PERSONAL DATA PROTECTION POLICY

1. PREAMBLE 

“Athenian Brewery SA” which is seated in 102 Kifissou Avenue, Aigaleo 122 41, TIN 094000362 (Athens Tax Office), GEMI no 251401000 (email: https://www.athenianbrewery.gr/gr/el/epikoinonia) (hereinafter “AB” or the “Company”), has as its main priority the protection of the personal data it processes. For this reason, it collects and processes data in accordance with the principles set out in Regulation (EU) 2016/679 (hereinafter “GDPR“) and in accordance with the applicable national and European legislation on the protection of personal data. It also takes all appropriate technical and organizational measures necessary to protect the personal data it collects and processes in the context of its commercial activity.

We invite you to carefully read this personal data protection policy of our Company, the aim of which is to inform you about the terms and conditions governing the processing of personal data by the Company, as well as about your rights under the applicable law.

For the purposes of this Policy, “Personal Data” means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one whose identity can be verified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors that approximate the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person (e.g. name/name of a sole proprietorship, tax identification number, etc.).

It is clarified that any commercial or other information, through which it is not possible to disclose or identify a specific natural person, does NOT constitute Personal Data.

1. GENERAL INFORMATION AND CONTROLLER

The Company “Athenian Brewery SA” which is seated in 102 Kifissou Avenue, Aigaleo 122 41, TIN 094000362 (Athens Tax Office), GEMI no 251401000 (email: https://www.athenianbrewery.gr/gr/el/epikoinonia) is the controller for the collection,  storage and in general processing of your personal data as these are collected and stored for the processing purposes specified in this Personal Data Protection Policy.

1. WHAT PERSONAL DATA OF YOURS WE COLLECT

We collect and process your personal data below:

• Details of your business, which directly or indirectly identify an owner/natural person (e.g. name, TIN, activity, telephone number of a sole proprietorship).
• Business address (county, town, area, street, number), market channel to which the business belongs, type of shop.
• Details of your business which directly or indirectly identify natural persons who participate in or manage the enterprise (e.g. in partnerships or other legal entities).
• Contact details and data of employees of your business, when and if required to inform the Company.
• Sales data (such as, but not limited to, sales prices, sales quantities per product, etc.) of AB’s products, as well as sales data of products that AB trades on behalf of its affiliated companies and the respective – corresponding to such sales – invoices, delivery notes and/or other tax documents. In addition, data relating to the granting of the right to use the Company’s fixed assets/equipment, to displaying the Company’s products and/or products of companies affiliated with it, to controlling the Company’s promotional activities in the store, to the image and availability of the products traded by the Company (if applicable) on the shelf, in the refrigerator and to the displays in the store area.
• Details necessary for your and/or your sub-contractors’ vehicles to enter the AΒ premises for the purpose of loading products and, in particular, name/surname, vehicle number plate, vehicle type and capacity, vehicle and load insurance expiration date, vehicle inspection (MOT/KTEO) and emission card expiration date, driver’s license expiration date, date and time of entry and exit and time the vehicle remains at the AB premises.
• In the context of examining a request submitted by your company for opening a customer code in order to start cooperation with the Company for the purchase of products, we collect from you, in accordance with the relevant Company’s Customer Code Opening Policy, information relating to the activity of your company, and we hereby inform you that we search for data relating to the activity of your company, both in databases of financial behavior (ICAP, TIRESIA) and in other public databases, for the purpose of checking the solvency/creditworthiness of your business, always subject to strict compliance with the provisions of the applicable data protection legislation. Moreover, in the context of our cooperation and of our Company’s participation in the exchange program “Trade Exchange Program” (“TEP”) of ICAP, we may provide to ICAP data concerning your financial behavior in the context of our contractual relationship, and, specifically, identification data of your company (name, TIN, address, activity), information on the credit agreed between us, as well as information on invoices issued in the context of our relationship and on their payment. From the moment of transfer of such data to ICAP, the latter becomes the data controller of such data.

1. PURPOSES OF PROCESSING

The Company processes your above personal data for the purposes listed below:

1. To record the distribution and availability of its products (indicatively, recording the prices at which they are sold, the quantities sold per product brand, etc.) and/or, if applicable, the products of its affiliated companies, per product brand, in order for the Company to make decisions on behalf of the Company to optimize the production planning, the designing of more effective future promotional activities and the optimization of its investments (e.g. sending promotional material, provision of promotional services, events, tastings, concerts, festivals, local events, on pack offers etc.).
2. Furthermore, the Company processes your personal data for the purpose of granting to your business the use of fixed equipment, refrigerators, etc., the performance of promotion services and/or advertising services, sending you the agreed fixed equipment and/or advertising material in accordance with the provisions of our cooperation if applicable.
3. The Company also processes personal data concerning you for the purpose of checking the creditworthiness of your business and its solvency, in order to assess the prospect of cooperation with you, in the context of ensuring its normal operation, as well as for the purpose of its participation in the exchange program “Trade Exchange Program” (“TEP”) of ICAP.
4. The Company processes personal data relating to the operation of your business and the cooperation between us, including invoice data and/or other tax documents, for the purpose of fulfilling its legal tax or other obligations.
5. The Company processes your personal data by sending you questionnaires for the purpose of conducting satisfaction surveys and surveys concerning the Company’s activity in general, in the context of the continuous development and improvement of its services.
6. The Company proceeds to check (“scan”) the license plate of your vehicle (or your subcontractor’s vehicle) in order to record the time of its entry and exit from its premises each time, as well as to process the documents shown each time concerning your vehicle or your subcontractor’s vehicle entering its premises for the loading of goods, for the purpose of ensuring the safety of persons and goods transported, compliance with road safety rules, but also for the purpose of carrying out the loading of the goods and the performance of the terms of its contract of cooperation with you in the best possible way. It is noted that such data are not kept by the Company but are only shown to the Company’s authorised employees and are processed exclusively for the period of time during which your vehicle or the vehicle of your subcontractor remains on the Company’s premises. If the loading of goods at the Company’s premises is carried out, on your behalf, by your subcontractors, you must also provide them with this information on the described processing of their data by Aβ in the context and for the purpose of loading.
7. The Company will process personal data relating to your business and/or the cooperation between us, if and to the extent that is required for the purpose of defending the Company’s legal interests and legal protection before courts or other competent authorities.
8. H. Finally, the Company, in the context of cultivating and maintaining a good working relationship with you, processes your personal data for the purpose of fulfilling its legal tax obligations.

The Company processes your personal data in a lawful and fair manner. Under no circumstances will it collect or process more information or data than is necessary to fulfil the purposes of the processing. Your data is kept in a secure manner. It is collected and processed exclusively for the processing purposes stated above. Your data is not used for profiling.

1. LEGALITY OF PROCESSING

The Company processes your personal data under the following legal bases:

1. By virtue of your explicit consent (Article 6 par. 1(a) of the GDPR) for the processing of data for the purpose of planning future promotional activities of the Company and/or its affiliated companies.
2. Execution of the respective (if applicable) contract between us (article 6 par. 1(b) of the GDPR) regarding the supply of products, the licensing of fixed equipment, the performance of presentation/promotion and/or advertising services, the handling of the process of loading products into your vehicles and your subcontractors’ vehicles at the Company’s premises, the provision of data services (SOD) and/or the provision of triangle warehousing services.
3. Satisfaction of the Company’s legitimate interests (article 6 par. 1(f) of the GDPR), with regard to the processing of your data that takes place for the purpose of optimising production planning, planning more effective future promotional activities and optimising the investments made by the company, verifying the creditworthiness and/or solvency of your company and participation of AB in the relevant program “Trade Exchange Program” (“TEP”) of ICAP, conducting research in the context of the improvement and development of its services, the safety of persons and goods, compliance with road safety rules by all vehicles transporting products of the Company, as well as the defense of the Company’s claims and interests before courts and competent authorities.
4. Compliance of the Company with its legal obligations (article 6 par. 1(c) of the GDPR), for the processing of our transaction data in the context of fulfilling tax or other obligations of the Company.   

1. RECIPIENTS OF YOUR PERSONAL DATA

We will need to share your personal data with third parties, subject to legal requirements, in order for them to assist us in our activities as described above. These recipients are:

• companies belonging to the same Group as the Company (e.g. for the purpose of storing personal data due to the shared use of information systems),
• the companies belonging to the Bacardi Group, namely “Tradall S.A.”, a company based in Switzerland (267, Route de Meyrin, CH-1217 Meyrin 2, Switzerland), and “Bacardi Greece Single Person Private Limited Company”, a company based in Greece (Aigaleo, Attica, L. Kifissou, no. 102, 122 41), when this is required in order, on the basis of the cooperation agreement concluded between the Company and these companies, for the latter to have access to the sales data of your company concerning the products of the Bacardi Group, e.g. for the purpose of designing and organizing respective promotional activities regarding the said products, planning offers/discounts to your store, etc.), as well as other companies AB cooperates with under respective cooperation agreements.
• service providers, when required, for the provision of a service to us and for the provision of data logging services, e.g. data logging services of the points of sale (for example, recording the availability and quantity of products sold by the Company or its partner companies, recording sales prices per product of the Company or its partner companies, etc.) for the purposes of our commercial activity,
• third party customers of the Company (retailers), who submit their orders for products to you and to whom you deliver the Company’s products, on behalf of the Company, under the contract between us for the provision of triangle warehousing services,
• service providers who help us to organize campaigns and promotions, advertising companies and/or media agencies that provide us with services in the context of the above processing purposes,
• databases of financial behavior (TIRESIAS and ICAP) to which the Company transmits data concerning your business, for the purpose of checking its solvency and creditworthiness, prior to the conclusion of a cooperation agreement between us, as well as for the purpose of participation of AB in the exchange program “Trade Exchange Program” (“TEP”) of ICAP.

If the HEINEKEN Group to which the company belongs sells all or part of the assets or shares of a HEINEKEN Group company to which personal data has been transferred to third parties, your personal data may be provided to these third parties.

These recipients mentioned above may be located in Greece or in countries within the EU or anywhere in the world. Where personal data is stored by us outside the EU, we ensure an adequate level of protection of personal data transferred in accordance with the applicable legal requirements and require service providers to use appropriate measures to protect the confidentiality and security of personal data. Where we are going to transfer your personal data to a third country, i.e. a country outside the EEA or an international organisation, you will be informed prior to the transfer in accordance with the provisions of Article 13 para. 1 (f) GDPR, both of the details concerning such transfer and of the personal data protection measures to be taken in this context in accordance with the applicable legislation as in force from time to time.

In each of these cases, the Company shall ensure, through the conclusion of relevant contracts with the recipients of personal data, that the said persons undertake in writing the necessary obligations and commitments regarding the protection of personal data in accordance with the conditions set out in the applicable legislation, in order to ensure that the processing is carried out in accordance with the applicable legal framework and that each natural person can freely and unhindered exercise the rights that

Finally, where required by a legal obligation imposed on us by law, a court order or a public authority, or where necessary to pursue the legal protection and/or legitimate claims of the Company, we will provide personal data to the relevant judicial or other competent authorities.

1. RETENTION PERIOD OF PERSONAL DATA

The personal data of users are kept exclusively for the time required to fulfill the purpose for which they were collected. When the purpose of processing your personal data is completed, they are deleted, unless their retention is necessary for the fulfilment of a legal obligation or the exercise of legitimate interests of Ab, always in accordance with the applicable legislation.

1. YOUR RIGHTS IN RELATION TO YOUR PERSONAL DATA

Every natural person whose data are processed shall enjoy the following rights:

• Right of information & access: you have the right to be informed about and have access to your data kept by us and to receive additional information about their processing.
• Right of rectification: you have the right to request the rectification, modification, supplementation and update of your data kept by us.
• Right to erasure: You have the right to request the erasure of your personal data, in accordance with the conditions set by the applicable legislation, when we have collected and/or processed them on the basis of your consent, or in order to protect our legitimate interests.
• Right to restriction of processing: You have the right to request the restriction of the processing of your personal data when: (a) the accuracy of your personal data kept is contested and until verification is carried out; (b) the processing is unlawful and you request the restriction of the use of your personal data instead of erasure; (c) the personal data is not necessary for the purposes of processing, but is necessary for the establishment, exercise, support of legal claims; and (d) you object to the processing and until verification is carried out that there are legitimate grounds for the processing that concern us and override the reasons why you object to the processing.
• Right to object to processing: You have the right to object at any time at the processing of your personal data when there are no legitimate reasons on our behalf to continue to do so.
• Right to portability: You have the right to receive, free of charge, your personal data in a format that allows you to access, use and process it, and to request us, where technically feasible, to transfer your data directly to another controller. This right applies to data that you have provided us with and that is processed by automated means on the basis of your consent or in performance of a contract between us.
• Right to withdraw consent: You have the right to withdraw your consent, to the extent that it was obtained for the intended processing, at any time. Any withdrawal of the consent given does not affect, in any event, the processing of your personal data that has taken place pursuant to your consent up to the point in time of such withdrawal.

In order to exercise any of the above rights, you can send a message to the following email address: DPO_ABOffice@heineken.com

• Right to submit a complaint before the Hellenic DPA: You have also the right to file a complaint at the Hellenic Data Protection Authority (www.dpa.gr): Telephone: +30 210 6475600, Fax: +30 210 6475628, E-mail: complaints@dpa.gr.

1. SECURITY OF PERSONAL DATA

The Company assures you that it takes all appropriate technical and organizational measures for the security of your personal data, to ensure the confidentiality of their processing and their protection from accidental or unlawful destruction/loss/alteration, unauthorized disclosure or access and any other form of unlawful processing and ensures the lawfulness of the collection, processing and safe keeping of personal data, as well as for the adoption and compliance with corresponding technical and organizational measures by the respective recipients of such personal data, in accordance with the provisions of national, European and international law on the protection of individuals against the processing of personal data and in particular taking into account the provisions of the GDPR.

1. APPLICABLE LAW

For any dispute arising in connection with this Policy, the Greek courts will have exclusive jurisdiction.

1. AMENDMENTS

This Personal Data Protection Policy has been drafted in accordance with the provisions of the General Data Protection Regulation (GDPR). In case of update, any change will be posted on the Company’s official website and will carry a revision date, otherwise it will be communicated to you in the most appropriate way.

For further information, or for any issue regarding the above processing of your personal data, you may contact the Company’s Data Protection Officer (DPO) at e-mail: DPO_ABOffice@heineken.com.