This employee privacy notice is for all employees of Unilever in the UK. It also sets out the standards expected of contingent workers.
UK Policy
Employee Privacy Notice
January 2026
At Unilever we are committed to protecting the personal data of our employees, as well as to compliance with applicable data privacy laws. This Employee Privacy Notice (“Notice”) outlines and explains how Unilever processes your personal data.
The aim of this document is to provide you with information on what personal data we process, why we process your personal data and what privacy principles we abide by, as well as informing you of the rights you can exercise in relation to your personal data.
Personal data is any information relating to an identified or identifiable individual. An identifiable individual is one who can be identified, directly or indirectly, by reference to an identification number or to one or more factors specific to their physical, physiological, mental, economic, cultural or social identity.
Note: For key Privacy terms in Unilever’s privacy policies, notices and procedures, please refer to the following list available on SharePoint.
Any personal data provided to or collected by Unilever is controlled by Unilever PLC, the parent company of the Unilever Group (all Unilever Group companies).
At Unilever we have appointed a global Data Protection Officer (“DPO”). For any questions relating to the processing and protection of your Personal Data you can contact your (local) HR department or reach out to the DPO via the following e-mail address – unilever.privacy@unilever.com
Personal data collected directly from you
We process personal data that we collect directly from you when you join Unilever during the recruitment and onboarding process and during your employment at Unilever. Examples of such data are: your personal contact details, date of birth, citizenship, bank account details, gender, information regarding work experience and education etc.
We also generate personal data during your employment at Unilever. Examples of personal data we generate during your employment are: information relating to your performance, payroll information, timesheets, information relation to leave or absence, training during your employment, and information necessary for administrative purposes, such as your employee ID, your designated MAC or IP address or device ID that allows each of your devices (mobile, laptop, fixed computer or other user equipment, whether personal or Unilever issued) to connect to the Unilever network, and your Work Level etc.
Personal data collected from third parties
Sometimes we also process personal data which is provided to us by third parties. Examples of such third parties are former employees, recruitment agencies, car lease agencies, background screening providers, employee support service providers etc.
Some data is, due to its nature, more sensitive than other personal data. Under the applicable privacy legislation, some data has been categorised under special categories of personal data. We only process these special categories of personal data in limited circumstances and only when this is allowed under applicable privacy legislation.
Due to the nature of the special categories of personal data we consider these as high-risk personal data processing activities and will apply the highest levels of technological and organizational measures to keep this data secure.
Unilever will only process your personal data for specified and lawful processing purposes which are described in this Notice. The legal grounds on which we may base our processing activities include:
Performance of a contract
The processing is necessary for the performance of a contract we have with you. For example, in fulfilling your employment contract, we will process your bank details for payroll purposes.
Legal obligation
The processing is necessary for us to comply with our legal obligations (not including contractual obligations). For example: compliance with tax provisions and court orders.
Vital interests
The processing is necessary to protect someone’s life. For example: In case of a medical emergency at the workplace.
Legitimate interest
The processing is necessary for the purposes of Unilever or a third party’s legitimate interests. Examples of our legitimate interests include reporting and auditing, managing our business operations, market research, analysis and statistical purposes, corporate acquisitions and mergers, and security of our operations, systems and premises including monitoring systems, networks, e-mails and IT activity to prevent misuse and fraud.
Consent
In very limited situations we will ask you for consent for the processing of your personal data. This will be the case, for example, when we ask you for consent to use your picture that was taken during an event for, for instance, recruitment purposes or your personal preferences when participating to a survey.
We may process your personal data for various purposes, which are described below.
HR Services
We process your personal data in order to provide HR Support to manage all aspects of your employment relationship with Unilever, including absence monitoring, performance appraisal, conducting investigations including any disciplinary and grievance processes, administering termination of employment, complying with legal or regulatory obligations including in relation to any pending or threatened litigation, establishing, exercising or defending legal rights and administering data subject requests. We may also use it for the following non-exhaustive purposes:
- For statistical purposes, to understand the composition of our organisation, our labour productivity, style of working and performance, so that we can optimise the organisation and performance of Unilever. For example, to look at how graduate recruits as a cohort have performed over time, to assess how good our development programmes are. Data will be aggregated and anonymized where relevant.
- To understand and assess individual performance, productivity, and risk factors, for example the risk of attrition. We may use information on when and how you interact with using Unilever systems, such as by sending emails or instant messages or working through tools such as Chatter, Sharepoint, Microsoft Teams and other workplace related technologies, to understand how you and your colleagues collaborate, to help us optimise the organisation. We may also use scheduling, calendar data and/or physical and logical access control data to understand where the business is spending its time or to monitor adherence to company policies. Data will be aggregated and anonymised where relevant. Similarly, we may use any of the HR data that you have given us to help assess performance.
- To understand the needs, wants and feedback from our employees, so that we can enhance the working environment for all.
| Personal Data categories | Lawful grounds | Categories of Recipients with whom data maybe shared |
|---|---|---|
Sensitive personal data
|
|
|
Compensation and benefits
We also process your personal data for the purpose of execution and administration of benefits and compensation.
| Personal Data categories | Lawful grounds | Categories of Recipients with whom data maybe shared |
|---|---|---|
|
|
|
Recruitment and onboarding
We process personal data for recruitment and onboarding purposes such as candidate selection and assessment, including pre-employment screening for validation of identity and background and reference checks, preparation of job offers, employee orientation, managing new hire activities, assigning company property and to provide secure access to Unilever premises. We are increasingly leveraging the benefits of statistics, analytics and machine learning to improve the recruitment and onboarding process in a way that more efficiently, and effectively matches the right skills with the right opportunities.
Automated decision-making
We will not make decisions based solely on automated decision making that have significant impact on you without notifying you and providing you with clear information about our decision to rely on automated processing, and our lawful basis for doing so. For example, Unilever processes your personal data using automated means only if it is necessary for the entering into or the performance of a contract with you, or when you have given your explicit consent.
You have the right not to be subject to a decision which is based solely on automated processing and which produces legal or other significant effects on you. In particular, you have the right:
- to obtain human intervention;
- to express your point of view;
- to obtain an explanation of the decision reached after an assessment; and
- to challenge such a decision.
For more information about how we use automated decision making in our recruitment process, please consult our privacy recruitment notice.
| Personal Data categories | Lawful grounds | Categories of Recipients with whom data maybe shared |
|---|---|---|
Sensitive Personal Data
|
|
|
Security management
We also process your personal data for the purpose of ensuring the security of Unilever premises and Unilever-held information, as well as the safety of our employees. This may include processing personal data for the identification and authentication of employees, usernames and password management, video monitoring systems, logging, e-mail monitoring, keeping a list of emergency contacts, occupational health and safety management, fraud investigations and management, for detecting or preventing the loss of intellectual property or confidential information, and monitoring device usage for device, network and infrastructure management purposes, in line with privacy laws and other applicable legislation.
| Personal Data categories | Lawful grounds | Categories of Recipients with whom data maybe shared |
|---|---|---|
Sensitive Personal Data
|
|
|
Data about you to further Unilever’s equal opportunity and diversity policies and obligations
| Personal Data categories | Lawful grounds | Categories of Recipients with whom data maybe shared |
|---|---|---|
Sensitive personal data
|
|
|
HR Information & Analytics
We aim to continuously improve and drive sound decisions about human resources, talent and organisation, based on timely and accurate people and organisation insights and to contribute to the development of organisational diagnostic capabilities. To this end, we are increasingly leveraging the benefits of statistics, analytics and machine learning.
| Personal Data categories | Lawful grounds | Categories of Recipients with whom data maybe shared |
|---|---|---|
Sensitive personal data
|
|
|
When we process your personal data, we do this based on the following privacy principles:
Purpose limitation
Your personal data will be only processed for specified and lawful processing purposes, as detailed in this Notice and will not be further processed in a manner incompatible with those purposes.
Data Minimization
We will only process personal data that is adequate, relevant and is limited to what is necessary. This also includes restricting access to personal data to only those functions/groups offunctions that need this personal data to carry out their work.
Personal data is accurate and, where necessary, kept up to date
We take appropriate measures to ensure that the personal data that we process about you is accurate and up to date. For this purpose, we provideyou with theability to correct, amend, or delete inaccurate personal data where this is applicable, in accordance with relevant laws. In some instances, you can make these changes yourself in our HR applications such as Workday. Otherwise, please contact the HR Department for more information on how you can correct, amend or delete your inaccurate data.
Personal Data is held for no longer than is necessary
In principle we do not hold your personal data for longer than is required for the original purpose it was collected, unless those purposes are compatible with the original purpose, or we are under a legal obligation to retain it for longer. The purpose of retention could be a legal obligation, such as employment laws, tax law or another legitimate reason, for example to prove our rights and obligations. When personal data is no longer required to be stored, we take appropriate steps to securely delete or anonymize. For specific applicable retention periods please refer to the Unilever Data Retention Standard.
Personal Data is protected by appropriate level of technical and organizational measures
The right security controls are in place to protect against unauthorized and unlawful processing and against accidental loss or destruction of, or damage to, personal data. This includes both technical controls (e.g. pseudonymization/encryption, role-based access control) and organizational controls (e.g. training and awareness). For moreinformation on howUnilever safeguards information, pleasevisit the Information Protection Zone.
Personal Data is only transferred to third parties and/or outside Sri Lanka if there is adequate protection
Unilever is a global company, and therefore we may need to transfer data internationally within the Unilever organization. We are fully committed to ensuring that there are adequate safeguards in place, as required by applicable laws.
Further, where we transfer personal data to third parties, we will ensure that the we follow the applicable data privacy laws of Sri Lanka in relation thereto.
In such context and where required, Unilever will send your personal data out of Sri Lanka to any country prescribed by the Data Protection Authority of Sri Lanka pursuant to an adequacy decision, or if it is to a country not so prescribed, only when Unilever is satisfied that:
(i) regardless of transfer of your personal data to such country, we are able to comply with our mandatory obligations under the data protection law of Sri Lanka, and
(ii) only after executing an appropriate instrument as may be prescribed by the Data Protection Authority of Sri Lanka, with the recipient of data in such country.
When we process your personal data, we do this based on the following privacy principles:
Purpose limitation
Your personal data will be only processed for specified and lawful processing purposes, as detailed in this Notice and will not be further processed in a manner incompatible with those purposes.
Data minimisation
We will only process personal data that is adequate, relevant and is limited to what is necessary. This also includes restricting access to personal data to only those functions/groups of functions that need this personal data to carry out their work.
Personal data is accurate and, where necessary, kept up to date
We take appropriate measures to ensure that the personal data that we process about you is accurate and up to date. For this purpose, we provide you with the ability to correct, amend, or delete inaccurate personal data where this is applicable, in accordance with relevant laws. In some instances, you can make these changes yourself in our HR applications such as Workday. Otherwise, please contact your People Partner for more information on how you can correct, amend or delete your inaccurate data.
Personal data is held for no longer than is necessary
In principle we do not hold your personal data for longer than is required for the original purpose it was collected, unless those purposes are compatible with the original purpose, or we are under a legal obligation to retain it for longer. The purpose of retention could be a legal obligation, such as tax law or another legitimate reason, for example to prove our rights and obligations. When personal data is no longer required to be stored, we take appropriate steps to securely delete, anonymise or transfer the data to an archive (where this is allowed under applicable laws). For specific applicable retention periods please refer to the Unilever Data Retention Standard.
Personal data is protected by appropriate level of technical and organisational measures
The right security controls are in place to protect against unauthorised and unlawful processing and against accidental loss or destruction of, or damage to, personal data. This includes both technical controls (e.g. pseudonymization/encryption, role-based access control) and organisational controls (e.g. training and awareness). For more information on how Unilever safeguards information, please visit the Information Protection Zone.
Personal data is only transferred to third parties and/or outside the EEA if there is adequate protection.
Where we transfer personal data to third parties, we will ensure that the required contractual obligations are stipulated between us and the third party. In case of international data transfers to countries that do not offer adequate protections outside of the EEA, we will ensure that appropriate safeguards, as required by applicable laws, will be put in place to protect the personal data.
Unilever is a global company, and therefore we may need to transfer data internationally within the Unilever organisation. We are fully committed to ensuring that there are adequate safeguards in place, as required by applicable laws, to protect the personal data we transfer to countries that may not have adequate data protection laws.
We sometimes need to request specific information from you to help us confirm your identity and to ensure that you have the right to exercise any of your rights in relation to your personal information.
We may refuse your request based on certain grounds to the extent permitted by applicable law.
If your request has not been resolved to your satisfaction, please email dataprivacy.advisorSL@unilever.com
Right to lodge a complaint with the Data Protection Authority
You have the right to lodge a complaint directly with the Data Protection Authority about how your personal data is processed within Unilever, but please do check if the HR Department can help you first or use the BI Employee Whistleblowing Hotline and report a Code Incident.
When we process your personal data, you have certain rights with respect to the data we process. These rights are listed and explained below:
The right to information
You have the right to be informed about the collection and use of your personal data by us. This information is shared with you through this Privacy Notice.
Right to access
You have, at any time, the right to request access to the personal data we process about you. When you exercise this right, Unilever must provide a copy of the personal data to which you have requested access.
Right to rectification
You are entitled to require Unilever to rectify any errors in your personal data. This includes inaccurate or incomplete personal data. We must take reasonable steps to ensure that personal data which is inaccurate is rectified without delay.
Right to erasure
Under certain circumstances, you are entitled to request Unilever to erase your personal data. Please note that this right only applies under certain circumstances and is not absolute.
Right to restriction
In certain circumstances, you may not be entitled to require Unilever to erase your personal data, but you may be entitled to restrict the use of the data. In this instance, all processing, except from storing, of that personal data must stop whilst the restriction is in place. Please note that this right only applies under certain circumstances and is not absolute.
Right to data portability
Under some circumstances, you have the right to receive your personal data in a commonly used and machine-readable format and have that data moved, copied or transferred to another party. This right is not absolute, as it only applies to personal data that is directly provided by you and where the processing is based on consent or on performance of a contract.
Right to object
In certain situations, you have the right to object to the processing of your personal data when:
- the processing is based on legitimate interests, including situations where we use profiling, for instance when Unilever uses a screening algorithm to predict if you are fit for a specific role;
and - when the data is processed for the purposes of scientific/historical research and statistics.
Right to withdraw consent
Where we rely on your consent for the processing of your personal data, you always have the right to withdraw your consent.
Right not to be evaluated on the basis of automated decision making
You have the right to not be evaluated solely on the basis of automated processing, including profiling, (e.g. automated profiling in connection with offers of employment, credit access, insurance premiums). This means we will not use (without any human involvement) your personal data (e.g. automated processing of personal data to evaluate certain aspects about you) in a way that produces legal effects concerning you or similarly significantly affects you unless it is:
- necessary for entering into, or for performance of, a contract between Unilever and you; or
- authorised by law (e.g. for the purposes of fraud or tax evasion); or
- if you provide your explicit consent.
You can exercise your rights by completing the form at following link.
Alternatively, you can contact your HR Business Partner.
We will provide you with information on the action taken within one month following receipt of your valid request. When handling your request, we will follow the procedure relating to Employee Data Subjects’ Rights Requests.
If your request has not been resolved to your satisfaction, please contact the Global Privacy Office and the Data Protection Officer via unilever.privacy@unilever.com
Right to lodge a complaint with the Supervisory Authority
You have the right to lodge a complaint directly with the data protection authority about how your personal data is processed within Unilever, but please do check if your People Experience Lead can help you first or use the BI Employee Whistleblowing Hotline and report a Code Incident. Please find a link here with an overview of the relevant authorities.
If you have any further questions about this policy, please contact unilver.privacy@unilever.com