Brands A-Z Community Find a store
United Kingdom

Welcome

CheckoutFasterIconCheckout faster with an account ViewOrderTrackIconAble to view and track all ordersCollectLoyaltyPointsCollect loyalty points AcessToSpecialOffersAccess to special offers
Create Account
WishlistBuy AgainMy Basket £0.00 Basket 0

Privacy Policy Menu

FACIAL RECOGNITION WITH AI IN SUPERDRUG STORES PRIVACY NOTICE

Last version: March 18, 2025

1. Introduction

We value your privacy and are committed to protecting your personal data. Live facial recognition technology (hereinafter “FR Technology”) is in operation within our selected stores where you will see a signage about this activity. Superdrug takes the safety and security of colleagues and customers very seriously. Our primary aim for introducing the FR Technology is to enhance the safety and security of our colleagues and customers along with reducing the overall level of crime within Superdrug’s locations. This Privacy Notice explains how we collect, use, and store your information in accordance with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 for the FR Technology installed in selected Superdrug stores.

2. Data Controller

The data controller of your personal data is Superdrug Stores plc, 51 Sydenham Road, Croydon, Surrey, CR0 2EU (hereinafter "Superdrug"), a member of the AS Watson Group, which is part of the multinational conglomerate CK Hutchison Holdings Limited and its affiliated or related companies.

If you have any questions, concerns, or would like more details about how we use your personal data by the FR Technology installed in our Superdrug stores, please contact us at: FacialRecognitionTechnologyEnquiries@uk.aswatson.com.

In order to ensure adequate protection of personal data, we have appointed a Data Protection Officer ("DPO") whom you can contact regarding the protection of your personal data. Our DPO can be contacted via dataprotectionofficer@superdrug.com, via our customer service team by contacting them via our online chat options which you can access through our website https://www.superdrug.com/contact or via post at 51 Sydenham Road, Croydon, Surrey, CR0 2EU.

3. Purpose of the processing

The purpose of processing is to prevent and detect crimes and ensure security at our Superdrug stores. The FR Technology is used for the purpose of verifying if an individual entering the store has previously committed any unlawful acts (i.e. physical violence, threats of violence, theft, fraud, property damage) on its premises. FR Technology helps us with reducing workplace violence, reducing incidents of threatening behaviour, discrimination and harassment (including racial, gender and sexual assault) both against customers and colleagues, increasing the safety and wellbeing of customers and colleagues and reducing the incidents of theft.

Our Superdrug team prepares, and stores extract facial images from the CCTV system of individuals who have recently committed unlawful acts in our Superdrug stores. The extractions of facial images are later reviewed and approved by a Superdrug Regional Security Manager. Superdrug then sends these images to the third-party provider of the FR Technology (hereinafter "FR Provider"), a company which generates biometric templates of the facial images on Superdrug's behalf. FR Technology is integrated into Superdrug CCTV, allowing a mathematical algorithm to compare live CCTV images with these previously generated biometric templates. In other words, the FR Technology scans every face that visits a store and makes a comparison against previously generated biometric templates. The data capture does not operate in a subjective or targeted way; anyone passing through the range of the camera will have their CCTV images captured via a high-definition camera. This technology creates a biometric template from the subject scan and destroy the image taken. If a live CCTV image matches a previously generated biometric template with a high degree of probability, then designated persons in our Superdrug team will be alerted via email and/or SMS. This is done for the purpose of recognising individuals who have recently committed unlawful acts in our stores only. Each match requires a verification from a designated person at Superdrug before any action is taken. If no positive probable match is identified in the systems database, then all information created is destroyed within nanoseconds.

4. AI Technology

This FR Technology is worked with artificial intelligence. The AI solution utilises pre-trained Machine Learning algorithms, which are not adaptive or learning algorithms. The FR Technology processes all individuals' images within the field of view of a single AI-powered CCTV camera in each store by generating a biometric template of their face. These biometric templates are then matched against biometric templates prepared from facial images of known individuals who have committed unlawful acts in the store in recent months. The output is information indicating whether there is a probable match of a sufficiently high percentage (80% or higher) between the two biometric templates.

The use of AI is essential for the FR Technology because it enables the comparison of biometric templates, which would be impossible without AI. The AI system acts as a notification tool for our dedicated security team. Without AI-powered CCTV cameras, verification of people who have committed unlawful acts in our stores would be much more difficult.

When the FR Technology presents a probable match, it is flagged for verification by a trained individual within our team. The technology does not alert us to a definitive match, only a highly probable one. These probable matches must be verified by a human staff member before any action is taken. Nominated persons from our stores are alerted via email and/or SMS, but no personal data is included in the alerts. Instead, they contain a link to a secured portal where our dedicated team can log in to verify the probable match.

The FR technology algorithm is pre-trained using large publicly available datasets specifically for this purpose. No training occurs in the live environment.

If you have any questions or concerns regarding our use of AI, please contact us at: FacialRecognitionTechnologyEnquiries@uk.aswatson.com.

5. Legal basis for processing

We process your personal data based on Superdrug's legitimate interests, in compliance with Article 6(1)(f) of the UK GDPR. Superdrug's legitimate interest in introducing the FR Technology is to prevent and detect crime. Specifically, as Superdrug, we aim to reduce workplace violence, decrease incidents of threatening behaviour in the workplace, protect our customers from violent and threatening behaviour, and lower the occurrences of high-value external thefts.

In addition, processing of biometric data is based on substantial public interest, in compliance with Article 9(2)(g) of the UK GDPR.

6. What personal data will be collected?

Superdrug extracts facial images from CCTV images. FR Provider, based on facial images provided to them by Superdrug, creates and stores biometric templates used for the FR Technology.

7. Data transfers

All personal data will be processed within the European Economic Area ("EEA") and in the United Kingdom. There will be no transfer of personal data outside the EEA or the UK.

We work with an FR Provider that supports us with this FR Technology. We have established contractual, organisational, and security measures with FR Provider to ensure that biometric templates are stored safely and that the FR Technology is secure and protected. Please note that only biometric templates of known individuals who have committed unlawful acts in the store are stored in its database. No facial images or biometric templates of regular store visitors are retained in FR Provider's systems. Furthermore, FR Provider stores no images in its database. In the alerts sent to the Superdrug team, no personal data will be included.

No facial images will be added or used from any other external source (i.e. Police, other retailers etc).

8. Processing of children data

Although children's faces are captured by our CCTV cameras in Superdrug's stores, facial images of persons under 18 are never extracted from Superdrug's CCTV cameras and biometric templates are not created for them. Therefore, individuals under 18 are not subjected to the FR Technology.

9. Data retention period

We keep your personal data in relation to the FR Technology for specific periods to ensure the security and effectiveness of our FR Technology.

Retention periods for facial images from CCTV

We store facial images for three different retention periods.

  • For theft incidents, including offenders who have stolen up to three times, the retention period is 1 year.
  • For thefts of £500 or more, individuals who have stolen four times or more, and traveling groups (those who have stolen from three or more different stores), the retention period is 2 years.
  • For individuals who commit acts of violence, harassment (including sexual, stalking, homophobic, racism, etc.), or extreme aggression, the retention period is 5 years.

Each person on the database is reviewed as their deletion date approaches, and a decision is made whether to retain their data for another year, 2 years, or 5 years, depending on their history and if they have reoffended. If there have been no further incidents, then the person will be removed from Superdrug’s database.

Retention periods for biometric templates

We store biometric templates for 4 weeks.

Additionally, image file URLs in-transit will expire after 4 hours, and service database backups are retained for 4 weeks. The FR Technology can flag a record for review before the end of the retention period and reset the period if the individual is involved in new incidents. It can also set shorter retention periods for different categories, such as vulnerable persons or those under 18.

10. Data subject rights

Under the UK GDPR, you have the right to:

  • Be informed (you can ask for details of how we process your personal data, as covered by this Privacy Notice);
  • Access your personal data (you can obtain information on the processing of your personal data by Superdrug and receive a copy of it);
  • Rectify your personal data (you can request to correct incorrect or outdated personal data, or to supplement incomplete personal data);
  • Delete your personal data(you have the right to request the deletion or removal of your personal data when there is no valid reason for us to retain or process it. This includes situations where you have effectively objected to the processing of your data, where we may have processed your data unlawfully, or where we are required to erase your personal data to comply with applicable law. However, where we have an overriding legitimate interest, we may need to retain or use your data. In such cases, we will notify you as soon as possible);
  • Restrict the use of your personal data (you have the right to request the restriction of processing of your personal data in certain circumstances. When we restrict processing, we can store your personal data, but we will not use it. You can ask us to suspend the processing of your personal data when: (i) you want us to verify the accuracy of the data, (ii) our use of your data is unlawful but you do not want us to erase it, (iii) you need us to retain the data even if it is no longer required to establish, exercise, or defend legal claims, or (iv) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it);
  • Object to processing your personal data (you can request that your personal data is not processed for specific purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your personal data that override your right to object).

If you would like to exercise your rights or if you have any concerns about how we use your personal data for this FR Technology, you can contact us directly at FacialRecognitionTechnologyEnquiries@uk.aswatson.com.

You can also complain to the ICO if you are unhappy with how we have used your personal data (please see the contact details below). We are always willing to help you with any issue, so we would appreciate the chance to resolve your complaint before you complain to the ICO and encourage you to contact us first before you choose to contact the ICO.

The ICO’s contact details are:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk

11. Automated decision making

The automated matching process of biometric templates takes only nanoseconds. Biometric templates that do not achieve an 80% match threshold are deleted almost instantaneously, typically within less than one second. Consequently, only the biometric data of individuals whose facial images were first provided by Superdrug is retained, while the data of others is processed and deleted promptly.

In the event of a probable match, it is flagged for review and verification by a trained member of our dedicated them. This ensures that you are not subjected to automated decision-making without manual intervention.

False matches are be reviewed regularly, and corrective actions are taken on the basis of such review. The performance of the FR Technology will be regularly reviewed and tested to ensure it functions correctly by our dedicated teams.