1. General Information
1.1. Papastratos is fully and exclusively responsible for determining the method of operation and content of the Remote Sales Channels, as well as the terms and procedure for the placement of consumers' orders, the execution thereof and the delivery Products. The Products are sold through the Remote Sales Channels either by Papastratos or by third-party associates (hereinafter referred to as the “Sellers”). Those associates contract with the final consumer in their name, but on behalf of Papastratos, as agents-indirect representatives thereof. Retail sale from Sellers to final consumers is governed by the Terms and Conditions for the sale of products via the iqos.gr e-shop and/or via telephone orders (hereinafter referred to as the “Terms of Sale”),based on the terms and procedures designated by Papastratos.
ii) the Terms and Conditions of sale of products through the e-shop iqos.gr and/or through telephone orders (hereinafter referred to as "Terms of Sale"),
which form an integral part hereof, and govern purchases made via the e-shop and/or by telephone in a unified and cumulative manner.
Please note that other programmes or actions of Papastratos are governed by different Privacy Policies, which are duly indicated to you each time.
1.3. You must accept these terms before you make your purchases through the Remote Sales Channels. We encourage you to read this Policy from time to time to keep up to date with any changes we make.
1.4. Identity and details of Papastratos as data controller: Where Papastratos is the controller of the processing of your personal data in accordance with the distinctions of articles 3 and 5 below, the data controller is a limited liability company under the name "PAPASTRATOS SOLE PROPRIETOR SOCIETE ANONYME SIGARETTE COMPANY" and the distinctive title "PAPASTRATOS SOLE PROPRIETOR S.A.", with its registered office at Aspropyrgos, Imeros Topos, Kororemi location, GEMI registration no. 227601000, VAT no. 094011481, Tax Office of Athens, telephone no. 210 4193000, fax no. 210 4112303, e-mail address email@example.com.
1.5. Communication regarding personal data protection: For any issue concerning this Policy and the processing of the Personal Data of Consumers by Papastratos as part of the purchases through Remote Sales Channels, based on the provisions of Articles 3 and 5 below, the Consumer may contact us in one of the following manners:
a) by telephone service at 8001114767 (free of charge from a landline phone) or at 210 4193888 (charge depending on the telecommunications provider) daily from 09:00 to 23:00;
b) by e-mail to firstname.lastname@example.org;
c) by mail at the postal address: PAPASTRATOS SINGLE MEMBER S.A. Headquarters, Imeros Topos, Kororemi Site, Aspropyrgos, Attn. Legal Department.
For the processing carried out by the respective Seller from whom the Consumer purchases the Product in accordance with the Terms of Sale, whose details appear on the receipt delivered to him/her upon delivery of the Product, you can contact the details indicated on the sales document or on the list available here.
2. Who does this Policy concern?
This Policy is addressed to consumers, who:
i) are natural persons, over 18 years of age, and have full legal capacity (such age must already have been completed upon access to iqos.gr and performance of any action relating to the Website), and whose adult status is confirmed by us upon delivery of the Product;
ii) are smokers and/or users of other tobacco products, new tobacco products, e-cigarettes or nicotine products in general, or related products, as determined by the relevant laws at any given time
iii) reside or are staying in Greece (hereinafter referred to as the “Consumers’’)
and wish to purchase the Products through the Remote Sales Channels (either through the e-shop or by telephone) on your own initiative, after you have declared your age and have created an Account based on the Terms and Conditions of iqos.gr and the Terms of Sale. Users who have not reached legal age (18) are prohibited from carrying out any action on the Website or the e-shop, or making telephone orders.
3. Who are the Data Controllers and for which processes?
3.1. The processing of your personal data for the purchase of Products through the Remote Sales Channels requires cooperation between more companies, as regulated by the individual contracts of the parties, and the role thereof is explained hereunder, in accordance with the legal requirements.
3.2. Papastratos is the Data Controller for all the processing functions and actions performed by the Remote Sales Channels both before and after conclusion of the order. Each Seller acts as a Data Processor for the processing of consumers’ data, as part of executing the sale cycle, based on explicit orders and procedures designated by Papastratos. In particular, the Seller takes all the necessary actions on behalf of Papastratos and based on the orders of Papastratos as an agent/indirect representative thereof, from the moment when the order is forwarded to the Seller by Papastratos through the Remote Sales Channels, until final delivery of the Products, as well as with regard to fulfillment of the obligations pertaining to customer service, management of complaints and requests, verification of identity during delivery, and registration of consumers or their devices in databases or programmes of Papastratos.
4. What personal data categories do we collect from you and how?
4.1. Your Personal Data include any information that allows, either on its own or in combination with other information, your single identification, under the provisions of the Regulation, the applicable Greek laws, and the decisions of the Data Protection Authority (DPA), as well as the directives and decisions of the competent European bodies.
4.2. We collect for you the following categories of data concerning you from the following sources:
Directly from you, when you submit such data either to us or to our processing partners:
|when placing an order via the e-shop and/or the call centre until delivery thereof, including the exercise of the right to rescind the contract
(first name, surname)
Legal Age details
(date of birth, legal age status)
(e-mail, phone number)
Necessary data for the exercise of the right of withdrawal based on our business model
(date of exercise of the right of withdrawal, order number, etc.)
Your participation data for other Papastratos Programmes
(such as which tier you belong to in the IQOS Club, whether you are entitled to a voucher, etc.)
|during the identification/identity check and confirmation of your adult status (through the age gate of the Website and through the proper identification documents/documents proving adult status presented at the delivery of the Products) and the creation of an account
(first name, surname)
Legal Age details
(date of birth, legal age status)
|when you contact us for issues of guarantees and/or after sales service
(first name, surname)
(e-mail, phone number)
(Type/product purchased, time of purchase, time and place of delivery, purchase value, device barcode and other data relating to the order)
Background in relation to warranties/ after sales
(time and actions related to the provision of guarantees/ after sales)
Through automated means:
|from your navigation on the e-shop
(Internet Protocol (IP) address, operating system)
|from your access to your account
log files for logging into the iqos.gr account
(date , duration)
4.3. As a Data Controller, we have the obligation to keep your data accurate and updated, and, we therefore encourage you to contact us using the contact means listed above if your data have changed or if you have provided inaccurate data to us by mistake.
4.4. Where the provision of data is necessary for the conclusion of the contract, failure to provide such data shall mean that the contract cannot be concluded.
5. Purpose and Legal Basis of Processing
5.1. The table below shows the purposes of processing the Consumer's personal data, the categories of personal data collected either by Papastratos or through partners and processed, and the legal basis for processing, in cases where Papastratos processes the Consumer's personal data as a Data Controller, i.e:
|PURPOSE FOR PROCESSING
|LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA RELATING TO THE PURPOSE OF THE PROCESSING
Making your purchases and fulfilling your order through Remote Sales Channels (from the submission of the order until its delivery, including the exercise of the right of withdrawal) and/or in order to provide you with any discounts or redemption of points/coupons that you are entitled to as a member of Papastratos programmes
execution of a contract
We process your personal data necessary for the conclusion and execution of the contract for the purchase and sale of our Products through the Remote Channels and the provision to you of any discounts or other offers to which you may be entitled.
Confirmation of legal age, identification check, and creation of an account
compliance with a legal obligation
Collection and processing of your personal data is necessary in order for us to check your legal age identity, and verify that you meet the purchase conclusion requirements, therefore fulfilling our legal obligations regarding prevention of sale to individuals below the legal age in view of the nature of our products, and in order to demonstrate compliance with the applicable legislation, ethics and policy of Papastratos with regard to tobacco or nicotine products.
Provision of customer service (as part of the provision of guarantees and Customer Care and After Sales Services),management of complaints and requests with regard to the Product you purchased from the Remote Sales Channels, and contact for issues pertaining to guarantees
legal obligation or execution of a contract per case of after sales service below
As part of our business model, following a request submitted by you, we process your personal data and we communicate with you by the contact means and at the contact details you will indicate to us in order to fulfil the statutory or commercial guarantee, as well as the obligations to provide after sales services to consumers, after they have purchased our Products
Safety and proper operation of the Remote Sales Channels
The legal interest of Papastratosfor safety and proper operation of the e-shop, the call centre, and your account, which, in the case at issue, is fairly balanced against your privacy and your rights.
5.1.1. If we need to exercise or defend our legal claims, we process your personal data, relying on our legal interest, which has been fairly balanced against your privacy.
5.1.2. Moreover, we process your personal data as part of our compliance with our legal obligations when documents, applications, orders, court documents etc. are notified to us.
5.1.3. It should be noted that the data you enter in the website of the payment company-credit institution cooperating with the e-shop are not collected and are not processed by either Papastratos or by the Seller, but are collected and processed by the said payment company-credit institution.
5.1.4. Where the legal basis for the processing of your data involves the legal interest of Papastratos, you can object to the processing by contacting Papastratos at email@example.com.
6. Retention time of personal data
7. What are your rights? How can you exercise them?
7.1. The current laws on the protection of your personal data enable you to exercise your rights listed below regarding the protection of your personal data:
- Right to Object
- Right to human intervention
- Withdrawal of consent
7.2. For the purposes for which the relevant Seller has been identified above as aindependent Controller, you may exercise your above rights by submitting your request to the contact details of the relevant Seller, which are indicated on the Product document which you purchased or in the list available here and/or to Papastratos (who will forward the request) and respectively to Papastratos for the processing carried out by itself as Data Controller in the contact details mentioned in Article 1. 4 above.
7.3. Moreover, you have the right to submit your grievances or your complaint to the local supervisory authority in relation to the processing of your personal data. In Greece the supervisory authority for data protection is the Data Protection Authority (DPA) – www.dpa.gr
7.4. We also support Alternative Dispute Resolution - Mediation as a more lenient means of resolution of any disputes between us.
7.5. While exercising your rights, you need to take into account the following considerations:
- Identification: It is necessary that we identify you in order to respond to your requests to exercise your rights, and we therefore reserve the right to request some proof of your identify.
- Response time We will respond to valid and accurate requests within a period of one (1) month from receipt thereof, unless the request is particularly complex, or you have submitted multiple requests. If we need more time to respond to your request, due to the foregoing causes, we will notify this to you within one month at your contact details, but the response time will not be longer than three months.
- -Specific requests: In any event, you should provide specific and true information and/or facts, in order to allow us to respond and/or accurately satisfy your request, otherwise we disclaim any liability for any errors that are beyond our control. We reserve our right to deny invalid, excessive, abusive, or illegal requests, under the law.
- Cost: We will not charge you with any cost for the exercise of your rights in relation to your personal data, unless, pursuant to the law, your request for access to information is invalid or excessive, in which case we have the right to charge a reasonable fee under the specific circumstances. In any case, we will inform you of any charges before we finish processing your request.
8. Recipients of your data
8.1. As part of the operation of remote sales (via the e-shop and/or via telephone orders), in order for you to purchase the tobacco products sold through the Remote Sales Channels, we can forward your personal data to third-party companies with which we cooperate, in order to execute your purchases (e.g. companies acting as agents-indirect representatives of Papastratos, courier companies, companies offering data management and hosting services, consulting companies (e.g. business consulting companies etc.), companies related to the safety and operation of the Product, companies providing technical support and operation of the Remote Sales Channels, companies providing call centre services, electronic platforms for contacting you, advertising companies, etc.), and as part of our business operation (e.g. accountants, lawyers).
8.2. All the cooperating companies that support the systems and the operation of Papastratos and sales through the Remote Sales Channels acquire access only to your data that are absolutely necessary for the service they offer to us. They are bound by a contract to keep your data confidential and to adopt all the technical and organisational measures for safe processing, and not to use your information in any manner other than for the purpose assisting us to provide you with the products we have agreed.
8.3. Should we receive a request from a competent Administrative Authority, a Public Prosecutor, a Court or another Authority, we may need to forward those data to such Authorities (with or without prior notification to you) based on the relevant provisions of the law. Moreover, in the event of a legal order, a service mandate, or an official preliminary examination, we have the right to promptly disclose the relevant evidence to the respective authority.
8.4. The majority of your data recipients are within the EEA. Article 9 below shall apply to transfers of personal data out of the EEA.
9. Data Transfers out of the EEA
As a rule, we retain your personal data within the European Economic Area (EEA). If data are to be transferred to third countries out of the European Economic Area for which there is no adequacy decision of the European Commission, or to International Organisations, all the appropriate guarantees will be received (pursuant to Articles 46, 47, 49 of the GDPR depending on the specific case) and additional technical and organisational measures, provided for in the current laws on personal data protection and on the decisions and directives of competent European bodies regarding transfers to third countries, will be adopted.
10. Data security
On your part, you must not disclose your credentials/password of your Account and, in particular, you must prevent unauthorised access to your Account by third persons. In any case, we identify you as a Consumer and verify that you are an adult at the delivery of the Products.
11. Modifications to this Policy