Shell GO+ Privacy Processing Update

Our Company under the name "CORAL S.A. of petroleum products and chemical products" and distinctive title "CORAL S.A.", which has its registered office in Maroussi, Attica, on Herodes Atticus Street no. 12A, PC 151 24, Greece, with no. G.E.MI.: 122222201000, V.A.T.: 094472979, KEFODE of Attica, no. Phone: 210-9476555, e-mail address: csc-hellas@ceg.gr, prioritizes the respect of your personal data and takes reasonable measures to comply with the applicable legislation, in relation to their protection.

With this Personal Data Processing Notice, we inform you about the processing of your personal data, as a beneficiary ("Holder") of the Shell GO+ personal card, physical or intangible ("Card"), by our Company, acting in its capacity as a data controller and in accordance with Regulation (EU) 2016/679 and the provisions of the applicable legislation on the protection of personal data; in the context of your participation in the Shell GO+ Loyalty Program ("Shell GO+ Program") as well as for your rights under the General Data Protection Regulation ("GDPR") and the applicable Greek legislation on personal data protection (Law 4624/2019 as in force from time to time).

Our Company reserves the right to modify and update this update, whenever it deems it necessary, while the changes from time to time come into force from the public appearance thereof on the Shell GO+ app of our Company and on www.shell.gr website and on the www.allsmart.gr

 website of "CORE INNOVATIONS SINGLE-MEMBER SOCIÉTÉ ANONYME".

In the event that any of these terms is held to be invalid, illegal or unfair for any reason, the remaining terms shall remain valid and valid, as is, to the extent that they do not conflict with the will expressed through this notice.

1. PROCESSING PRINCIPLES 

We fully respect your fundamental rights and make the protection of your privacy a priority of our Company. In this context, when processing your personal data, we follow the following basic principles:

1.1. We process your personal data lawfully and fairly and maintain full transparency towards you in relation to the way we manage your personal data.

1.2. We collect and process your data only for specified, explicit and lawful purposes, as set out in this notice, and we do not further process it in a manner incompatible with these purposes.

1.3. We process your personal data only to the extent that it is appropriate and relevant to the above purposes, while limiting the relevant processing to the extent necessary for these purposes.

1.4. We make reasonable efforts, including with your assistance, to ensure that your data being processed is accurate and, where necessary, updated in relation to the purposes of the processing, taking all reasonable steps to immediately erase or correct them in case of inaccuracy.

1.5. We retain your personal data in a form that allows your identification only for the period necessary for the above processing purposes.

1.6. We process your personal data in a way that guarantees its security by using appropriate technical or organizational measures.

1.7. We do not intend to further process your personal data for any purpose other than that for which it was collected.

1.8. We inform you that there is no obligation on your part to provide your personal data and there are no possible consequences from not providing them. Without prejudice to what is stated in this notice, we do not disclose or transfer your personal data to further third parties without your consent, unless permitted by law or by the contract between us.

1.9. We inform you that we do not transfer your personal data to a third country or international organization, for which there is no adequacy decision of the European Commission in accordance with the GDPR.

1.10. In general, we fully comply with the applicable legislation and comply with all our obligations arising from it, as the legal controller of your personal data.

2. TYPES OF DATA

2.1. The types of personal data that we collect and process from you: a) for your registration in the Shell GO+ Programme, through the paper application or through the Shell GO+ app or through the www.allsmart.gr

Website; of "CORE INNOVATIONS SINGLE-MEMBER SOCIÉTÉ ANONYME", b) the acquisition and maintenance of your personal Card and c) (if you wish) the creation and maintenance of your account in the Shell GO+ app are the following:

• Identification Data

Name

Date of Birth

• Contact

Postal address

Email address

Telephone

Preferred means of communication

• Transaction Data

Type, place, time, value and quantity of product and/or service provided

Delivery data

• Reward Data

Number of points

Type and value of gifts

Redemption Data

• Transactional Behavior Data

Consumer preferences

2.2. In addition to the above data and after submitting your relevant request to our Company for your inclusion in the Coral family program, we collect and process the following data from the Coral Pass section of our Company:

• Tax Identification Number

2.3. Our Company does not collect or access personal data of its users – customers, related to the online payment of the services provided, through the Shell GO+ app [Electronic Payment Service at the Pump (pay@the pump)], such as credit card numbers and codes. Such data is collected and processed exclusively by and under the responsibility of the cooperating bank during the execution and completion of each sale by the method of redirect, i.e. by the method of transferring the user from the Website to a website under the responsibility of the said banking company.

2.4. Our Company does not collect, nor does it access in any way special categories ("sensitive") personal data or data relating to criminal convictions and offences of the Owners. You have the obligation to refrain from posting such data concerning yourself or third party data subjects. In case you make a relevant disclosure of such data to the Company, it will be deleted as soon as it comes to the Company's knowledge. We have no liability to you or any third party for any posting and/or processing of sensitive data, due to your acts or omissions in violation of the above obligation.

3. PURPOSES AND LEGAL BASIS FOR PROCESSING

3.1. Your personal data, which is necessary for the registration and execution of the Shell GO+ Program, in accordance with Article 6 § 1 (b) of the GDPR, is collected and processed by our Company for the following purposes:

3.1.1. For your registration in the Shell GO+ Program which includes the conclusion of the contract between us, the acquisition and maintenance of your personal Card and (if you wish) the creation and maintenance of your account in the Shell GO+ app.

3.1.2. For the execution of the Shell GO+ Program which includes the collection and redemption of points through the Card, your reward under the terms of the Shell GO+ Program, the issuance of redemption vouchers, the ordering and sending of gifts to which you are entitled, the generally execution, management and financial fulfillment of the Shell GO+ Program by us and our third-party partners; to serve our members as well as to inform you in the event of any modification of the terms of use and this update of the Shell GO+ Program or changes in the operation of the Shell GO+ Program.f

3.1.3. To optimize the management of the Shell GO+ Program which includes checking the performance of correct points per product or service purchase, the correct redemption of points and the issuance of vouchers or the provision of rewards, the control and proof of the correctness of the clearance of points, vouchers and rewards to which you are entitled from our Company or from our third-party partners; as well as the general service of our members.

3.1.4. For the security of the Shell GO+ Program and your account in the Shell GO+ app and your identification where required.

3.1.5. For the statistical analysis to evaluate and improve the services and procedures of the Shell GO+ Programme, complying with all the necessary guarantees for the collection and processing of data that do not identify a specific subject and do not affect the rights and freedoms of the data subjects.

3.2. Our Company collects and processes your personal data only for the aforementioned purposes and only to the extent necessary to effectively serve these purposes. These data are relevant, appropriate and no more than what is required in view of the above purposes, and are accurate and, if necessary, are updated. Furthermore, such data are retained only for the period necessary for the purposes of their collection and processing and are deleted after the end of that period.

4. CONSENT

4.1. Our Company may process your personal data only with your lawful consent for the following purposes:

4.1.1. For the purposes of commercial communication, commercial promotion of products and services, by conducting commercial communications (by phone, by email, by message on your mobile phone, by multimedia communication, e.g. viber, social media if the contact information you have provided) informing you about:

• the methods of collecting and redeeming points,
• rewards, gifts, offers, promotions, 
• in general, our products and services,
• your voluntary participation in competitions or in investigating the degree of customer satisfaction with the products and services provided.

4.1.2. For research and/or analysis purposes to better understand your needs, preferences, interests, experiences and/or habits as a consumer.

4.1.3. To facilitate your future transactions through the ability to store your data (name, surname, email, telephone number and address), when using the Electronic Payment Service at the Pump (pay@the pump), without the need to re-fill the stored data.

4.2. You can choose the means of communication to receive the commercial communication. In the event that you give us your consent to communicate without a choice of means, we will use the contact data you provided to us when you registered for the Shell GO+ Program.

4.3. If you provide the optional information included in your registration application (paper or electronic) and/or in your application for creating an account in the Shell GO+ app, or at other points that will be highlighted, you give us your consent for their processing for the purposes of contract execution, security and statistical analysis. Also for commercial communication (if you consent to it according to the above).

4.4. When you give us your consent for any of the above, you can withdraw it at any time and for the future, in part or in total, by contacting the Company's details, as well as by unsubscribeing at the corresponding link in the contact email or by sms or viber or by accessing the special data management panel in your account (if you have it in the Shell GO+ app).

5. AUTOMATED PROFILING AND/OR PROFILING

5.1. During your visits to the Shell GO+ app of our Company, you can browse and remain an anonymous user until you decide that you want to create an account and/or register for the Shell GO+ Program, giving your consent accordingly.

5.2. With your relevant consent and when using your Card, your profile is compiled through automated processing, with your personal preferences, interests or behavior. The information you provide to us is used to provide you with a personalized experience of using the Card, to send you notifications that are personally about you (for example, products that you buy frequently or that interest you), but also to be able to customize the content of the Shell GO+ Program and the Shell GO+ app depending on your searches; your history and preferences.

5.3. Our goal is to be able to discover your likes in order to provide you with suggestions adapted to your own needs and preferences.

6. THIRD PARTY RECIPIENTS OF THE DATA

6.1. Our Company does not proceed to the concession of your personal data or to the interconnection of its file for financial or other consideration with any third party private companies, natural or legal persons, public authorities or services or other organizations.

6.2. In order to serve the processing purposes mentioned in this notice, our Company may provide access to and/or transmit the following types of your personal data to the following processors on our behalf and on our behalf:

6.3. Within the framework of the Shell GO+ Program and the fulfillment of its contractual obligations, our Company cooperates with third party companies, which only gain access to your data that are absolutely necessary for the service of the Shell GO+ Program. In particular, we cooperate with our subsidiaries "HERMES TRANSPORT, EXPLOITATION, TRADE AND SERVICE COMPANY", "MYRTEA S.A. FOR THE TRADE, STORAGE, PETROLEUM PRODUCTS AND SERVICE AGENCIES", and "Coral Energy Products Cyprus Limited", as well as with third party companies, or natural persons who operate and manage the petrol stations bearing the Shell brand and who act as processors, both for your registration in the Shell GO+ Program, if it is done at a Service Station, and for the service of the Shell GO+ Program. We also cooperate with our above-mentioned subsidiaries, with third-party companies as well as with the company "CORE INNOVATIONS SINGLE-MEMBER S.A.", owner of the www.allsmart.gr

website , both for collecting points from you, with purchases you make from their own stores (physical or online) and for redeeming points, receiving gifts, redeeming coupons. "CORE INNOVATIONS SINGLE-MEMBER S.A." also acts as a processor for members who register online (or online only), through the website allsmart.gr the Shell GO+ Program. Finally, it cooperates with third-party partner companies that provide services to fulfill the objectives of the program.

6.4. As a rule, our Company retains your personal data within the European Economic Area. In the event that data is to be transferred to Third Countries, all appropriate safeguards provided for in the applicable legislation will be obtained and the relevant information will be posted on the shell.gr, the Shell GO+ app and the allSmart.gr. The processing of your personal data by the above cooperating entities is carried out under our control and only on our instructions and is subject to the same data protection policy or a policy of at least the same level of protection.

6.5. In case it is obliged by a court or other administrative authority as well as in any other case that bears a legal obligation to do so, our Company may provide your personal data up to the extent provided by law, but after informing you.

7. PRIVACY AND DATA SECURITY

7.1. Our Company, in order to ensure the proper use and integrity of your personal data as well as to prevent unauthorized or accidental access, processing, deletion, alteration or other use thereof, implements appropriate internal policies, while taking all appropriate organizational, technical, physical, electronic and procedural security measures, as well as technological standards, in accordance with applicable laws and regulations.

7.2. The processing process of your data by our Company is carried out in a way that ensures the confidentiality and the physical and logical security thereof, taking into account the latest developments, the cost of implementation and the nature, scope of application, context and purposes of the processing, as well as the risks of different probability of occurrence and severity for your rights and freedoms.

7.3. The processing of your personal data is carried out exclusively by personnel authorized for this purpose, who are bound by strict obligations to maintain their confidentiality.

8. DATA RETENTION PERIOD

8.1. We retain your personal data for as long as the purposes for which they were collected and listed above remain in force, and in particular: a) The data that you disclose to our Company through your application for your registration as well as the data collected by us from its use for the fulfillment of our contractual relationship and the execution of the Shell GO+ Program; are retained by our Company for as long as you participate in the Shell GO+ Program and are deleted within a reasonable period of time from the termination of the Program in any way; b) Your contact data as well as the data of your personal choices for commercial communication purposes are also retained for as long as you participate in the Shell GO+ Program or until your consent is withdrawn for each of the above processing purposes.

8.2. Our Company may retain your personal data even after fulfilling the purposes of their collection and processing in the following restrictively mentioned cases:

8.2.1. If there is a legal obligation on our part by a relevant provision of law.

8.2.2. For use before tax and social security authorities as well as any other audit authority within the framework of the legal limitation period.

8.2.3. If necessary for the proper organization and operation of our Company, provided that anonymization or pseudonymization of your data takes place.

8.2.4. Until the statute of limitations of the relevant claims for the defence of our rights and legitimate interests before any competent Court and any other public authority.

8.3. After the expiration of the retention period, your personal data is destroyed by our files and system in compliance with our Company's policy and provided that their retention is no longer required for the fulfillment of the purposes we have described to you above.

9. RIGHTS

9.1. Subject to applicable law, you have the following rights:

9.1.1. Request access to your personal data as well as information related to the processing and receive a copy thereof.

9.1.2. Request the correction of any inaccuracies and the completion of any incomplete personal data about you.

9.1.3. Request the deletion of your personal data.

9.1.4. Request the restriction of the processing of your personal data for the cases expressly provided for by law.

9.1.5. Request the portability of your personal data to another controller in a structured, commonly used and machine-readable format (e.g. cd).

9.1.6. Object to the processing of your personal data for the cases expressly provided for by law.

9.2. Our Company will respond to your every request within one (1) month from its receipt. Upon informing you, this deadline may be extended by a further two months, if necessary, taking into account the complexity of the request and the number of requests. Any rejection of your request will take place on a justified basis.

9.3. If your requests do not meet the requirements of the law, our Company reserves the right either: (a) to impose the payment of a reasonable fee, taking into account the administrative costs for providing the information or the announcement or execution of the requested action, or (b) to refuse to follow up on your request.

9.4. In the event of a breach of your personal data, which may put your rights and freedoms at high risk and provided that it does not fall under one of the exceptions expressly provided for by law, we undertake the obligation to inform you thereof without undue delay.

9.5. If there are doubts about the identity of the natural person making the request, we reserve the right to request the provision of additional information necessary to confirm their identity.

9.6. If your rights are violated, we inform you that you have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr

) or to another competent supervisory authority.

10. JURISDICTION AND APPLICABLE LAW

10.1. For the resolution of any dispute that arises between our Company and the Holders regarding this information and its subject-matter, the courts of Athens are competent and the applicable law is the Hellinikon, without taking into account its conflict rules.

10.2. In the event that a provision of this notice is annulled by a decision of a competent court as unlawful, valid and enforceable, this fact shall not affect the remainder of its provisions, which shall remain in force and shall be applied normally.

11. CONTACT

For any further information or request regarding this information, you can contact our Data Protection Officer at the following details:

• Postal Address: Herodes Atticus Street no. 12A, Maroussi, P.C. 151 24, Attica, Greece 
• E-mail: dpo@moh.gr

This information forms an integral part of the terms of use that govern the Shell GO+ Program as a whole.