitter and Instagram. If you choose to sign-in via a third party service provider, you will be presented with a dialog box which will ask your permission to allow PepsiCo to access your personal data (e.g. your name and surname, date of birth, email address or any other information you have made publicly accessible on the third party site).

In relation to the personal data, PepsiCo is the personal information controller (“PIC”) which means that it determines what information is collected, or the purpose or extent of the processing of the personal data.

PepsiCo also collects information about how you use PepsiCo mobile app, PepsiCo website or other PepsiCo content online, and the device(s) you use to access the services as well as unique online identifiers such as IP addresses, which are numbers that can uniquely identify a specific computer or other network device on the internet.

Purposes of Data Processing

PepsiCo collects, uses and otherwise processes your personal data:

communicating information about our services, activities or online contents (e.g. relating to upcoming promotions or new product launches) or dealing with your requests and enquiries;
service administration, which means that PepsiCo may contact you for reasons related to the business, transaction, service, activity or online content you have executed or signed up for (e.g. notifying you about the administration of a promotion that you have participated in, or notifying you that a particular service, activity or online content has been suspended for maintenance or updating our Privacy Policy);
customising the content that you see on our website and app, and the advertising that you see on our website, app, or other sites and services;
working with third parties to show you relevant advertising on that third party websites;
contacting you about any submission you have made;
using IP addresses and device identifiers to identify the location of users, blocking disruptive use, establishing the number of visits from different countries, tailoring the content of our website, app or other services based on browsing behaviours, and determining which country you are accessing the services from;
analysis and research so that PepsiCo may improve the services offered by PepsiCo;
investigating suspected misconduct activities reported by or against you or third party via PepsiCo Speak Up Hotline including enquiring those who witnessed the misconduct activities; or
conducting a third-party due diligence (TPDD) against you to find out any corruption and for our Global Anti-Bribery Compliance Policy including investigation via public sources.

Scope and Method of Collection and Processing

We use standard manual and computerized methods and systems to file, store and process personal data. Collection and processing of personal data shall be in accordance with the principles of this Policy and as required by law.

Transfers or Disclosure of Personal Data to Third Parties

Third-Party Service Providers

Your personal data may be transferred or disclosed to third parties that PepsiCo has engaged to enable it to achieve the purposes set out above, including but not limited to Trusted Partners who provide us services and assist us to:

perform statistical analysis
send you email or postal mail
provide customer support, or
arrange for deliveries.

All such Trusted Partners are third-party service providers which are prohibited from using your personal data except to provide these services to PepsiCo and are required to maintain the confidentiality of your information. Any personal data outsourced to such third-party service providers are subject to appropriate written agreements specifying that personal data shall only be processed upon the documented instructions of PepsiCo, imposing an obligation of confidentiality on persons authorized to process the personal data, and implementing appropriate security requirements for compliance with the DPA including the conduct of annual audits of such service providers to ensure adequate safeguards are implemented by such service providers.

Some of these entities may be outside Singapore and the transfer of personal data to them shall be cross-border.

Disclosure of Aggregate Information

On occasion, aggregate information, that does not identify any particular user may be complied and shared with subsidiaries and affiliates of the Company, strategic partners, merchants and advertisers. PepsiCo does not sell, rent or lease its customer lists to third parties.

Aside from age and gender which are collected, used and processed as provided in this Policy, PepsiCo will not use or disclose other sensitive personal data such as race, religion, or political affiliations, without your explicit consent.

Please note that PepsiCo does not request personal data by sending e-mails. We only collect such information on our Site. If you receive an e-mail purporting to be from us that solicits personal data, do not respond to it.

PepsiCo will disclose your personal data, without notice, only if required to do so by law or in the good faith belief that such action is necessary to: (a) conform to the edicts of the law or comply with legal process served on PepsiCo or the site; (b) protect and defend the rights or property of PepsiCo; and, (c) act under exigent circumstances to protect the personal safety of users of PepsiCo, or the public.

Retention of Personal Data

We shall retain and use your personal data as long as necessary for the fulfilment of the purposes for which the information was obtained, or for the establishment, exercise or defence or legal claims, or for legitimate business purposes, or as provided by law.

Security of Personal Data

The security, confidentiality, integrity and availability of your personal data are important to PepsiCo. We strictly enforce and implement administrative, technical, organizational and physical security measures for the protection of personal data against accidental loss or destruction, unlawful or unauthorized access and disclosure, fraudulent misuse, alteration and contamination of the personal data you provide to us. PepsiCo require our employees and third parties who carry out work on our behalf to comply with the Data Privacy Act and the appropriate privacy standards including obligations to protect any leakage of information and to apply appropriate security measures for the processing of information.

Rights of Data Subjects

As a data subject, you have the following rights under the Data Privacy Act (“DPA")

The right to access. Upon your request, you may be provided access to your personal data that we collect and process. You also have the right, insofar as allowed by law, to request access to the circumstances relating to the collection and processing of your personal data.
The right to make corrections. You have the right to dispute the inaccuracy or error in the personal data and have us correct it immediately and accordingly, unless the request is vexatious or otherwise unreasonable.
The right to object. You have the right to object to the processing of your personal data, including processing for direct marketing, automated processing or profiling. You also have the right to be notified and given an opportunity to withhold consent to further processing in case of amendment to the information supplied to you. Once you object or withhold consent, we will no longer process the personal data unless:
- The personal data is needed pursuant to a subpoena;
- The collection and processing are undertaken pursuant to any lawful basis or as a result of, or when necessary in relation to, a legal obligation or other criteria where the data is not covered by the DPA.

You may at any time opt-out of receiving direct and indirect marketing materials and advertising information on products and services available from PepsiCo, its affiliates, and business partners, by clicking on icons on the account profile page, or clicking on the unsubscribe button in the e-mail or by otherwise sending your request to the contact email as provided below. However, if you ask us to stop collecting, using, disclosing or processing your personal data, we may not be able to offer you certain services available only to those who consent to our collecting, using, disclosing or processing their personal data.

The right to erasure or blocking. You have the right to suspend, withdraw or order the blocking, removal or destruction of your personal data from our filing system (i) if there is no other legal ground or overriding legitimate interest for the processing, or (ii) when there is substantial proof that your personal data is incomplete, outdated, false, unlawfully obtained, used for a purpose not authorized, or no longer necessary for the purposes for which they were collected. We may notify third parties who have previously received such processed personal data.
The right to damages. You have the right to be indemnified for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained or unauthorized use of personal data, taking into account any violation of your rights as a data subject as provided by the DPA.
The right to lodge a complaint. You have the right to lodge a complaint with the National Privacy Commission (“NPC”) subject to its guidelines for the exercise of such right.
The right to data portability. Where your personal data is processed by electronic means and in a structured and commonly used format, you have a right to obtain a copy of such data in an electronic or structured format that is commonly used and allows for your further use, subject to the NPC’s standards, procedures and other rules for the exercise of such right.
Transmissibility of rights of the data subject. Should you pass away or be incapacitated or incapable of exercising your rights above, your lawful heirs and assigns may invoke your rights in your stead.
Limitation on rights. The immediately preceding rights are not applicable if your processed personal data are used only for the needs of scientific and statistical research and no activities are carried out or no decisions are taken in relation to you, on the basis of such data. Your rights as a data subject remain shall be subject to all other limitations provided by law.

Minors or Persons under the Age of Eighteen (18)

PepsiCo does not knowingly solicit, collect, use, disclose or process personal data of minors below eighteen (18) years of age without obtaining prior consent from a person with parental responsibility. Minors must review the Policy with their parents or guardians who shall agree to the Policy before providing personal data. Consent provided to this Policy is assumed to have been given by persons aged eighteen (18) and above. PepsiCo shall not, under any circumstances, be liable for any consequences, legal or otherwise, arising from any misrepresentation and/or false information provided to it regarding the age of the data subject.

Changes To This Statement

PepsiCo reserves the right to change this Privacy Policy at any time and we will take reasonable steps to advise you of any material changes. PepsiCo will occasionally update this Policy to reflect company and customer feedback. PepsiCo encourages you to periodically review this Policy to be informed of how PepsiCo is protecting your information.

Contacting Us

If you have any queries about this Policy and our use of personal data, have suggestions on how we may improve the Policy, or wish to have access to your personal data in our records, please contact us.

Updates to Policy