Privacy Notice for Key Opinion Leaders (KOLs)
Contents
1. About This Privacy Notice
This Privacy Notice explains how Kenvue collects, uses, and protects personal data of our Key Opinion Leaders (KOLs). We value your privacy and are committed to handling your personal information responsibly and in accordance with applicable data protection laws.
We have organised this Privacy Notice into sections and included a Glossary at the end where you can find explanation of any defined terms we have used. We will update this Privacy Notice from time to time. Any changes will be available on the Privacy Notice accessible from the website and will include the last reviewed date. If we make any significant changes, we will notify you and provide you with additional information. We encourage you to check this Privacy Notice regularly to stay informed about how we use your Personal Data.
Links on our website may direct you to other brands or services we offer, each with its own privacy notice distinct from this one. We encourage you to review the specific privacy notices of these sites to understand how they use your personal data.
2. About Us and Contact Details
Kenvue UK Ltd, is registered in the United Kingdom, with offices at 50-100 Holmers Farm Way, High Wycombe, HP12 4EG. Under Applicable Data Protection Laws, we are the Controller responsible for processing your Personal Data.
If you have any questions about this Privacy Notice or how we process your personal data, you can contact our Data Protection Officer and the EMEA DPO Team at emeaprivacy@kenvue.com
3. How We Collect Your Personal Data
We collect personal data that you provide to us directly, such as your name, contact details, professional background, and areas of expertise. We may also collect information from public sources and social media platforms to better understand your influence in relevant fields.
4. What Personal Data We Collect and Why
Why We Collect Your Personal Data | Personal Data Processed | Our Legal Basis |
|---|---|---|
To understand and review your expertise and experience within your industry. | (All publicly available) Name, contact details, professional background, experience (CV), your academic research, publication history, speaking engagements, awards, social media profiles, workplace, membership of professional bodies, your photo and any publicly shared work that demonstrates expertise and experience. | Legitimate interest. The company's legitimate interest here is to ensure that potential collaborators have the necessary expertise and experience for the projects or campaigns being considered. |
To decide whether we want to collaborate with you on any projects or campaigns | Contact information (name, email, phone number), professional profiles (LinkedIn, professional websites), and information about past collaborations or projects. | Legitimate interest. The legitimate interest is in conducting due diligence to select the most suitable KOLs for potential projects or campaigns, optimising the selectionprocess for collaborations. |
To communicate with you about our products, services, and events | Contact information, (name, email, phone number) areas of interest based on professional expertise, preferences based on previous interactions. | Consent (for potential collaborations without a current contract) or performance of a contract (if there is an agreement to collaborate). When based on legitimate interest (e.g., initial outreach), it's to inform KOLs about opportunities they might find valuable. |
To build and maintain our relationship with you as a KOL. | Contact information, (name, email, phone number) records of communication and previous collaborations, feedback and opinions on past events or products. | Legitimate interest and, in some cases, performance of a contract. The legitimate interest is in nurturing professional relationships with KOLs, which is beneficial for both the company and the KOL for future collaborations and opportunities. |
To seek your expert opinion and insights. | Professional expertise, public writings, and presentations, opinions shared in professional forums. | Legitimate interest. The interest is in leveraging the KOL's expertise to inform product development, marketing strategies, or content creation, improving the relevance and effectiveness of the company's offerings |
To collaborate on marketing and promotional campaigns. | Contact information, (name, email, phone number) content created during collaborations, feedback on campaigns. | Performance of a contract. When a KOL agrees to collaborate on a campaign, processing their data is necessary to fulfil the obligations of the contract. Prior to the contract, legitimate interest in identifying suitable KOLs for campaigns applies. |
To provide customer service and support | Email, name, communication/content of support requests. | Contractual necessity (to resolve issues and provide support) legitimate interest (to ensure satisfactory customer experience and service quality). |
To find, investigate and prevent fraudulent activities. | Email, name, transaction history, browsing behaviour, and any other relevant data that could indicate fraudulent activities | Legitimate Interest (to investigate and prevent fraudulent activities). |
For claims, legal disputes, investigations, enforcement of terms and conditions, for the defense of our rights. | Email, phone number, transaction data, communication records, legal documents. | Legitimate Interest (for the purpose of establishing, exercising, or defending legal claims.) |
We may process and disclose your Personal Data to comply with legal process or applicable law, which may include laws outside your country of residence. | As required by the specific legal request or obligation, which could include a wide range of data, Contact details (email, phone number), As account details, transaction history, and communication records. | To comply with our legal obligations Legitimate Interest (to comply with the laws and regulations in other countries we are subject to). |
5. Use of Special Category Data (Sensitive Data)
In our efforts to collaborate with and understand the expertise and experience of KOLs in their respective fields, we sometimes incidentally collect personal data that falls under the category of special category data as defined by data protection legislation. This is the case where in the context of your professional background you have directly made information publicly available by way of publications, public statements, interviews and similar revealing sensitive personal data about yourself.
We will rely on both the following for processing special category data:
Data Made Public by the Data Subject - We process data that you have manifestly made public in accordance with Article 9(2)(e) of the General Data Protection Regulation (GDPR). This pertains to special category data about you that you have chosen to make public through professional platforms, publications, or public appearances.
Legitimate Interests - We process your special category data based on our legitimate interests (Article 6(1)(f) GDPR) in identifying and collaborating with experts in their field. When relying on legitimate interests, we ensure that the processing is necessary for our legitimate activities and does not unduly impact your rights and freedoms. Our legitimate interest lies in the need to assess and verify the expertise and professional background of potential collaborators to make informed decisions about potential partnerships and collaborations.
6. Sharing Your Personal Data
We may share your data with:
Internal teams and Kenvue Affiliates for business purposes, including those located outside the UK and EEA. A list of our affiliates is available at https://investors.kenvue.com/financials-reports/sec-filings/default.aspx - access Kenvue’s subsequent filings with the Securities Exchange Commission. Kenvue UK Limited is the party responsible for the management of the jointly-used Personal Information.
External partners and service providers, under confidentiality agreements.
Regulatory authorities, if required by law.
7. How do we protect your Personal Data?
We seek to use effective organisational, technical, and administrative measures designed to protect Personal Data under our control. For example, we implement robust security measures to protect your information, which include encryption of transmitted data and secure password practices. If you have a reason to believe that your interaction with us is no longer secure (for example, you believe that the security of your account with us has been compromised), please immediately notify us at emeaprivacy@kenvue.com
8. International Transfers of Personal Data
To ensure your data is protected in the countries we transfer to outside the UK, we either:
Transfer your Personal Data to countries recognised by the UK as providing adequate data protection, please see list here. or
Transfer your Personal Data by contractually ensuring that the recipient is bound by the UK International Data Transfer Agreement or the UK Addendum to the EU's Standard Contractual Clauses/ EU Standard Contractual Clauses.
You may obtain a copy of these adequate measures by contacting our Data Protection Officer and the EU DPO Team at emeaprivacy@kenvue.com
9. How Long We Keep Your Personal Data
We will retain your Personal Data for as long as needed or permitted considering the purpose(s) for which it was obtained. The criteria used to determine our retention periods include: (i) the length of time we have an ongoing relationship with you and provide our services to you; (ii) whether there is a legal obligation to which we are subject; and (iii) whether retention is advisable considering our legal position (such as in regard to applicable statutes of limitations, litigation, or regulatory investigations).
10. Your Data Protection Rights
You have various rights regarding your data, as detailed in the table below.
Your rights | Description |
|---|---|
The right to object to the processing of your Personal Data | You have the right to object at any time if we process your personal data based on our legitimate interests or those of third parties, unless we can demonstrate that there are compelling reasons to continue or that the processing is necessary for legal action. We will then no longer use your data for this purpose. You have an absolute right to stop your Personal Data being used for direct marketing. |
The right to be informed | You have the right to know if and how we process your Personal Data, as detailed in this Privacy Notice. |
The right of access | You can request access to and a copy of your Personal Data we have unless legal exceptions and exemptions apply. |
The right to rectification (correct) | You can ask us to complete or correct any incomplete or incorrect Personal Data. |
The right to Erasure (also known as the “right to be forgotten”) | You have the right to ask us to delete your Personal Data in certain circumstances, for example, we cannot delete if there is a legal or regulatory obligation on us to keep it. |
The right to restrict the processing | You can request that we limit processing your Personal Data in specific situations: a) when its accuracy is contested, b) the processing is unlawful, but you do not require the deletion of your Personal Data c) your Personal Data is no longer needed for processing, but you need it for the establishment, exercise or defence of legal claims d) If you object to processing of your Personal Data occurring based on our Legitimate Interest. |
The right to data portability | You can request your Personal Data in a machine-readable format, only when processing is based on your consent or contract and is carried out by automated means. |
The right to withdraw consent | If you gave consent for processing your Personal Data, you can withdraw it anytime. Withdrawing consent will not affect the lawfulness of past processing, and we will inform you if we can no longer provide you with your chosen service. |
We will keep a record of your requests. We may charge a reasonable fee or refuse requests that are manifestly unfounded, vexatious or excessive. If you make a request, we will need to confirm your identity and may ask for additional information to help us with your request. We have up to one month to respond to your request after verifying your identity. If your identity cannot be verified, we cannot process your request. You can exercise your rights by emailing CONS-professionalsprivacy@Kenvue.com. Please note that for a complex request, timelines may extend to up to two months. In such case you will be promptly informed accordingly.
11. How to Lodge a Complaint
If you have any questions, concerns or complaints about this Privacy Notice, please contact CONS-professionalsprivacy@Kenvue.com.
In the UK you may also lodge a complaint with the Information Commissioner’s Office, the UK’s Data Protection Authority at Make a complaint | ICO
You may also lodge a complaint with a data protection authority where: you reside, you work or the matter you are complaining about took place.
12. Updates to the Privacy Notice
This policy was last updated on 12 May 2025.
13. Glossary
Terms | Definitions |
Applicable Data Protection Laws | means all applicable UK and EU legislation and regulation relating to data protection and privacy including without limitation UK's version of the EU GDPR (the "UK GDPR") and the UK's ePrivacy rules ("PECR"). |
Controller | is a person(s) or company (either alone or jointly or in common with other persons) who decides how Personal Data will be processed. |
Legitimate Interest | This is a legal basis which we are able to rely on where we are processing Personal Data for our activities and needs or the activities and needs of others, including providing you with the best service and experience we can offer. We will balance our interests against any potential impact on your rights or freedom. If your rights, interests and freedoms override our interests, we will not process your Personal Data under this legal basis. |
Personal Data | This refers to any Information relating to an identified or identifiable individual, who can be directly or indirectly identified by reference to identifiers (e.g. name, email, demographic information, and online identifiers). |
Privacy Notice | Also referred to as a Fair Processing Notice or a Privacy Policy – informs individuals what Personal Data is processed and how and why a company will process it. This document is the Privacy Notice for the Services. |