Personal Data Protection and Privacy Policy for sales of products via e-shop iqos.gr and/or via telephone orders

1. General Information

1.1. Papastratos is fully and exclusively responsible for determining the method of operation and content of the Remote Sales Channels, as well as the terms and procedure for the placement of consumers' orders, the execution thereof and the delivery Products. The Products are sold through the Remote Sales Channels either by Papastratos or by third-party associates (hereinafter referred to as the “Sellers”). Those associates contract with the final consumer in their name, but on behalf of Papastratos, as agents-indirect representatives thereof. Retail sale from Sellers to final consumers is governed by the Terms and Conditions for the sale of products via the iqos.gr e-shop and/or via telephone orders (hereinafter referred to as the “Terms of Sale”),based on the terms and procedures designated by Papastratos.

1.2. In that context, we prioritise respect for your privacy and for protection of your personal data. We take appropriate measures, in accordance with the applicable laws on data protection. We have established this Data Protection and Privacy Policy (hereinafter referred to as “Privacy Policy” or “Policy”), for your information about the processing of your personal data while you make purchases of Products through the Remote Sales Channels, on your initiative as a Consumer. This Policy is supplementary (to the extent otherwise provided herein, this Policy takes precedence as the more specific information document):

i)of the PMI Privacy Policy and should be read in conjunction with it,

ii) the Terms and Conditions of sale of products through the e-shop iqos.gr and/or through telephone orders (hereinafter referred to as "Terms of Sale"),

which form an integral part hereof, and govern purchases made via the e-shop and/or by telephone in a unified and cumulative manner.

Please note that other programmes or actions of Papastratos are governed by different Privacy Policies, which are duly indicated to you each time.

1.3. You must accept these terms before you make your purchases through the Remote Sales Channels. We encourage you to read this Policy from time to time to keep up to date with any changes we make.

1.4. Identity and details of Papastratos as data controller: Where Papastratos is the controller of the processing of your personal data in accordance with the distinctions of articles 3 and 5 below, the data controller is a limited liability company under the name "PAPASTRATOS SOLE PROPRIETOR SOCIETE ANONYME SIGARETTE COMPANY" and the distinctive title "PAPASTRATOS SOLE PROPRIETOR S.A.", with its registered office at Aspropyrgos, Imeros Topos, Kororemi location, GEMI registration no. 227601000, VAT no. 094011481, Tax Office of Athens, telephone no. 210 4193000, fax no. 210 4112303, e-mail address contact.gr@iqos.com.

1.5. Communication regarding personal data protection: For any issue concerning this Policy and the processing of the Personal Data of Consumers by Papastratos as part of the purchases through Remote Sales Channels, based on the provisions of Articles 3 and 5 below, the Consumer may contact us in one of the following manners:

a) by telephone service at 8001114767 (free of charge from a landline phone) or at 210 4193888 (charge depending on the telecommunications provider) daily from 09:00 to 23:00;

b) by e-mail to contact.gr@iqos.com;

c) by mail at the postal address: PAPASTRATOS SINGLE MEMBER S.A. Headquarters, Imeros Topos, Kororemi Site, Aspropyrgos, Attn. Legal Department.

For the processing carried out by the respective Seller from whom the Consumer purchases the Product in accordance with the Terms of Sale, whose details appear on the receipt delivered to him/her upon delivery of the Product, you can contact the details indicated on the sales document or on the list available here.

2. Who does this Policy concern?

This Policy is addressed to consumers, who:

i) are natural persons, over 18 years of age, and have full legal capacity (such age must already have been completed upon access to iqos.gr and performance of any action relating to the Website), and whose adult status is confirmed by us upon delivery of the Product;

ii) are smokers and/or users of other tobacco products, new tobacco products, e-cigarettes or nicotine products in general, or related products, as determined by the relevant laws at any given time

iii) reside or are staying in Greece (hereinafter referred to as the “Consumers’’)

and wish to purchase the Products through the Remote Sales Channels (either through the e-shop or by telephone) on your own initiative, after you have declared your age and have created an Account based on the Terms and Conditions of iqos.gr and the Terms of Sale. Users who have not reached legal age (18) are prohibited from carrying out any action on the Website or the e-shop, or making telephone orders.

3. Who are the Data Controllers and for which processes?

3.1. The processing of your personal data for the purchase of Products through the Remote Sales Channels requires cooperation between more companies, as regulated by the individual contracts of the parties, and the role thereof is explained hereunder, in accordance with the legal requirements.

3.2. Papastratos is the Data Controller for all the processing functions and actions performed by the Remote Sales Channels both before and after conclusion of the order. Each Seller acts as a Data Processor for the processing of consumers’ data, as part of executing the sale cycle, based on explicit orders and procedures designated by Papastratos. In particular, the Seller takes all the necessary actions on behalf of Papastratos and based on the orders of Papastratos as an agent/indirect representative thereof, from the moment when the order is forwarded to the Seller by Papastratos through the Remote Sales Channels, until final delivery of the Products, as well as with regard to fulfillment of the obligations pertaining to customer service, management of complaints and requests, verification of identity during delivery, and registration of consumers or their devices in databases or programmes of Papastratos.

3.3. Each Seller is an independent Data Controller where processing is necessary for the Seller’s statutory obligations as an agent/indirect representative (including, but not limited to, tax obligations), as well as for payment by the consumer (carried out in collaboration with a third-party provider with whom they transact independently). In particular, with regard to the processing made by each Seller as an independent Data Controller, such Seller bears full and exclusive liability for the legality and compliance thereof with the current laws on data protection. You can be informed about the Privacy Policy of each Seller that carries out the sale on behalf of Papastratos on the website of each Seller.

4. What personal data categories do we collect from you and how?

4.1. Your Personal Data include any information that allows, either on its own or in combination with other information, your single identification, under the provisions of the Regulation, the applicable Greek laws, and the decisions of the Data Protection Authority (DPA), as well as the directives and decisions of the competent European bodies.

4.2. We collect for you the following categories of data concerning you from the following sources:

Directly from you, when you submit such data either to us or to our processing partners:




Τρόπος	Δεδομένα
when placing an order via the e-shop and/or the call centre until delivery thereof, including the exercise of the right to rescind the contract	Identity details (first name, surname) Legal Age details (date of birth, legal age status) Communication details (e-mail, phone number) Necessary data for the exercise of the right of withdrawal based on our business model (date of exercise of the right of withdrawal, order number, etc.) Your participation data for other Papastratos Programmes (such as which tier you belong to in the IQOS Club, whether you are entitled to a voucher, etc.)
during the identification/identity check and confirmation of your adult status (through the age gate of the Website and through the proper identification documents/documents proving adult status presented at the delivery of the Products) and the creation of an account	Identity details (first name, surname) Communication details (e-mail) Legal Age details (date of birth, legal age status)
when you contact us for issues of guarantees and/or after sales service	Identity details (first name, surname) Communication details (e-mail, phone number) Purchase details (Type/product purchased, time of purchase, time and place of delivery, purchase value, device barcode and other data relating to the order) Background in relation to warranties/ after sales (time and actions related to the provision of guarantees/ after sales)





Through automated means:

Τρόπος	Δεδομένα
from your navigation on the e-shop	Technical information (Internet Protocol (IP) address, operating system)
from your access to your account	log files for logging into the iqos.gr account (date , duration)

4.3. As a Data Controller, we have the obligation to keep your data accurate and updated, and, we therefore encourage you to contact us using the contact means listed above if your data have changed or if you have provided inaccurate data to us by mistake.

4.4. Where the provision of data is necessary for the conclusion of the contract, failure to provide such data shall mean that the contract cannot be concluded.

5. Purpose and Legal Basis of Processing

5.1. The table below shows the purposes of processing the Consumer's personal data, the categories of personal data collected either by Papastratos or through partners and processed, and the legal basis for processing, in cases where Papastratos processes the Consumer's personal data as a Data Controller, i.e:

No	PURPOSE FOR PROCESSING	LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA RELATING TO THE PURPOSE OF THE PROCESSING
1.	Making your purchases and fulfilling your order through Remote Sales Channels (from the submission of the order until its delivery, including the exercise of the right of withdrawal) and/or in order to provide you with any discounts or redemption of points/coupons that you are entitled to as a member of Papastratos programmes	execution of a contract We process your personal data necessary for the conclusion and execution of the contract for the purchase and sale of our Products through the Remote Channels and the provision to you of any discounts or other offers to which you may be entitled.
2.	Confirmation of legal age, identification check, and creation of an account	compliance with a legal obligation Collection and processing of your personal data is necessary in order for us to check your legal age identity, and verify that you meet the purchase conclusion requirements, therefore fulfilling our legal obligations regarding prevention of sale to individuals below the legal age in view of the nature of our products, and in order to demonstrate compliance with the applicable legislation, ethics and policy of Papastratos with regard to tobacco or nicotine products.
3.	Provision of customer service (as part of the provision of guarantees and Customer Care and After Sales Services),management of complaints and requests with regard to the Product you purchased from the Remote Sales Channels, and contact for issues pertaining to guarantees	legal obligation or execution of a contract per case of after sales service below As part of our business model, following a request submitted by you, we process your personal data and we communicate with you by the contact means and at the contact details you will indicate to us in order to fulfil the statutory or commercial guarantee, as well as the obligations to provide after sales services to consumers, after they have purchased our Products
4.	Safety and proper operation of the Remote Sales Channels	The legal interest of Papastratosfor safety and proper operation of the e-shop, the call centre, and your account, which, in the case at issue, is fairly balanced against your privacy and your rights.

5.1.1. If we need to exercise or defend our legal claims, we process your personal data, relying on our legal interest, which has been fairly balanced against your privacy.

5.1.2. Moreover, we process your personal data as part of our compliance with our legal obligations when documents, applications, orders, court documents etc. are notified to us.

5.1.3. It should be noted that the data you enter in the website of the payment company-credit institution cooperating with the e-shop are not collected and are not processed by either Papastratos or by the Seller, but are collected and processed by the said payment company-credit institution.

5.1.4. Where the legal basis for the processing of your data involves the legal interest of Papastratos, you can object to the processing by contacting Papastratos at contact.gr@iqos.com.

6. Retention time of personal data

We will retain your personal data for as long as it is necessary for the fulfillment of the processing purposes for which they were collected and for as long as you continue interacting with us (e.g. for the execution of your purchases, for tax purposes, etc.). For more information about issues concerning the time of retention of your data, please refer to the PMI Privacy Policy.

7. What are your rights? How can you exercise them?

7.1. The current laws on the protection of your personal data enable you to exercise your rights listed below regarding the protection of your personal data:

• Access
• Rectification
• Erasure
• Restriction
• Portability
• Right to Object
• Right to human intervention
• Withdrawal of consent

You can find more information about your rights in the PMI Privacy Policy , and you can exercise your rights by contacting………………………

7.2. For the purposes for which the relevant Seller has been identified above as aindependent Controller, you may exercise your above rights by submitting your request to the contact details of the relevant Seller, which are indicated on the Product document which you purchased or in the list available here and/or to Papastratos (who will forward the request) and respectively to Papastratos for the processing carried out by itself as Data Controller in the contact details mentioned in Article 1. 4 above.

7.3. Moreover, you have the right to submit your grievances or your complaint to the local supervisory authority in relation to the processing of your personal data. In Greece the supervisory authority for data protection is the Data Protection Authority (DPA) – www.dpa.gr

7.4. We also support Alternative Dispute Resolution - Mediation as a more lenient means of resolution of any disputes between us.

7.5. While exercising your rights, you need to take into account the following considerations:

• Identification: It is necessary that we identify you in order to respond to your requests to exercise your rights, and we therefore reserve the right to request some proof of your identify.
• Response time We will respond to valid and accurate requests within a period of one (1) month from receipt thereof, unless the request is particularly complex, or you have submitted multiple requests. If we need more time to respond to your request, due to the foregoing causes, we will notify this to you within one month at your contact details, but the response time will not be longer than three months.
• -Specific requests: In any event, you should provide specific and true information and/or facts, in order to allow us to respond and/or accurately satisfy your request, otherwise we disclaim any liability for any errors that are beyond our control. We reserve our right to deny invalid, excessive, abusive, or illegal requests, under the law.
• Cost: We will not charge you with any cost for the exercise of your rights in relation to your personal data, unless, pursuant to the law, your request for access to information is invalid or excessive, in which case we have the right to charge a reasonable fee under the specific circumstances. In any case, we will inform you of any charges before we finish processing your request.

8. Recipients of your data

8.1. As part of the operation of remote sales (via the e-shop and/or via telephone orders), in order for you to purchase the tobacco products sold through the Remote Sales Channels, we can forward your personal data to third-party companies with which we cooperate, in order to execute your purchases (e.g. companies acting as agents-indirect representatives of Papastratos, courier companies, companies offering data management and hosting services, consulting companies (e.g. business consulting companies etc.), companies related to the safety and operation of the Product, companies providing technical support and operation of the Remote Sales Channels, companies providing call centre services, electronic platforms for contacting you, advertising companies, etc.), and as part of our business operation (e.g. accountants, lawyers).

8.2. All the cooperating companies that support the systems and the operation of Papastratos and sales through the Remote Sales Channels acquire access only to your data that are absolutely necessary for the service they offer to us. They are bound by a contract to keep your data confidential and to adopt all the technical and organisational measures for safe processing, and not to use your information in any manner other than for the purpose assisting us to provide you with the products we have agreed.

8.3. Should we receive a request from a competent Administrative Authority, a Public Prosecutor, a Court or another Authority, we may need to forward those data to such Authorities (with or without prior notification to you) based on the relevant provisions of the law. Moreover, in the event of a legal order, a service mandate, or an official preliminary examination, we have the right to promptly disclose the relevant evidence to the respective authority.

8.4. The majority of your data recipients are within the EEA. Article 9 below shall apply to transfers of personal data out of the EEA.

9. Data Transfers out of the EEA

As a rule, we retain your personal data within the European Economic Area (EEA). If data are to be transferred to third countries out of the European Economic Area for which there is no adequacy decision of the European Commission, or to International Organisations, all the appropriate guarantees will be received (pursuant to Articles 46, 47, 49 of the GDPR depending on the specific case) and additional technical and organisational measures, provided for in the current laws on personal data protection and on the decisions and directives of competent European bodies regarding transfers to third countries, will be adopted.

10. Data security

We take all necessary technical and organizational security measures in order to protect and maintain the security of your personal data in accordance with the specific provisions of the PMI Privacy Policy. The data you submit to Papastratos are handled exclusively by its specifically authorised staff, under its direction, by authorised third-party associates and only at the order of the Company, as well as by the aforementioned recipients, where necessary. In carrying out the processing, Papastratos selects persons or associates with relevant professional qualifications, offering adequate guarantees in terms of technical knowledge and personal integrity with regard to keeping confidentiality.

On your part, you must not disclose your credentials/password of your Account and, in particular, you must prevent unauthorised access to your Account by third persons. In any case, we identify you as a Consumer and verify that you are an adult at the delivery of the Products.

11. Modifications to this Policy

We reserve the right to modify this Policy, for instance, in order to comply with new requirements imposed by applicable laws and directives, or in case we revise our procedures or practices. We will notify you of any revision to our Privacy Policy, by publishing it on the Website.