Personal Data Protection and Privacy Policy for sales of products via e-shop iqos.gr and/or via telephone orders

1. General Information

1.1. Papastratos is fully and exclusively responsible for determining the method of operation and content of the Remote Sales Channels, as well as the terms and procedure for the placement of consumers' orders, the execution thereof and the delivery Products. The Products are sold through the Remote Sales Channels either by Papastratos or by third-party associates namely FΟΟDLINK COMMERCIAL AND INDUSTRIAL COMPANY FOR FOOD – AGENCIES AND DISTRIBUTIONS SOCIETE ANONYME (FΟΟDLINK S.A.), 19300, VAT number 094509258, telephone number 2105517700 (hereinafter referred to as the “Sellers”). Notwithstanding the service “Click n’ Collect, third-party Seller concludes those associates contracts with the end consumer in their name, but on behalf of Papastratos, as agents-indirect representatives thereof. Retail sale, therefore, from Sellers to final consumers is governed by the Terms and Conditions for the sale of products through zyn.com (hereinafter referred to as the “Terms of Sale”), based on the terms and procedures designated by Papastratos.

1.2. 1.2. In that context, we prioritise respect for your privacy and for protection of your personal data. We take appropriate measures, in accordance with the applicable laws on data protection. We have established this Personal Data Protection and Privacy Policy (hereinafter referred to as “Privacy Policy” or “Policy”), for your information about the processing of your personal data while you make purchases of Products through the Remote Sales Channels, on your initiative as a Consumer. This Policy is supplementary (to the extent otherwise provided herein, this Policy takes precedence as the more specific information document):

which form an integral part hereof, and govern purchases made through ZYN's Remote Sales Channels in a unified and cumulative manner.

Please note that other programmes or actions of Papastratos are governed by different Privacy Policies, which are duly indicated to you each time.

1.3. You must accept these terms before you make your purchases through the Remote Sales Channels.

1.4. Identity and details of Papastratos as data controller: Where Papastratos is the controller of the processing of your personal data in accordance with the distinctions of articles 3 and 5 below, the data controller is a limited liability company under the name "PAPASTRATOS SINGLE-MEMBER CIGARETTE MANUFACTURING COMPANY S.A. " and the distinctive title "PAPASTRATOS SINGLE-MEMBER S.A.", with its registered office at Aspropyrgos, Imeros Topos, Kororemi location, GEMI registration no. 227601000, VAT no. 094011481, Tax Office of Athens, telephone no. 210 4193000, fax no. 210 4112303, e-mail address contact.gr@zyn.com.

1.5. Communication regarding personal data protection: For any issue concerning this Policy and the processing of the Personal Data of Consumers by Papastratos as part of the purchases through Remote Sales Channels, based on the provisions of Articles 3 and 5 below, the Consumer may contact us in one of the following manners:

a) by telephone service at 2104193777 (charge depending on the communication provider), (charge depending on the telecommunications provider) daily from 09:00 to 21:00

b) by e-mail to contact.gr@zyn.com ;

c) by mail at the postal address: PAPASTRATOS SINGLE MEMBER S.A. Headquarters, Imeros Topos, Kororemi Site, Aspropyrgos, Attn. Legal Department.

2. Who does this Policy concern?

This Policy is addressed to consumers, who:

• i) are natural persons, over 18 years of age, and have full legal capacity (such age must already have been completed upon access to zyn.com and performance of any action relating to the Website), and whose adult status is confirmed by us upon delivery of the Product;
• ii) are smokers and/or users of other tobacco products, new tobacco products or e-cigarettes or nicotine products in general or related products
• iii) reside or are staying in Greece (hereinafter referred to as the “Consumers’’)

and wish to purchase the Products through the Remote Sales Channels (on your own initiative, after you have declared your age and have created an Account based on the Terms of Sale. Users who have not reached legal age (18) are prohibited from carrying out any action on the Website or the e-shop, or making telephone orders.

3. Who are the Data Controllers and for which processes?

• 3.1.The processing of your personal data for the purchase of Products through the Remote Sales Channels requires cooperation between more companies, as regulated by the individual contracts of the parties, and the role thereof is explained hereunder, in accordance with the legal requirements.
• 3.2 Papastratos is the Data Controller for all the processing functions and actions performed by the Remote Sales Channels both before and after conclusion of the order. The Seller acts as a Data Processor for the processing of consumers’ data, as part of executing the sale cycle, based on explicit orders and procedures designated by Papastratos. In particular, the Seller takes all the necessary actions on behalf of Papastratos and based on the orders of Papastratos as an agent/indirect representative thereof, from the moment when the order is forwarded to the Seller by Papastratos through the Remote Sales Channels, until final delivery of the Products, as well as with regard to fulfillment of the obligations pertaining to customer service, management of complaints and requests, verification of identity during delivery, and registration of consumers or their devices in databases or programs of Papastratos.
• 3.3. The Seller is an independent Data Controller where processing is necessary for the Seller’s statutory obligations as an agent-indirect representative (including, but not limited to, tax obligations), as well as for payment by the consumer (carried out in collaboration with a third-party provider with whom they transact independently). In particular, with regard to the processing made by the Seller as an independent Data Controller, such Seller bears full and exclusive liability for the legality and compliance thereof with the current laws on data protection. You can be informed about the Privacy Policy of the Seller that carries out the sale on behalf of Papastratos on the website of each Seller. Moreover, each Seller acts as independent Controller for the Click n Collect service, since it acts on its own name and behalf for the sales conducted within its physical store.

4. What personal data categories do we collect from you and how?

• 4.1. Your Personal Data include any information that allows, either on its own or in combination with other information, your unique identification, under the provisions of the Regulation, the applicable Greek legislation, and the decisions of the Data Protection Authority (DPA), as well as the guidelines and decisions of the competent European bodies.
• 4.2. We collect for you the following categories of data concerning you from the following sources: Directly from you, when you submit such data either to us or to our partners/Processors:

Through automated means:

4.3.As a Data Controller, we have the obligation to keep your data accurate and updated, and, we therefore encourage you to contact us using the contact means listed above if your data have changed or if you have provided inaccurate data to us by mistake.

4.4. Where the provision of data is necessary for the conclusion of the contract, failure to provide such data shall mean that the contract cannot be concluded.

5. Purpose and Legal Basis of Processing

5.1. The table below shows the purposes of processing the Consumer's personal data, the categories of personal data collected either by Papastratos or through partners and processed, and the legal basis for processing, in cases where Papastratos processes the Consumer's personal data as a Data Controller, i.e:

5.1.1. If we need to exercise or defend our legal claims, we process your personal data, relying on our legitimate interest, which has been fairly balanced against your privacy.

5.1.2. Moreover, we process your personal data as part of our compliance with our legal obligations when documents, applications, orders, court documents etc. are notified to us.

5.1.3. It should be noted that the data you enter on the website of the payment provider - credit institution cooperating with the e-shop are not collected and are not processed by neither Papastratos or by the Seller, but are collected and processed by the said payment company-credit institution.