Terms of use

1. Content and purpose of this Privacy Policy

This Privacy Policy contains relevant information related to the data processing activities of the Controller, which are the subject of data processing activities, the personal data of consumers (hereinafter collectively referred to as: consumer data processing). The General Part of this consolidated Privacy Policy contains the provisions governing all consumer data processing described in the Special Part, and the Special Part contains the rules applicable to each consumer data processing described therein. Chapter “A” of the Special Part describes the data processing activities relating to devices and other associated products marketed by the Data Controller; Chapter “B” describes the data processing activities relating to nicotine pouch products marketed by the Data Controller. For data processing activities not covered by this detailed Privacy Policy, the provisions of the PMI General Consumer Privacy Policy shall apply. The referenced general privacy policy and this Terms and Conditions of Use, including the detailed privacy policy part of this, can be found at the www.iqos.com and www.zyn.com websites.

2. The Data Controller

Philip Morris Hungary Ltd.

Address: 1085 Budapest, Kálvin tér 12.

Phone: +36 80 888 222

E-mail: PMHU.GDPR@pmi.com

3. Rights of the Data Subject

Data Subjects are entitled to request the following from the Controller

1. access to personal data concerning him as a Data Subject,

2. supplementation, correction, deletion or restriction of the processing of their personal data,

3. they may object to the processing of their personal data. In this case, the Controller shall not further process such personal data, unless data processing is justified by compelling legitimate reasons which take precedence over the interests, rights and freedoms of the Data Subject or which are related to the submission, enforcement or protection of legal claims.

We recommend to use the following form for submitting a request: „https://hu.iqos.com/documents/en/Elektronikus_nyomtatvany_erintetti_joggyakorlas_EN.pdf”, please send the completed form to PMHU.GDPR@pmi.com.

4. The protection of your data is very important to us, so we ask that if you have any problem with the protection of your data, contact us at one of the following contact details in order to find a satisfactory solution as soon as possible: Phone: +36 80 888 222

E-mail: PMHU.GDPR@pmi.com

5. The Data Subject has the right to submit a complaint to the supervisory authority (National Authority for Data Protection and Freedom of Information, 1055 Budapest, Falk Miksa utca 9-11., https://naih.hu, telephone number: +36 (1) 391-1400, postal address: 1363 Budapest, Pf. 9., e-mail: ugyfelszolgalat@naih.hu). If the Data Subject is a foreign citizen, they may also submit a complaint to the supervisory authority of their place of residence.

6. Data Subjects may go to court if their rights are violated. The court shall act with priority in the case. Data protection lawsuits fall within the jurisdiction of the tribunal, which may, at the choice of the Data Subject, be sued in the court of the Data Subject's domicile or residence.

The Controller informs the owner of the personal data (the Data Subject) that any person who has suffered pecuniary or non-pecuniary damage as a result of a breach of law is entitled to compensation from the Controller for the damage suffered in accordance with the rules of civil law.

Before contacting the supervisory authority or the court with your complaint, please contact our Company, if possible, at the e-mail address indicated in The Controller section of this policy.

4. Automatic decision making

There is no automatic decision making during data processing.

5. Nature of reporting

The provision of personal data is voluntary.

1. General purpose of data processing

The purpose of data processing is

a) For consumers with a device, product information on the website, warranty services, and additional services related to the right of withdrawal upon customer and product registration, while

b) For consumers without a device, product information on the website upon customer registration, including information on programs that may be announced by PM for consumers registered under this "b)" point on the website or other legally available channels, and the purchase of devices at a reduced price according to the information, as well as feedback from the consumer

this contract is to be fulfilled by the Data Controller for the Data Subjects.

2. Data Subjects of data processing

Data Subjects of data processing are

a)      Consumers who have a device and who choose

•  for product information on the website and

•  for the warranty and related services related to the purchase of the device and

•  for the possibility of exercising the right of withdrawal (buyback) in the case of an undamaged, complete device

to register their device in the System or in the national tobacco shop personally, or the purchased device, or through the Controller's customer service via video chat.
The Data Subject previously registered under point b) below becomes a Data Subject under this point, and the provisions applicable to Data Subjects under this point become applicable to them at the time when a device is subsequently registered for their profile.

b) Consumers without a heating device who decide to:

•  Utilize the product information service on the website, which becomes immediately available upon registration, including information on programs that may be announced by PM for consumers registered under this point II.A.1.1.b) on the website or other legally available channels, and the possibility of purchasing devices at a reduced price according to the information, as well as providing feedback from the consumer.
•  Additionally, to enable the Data Subject to utilize the services and exercise the rights referred to in point II.A.1.2. a) automatically upon possible device registration following registration, they register themselves and possibly their device either on the website, in person at a national tobacco shop, or with the help of the Data Controller's customer service via video call. In this case, the subsequent device registration can also be completed by the consumer on the website.

For the purposes of applying this privacy policy, an individual is also considered to be according to point II.A.1.2. a) Data Subject who purchases the device for another individual and also registers the profile with his or her own data in the ways specified above.

3. Legal basis for data processing

Processing is carried out on the legal basis set out in Article 6 (1) b) of the GDPR, i.e. the processing is necessary for the performance of a contract to which the Data Subject is a party.

4. Purpose of the personal data processed and the processing of individual data

Mobile phone number
The mobile phone number is used for several purposes. On the one hand, as a first step in registration, it is necessary to provide this personal data by the Data Subject in order to avoid multiple registration. On the other hand, if the Data Subject requests the replacement of the device, the Controller will perform a (remote) inspection of the product with regard to registration and in case of a favourable assessment of the warranty claim, the Controller will send an SMS containing the replacement code to the Data Subject's mobile phone number. The consumer will also receive a unique identification code via SMS before performing operations requiring consumer identification. Instead of entering the password the registered consumer can request a one-time verification code to enter the profile on the website, the code will be sent via SMS to the registered mobile phone number.

Simultaneously with registration, a user profile is automatically created for the Data Subject in the System which profile allows the Data Subject to view the product information content available only to registered Data Subjects on the website. The mobile number (or e-mail address) is required in addition to the password generated by the Data Subject and known only to the Data Subject in order for the Data Subject to access the website and view product information content. In the event that the Data Subject has forgotten their password, they may request the System to reset the password associated with the profile.

The Data Controller also processes this personal data for the purpose of organizing a personal meeting requested by the Data Subject between the Data Subject and the Data Controller’s representative present at the national tobacco store.

The Data Controller also processes this personal data for the purpose of verifying by the System whether the Data Subject already has a profile in the System by registering on one website, and if so, to make the process of registration on the other website more convenient and faster for the Data Subject.

The Data Controller also processes this personal data, in case of consumers specified in point II.A.1.1. b), for the purpose of soliciting feedback.

Last name
The processing of this personal data is necessary for the purpose of identifying the Data Subject, in their capacity as a contracting party with the Data Controller in connection with the provision of product information via the website, in the case of consumers specified in Section II.A.1.1. b), the solicitation of feedback, and (in case of device registration, automatically granted to the Data Subject from the date of registration) eligibility for extra warranty rights and the right of withdrawal.

First name
The processing of this personal data is necessary for the purpose of identifying the Data Subject, in their capacity as a contracting party with the Data Controller in connection with the provision of product information via the website, in the case of consumers specified in Section II.A.1.1. b), the solicitation of feedback, and (in case of device registration, automatically granted to the Data Subject from the date of registration) eligibility for extra warranty rights and the right of withdrawal.

Consumer identifier
The Controller processes this data in order to identify the consumer in the System.

E-mail address

The e-mail address is processed for the following purposes:

Registered Data Subjects will receive automatic system messages to the e-mail address provided during registration.
By using the e-mail address with a password, Data Subjects can access the website, reset their password and change their telephone number. The registered consumer can login also with a one-time verification code, which is sent to the registered e-mail address via e-mail.

The mobile phone number and e-mail address are alternatives to each other in the operations described. For example, Data Subjects can access the website with either the registered e-mail address and a password (or with a one-time code), or a mobile phone number (in the case of logging in this way, by entering the date of birth) and with a one-time code. In case of the validation of a warranty claim, Data Subjects will also receive the related minutes and notifications to their e-mail address.

The Data Controller shall provide information on the possible changes in the warranty conditions in an e-mail sent to the Data Subject's e-mail address.

The electronic document certifying the purchase of the device is delivered to the Data Subject’s e-mail address.

The Data Controller also processes the Data Subject's e-mail address for the purpose of informing the Data Subject about changes in the Terms of Use and the relevant circumstances of the processing of personal data in accordance with data protection legislation. For this purpose, the Data Controller processes this personal data on the basis of the legitimate interest of the Data Controller to be able to comply with data protection legislation (Article 6(1)(f) of the GDPR).

The Data Controller also processes this personal data, in case of consumers specified in point II.A.1.1. b), for the purpose of soliciting feedback.

Date of birth
Date of birth as personal data shall be processed for the following purposes:

1. considering that only persons who have reached the age of 18 may register under the Terms and Conditions of Use and the relevant legislation, the date of birth must be provided by the Data Subject and processed by the Controller in order to verify this circumstance,

2. on the other hand, the Controller prepares cumulative reports and analyses in order to improve the quality of its services to an even more appropriate level for consumers, and in the course of this data processing activity it also processes the birth date constituting the consumer's personal data for the purpose indicated herein.

3. and in the event that the Data Subject intends to log in to their profile using their mobile phone number, they must provide their birth data, which data is processed by the Data Controller for the purpose of preventing an unauthorized person from entering their profile,

4. the Data Controller also processes this personal data for the purpose of verifying by the System whether the Data Subject already has a profile in the System by registering on one website, and if so, to make the process of registration on the other website more convenient and faster for the Data Subject.

Address zip code
The address zip code of the Data Subject is managed by the Controller to develop and enhance services for consumers, the Controller shall take into account the address zip code of the consumers and be able to send geographically segmented messages to consumers based on their zip code.

Smoking and nicotine-containing product user condition
Based on the Terms and Conditions of Use, only persons who already smoke or use a nicotine-containing product can register, as the device has also been developed for adults who already smoke or using a nicotine-containing product, so this data of the Data Subject is processed by the Controller in order to check compliance with the Terms and Conditions of Use.

Unique identification data number and color of devices assigned to the consumer (data processed in the case of Data Subjects pursuant to point II.A.1.2. a)

To identify and handle the device used by the Data Subject.

Data relating to the fact of watching or not watching product usage e-coach videos
The Data Controller processes this personal data in order to evaluate whether the right to buyback (withdrawal) and additional warranty in case of damage arising from one’s own fault (defect resulting from improper use) is met, according to which the registered consumer must watch the product usage e-coach videos. The Data Controller informs the data subjects that it is also possible for the Data Subject referred to in point II.A.1.2.b) to view the product usage videos, and in the event that the Data Subject becomes a Data Subject referred to in point II.A.1.2.a), it is not necessary to view the product usage videos again in order to obtain the related rights.

Registration date of consumers in the System
The Data Controller processes this personal data in order to ensure a more personalized contact.

Customer service tasks related to the consumer
The Data Controller processes this personal data in order to ensure a more personalized contact.

The image and voice of the consumer will be processed during the period of registration within the framework of the video chat, withthe video chat being preceded by an automated, face-based age verification (Yoti) during the registration initiated on the website, which, if it does not lead to a result or at the initiative of the Data Subject, if the Data Subject is not satisfied with the result of the verification, is followed by a human age verification by the customer service administrator, which takes place within the framework of a video chat between the Data Subject and the administrator and a personal document-based data verification, provided that and voice in the context of a video call, only audio recording is made, and the handling of this audio recording as personal data is governed by the provisions set out in Title II.A.6. The provisions of Title II.A.22 shall apply to the data processing activities of the Data Controller related to the automated, facial-based age verification of the Data Subject's age.

Content of the personal conversation between the Data Subject and the representative

The Data Controller records relevant information on the Data Subject's product consumption, product use, and the topics discussed based on the conversation between the Data Subject and the Data Controller's representative on the registered profile of the Data Subject referred to in point II.A.1.2.b). The data processing related to these data serves exclusively to ensure the personalized nature of the communication with the Data Subject. In the event that the Data Subject referred to in point II.A.1.2.b) becomes the Data Subject referred to in point II.A.1.2.a), these data will not be deleted from the Data Subject's profile.

Language of communication (Hungarian or English):

The Data Controller processes this data to use the language (Hungarian or English) that is most suitable for the consumer during communication.

5. Duration of data storage

The data processing between the parties is based on the duration of the contract for the additional services outlined above (i.e. the period between registration and cancellation of registration) and for Data Subjects with device,  the validity of the warranty claim. In the event that a Data Subject cancels their registration, this will also lead to the deletion of their data, i.e. also their profile, except where the consumer is likewise registered on the website referred to in Chapter II.B., in which case the consumer’s profile shall be retained and the Data Controller shall continue to process the consumer’s personal data in accordance with the provisions set out in Chapter II.B.. If a buyback (withdrawal) takes place in the case of Data Subjects with device, the profile will be deleted after 3 months.

In the case a registered Data Subject remains inactive for a period of 3 years, defined as not logging into the website (and, if also registered on the website referred to in chapter II.B., not logging into that website during the same period), not initiating any contact with our Customer Service or customer support specialists, not updating their consumer profile, and not opening any e-mail(s) sent by us, their profile shall be deleted.

6. Relationship between failure to disclose data and statutory warranty rights

Failure to disclose data shall not affect the Data Subject's statutory warranty rights attached to the device.

7. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during this data processing:

1. MONOLITH Advanced Internet Solutions LTD the data processing company operating the registration interface
2. Konecta Hungary Kft. the company operating the customer service
3. Erlab Hungary Kft service provider operating a backup system in the case of a failure of the System
4. Tobacco retailers
(a) if assistance is provided in in the customer and device registration to the Data Subject with a device, or in the intender registration of the Data Subject without a device at the express request of the Data Subject,
(b) if the device is being replaced.

5. Microsoft Corporation: feedback provided by Data Subjects to representatives is provided by MS Forms, which is provided by the designated company.

1. General purpose of data processing

The purpose of data processing is for the Data Controller to delete from System the mobile phone number that, due to its inaccuracy or change, cannot be linked to the registered consumer whose profile contains the given mobile phone number.

2. Data Subjects of data processing

Consumer who has a profile in the System as a result of registration indicated in Title II.A.1.

3. Legal basis for data processing

The legal basis for the processing is the legal basis set out in Article 6 (1) f) of the GDPR, i.e. the legitimate interest of the Controller. The legitimate interest of the Controller is as follows: compliance with point d) of Article 5 (1) of the GDPR (principle for data accuracy) and storing only accurate and up-to-date personal data in the System of the Data Controller.

4. Purpose of the personal data processed and the processing of individual data

Registered incorrect phone number
In the event that the Data Controller determines that the mobile phone number assigned to the profile of a particular Data Subject is incorrect, i.e. cannot be linked to the Data Subject (which may be due to e.g. a typo or a change in the Data Subject's mobile phone number in the meantime in such a way that the Data Subject does not reflect the change on his/her profile does not transfer, etc.), the Data Controller deletes the incorrect mobile phone number from the Data Subject's profile.

Correct mobile phone number
If the Data Subject provides the correct mobile phone number linked to the Data Subject, it will be stored in the Data Subject's profile.

Last name
The processing of this personal data is necessary for the purpose of contacting the Data Subject via e-mail.

First name
The processing of this personal data is necessary for the purpose of contacting the Data Subject via e-mail.

E-mail address
If an incorrect mobile phone number is detected, the Data Controller sends an e-mail to the Data Subject asking the Data Subject to enter the correct mobile phone number.

5. Duration of data storage

The duration of data storage is the same as the conditions and periods specified in point II.A.1.5. of these Terms and Conditions of Use.

6. Consequence of failure to provide data

In the event that the Data Subject does not provide the Data Controller with the correct mobile phone number, communication with the Data Controller will be limited, as the Data Controller will not be able to reach the Data Subject via mobile phone calls, the Data Subject will not be able to access his/her profile using the mobile phone number, and basic functions (e.g. new device registration) become unavailable to the Data Subject.

7. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during this data processing:

1. MONOLITH Advanced Internet Solutions LTD the data processing company operating the registration interface

2. Konecta Hungary Kft. the company operating the customer service

Information about device CLUB membership

Please also review the information regarding device CLUB membership, which can be accessed by clicking here.

1. General purpose of data processing

The purpose of data processing is to enable the Controller to fulfil the contract for the provision of additional services, discounts to the Data Subject, i.e. beyond the registration without club membership as regards warranty, information about the characteristics, use and effects of the products via electronic mail as specified in the membership terms of use and product support (e.g. device usage assistance, training, device testing, collecting and giving feedback in connection with membership and products distributed or planned to be distributed by the Data Controller or others, device software update, registration support, device personalization) also providing unique shopping opportunities related to device Club membership, in connection with the Data Subject's choice of device CLUB membership and assess how the Data Subject received the phone call.

In case of a hearing-impaired consumer, the purpose of processing special personal data related to hearing loss is for the Data Controller to use written communication (e-mail or other text message) instead of outgoing phone calls.

2. Data Subjects of data processing

Data Subjects of data processing are consumers who purchase a device and registered who decide to choose device CLUB membership in order to use the heating device Club membership-related,

•  i.e. additional warranty services beyond those provided by registration, and

•  information about the characteristics, use and effects of the products via e-mail as set out in the membership terms and conditions

•  extra product support, information (phone or personal support provided by a representative employee, answering questions, product usage assistance, feedback and other services referred to in the purpose of data processing section)

in addition to own customers and registering the device on the website or through the Controller's customer service in case they chose the device Club membership.

3. Legal basis for data processing

Processing is carried out on the legal basis set out in Article 6 (1) b) of the GDPR, i.e. the processing is necessary for the performance of a contract to which the Data Subject is a party.

In case of a hearing-impaired consumer, the processing of special personal data related to hearing loss is based on the legal basis set out Article 6 (1) a) of the GDPR and the exemption condition set out in Article 9 (2) a) of the GDPR based on the express consent of the Data Subject.

4. Purpose of the personal data processed and the processing of individual data

Voice recording, listening in
The customer service conversation with the Data Subject is recorded for the purpose of subsequent service quality inspection, improvement the quality of services and later demonstration of what has been said.

The Controller’s competent staff may listen in the conversation in real time in order to monitor customer service quality and to improve the quality of services.

Mobile phone number
If the Data Subject has a request to replace the device, the identification SMS sent to their mobile phone number can prove that they are entitled to use the additional warranty service based on device CLUB membership, as well as to receive additional support, answers to their questions, product usage assistance and to give feedback. The consumer will also receive a unique identification code via SMS before performing operations requiring consumer identification.

The mobile phone number is also processed for the purpose of checking the fact of device CLUB membership, checking the right to use additional services related to device CLUB membership, analyzing the use of services in order to personalize services.

The Data Controller processes this personal data to verify whether the Data Subject has an device Club membership, so that support can be provided at customer support points at festivals or other events, and to determine whether their participation in filling out questionnaires is relevant.

The Data Controller shall also process this personal data for the purpose of soliciting feedback.

Last name
It is necessary to process this personal data for the purpose of identifying the Data Subject as a contracting party to the Controller in order to be entitled to the extra warranty, to receive information by email about the characteristics, use and effects of the products, product support and other information.

The Data Controller processes this personal data to verify whether the Data Subject has an device Club membership, so that support can be provided at customer support points at festivals or other events, and to determine whether their participation in filling out questionnaires is relevant.

First name
It is necessary to process this personal data in order to identify and to address in e-mails personally the Data Subject as a contracting party to the Controller in order to be entitled to the extra warranty, to receive information by email about the characteristics, use and effects of the products, product support and other information.

The Data Controller processes this personal data to verify whether the Data Subject has an device Club membership, so that support can be provided at customer support points at festivals or other events, and to determine whether their participation in filling out questionnaires is relevant.

Consumer identifier
The Controller processes this data in order to identify the consumer in the System.

E-mail address
The Data Subject joined to the device CLUB (visit the website for detailed terms and conditions of membership) will receive automatic system messages to the e-mail address provided by him or her.

With device CLUB membership, the Controller not only provides additional warranty services, but also information via electronic mail about the characteristics, use and effects of the products (including the refills that can be used with them), customer support and other product information to the Data Subject, such as the most basic technological information about the device, news, product range and price changes; knowledge of the use, operation, technical knowledge and troubleshooting of the device. Data Subjects may provide feedback on their device, product usage habits, and the device Club.
The e-mail address is processed for the above purposes.

The Data Controller processes this personal data to verify whether the Data Subject has an device Club membership, so that support can be provided at customer support points at festivals or other events, and to determine whether their participation in filling out questionnaires is relevant.

The fact and time of the data subject's visit to the customer support point.

The Data Controller processes this personal data to provide personalized information to IQOS Club members who visit the customer support points.

Address
The address of the Data Subject is processed by the Controller in order to be able to contact the Data Subject by post if other channels (e.g. mobile phone, e-mail) are not available in order to facilitate the enforcement of warranty claims. Also, if the Data Subject cannot be reached via another channel (e.g. mobile phone, e-mail), the Data Controller should be able to send him/her a notification of important information by post. Furthermore, the Controller reserves the right to give gifts and prizes at any time in return for the Data Subject’s feedback on the heating device Club and to deliver such gifts to the provided address.

Unique identification data and number of devices assigned to the consumer
To identify and handle the device used by the Data Subject.

Gender (an optional, non-compulsory data field)
The Controller handles this personal data in order to ensure a more personalised contact.

Data related to product usage, feedback and areas of interest
The Controller obtains data on product use, feedback and areas of interest from Data Subjects (e.g. consumers’ opinion about the heating or other device and whether they would recommend the product to others, expressing interest in a new product) within the framework of feedback from Data Subjects in order to improve its services and personalise its shipments and information, including the provision that the data controller informs the Data Subjects about the available products regarding products to be withdrawn or already withdrawn from the market as well as to use the data in a statistical way in order to develop and organize its strategy and business plans.

Provision of gifts
In the event that the Data Controller undertakes to provide gifts (typically vouchers) to consumers for providing feedback, the data regarding whether a particular consumer has already received a gift for providing feedback is recorded. This is to ensure that the gift is provided and to prevent the same questions from being answered within a short period and the consumer from receiving a gift repeatedly for answering the same questions.

Registration date of consumers in the System
The Data Controller processes this personal data in order to ensure a more personalized contact.

Customer service tasks related to the consumer
The Data Controller processes this personal data in order to ensure a more personalized contact.

Answers recorded during telephone and e-mail inquiries of consumers (supporting and anniversary inquiries)
The purpose of data processing is to improve the quality of the Data Controller's services.

Data on the Data Subject's interaction regarding electronic mails and newsletters sent:
The Data Controller monitors with the help of the used electronic mail system whether Data Subjects open and the type of product information e-mails sent to them and whether they click on the link(s) found in them, whether they filled out the questionnaire in the email, and how much time elapses between the time the e-mail was sent and the time of opening the e-mail or clicking on the internet link(s) that may be found in them,  for the purpose of improving the effectiveness of fulfilling the contractual obligation to send out information, improving the quality of this service, in particular by updating the managed product information electronic mail addresses as necessary. The Data Controller also manages the data on whether the Data Subject has unsubscribed from the newsletters and thereby terminated the device CLUB membership.

Consumer's attitude towards phone calls:
This personal data is created on the basis of the operator's assessment based on the operator's phone conversation with the Data Subject, the purpose of data management is to improve the quality of the Data Controller's services.

Segment name:
Within the device CLUB membership, consumers are divided into groups based on registration and interaction data, the purpose of which is to improve the quality of the Data Controller's services

IP address and other IT related personal data
The cookie information on the website contains additional information about the relevant circumstances of the management of this data.

Firmware status of the affected device

After informing and consent from the Data Subject, the Data Controller checks whether the firmware or other software on the Data Subject's device has been updated to the latest version in order to ensure that the device can function as properly as possible and provide the highest possible level of consumer and user experience for the Data Subject.

Data relating to the fact of watching or not watching product usage e-coach videos
The Data Controller processes this personal data in order to determine whether the condition of the entitlement to the additional warranty undertaken in the case of damage due to one's own fault (even resulting from improper use) is met, according to which the consumer who is a device CLUB member must watch the product usage e-coach videos.

Personal data relating to device CLUB membership
On the one hand this data is processed by the Data Controller with the aim of verifying whether the given consumer has an device CLUB membership, and based on this, are the specific discounts and services available that the Data Controller provides only to consumers with device CLUB membership, on the other hand this personal data is processed by the Data Controller for the express purpose of providing specific discounts and services to consumers with device CLUB membership.

The Data Controller also processes this personal data for the purpose of verifying whether the Data Subject has a device Club membership, so whether support can be provided to them at festivals or other events at customer support points, and whether their participation in filling in questionnaires is relevant.

The fact and time of the Data Subject's visit to the Customer Support Point

These personal Data are processed by the Data Controller in order to be able to provide personalized information to the data subjects who visit the customer support points.

Data relating to hearing loss
In the case of a hearing-impaired consumer, the purpose of processing special personal data related to hearing loss is for the Data Controller to use written communication (e-mail or other text message) instead of outgoing phone calls.

Language of communication (Hungarian or English):
The Data Controller processes this data to use the language (Hungarian or English) that is most suitable for the consumer during communication.

5. Duration of data storage

Data processing between the parties is based on the duration of the contract for additional services outlined above (i.e. the period between the start of device CLUB membership and its termination by the Data Subject) and on the term of enforceability of warranty claims. In the event that a Data Subject cancels their registration, this will also lead to the deletion of their data managed in connection with device CLUB membership. (The Data Subject's entire profile will be deleted, so if there are more than one devices assigned to the Data Subject, the CLUB membership and related data for each device will be deleted.) The Data Subject may at any time decide to cancel device CLUB membership only, in which case the data processing of the Data Subject for purposes related to device CLUB membership will be terminated; however, data supplied earlier by the Data Subject (e.g. the fact and description of phone conversations, the fact and description of discussions with a customer support expert), and the registration previously performed by the Data Subject (see Title II.A.1.) will remain until the date of canceling the registration.

The period of retention of customer service voice recordings is 3 months from the date of recording; voice recordings will be deleted afterwards. In case of a complaint, a warranty claim disputed by the Data Controller, the period of retention is specified in point 6 of Title II.A.6.. In case of surrender (withdrawal), device CLUB membership – together with the profile – will be canceled after 3 months. In case a Data Subject is inactive for 3 years, their registration and device CLUB membership will be canceled.

Data regarding the opening of e-mails is managed by the Data Controller until the device CLUB membership is canceled. Information about the retention period of IP addresses and other IT-related personal data is contained in the cookie information of the specific cookie.

6. Relationship between failure to disclose data and statutory warranty rights

Failure to provide data shall not affect the Data Subject's statutory warranty rights attached to the device.

7. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during this data processing:

1. MONOLITH Advanced Internet Solutions LTD
the data processing company operating the registration interface

2. Konecta Hungary Kft.
the company operating the customer service

3. Tobacco retailers,
a) if assistance is provided during the registration of the device for the selection of device CLUB membership at the expressed request of the Data Subject,
b) if the device is replaced

4. Erlab Hungary Kft
service provider operating a backup system in the case of a failure of the System

5. The service provider preparing the delivery of the gift for the Data Subject’s feedback as device CLUB member, the registered seat of which is in Hungary.

6. The service provider making arrangements for the delivery of the gift for the Data Subject’s feedback as device CLUB member, the registered seat of which is in Hungary.

7. IPSOS Zrt. (headquarter: 1139 Budapest, Pap Károly utca 4-6.) the company performing tasks related to customer feedback

8. Compoffice -R Ltd: the provider of platforms on which the Data Controller can verify the existence of a device Club membership for a Data Subject at customer support points at festivals and other events.

1. General purpose of data processing

To analyze data in order to understand consumers and in connection with business initiatives, issues and product development, and to understand consumer habits.

2. Data Subjects of data processing

Consumers registered to the website and device Club members

3. Legal basis for data processing

The legal basis for the processing is the legal basis set out in Article 6(1)f) of the GDPR, i.e. the legitimate interest of the Controller. The legitimate interest of the Controller is as follows: to offer and develop goods and services that best satisfy the needs of consumers.

4. Purpose of the personal data processed and the processing of individual data

In the event that data are not provided, the data that a consumer does not intend to provide will not be used for business analytics purposes.

5. The personal data processed and the purpose of the processing of the respective data

For registered consumers, the personal data specified in Title II.A.1.

For device Club members, the personal data specified in Title II.A.3.

6. Data retention period

The personal data used are deleted in the manner and at the time specified in Titles II.A.1. and II.A.3.

7. Transfer of personal data, data processors, description of their services

In the course of this processing, the Controller uses the services of the following processors:

1.MONOLITH Advanced Internet Solutions LTD
the data processor operating the registration interface

2. Microsoft Corporation
the entity storing the underlying data of PowerBI in a cloud

3. Sii Sp. z o.o.

IT development and support partner, which performs development and data processing tasks related to the database

1. General purpose of data processing

Understanding consumer perception in relation to various business initiatives, issues, product development, learning about consumer switching. The purpose of processing the personal data on the list of those who unsubscribed is to prevent the Controller from contacting those Data Subjects for market research purposes who withdrew their consent earlier granted thereto.

2. Data Subjects of data processing

Consumers who have given their consent to participate in market research. In case of the list of those who unsubscribed, those consumers who withdrew their consent earlier granted to the Controller to contact them for market research purposes.

3. Legal basis for data processing

In the course of market research activities, processing is carried out on the legal basis set out in Article 6 (1) a) of the GDPR, i.e. on the basis of the Data Subject's consent.
In the course of voucher management activities, processing is carried out on the legal basis set out in Article 6 (1) (b) of the GDPR, i.e. for the performance of a contract to which the Data Subject is a party; and in case of the list of those who unsubscribed, on the legal basis set out in Article 6 (1) (f) of the GDPR, i.e. in the legitimate interest pursued by the Controller, namely to prevent legal disputes by the fact that the Controller shall not contact those Data Subjects for market research purposes who withdrew their consent earlier granted to the Controller to contact them for such purpose.

4. Consequence of failure to provide data

In case of any failure to provide data, the consumer shall not have the opportunity to participate in the market research.

5. Purpose of the personal data processed and the processing of individual data

The processing of personal data by the Controller takes place only for the following purposes:

1. for the performance of the quantitative market research activities,

2. in connection with the related voucher management,

3. and in connection with the processing of the list of those who unsubscribed.

1. With the consent of the Data Subject, the following personal data will be transferred to the data processor for market research purposes: consumer identifier, full name, e-mail address, age, gender, date of device purchase, and a reference to whether the Data Subject has viewed the product usage e-coach video or not. Based on the Data Subject's consent, the Data Controller also processes data on whether the Data Subject has completed the questionnaire sent to him/her or not for market research purposes. In the case of personal data other than those mentioned above, in relation to any data collected by the Market Researcher (see point II.A.5.7. below), e.g. for taxation and accounting purposes, the Market Researcher shall be considered as Controller.

2. On the legal basis of performing a contract to which the Data Subject is a party, the following personal data of participants entitled to be involved in market research will be transferred to the data processor in order to incentivize consumers’ participation in market research, for the purposes of gift voucher delivery, answering questions related to voucher use, and claims management: the Data Subject’s name and e-mail address. The data processor obtains the following personal data from the voucher service provider: voucher code, voucher validity, date of sending the voucher to the Data Subject.

3. The list of those who unsubscribed, generated by the data processor, contains the Data Subjects’ consumer identifier and e-mail address. The legal basis for processing the personal data included in the list of those who unsubscribed is the legitimate interest pursued by the Controller, the purpose of which is to prevent the Controller from contacting those Data Subjects for market research purposes who withdrew their consent earlier granted for such purpose.

In the case of personal data other than those mentioned above, in relation to any data collected by the data processor, the Market Researcher shall be considered as Controller.

6. Duration of data storage

The processing of personal data lasts until the withdrawal of the Data Subject's previous consent for market research purposes or the deletion of the profile, provided that data will be processed for voucher management purposes during the 1-year validity period of the voucher.

7. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processor during this data processing:

1. IPSOS Mori UK Ltd (3 Thomas More Square, London, E1W 1YW, UK) the company carrying out the market research activity (market researcher)

Data transfer guarantee: COMMISSION IMPLEMENTING REGULATION (EU) 2021/1772 (28 June 2021) on the adequate level of protection of personal data in the United Kingdom pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, which can be viewed here.

1. General purpose of data processing

a) Answering consumers' questions, fulfilling your requests, supporting your registration in the System, customer support, service development, efficiency measurement and planning, investigating their comments, general communications and communications concerning matters and key topics as determined unilaterally by the Data Controller from time to time with consumers,
b) handling consumers’ complaint,
c) manage consumers’ warranty claims.
d) In the case of a hearing-impaired consumer, the purpose of processing special personal data related to hearing loss is for the Data Controller to use written communication (e-mail or other text message) instead of outgoing phone calls.

2. Data Subjects of data processing

Consumers.

3. Legal basis for data processing

a) In the course of data processing for the purpose indicated in point 1. a) of this Title, data processing is carried out on the legal basis specified in point f) of Article 6 (1) of the GDPR, i.e. on the basis of the legitimate interest of the Data Controller, which legitimate interest is the effective and high-level support of consumers.

b) In the course of data processing for the purpose specified in point 1. b) of this Title, the data processing is carried out on the one hand on the legal basis specified in Article 6 paragraph (1) point b) of the GDPR, i.e. in order to fulfill the legal obligation of the Data Controller, the CLV of 1997 on consumer protection Act 17/A. § (5) and (7), on the other hand, it takes place on the legal basis defined in Article 6 (1) point f) of the GDPR, i.e. on the basis of the legitimate interest of the Data Controller, which legitimate interest is to facilitate the proof and defense of consumer claims. On the individual legal bases of data management see also those contained in point 5 of this Title.

c) In the case of data processing for the purposes specified in point 1. c) of this Title, the data processing is carried out on the one hand on the legal basis specified in Article 6 (1) point b) of the GDPR, i.e. in order to fulfill the legal obligation of the Data Controller and 19/2014 on the procedural rules for handling warranty claims (IV. 29.) on the basis of Section 4(1) and Section 6(1) of the NGM Decree, on the other hand on the legal basis defined in Article 6(1)(f) of the GDPR, i.e. the legitimate interest of the Data Controller takes place on the basis of which is a legitimate interest in the efficient and high-level fulfillment of consumers' warranty needs. On the individual legal bases of data management see also those contained in point 5 of this Title.

d) Data processing specified in point 1. d) of this Title, i.e. in the case of a hearing-impaired consumer, the processing of special personal data related to hearing loss is based on the legal basis set out Article 6 (1) a) of the GDPR and the exemption condition set out in Article 9 (2) a) of the GDPR based on the express consent of the Data Subject.

4. Consequence of failure to provide data

The Controller does not become aware of the issue, claim validation or complaint and thus cannot provide information or take appropriate steps in connection with the event.

5. Purpose of the personal data processed and the processing of individual data

a, The personal data that the Data Controller manages for the purpose indicated in point 1. a) of this Title:

i. Voice recording
Questions and comments made by the Data Subject on +36 80 888 222 will be recorded for the purpose of answering the question, investigating the comment and quality assurance. Additionally, the audio recording of the video call between the Data Controller's customer service and the consumer, in connection with the consumer's registration in the System, will be recorded (hereinafter collectively referred to as the audio recording of the phone call and the video call: audio recording).

ii. Last name / First name
The processing of this personal data is necessary for the purpose of identifying the Data Subject.

iii. Mobile phone number
The processing of this personal data is necessary for the purpose of contacting the Data Subject.

iv. E-mail address
It is stored for the purpose of contacting the Data Subject. With respect to specific key topics as determined by the Data Controller, an email shall be sent to the Data Subject where the Data Subject contacts the Data Controller’s telephone customer service line and, in the course of the discussion with the customer service representative, a given key topic is addressed. In such case, the representative shall inform the Data Subject which subject matter has arisen as a key topic during the conversation and that the Data Controller will send an email to the Data Subject concerning that key topic.

v. Consumer identifier
The Data Controller processes this data for the purpose of identifying the consumer in the System in the case of a request from a registered consumer regarding a non-traditional product (i.e. tobacco heating devices, e.g. IQOS).

vi. Unique identification data and number of devices assigned to the consumer
In the case of a non-traditional product, identification and management of the device used by the registered consumer.

vii. Other personal data

In the case of registered consumers:

•  Registration date of consumers in the System

•  Preliminary communications with the consumer (e.g. topics, e-mail communication),

•  the support used by the consumer in the premises of a contracted partner or at another location from the customer support expert, the description of which is recorded in the System,

•  Data related to participation in the program announced by the Data Controller, the description of which is recorded in the System (e.g. in relation to product use, cleaning of the device, online registration, software update, device check, services used, completion of program announcement or other circumstances),

•  The opinion of the registered consumer regarding the IQOS device and related services (e.g. would you recommend the product to others if you answer the asked questions),

•  Data on the Data Subject's interaction regarding e-mails and electronic letters sent: The Data Controller monitors with the help of the used electronic mail system whether Data Subjects open the electronic letters and informative emails sent to them and whether they click on the link(s) found in them for the purpose of improving the effectiveness of fulfilling the contractual obligation to send out information (electronic letters), improving the quality of this service, in particular by updating the managed e-mail addresses as necessary. The Data Controller also manages the data on whether the Data Subject has unsubscribed from the electronic letters and thereby terminated the device CLUB membership.

•  Answers recorded during telephone and e-mail inquiries of consumers (supporting and anniversary inquiries)
The purpose of data processing is to improve the quality of the Data Controller's services.

•  Customer service tasks related to the consumer
The Data Controller processes this personal data in order to ensure a more personalized contact.

•  Consumer's attitude towards phone calls: this personal data is created on the basis of the operator's assessment based on the operator's phone conversation with the Data Subject, the purpose of data management is to improve the quality of the Data Controller's services.

viii. Other personal data provided by the consumer
Any other personal data provided by the Data Subject during the telephone call or in e-mail. Personal data (first name, last name, mobile phone number, e-mail address, e-mail subject, message) provided by the Data Subject in the “Contact Us” marked electronic form on the website.

Language of communication (Hungarian or English):
The Data Controller processes this data to use the language (Hungarian or English) that is most suitable for the consumer during communication.

b, The personal data that the Data Controller manages for the purpose indicated in point 1. b) of this Title:

i. Name of the consumer
ii. Consumer’s address
iii. Place, time and method of presenting the complaint
iv. Detailed description of the consumer's complaint
v. Signature of the person taking the record
vi. The consumer's signature on the record
vii. In the case of a verbal complaint communicated by telephone or using other electronic communication services, the unique identification number of the complaint
viii. Response to the consumer's complaint
ix. Voice recording of the conversation with the consumer
x. Consumer identifier
xi. Unique identification data and number of devices assigned to the consumer
xii. Consumer’s mobile phone number
xiii. Consumer’s e-mail address

The processing of personal data specified in points i-viii.   is carried out on the legal basis of fulfilling the legal obligation specified in point 3. c) of this Title and the processing of personal data specified in points ix-xiii.  Is carried out on the legal basis of the legitimate interest defined in point 3. c) of this Title.

c, The personal data that the Data Controller manages for the purpose indicated in point1. c) of this Title:

i. Name of the consumer
ii. Consumer’s address
iii. The name of the movable asset sold
iv. The purchase price of the movable asset sold
v. Data needed to identify the product
vi. The consumer's mobile phone number: in the case of a replacement product, it is processed for the purpose of negotiating the delivery date
vii. Consumer's e-mail address: the protocol and notification related to claim enforcement will be sent to the consumer's e-mail address
viii. Address of the consumer: it is processed for the purpose of determining the regional representative to be appointed to hand over the replacement product.
ix. Voice record about the conversation with the consumer.
x. Consumer identifier
xi. Device codentify code

The processing of personal data specified in points i-v. is carried out on the legal basis of fulfilling the legal obligation defined in point 3. c) of this Title, and the processing of personal data specified in points vi-xi is carried out on the legal basis of the legitimate interests defined in point3. c) of this Title.

d, The personal data that the Data Controller processes for the purpose indicated in point 1. d) of this Title:

Condition of hearing loss
In the case of a hearing-impaired consumer, the purpose of processing special personal data related to hearing loss is for the Data Controller to use written communication (e-mail or other text message) instead of outgoing phone calls.

6. Duration of data storage

Data Subjects can provide their personal data by phone, the video chat or by e-mail. In the case of a voice recording, as a general rule 3 months from the date of the recording, complaint, in case of enforcement of a disputed warranty claim by the Data Controller 5 years from the date of the recording.

In the case of communication by e-mail the retention period is 3 months from the date of origin of the e-mail in case of communication not considered as a complaint, and 5 years from the date of origin of the e-mail in case of a complaint.

In case of handling a warranty claim, the retention period of personal data entered in the records is 3 years from drawing up such records.

In case of handling a complaint, the retention period of personal data entered in the records is 5 years from drawing up such records.

The Data Controller considers any communication from the customer (regardless of its form or medium) as a complaint, in which the customer makes a specific complaint, and/or in which the client refers to the possible initiation of a conciliation board, official, or court proceeding, refers to a claim for compensation, health damage, deterioration of health, or the use of a legal representative.

In the case of initiating conciliation body, official or judicial procedure the Data Controller processes the data for 6 months from the final conclusion of the procedure or, in case of recourse to an extraordinary legal remedy procedure, until its completion, which period (due to the possible prolongation of the procedures) may exceed 5 years from the date of creation of the data.

7. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during this data processing:

1. MONOLITH Advanced Internet Solutions LTD
the data processing company operating the registration interface

2. Erlab Hungary Kft service provider operating a backup system in the case of a failure of the System

3. Konecta Hungary Kft.
the company operating the customer service

4. Associate companies belonging to the PMI group of companies partner companies participating in the international assistance program and handling the request of the Data Subject

1. General purpose of data processing

a) Answering consumer questions, providing customer support, service development, efficiency measurement and planning, investigating consumer comments, general communication with consumers,
b) handling consumer complaints,
c) handling consumer warranty claims,
d) in case of a hearing-impaired consumer, the purpose of processing special personal data related to hearing loss is for the Data Controller to use written communication (e-mail or other text message) instead of outgoing phone calls,

e) in the case of data processed in connection with the product replacement of sticks, the Data Controller also aims to prevent abuses.

2. Data Subjects of data processing

The consumer specified in Title II.A.1. of these Terms and Conditions of Use who does not have intender or consumer profile in the System, i.e. is not a registered consumer.

3. Legal basis for data processing

a) In the course of data processing for the purpose indicated in point 1. a) of this Title, data processing is carried out on the legal basis specified in Article 6 (1) f) of the GDPR, i.e. on the basis of the legitimate interest of the Data Controller, which legitimate interest is effective and high-level support of consumers, appropriate product use and satisfaction with the services and the product.

b) In the course of data processing for the purpose specified in point 1. b) of this Title, the data processing is carried out on the one hand on the legal basis specified in Article 6 paragraph (1) point b) of the GDPR, i.e. in order to fulfill the legal obligation of the Data Controller, the CLV of 1997 on consumer protection Act 17/A. § (5) and (7), on the other hand, it takes place on the legal basis defined in Article 6 (1) point f) of the GDPR, i.e. on the basis of the legitimate interest of the Data Controller, which legitimate interest is supporting proof and defense related to consumer needs. On the individual legal bases of data processing see in point 5 of this Title.

c) In the case of data processing for the purposes specified in point 1. c) of this Title, the data processing is carried out on the one hand on the legal basis specified in Article 6 (1) point b) of the GDPR, i.e. in order to fulfill the legal obligation of the Data Controller and 19/2014 on the procedural rules for handling warranty claims (IV. 29.) on the basis of Section 4(1) and Section 6(1) of the NGM Decree, on the other hand on the legal basis defined in Article 6(1)(f) of the GDPR, i.e. the legitimate interest of the Data Controller takes place on the basis of which is a legitimate interest in the efficient and high-level fulfillment of consumers' warranty needs. On the individual legal bases of data processing see in point 5 of this Title.

d) Data processing specified in point1. d) of this Title, i.e. in the case of a hearing-impaired consumer, the processing of special personal data related to hearing loss is based on the legal basis set out Article 6 (1) a) of the GDPR and the exemption condition set out in Article 9 (2) a) of the GDPR based on the express consent of the Data Subject.

e) In the case of data processing for the purposes specified in point 1. e) of this Title, the data processing is carried out on the legal basis specified in Article 6 (1) f) of the GDPR, i.e. on the basis of the legitimate interest of the Data Controller, which is the legitimate interest of preventing abuse of the sticks.

4. Consequence of failure to provide data

The Controller does not become aware of the issue, claim validation or complaint and thus cannot provide information or take appropriate steps in connection with the event.

5. Purpose of the personal data processed and the processing of individual data

a, The personal data that the Data Controller processes for the purpose indicated in point 1. a) of this Title:

i. Voice recording
Questions and comments made by the Data Subject on +36 80 888 222 will be recorded for the purpose of answering the question, investigating the comment and quality assurance.

ii. Last name / First name
The processing of this personal data is necessary for the purpose of identifying the Data Subject.

iii. Mobile phone number
The processing of this personal data is necessary for the purpose of contacting the Data Subject.

iv. E-mail address
It is stored for the purpose of contacting the Data Subject.

v. Consumer identifier
The Data Controller processes this data for the purpose of identifying the consumer in the System.

vi. Date of Birth
Considering that the Data Controller does not wish to communicate with individuals under the age of 18 who do not have an interested or consumer profile in the System – except in cases where it is required by law – it is necessary for the Data Subject to provide and for the Data Controller to process this data.

vii. Other personal data provided by the consumer
Any other personal data provided by the Data Subject during the telephone call or in e-mail. Personal data (first name, last name, mobile phone number, e-mail address, e-mail subject, message) provided by the Data Subject in the “Contact Us” marked electronic form on the website.

b, The personal data that the Data Controller processes for the purpose indicated in point 1. b) of this Title:

i. Name of the consumer
ii. Consumer’s address
iii. Place, time and method of presenting the complaint
iv. Detailed description of the consumer's complaint
v. Signature of the person taking the record
vi. The consumer's signature on the record
vii. In the case of a verbal complaint communicated by telephone or using other electronic communication services, the unique identification number of the complaint
viii. Response to the consumer's complaint
ix. Voice recording of the conversation with the consumer
x. Consumer identifier
xi. Device codentify code
xii. Consumer’s mobile phone number
xiii. Consumer’s e-mail address

The processing of personal data specified in points i-viii. is carried out on the legal basis of fulfilling the legal obligation specified in point 3. b) of this Title and the processing of personal data defined in points ix-xiii. is carried out on the legal basis of the legitimate interest defined in point 3. b) of this Title.

c, The personal data that the Data Controller processes for the purpose indicated in point 1. c) of this Title:

i. Name of the consumer
ii. Consumer’s address
iii. The name of the movable asset sold
iv. The purchase price of the movable asset sold
v. Data needed to identify the product
vi. The consumer's mobile phone number: in the case of a replacement product, it is processed for the purpose of negotiating the delivery date
vii. Consumer's e-mail address: the protocol and notification related to claim enforcement will be sent to the consumer's e-mail address
viii. Address of the consumer: it is processed for the purpose of determining the regional representative to be appointed to hand over the replacement product.
ix. Voice record about the conversation with the consumer.
x. Consumer identifier
xi. Device codentify code

The processing of personal data specified in points i-v. is carried out on the legal basis of fulfilling the legal obligation defined in point 3. c) of this Title, and the processing of personal data specified in points vi-xi is carried out on the legal basis of the legitimate interests defined in point 3. c) of this Title.

d, The personal data that the Data Controller processes for the purpose indicated in point 1. d) of this Title:

Condition of hearing loss
In the case of a hearing-impaired consumer, the purpose of processing special personal data related to hearing loss is for the Data Controller to use written communication (e-mail or other text message) instead of outgoing phone calls.

e, The personal data processed by the Data Controller for the purposes specified in point 1. e) of this Title: data related to the replacement of the sticks (name of the replaced product, number of pieces, date of product replacement).

6. Duration of data storage

According to the provisions of Title II.A.6.6. of these Terms and Conditions of Use.

7. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during this data processing:

1. MONOLITH Advanced Internet Solutions LTD
the data processing company operating the registration interface

2. Konecta Hungary Kft.
the company operating the customer service

1. General purpose of data processing

1. Reception and analysis of consumer opinions supplied on questionnaires and in the course of communication by phone in respect of consumer experience with the device and consumer support provided by consumer support expert present at the premises of a contracted partner, in order to improve device quality and the quality of related services.

2. Reception of consumer opinions supplied on questionnaires and in the course of communication by phone, in order to increase consumer satisfaction and to turn rejecting consumers into supportive consumers based on feedback; in case of negative opinions supplied by consumers, identification of problems and reconciliation of opinions with consumers, and proposals for solution if possible.

2. Data Subjects of data processing

Those registered consumers who fill in the electronic questionnaire to provide their opinions on the device and on the expert support, and who supply answers of evaluation by phone.

3. Legal basis for data processing

Data processing is carried out on the legal basis defined in Article 6 (1) (f) of the GDPR, i.e. in the legitimate interest of the Data Controller. Legitimate interest of the Data Controller: to understand market processes in order to improve the device, the offer, the related services and the customer service; to understand the behaviours of consumers and potential consumers, as well as to understand consumer preferences in order to improve the quality of services and to increase consumer satisfaction.

4. Consequence of failure to provide data

The Data Controller is unable to take into consideration the Data Subject’s opinion in respect of the development of the device and related services; the Data Subject loses the opportunity, in case of negative opinions supplied by consumers, for the identification of problems, reconciliation of opinions, and proposals for solution with consumers.

5. Purpose of the personal data processed and the processing of individual data

Full name: consumer identification

Consumer identifier: consumer identification

Mobile phone number: contact and reconciliation of consumer opinions

E-mail address: contact

Scores given by consumer: getting to know the Data Subject’s opinion on the device and related services so that, in case of negative opinions supplied by consumers, the identification of problems and reconciliation of opinions with consumers can be carried out.

Consumer opinions supplied in reply to open questions on the questionnaire: getting to know the Data Subject’s opinion on the device and related services, as well as sticks for the devices, as well as nicotine pouches so that, in case of negative opinions supplied by consumers, the identification of problems and reconciliation of opinions with consumers can be carried out.

Opinions by registered consumers about the device and in relation to the services provided in connection therewith (e.g. whether they would recommend the product to someone else, provided that they answer the questions posed).

Consumer opinions supplied in the course of subsequent communication by phone: getting to know the Data Subject’s opinion on the device and related services, as well as sticks for the devices, as well as nicotine pouches so that, in case of negative opinions supplied by consumers, the identification of problems and reconciliation of opinions with consumers can be carried out.

Opinions by registered consumers about the device and in relation to the services provided in connection therewith (e.g. whether they would recommend the product to someone else, provided that they answer the questions posed).

6. Duration of data storage

In the case of data provided on the questionnaire:
Mobile phone numbers and e-mail addresses are stored for 7 calendar days from the date of collection.
The Controller maintains a connection between the opinion provided by the consumer and the identification data of the given consumer for 1 year by pseudonymisation; afterwards, the Controller cancels such connection, as a result of which the opinion provided by the consumer will become anonymous, i. e. it will cease to be considered as personal data.

Consumer opinions supplied in the course of subsequent communication by phone:
The data is processed until the consumer profile is deleted.

7. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during this data processing:

1. Kantar – generates an NPS opinion survey link; provides a web-based connection for collecting consumer opinions; stores consumers’ NPS opinions and the results of NPS telephone conversations on its own servers in Germany; makes consumer opinions available to the Controller’s competent staff.

2. MONOLITH Advanced Internet Solutions LTD the data processing company operating the registration interface

3. Konecta Hungary Kft. the company operating the customer service

1. General purpose of data processing

Activities related to the surrender of a device, receipt of a device, contract of sale and transfer of the price of the device.

2. Data Subjects of data processing

Registered consumers who initiate the buyback of the device within 14 (in case of devices with heating blade) or 30 (in case of devices without heating blade) days of purchase.

3. Legal basis for data processing

Processing is carried out on the legal basis set out in Article 6 (1) b) of the GDPR, i.e. the processing is necessary for the performance of a contract to which the Data Subject is a party.

4. Consequence of failure to provide data

The device buyback will not be processed.

5. Purpose of the personal data processed and the processing of individual data

Full name: consumer identification

Address: contact

Bank account number: required to make a purchase price refund

Unique device identification code: allows the device to be identified

Mobile phone number: contact

E-mail address: contact

All other personal data that the consumer shares during communication.

6. Duration of data storage

10 years from the date of buyback of the device

7. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during this data processing:

1. Konecta Hungary Kft.
the company operating the customer service

2. A service company involved in coordination, contact, activities, administration and other transaction of affairs related to the surrender of the buyback device, whose registered office is in Hungary.

3. erLab Hungary Kft., company participating in the buyback of the devices

1. General purpose of data processing

In the case of type(s) of device unilaterally selected by the Data Controller in the national tobacco shops operating in the geographical area(s) unilaterally selected by the data controller, a special device purchase offer is given for the given consumer if a purchase intention expressed which includes a discounted price, and if the consumer is not registered in the System. The condition for using the discounted price is the completion of costumer and device registration. The Data Controller may limit the number of devices that can be purchased using the discounted price. The Data Controller is entitled to unilaterally determine the discounted price. Before giving the consumer the opportunity to purchase at a discounted price, it is being checked in the System, whether the consumer is not registered in the System, because a registered consumer cannot use the discounted price. The primary purpose of data processing is to help verify whether the consumer is registered in the System.

2. Data Subjects of data processing

All those who wish to take advantage of the opportunity to purchase a device at a discounted price, and whose registration status is checked in the System.

3. Legal basis for data processing

Processing is carried out on the legal basis set out in Article 6 (1) b) of the GDPR, i.e. the processing is necessary for the performance of a contract to which the Data Subject is a party.

4. Purpose of the personal data processed and the processing of individual data

Mobile phone number
This data is used to verify that the consumer really does not have registration and is entitled to the option of purchasing the device at a discounted price, considering that the Data Controller offers the discounted price only to consumers who are not registered in the System.

Last name
This data is used to verify that the consumer really does not have registration and is entitled to the option of purchasing the device at a discounted price, considering that the Data Controller offers the discounted price only to consumers who are not registered in the System.

First name This data is used to verify that the consumer really does not have registration and is entitled to the option of purchasing the device at a discounted price, considering that the Data Controller offers the discounted price only to consumers who are not registered in the System.

5. Duration of data storage

The data will only be processed during the registration (or lack of the registration) verification process.

6. Relationship between failure to disclose data and statutory warranty rights

In the event of failure to disclose data, the Data Subject will not be entitled to purchase the device at a discounted price.

7. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during this data processing:

Tobacco retailers, who carry out the registration (or lack of registration) check.

1. General purpose of data processing

For registered Data Subjects service development and understanding of consumer behavior, for device CLUB member Data Subjects provision of more personalized services, service development and understanding of consumer behavior.

2. Data Subjects of data processing

Registered Data Subjects and device CLUB member Data Subjects who answered the questions asked by the Data Controller.

3. Legal basis for data processing

The legal basis for the processing is the legal basis set out in Article 6(1)f) of the GDPR, i.e. the legitimate interest of the Controller. The legitimate interest of the Controller is as follows: service development, understanding of consumer behavior, provision of more personalized services for Data Subjects.

4. Purpose of the personal data processed and the processing of individual data

Last name
It is necessary to process this personal data for the purpose of identifying the Data Subject.

First name
It is necessary to process this personal data for the purpose of identifying the Data Subject.

Consumer identifier
The Data Controller processes this data for the purpose of identifying the consumer in the System.

Answers given by the Consumer to the Data Controller's questions
The purpose of processing this data is to improve the service, understand consumer behavior, and provide more personalized services to Data Subjects.

5. Duration of data storage

In the case of a non-device CLUB member, until the Data Subject's registration is cancelled, in the case of a device CLUB member, until the Data Subject’s device CLUB membership is terminated. If the Club membership of the Data Subject is terminated, the data processing shall be carried out according to Title II.A.1. until their registration is deleted.

6. Relationship between failure to disclose data and statutory warranty rights

The consequence of not providing data is that the responses of the Data Subject are not used for the purpose of improving the services and, in the case of device CLUB members, they cannot benefit from more personalized services.

7. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during the data processing indicated in this data processing policy:

1. MONOLITH Advanced Internet Solutions LTD the data processing company operating the registration interface

2. Konecta Hungary Kft. the company operating the customer service

1. General purpose of data processing

Article 5 (2) of the GDPR (principle of accountability) is the confirmation by the Data Controller that the Data Controller has acted in accordance with the applicable data protection legislation in connection with the Data Subject request submitted by the Data Subject regarding the audio recording of the telephone conversation between the Data Controller's customer service employee and the Data Subject. .

2. Data Subjects of data processing

Consumers who submit the Data Subject application described in point 1. of this Title.

3. Legal basis for data processing

The legal basis for the processing is the legal basis set out in Article 6 (1) f) of the GDPR, i.e. the legitimate interest of the Data Controller. The legitimate interest of the Data Controller is as follows: on the basis of Article 5 (2) of the GDPR (principle of accountability), proof of data controller compliance with data protection legal provisions.

4. Purpose of the personal data processed and the processing of individual data

Audio recordings
The data controller handles the audio recording containing the data subject's request and the audio recording affected by the data subject's request in connection with the data subject's request.

Last name
It is necessary to process this personal data for the purpose of identifying and contacting the Data Subject.

First name
It is necessary to process this personal data for the purpose of identifying and contacting the Data Subject.

E-mail address
It is necessary to process this personal data for the purpose of identifying and contacting the Data Subject. The Data Controller sends the Data Subject the password to open the audio recording affected by the data subject's request and the file containing the audio recording in separate e-mails to the Data Subject's e-mail address.

5. Duration of data storage

The Data Controller processes the personal data for the purpose of data management defined in this Title for 1 year from the submission of the data subject's request.

6. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during this data processing:

1. MONOLITH Advanced Internet Solutions LTD
the data processing company operating the registration interface.

2. Konecta Hungary Kft.
the company operating the customer service.

3. Associate companies belonging to the PMI group of companies partner companies participating in the international assistance program and handling the request of the Data Subject

1. General purpose of data processing

Assessing the product preferences of Data Subjects and sending product information to them.

2. Data Subjects of data processing

Device Club members.

3. Legal basis for data processing

The legal basis for the processing is the legal basis set out in Article 6 (1) f) of the GDPR, i.e. the legitimate interest of the Controller. The legitimate interest of the Controller is as follows: providing information that best meets consumer needs.

4. Consequence of failure to provide data

In case of failure to provide data, the Data Controller will not be in a position to provide Data Subjects with information according to their preferences.

5. Purpose of the personal data processed and the processing of individual data

Personal data relating to device CLUB membership
For the purpose of identifying the Data Subject.

The Data Subject's product preference
The data is processed for the purpose of assessing consumer needs.

Last name
It is necessary to process this personal data for the purpose of identifying the Data Subject.

First name
It is necessary to process this personal data for the purpose of identifying the Data Subject.

E-mail address
The data is processed for the purpose of communication with the Data Subject.

6. Duration of data storage

The personal data will be deleted in the manner and time specified in Title II.A,1.

7. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during this data processing:

1. MONOLITH Advanced Internet Solutions LTD
the data processing company operating the registration interface.

2.Konecta Hungary Kft.
the company operating the customer service.

3. Tobacco retailers,
they can contribute to the assessment of consumer preferences.

1. General purpose of data processing

Personal support by representatives of the Data Controller for the registration of Data Subjects in the System (typically during a personal meeting in a national tobacco shop), who do not yet have a device, but are requesting support in registering as an interested party, or already have a device distributed by the Data Controller, but their registration in the System has not yet been completed. The Data Subject can receive a gift for registration.

2. Data Subjects of data processing

Interested parties who do not yet have a device, but request support in registering as interested parties, and consumers who already own a device distributed by the Data Controller, but have not yet registered in the System.

3. Legal basis for data processing

The processing of personal data is based on the legal basis set out Article 6 (1) a) of the GDPR, i.e. on the basis of the Data Subject's consent. The Data Subject has the right to revoke the consent he/she has given at any time without conditions or restrictions by sending a written statement to the e-mail address indicated in the General Part of this document.

4. Consequence of failure to provide data

In the case of a consumer Data Subject with a device: the Data Subject and their device will not be registered, and because of that the Data Subject will not be entitled to the additional services provided by the Data Controller in relation to the accessory warranty and product support information and the right of withdrawal described in Title IIA.1. of this document.

In the case of an intender Data Subject who does not have a device: the Data Subject will not receive the information referred to in point II.A.1.1. b), will not be entitled to the discounted device purchase mentioned there, and will not be entitled to provide feedback, furthermore, since the registration will not be completed, the Data Subject shall not be entitled to the gift associated with the registration

5. The processing of individual data

The data indicated in Title II.A.1. of this document in connection with the registration, as well as – in the case of Data Subjects who do not yet possess a device but request assistance in connection with their inclusion in the prospect (interested persons) registry –

the consumer's name, address, telephone number and e-mail address, for the purpose of delivering the gift provided for registration and related communication.

6. Duration of data storage

The data is stored for the period specified in Title II.A.1. of this document.

7. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during the data processing indicated in this data processing policy:

MONOLITH Advanced Internet Solutions LTD the data processing company operating the registration interface

1. General purpose of data processing

Identification and authentication of the consumer in cases where the fulfillment of consumer requests requires personal data already managed by the Data Controller (for example: product replacement, buyback, questions related to data management, complaints).

2. Data Subjects of data processing

Consumers who are registered in the System and registered consumers who are also members of the device Club.

3. Legal basis for data processing

The legal basis for the processing is the legal basis set out in Article 6 (1) (f) of the GDPR, i.e. the legitimate interest of the Data Controller. The legitimate interest of the Data Controller is as follows: avoiding personal data being shared with unauthorized persons and ensuring that data protection rules are fully complied with.

4. Consequence of failure to provide data

The Data Subject's request will not be fulfilled.

5. The processing of individual data

Full name, address, registered e-mail address, date of birth, registered telephone number, interaction with the consumer (recorded in writing on the consumer's profile), identification code of the device (stick case and heater), data related to product replacement (name and number of replaced sticks, date of product replacement) color and type of the registered device, number of registered devices, the fact whether the Data Subject receives electronic letters about the features, use and effects of the products.

6. Duration of data storage

The data is stored for the period specified in Title II.A.1. of this document.

7. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during this data processing:

MONOLITH Advanced Internet Solutions LTD the data processing company operating the registration interface

1. General purpose of data processing

Keeping contact with the person using the livechat service in order to provide reactive information (provided in response to consumer questions) about the Data Controller's products, consumer support and to raise the level of the services provided by the Data Controller, to ensure a personalized service.

2. Data Subjects of data processing

Adult smokers who use the Twilio livechat service.

3. Legal basis for data processing

The processing of personal data is based on the legal basis set out Article 6 (1) a) of the GDPR, i.e. on the basis of the Data Subject's consent. The Data Subject has the right to revoke the consent they has given at any time without conditions or restrictions by sending a written statement to the e-mail address indicated in the General Part of this document.

4. Consequence of failure to provide data

The Data Controller cannot communicate with the Data Subject with appropriate content.

5. The processing of individual data

Personal data uploaded by the Data Subject when using the Twilio livechat service (e.g. personal data mentioned in the written text, personal data in the uploaded attachment).

6. Duration of data storage

The data will be processed until the date of deletion at the request of the Data Subject.

7. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during this data processing:

Twilio Inc. (375 Beale Street, Suite 300, San Francisco, CA 94105, USA) the provider operating the livechat service

Data transfer guarantee:
IMPLEMENTING DECISION OF THE COMMISSION (10/07/2023) according to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data provided by the EU-US data protection framework, and Commission Implementing Decision (EU) 2021/914 (June 4, 2021) based on the general contractual terms and conditions for the transfer of personal data concluded with the data processor (SCC '21)

1. General purpose of data processing

The Data Controller requests, collects and stores feedback from device CLUB members about its employees in the positions of commercial area representative, commercial training representative, commercial relations expert, key account expert and consumer relations representative (hereinafter: " regional representatives as well as temporary workers employed by it (the hereinafter, employees and temporary employees together: employees) in relation to their activities in national tobacco shops, other locations, or using a telecommunications device. The purpose of the data management is to identify the consumer who gave the feedback, as well as to preserve and improve the quality of the information services provided by the Data Controller to device CLUB members, as well as to evaluate the work of the regional representatives and to differentiate their remuneration based on the performance achieved by the employee and its evaluation.

2. The nature, significance and possible legal consequences of data processing

The topics of the feedback are: the communication style, flexibility and efficiency of the regional representative in relation to the transfer of information, as well as the representative's preparedness.

Forms of feedback: online questionnaire and telephone discussion. As a general rule, the feedback is provided by the required choice of answers, as well as free-text justification.

Taking the feedback and evaluations into account, the Data Controller can differentially determine the amount of basic salary increases and benefits other than the basic salary that can be given to the employees, in the case of blatantly negative feedback, adverse legal consequences may be applied by the Data Controller, including a written warning and termination of employment.

3. The source of the data, the feedback providers

Device CLUB members giving feedback.

4. Data Subjects of data processing

Device CLUB members giving feedback.

5. Legal basis for data processing

The legal basis for the processing is the legal basis set out in Article 6 (1) f) of the GDPR, i.e. the legitimate interest of the Data Controller. The legitimate interest of the Data Controller is as follows: to ensure the adequate quality services for device CLUB members, for retailers and their employees, the development of services, the encouragement of the employees of the Data Controller to provide services at an appropriate level, and to increase the quality of services.

6. The processing of individual data

The full name, e-mail address, consumer ID of the consumer giving the feedback, the content of the feedback and the evaluation by the data controller of the relationship to the feedback and the topic of the feedback, as well as the audio recording of the telephone conversation between the consumer and the Data Controller.

7. Persons with access to personal data

Personal data is only processed by the manager of the evaluated employee, the employees of the Smoke-free Products (SFP) team dealing with consumer communication, the employees of the People & Culture department who manage the performance evaluation process and the disciplinary procedure process, and in the case of temporary employees, the employees of the labor hire company who work in the personnel area they can access, which the Data Controller provides with the help of IT tools, through access management.

8. Duration of data storage

3 years from the termination of employment of the employee affected by the feedback.

9. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during this data processing:

MONOLITH Advanced Internet Solutions LTD the data processing company operating the registration interface.

Konecta Hungary Kft. the company operating the customer service and storing audio recordings of customer service conversations.

1. General purpose of data processing

Providing access to the use of the IQOS application for registered consumers detailed in Title II.A.1.

2. Data Subjects of data processing

Registered consumers who enter the application can also consent to the processing of additional data when starting or continuing to use the application.

3. Legal basis for data processing

In the case of the consumer's e-mail address, mobile phone number and registered password the processing is carried out on the legal basis set out in Article 6 (1) b) of the GDPR, i.e. the processing is necessary for the performance of a contract to which the Data Subject is a party.
In the case of other referenced personal data the data processing is carried out on the legal basis set out in Article 6 (1) a) of the GDPR, i.e. it is based on the consent given by the Data Subject in the Preference Center of the application, which consent can be revoked at any time in the Preference Center.

4. Consequence of failure to provide data

The Data Subject will not be able to use the services provided by the application, which include: updating the firmware of the device, adding new features to the device, correcting some errors.

5. Purpose of the personal data processed and the processing of individual data

E-mail address: consumer identification
Mobile phone number: consumer identification
Registered password: consumer identification

Device geolocation data: providing support to the consumer in order to find the device
Device usage data: providing consumers with information about their consumption habits
Evaluation of the application by the consumer: application development

6. Duration of data storage

The consumer can enter the application with her registered data as long as the registered profile detailed in Title II.A.1. exists in the System.

The device's geolocation data is processed by the data controller until the device is found.

The device usage data is processed by the Data Controller for 3 months from the date of their recording.

7. Transfer of personal data, data processors, description of their services

In the course of the processing described in this privacy notice, the Controller uses the services of the following processors:

MONOLITH Advanced Internet Solutions LTD
the data processor operating the registration interface

Google
information about Google Analytics can be found in the Preference Center of the application.

Amplitude
information about Amplitude Analytics can be found in the Preference Center of the application.

8. Preference Center

Regarding the data processing conditions related to the application that are not described in this Detailed Privacy Notice, the information in the application's Preference Center is the governing document.

1. General purpose of data processing

For the benefit of and for the registered users detailed in Title II.A.1.

a) providing consumer support in connection with the use of the device (device diagnostics, firmware update, fulfillment of other consumer support requests)

b) product and service development based on data and error messages related to device usage habits.

2. Data Subjects of data processing

a) Registered consumers who use the service, and
b) the person providing consumer support (employee of the Data Controller)

3. Legal basis for data processing

The legal basis for the processing is the legal basis set out in Article 6 (1) f) of the GDPR, i.e. the legitimate interest of the Data Controller. The legitimate interest of the Data Controller is that the consumers can use the device in the right way, so that they are as satisfied as possible with the device.

4. Consequence of failure to provide data

In the case of a Data Subject defined in point 2.
a) of this Title, the Data Subject is unable to use the services provided by the application, in the case of a Data Subject defined in point 2.
b) of this Title, the Data Subject cannot fulfill his obligations related to work.

5. Purpose of the personal data processed and the processing of individual data

a) In the case of a Data Subject defined in point a) of the Data Management section, (i) the serial number of the charging case and heater affected by the services, the version number of the firmware running on the charging case, the version number of the heater firmware, the unique identification code of the charging case, the unique identification code of the heater, (ii) the cycle number of the charging case, the cycle number of the heater, consumption data (number of charges consumed, number of sniffs)
b) In the case of a Data Subject defined in point b) of the section Data subjects, the person's name, IP address, manufacturer and type of IT device to which the product is connected, e-mail address and login password.

6. Other data

During the period of connection of the device, the application stores data related to possible malfunctions of the device, as well as the technical data of the device, but the Data Subject cannot be identified based on these.

7. Duration of data storage

The purpose of processing personal data and individual data is the personal data defined in point a) point (ii) and in the case of personal data defined in point b) during the period of connecting the device to a smartphone, tablet or laptop, the personal data defined in point a) point (i) in this case, it lasts until the user profile (consumer registration) is deleted.

8. Transfer of personal data, data processors, description of their services

The Data Controller does not use the services of data processors during this data processing.

1. General purpose of data processing

The general purpose of this data processing activity is to make product information (hereinafter referred to as "information") specified in Government Decree No. 43/2025 (hereinafter referred to in this Title as "decree") about the characteristics, use, and effects of the devices and related products (hereinafter referred to in this Title as "products")  available via electronic mail (e-mail) to registered consumers who explicitly request it, in accordance with the provisions of the decree.

2. Data Subjects of data processing

Registered consumers with the Data Controller according to this Chapter A who explicitly request, in accordance with the provisions of the decree, that the Data Controller make the product information available to them via electronic mail (email).

3. Legal basis for data processing

The execution of data processing for the data specified in point 4.1 of this Title is based on the legal basis defined in Article 6(1)(a) of the GDPR, i.e., the consent given by the data subject. For the data specified in points 4.2-4.7 of this Title, the legal basis is defined in Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the Data Controller. The legitimate interest of the Data Controller is to deliver the information to the data subject efficiently and without delay.

The Data Subject has the right to withdraw their consent at any time. The withdrawal of consent does not affect the lawfulness of data processing based on consent before its withdrawal.

4. Purpose of the personal data processed and the processing of individual data

1. Email address
This personal data is processed by the Data Controller to make the information available to the Data Subject via email.

2. Last name and first name
This personal data is processed by the Data Controller to identify the Data Subject and to address them properly in the email.

3. Time of email opening
This personal data is processed by the Data Controller to initiate a personal consultation between the Data Subject and the Data Controller's representative at a suitable national tobacco shop if the Data Subject has not opened the information e-mail for an extended period, and to arrange the meeting.

4. Mobile phone number
This personal data is processed by the Data Controller to initiate a personal consultation between the Data Subject and the Data Controller's representative at a suitable national tobacco shop if the Data Subject has not opened the information e-mail for an extended period, and to arrange the meeting.

5. Consumer ID
This data is processed by the Data Controller to identify the consumer in the System.

6. Contact language (Hungarian or English)
This data is processed by the Data Controller to use the language preferred by the consumer during communication.

7. Data on the Data Subject's interaction regarding electronic mails and newsletters sent

The Data Controller monitors with the help of the used electronic mail system whether Data Subjects open and the type of product information e-mails sent to them and whether they click on the link(s) found in them, whether they filled out the questionnaire in the email and how much time elapses between the time the e-mail was sent and the time of opening the e-mail or clicking on the internet link(s) that may be found in them,  for the purpose of improving the effectiveness of fulfilling the contractual obligation to send out information, improving the quality of this service, in particular by updating the managed product information electronic mail addresses as necessary. The Data Controller also manages the data on whether the Data Subject has unsubscribed from the newsletters.

5. Duration of data storage

The data will be processed for the purpose related to this data processing activity until the Data Subject withdraws their previously given consent.

6. Relationship between the failure to provide data and statutory warranty rights

If the data is not provided, the Data Subject will not have access to the information via email.

7. Transfer of personal data, data processors, description of their services

The Data Controller does not use a data processor during this data processing.

‍Description and overview of the data processing activity

Description and overview of the data processing activity

The age verification process applied by the Data Controller in the course of the data subject’s registration on the website is as follows:

Successful registration on the website is conditional upon the satisfactory completion of the age verification procedure. The age verification constitutes a legal obligation incumbent upon the Data Controller. The purpose of this process is to ensure that any data subject who has not attained the age of 18 is prevented from successfully registering in the System and, consequently, from obtaining product-related information via the website.

The age verification procedure is initiated by an automated process. Following the Data Subject’s initiation of registration on the website, the Data Controller, as a first step, engages the automated, facial age-estimation technology and application developed by the data processor (Yoti Ltd.) for the purpose of verifying the Data Subject’s age on the basis of an electronic facial image (e.g., a “selfie”) captured by means of an image-recording device. This artificial intelligence–based solution operates a neural network trained to analyze an individual’s facial image and to estimate and verify the person’s age without the need for physical identity document verification or human intervention.

The accuracy rate of the application’s age verification varies between 96.31% and 99.96%, depending on the age group to which the individual depicted in the image belongs. In the event that the Data Subject considers that the application has erroneously estimated their age to be below the threshold required for registration, thereby preventing the Data Controller and its System from permitting successful registration, the Data Subject may request the assistance of the Data Controller’s customer support service. In such cases, age verification shall subsequently be carried out by the customer support service via a live video connection, during which the Data Subject shall present their identification documents for the purpose of verifying their age.

The technology has been designed in compliance with the principle of “data protection by design” as set out in Article 25 of the GDPR.

The application does not enable the identification of a natural person and is not suitable for drawing any further inferences or generating additional information relating to the user.

The solution ensures data minimization, as the estimation of age requires solely a single facial image.

The image captured is not stored on the Data Controller’s local device, rather, it is transmitted via an encrypted data connection (TLS 1.2) to the data processor’s back-end system, which is currently located in the United Kingdom.

Upon completion of the automated age verification process, the image is immediately and permanently deleted, and no further processing, disclosure, reuse, or sale of the data takes place. The application does not store, share, reuse, or otherwise make the facial image accessible to the Data Controller, the data processor, or their respective employees. Similarly, neither the facial image nor any data contained in the identification document is recorded during the customer service–assisted, manual age verification procedure.

Although the automated age verification process involves the processing of a facial image, the technology does not qualify as biometric data processing within the meaning of the GDPR, as it is neither suitable for the unique identification or authentication of natural persons nor deployed for such purposes. The sole purpose of the processing is the probabilistic estimation of age, which does not entail identification. This interpretation has also been confirmed by the United Kingdom’s supervisory authority, the Information Commissioner's Office (ICO).

The operation of the application and the associated data processing practices are subject to regular review independent external audits conducted in accordance with the SOC 2 and PAS 1296 standards.

The signed agreements concluded with the data processor, together with their respective annexes, contain detailed provisions governing data protection, confidentiality, incident management, and liability.

The data processor has submitted its ISO/IEC 27001 certification and its SOC 2 Type 2 report, which substantiate, with respect to the data processor, compliance with applicable information security and data protection requirements.

The privacy notice relating to the automated age verification application provided by Yoti Ltd. is available here, and detailed information in English regarding the Yoti age verification application may be accessed here.

Should you have any questions, please do not hesitate to contact us using the contact details set out in point 2. of General Part, preferably via the e-mail address specified therein.

1. General purpose of data processing

In accordance with the provisions of Government Decree No. 43/2025 (III. 13.) on the special rules for the description and presentation of certain products sold in tobacco shops (with particular regard to Section 5(1) and Section 8(3)), it must be ensured that individuals under the age of 18 cannot successfully register on the website, and that any product description process, presentation, display method, or any fact, data, or information derived from it does not become accessible to minors or other unauthorized persons.

2. Data Subjects of data processing

Data Subjects initiating registration on the website.

3. Legal basis for data processing

The execution of data processing is based on the legal basis defined in Article 6(1)(a) of the GDPR, i.e., the consent given by the Data Subject. The Data Subject has the right to withdraw their consent at any time. The withdrawal of consent does not affect the lawfulness of data processing based on consent before its withdrawal.

4. Relationship between the failure to provide data and statutory warranty rights

If the Data Subject does not provide a facial image, they will not be able to complete the registration on the website.

5. Purpose of the personal data processed and the processing of individual data

Processed personal data: the data subject's facial image, the purpose of its processing is described in point 1. of this Title.

6. Duration of data storage

The facial image is processed only during the automated age verification process (a few seconds), and the image is immediately deleted after the process is completed.

7. Transfer of personal data, data processors, description of their services

The Data Controller uses the services provided by the following data processor during this data processing:
Yoti Ltd, registered office: 6th Floor, 107 Leadenhall St, London, EC3A 4AF, United Kingdom, registration number: 0899895, which operates the automated age verification system described in the introductory part of this Title.

1. General purpose of data processing

a) In the case of consumer complaints, the possibility of sending a gift to our complaining consumers for compensation purposes, if they accept it.

b) Proof of sending the compensatory gift to the tax authority for accounting purposes.

2. Data Subjects of data processing

Consumers who accept a gift for compensatory purposes.

3. Legal basis for data processing

Data processing is carried out

a) on the legal basis set out in Article 6(1)(b) of the GDPR, i.e. the processing is necessary for the performance of a contract to which the Data Subject is a party.

b) on the legal basis specified in Article 6 (1) f) of the GDPR, i.e. on the basis of the legitimate interest of the Data Controller. Indication of the legitimate interest of the Data Controller: proof of accounting compliance.

4. Consequence of failure to provide data

In case of failure to provide data, the Data Controller will not be able to send a gift to the consumer.

5. The personal data processed and the purpose of the processing of individual data

a, Personal data that the Data Controller processes for the purposes specified in point 1. a) of this Title:

Last name

The data is processed for the purpose of identifying the Data Subject.

First name

The data is processed for the purpose of identifying the Data Subject.

Address

The data is processed for the purpose of delivering the gift to the Data Subject.

Phone number

The data is processed for the purpose of maintaining contact during the delivery of the gift to the Data Subject.

Subject and characteristics of the compensation gift

The data is processed for the purpose of selecting the compensation gift.

b, Personal data that the Data Controller processes for the purposes specified in point 1. b) of this Title:

Last name

The data is processed for the purpose of certifying the sending of the compensatory gift to the tax authority for accounting purposes.

First name

The data is processed for the purpose of certifying the sending of the compensatory gift to the tax authority for accounting purposes.

Date of sending the gift

The data is processed for the purpose of certifying the sending of the compensatory gift to the tax authority for accounting purposes.

Subject and characteristics of the compensatory gift

The data is processed for the purpose of certifying the sending of the compensatory gift to the tax authority for accounting purposes.

6. Duration of data storage

In the case of data processing for the purposes specified in point 1. a) of this Title, 30 days after the sending of the compensatory gift.

In the case of data processing for the purposes specified in point 1. b) of this Title, 8 years.

7. Transfer of personal data, data processors and description of their services

In the course of this data processing, the Data Controller uses the services of the following data processors:

1. MONOLITH Advanced Internet Solutions LTD is the data processor operating the registration interface

2. Konecta Hungary Kft. is the company operating the customer service

3. The company carrying out the delivery of the compensatory gift, which has its registered office in Hungary.

1. General purpose of data processing

The purpose of the data processing is to enable the Data Controller, in the event of the consumer’s registration on the website, to fulfill the contract concerning the provision of product information via the website, as well as the facilitation of feedback submitted by the consumer, for the benefit of the Data Subjects.

2. Data Subjects of data processing

The Data Subjects of the data processing are those consumers who elect to register – whether through the website, in person at a national tobacco shop, or by means of a video consultation with the assistance of the Data Controller’s customer service – for the purpose of availing themselves of the product information service available on the website (which becomes immediately accessible upon registration), as well as the opportunity to provide consumer feedback.

3. Legal basis for data processing

Processing is carried out – in the absence of any provision to the contrary in this Title – on the legal basis set out in Article 6 (1) b) of the GDPR, i.e. the processing is necessary for the performance of a contract to which the Data Subject is a party.

4. Purpose of the personal data processed and the processing of individual data

Mobile phone number
The mobile phone number is processed for the purposes below: as a first step in registration, it is necessary to provide this personal data by the Data Subject in order to avoid multiple registration. The consumer will also receive a unique identification code via SMS before performing operations requiring consumer identification. Instead of entering the password the registered consumer can request a one-time verification code to enter the profile on the website, the code will be sent via SMS to the registered mobile phone number.

Simultaneously with registration, a user profile is automatically created for the Data Subject in the System which profile allows the Data Subject to view the product information content available only to registered Data Subjects on the website. The mobile number (or e-mail address) is required in addition to the password generated by the Data Subject and known only to the Data Subject in order for the Data Subject to access the website and view product information content. In the event that the Data Subject has forgotten their password, they may request the System to reset the password associated with the profile.

The Data Controller also processes this personal data for the purpose of organizing a personal meeting requested by the Data Subject between the Data Subject and the Data Controller’s representative present at the national tobacco store.

The Data Controller shall also process this personal data for the purpose of soliciting feedback.

Last name
The processing of such personal data is necessary for the purpose of identifying the Data Subject as the contracting party who has entered into an agreement with the Data Controller for the provision of product information via the website and for the submission of feedback.

First name
The processing of this personal data is required for the purpose of identifying the Data Subject in their capacity as the contracting party having concluded an agreement with the Data Controller for the provision of product information via the website and for the submission of feedback.

Consumer identifier
The Controller processes this data in order to identify the consumer in the System.

E-mail address

The e-mail address is processed for the following purposes:

Registered Data Subjects will receive automatic system messages to the e-mail address provided during registration.
By using the e-mail address with a password, Data Subjects can access the website, reset their password and change their telephone number. The registered consumer can login also with a one-time verification code, which is sent to the registered e-mail address via e-mail.

The mobile phone number and e-mail address are alternatives to each other in the operations described. For example, Data Subjects can access the website with either the registered e-mail address and a password (or with a one-time code), or a mobile phone number (in the case of logging in this way, by entering the date of birth) and with a one-time code. In case of the validation of a warranty claim, Data Subjects will also receive the related minutes and notifications to their e-mail address.

The Data Controller also processes the Data Subject's e-mail address for the purpose of informing the Data Subject about changes in the Terms of Use and the relevant circumstances of the processing of personal data in accordance with data protection legislation. For this purpose, the Data Controller processes this personal data on the basis of the legitimate interest of the Data Controller to be able to comply with data protection legislation (Article 6(1)(f) of the GDPR).

The Data Controller shall also process this personal data for the purpose of soliciting feedback.

Date of birth
Date of birth as personal data shall be processed for the following purposes:

1. considering that only persons who have reached the age of 18 may register under the Terms and Conditions of Use and the relevant legislation, the date of birth must be provided by the Data Subject and processed by the Controller in order to verify this circumstance,

2. on the other hand, the Controller prepares cumulative reports and analyses in order to improve the quality of its services to an even more appropriate level for consumers, and in the course of this data processing activity it also processes the birth date constituting the consumer's personal data for the purpose indicated herein.

3. and in the event that the Data Subject intends to log in to their profile using their mobile phone number, they must provide their birth data, which data is processed by the Data Controller for the purpose of preventing an unauthorized person from entering their profile,

4. the Data Controller also processes this personal data for the purpose of verifying by the System whether the Data Subject already has a profile in the System by registering on one website, and if so, to make the process of registration on the other website more convenient and faster for the Data Subject.

Address zip code
The address zip code of the Data Subject is managed by the Controller to develop and enhance services for consumers, the Controller shall take into account the address zip code of the consumers and be able to send geographically segmented messages to consumers based on their zip code.

Smoking and nicotine-containing product user condition
Based on the Terms and Conditions of Use, only persons who already smoke or use a nicotine-containing product can register, as the nicotine pouch has also been developed for adults who already smoke or using a nicotine-containing product, so this data of the Data Subject is processed by the Controller in order to check compliance with the Terms and Conditions of Use.

Registration date of consumers in the System
The Data Controller processes this personal data in order to ensure a more personalized contact.

Customer service tasks related to the consumer
The Data Controller processes this personal data in order to ensure a more personalized contact.

The image and voice of the consumer will be processed during the period of registration within the framework of the video chat, with the video chat being preceded by an automated, face-based age verification (Yoti) during the registration initiated on the website, which, if it does not lead to a result or at the initiative of the Data Subject, if the Data Subject is not satisfied with the result of the verification, is followed by a human age verification by the customer service administrator, which takes place within the framework of a video chat between the Data Subject and the administrator and a personal document-based data verification, provided that and voice in the context of a video call, only audio recording is made, and the handling of this audio recording as personal data is governed by the provisions set out in Title II.B.4. The provisions of Title II.B.16. shall apply to the data processing activities of the Data Controller related to the automated, facial-based age verification of the Data Subject's age.

Content of the personal conversation between the Data Subject and the representative

The Data Controller records relevant information on the Data Subject's product consumption, product use, and the topics discussed based on the conversation between the Data Subject and the Data Controller's representative on the registered profile of the Data Subject referred to in point II.B.1.2. The data processing related to these data serves exclusively to ensure the personalized nature of the communication with the Data Subject.

Language of communication (Hungarian or English):

The Data Controller processes this data to use the language (Hungarian or English) that is most suitable for the consumer during communication.

Response of the Data Subject to a product usage question

The answer provided by the Data Subject, during registration, to the question posed by the Data Controller regarding product usage shall be processed by the Data Controller on the legal basis set forth in Article 6(1)(f) of the GDPR, namely, the legitimate interest of the Data Controller, which consists of providing the consumer with personalized product information and product support.

The fact of the gift granted for providing consumer feedback, the subject matter of the consumer feedback, voucher number 

• The Controller shall record the subject matter of the consumer feedback and the fact of granting a gift in return for such feedback, in cases where, based on the Controller’s unilateral decision, a gift (typically a voucher) is provided to the Data Subject for giving the feedback. In the case of a gift voucher, the Controller shall also record its number. If the Controller provides a gift to the Data Subject for giving feedback, it shall do so only once for the same Data Subject in relation to the same subject matter.

• The Controller processes the personal data specified herein on the legal basis set out in Article 6(1)(f) of the GDPR, namely on the basis of the Controller’s legitimate interest. This legitimate interest is the appropriate tracking of the provision of gifts in order to prevent multiple gifting, specifically to determine whether the Data Subject has already received a gift for providing feedback on the given subject matter.

5. Duration of data storage

The data processing between the parties is based on the duration of the contract for the additional services outlined above (i.e. the period between registration and cancellation of registration). In the event that the Data Subject deletes their registration, such deletion shall entail the erasure of their personal data, i.e. also the deletion of their user profile, save for the circumstance where the consumer has also registered on the website referred to in Chapter II.A. In the latter case, the consumer’s profile shall be retained, and the Data Controller shall continue to process the consumer’s personal data in accordance with the provisions set out in Chapter II.A.

In case a registered Data Subject is inactive with respect to the data processing activities carried out pursuant to both Chapter II.A. and Chapter II.B. for 3 years, their registration will be deleted.

In the event that a registered Data Subject remains inactive for a period of 3 consecutive years, such inactivity being defined as not logging into the website (and, where applicable, not logging into the website referred to in Chapter II.A. during the same period), not contacting the Data Controller’s Customer Service or its customer support specialists, not updating their consumer profile, and not opening any email(s) sent to them by it, their profile shall be deleted.

6. Consequence of failure to provide data

In case of failure in the provision of the required data, the Data Subject shall not be able to complete the registration process on the website.

7. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during this data processing:

1. MONOLITH Advanced Internet Solutions LTD the data processing company operating the registration interface
2. Konecta Hungary Kft. the company operating the customer service
3. Erlab Hungary Kft service provider operating a backup system in the case of a failure of the System
4. Tobacco retailers if assistance is provided in in the registration to the Data Subject at the express request of the Data Subject.

5. Microsoft Corporation: feedback provided by Data Subjects to representatives is provided by MS Forms, which is provided by the designated company.

1. General purpose of data processing

The purpose of data processing is for the Data Controller to delete from System the mobile phone number that, due to its inaccuracy or change, cannot be linked to the registered consumer whose profile contains the given mobile phone number.

2. Data Subjects of data processing

Consumer who has a profile in the System as a result of registration indicated in Title II.B.1.

3. Legal basis for data processing

The legal basis for the processing is the legal basis set out in Article 6 (1) f) of the GDPR, i.e. the legitimate interest of the Controller. The legitimate interest of the Controller is as follows: compliance with point d) of Article 5 (1) of the GDPR (principle for data accuracy) and storing only accurate and up-to-date personal data in the System of the Data Controller.

4. Purpose of the personal data processed and the processing of individual data

Registered incorrect phone number
In the event that the Data Controller determines that the mobile phone number assigned to the profile of a particular Data Subject is incorrect, i.e. cannot be linked to the Data Subject (which may be due to e.g. a typo or a change in the Data Subject's mobile phone number in the meantime in such a way that the Data Subject does not reflect the change on his/her profile does not transfer, etc.), the Data Controller deletes the incorrect mobile phone number from the Data Subject's profile.

Correct mobile phone number
If the Data Subject provides the correct mobile phone number linked to the Data Subject, it will be stored in the Data Subject's profile.

Last name
The processing of this personal data is necessary for the purpose of contacting the Data Subject via e-mail.

First name
The processing of this personal data is necessary for the purpose of contacting the Data Subject via e-mail.

E-mail address
If an incorrect mobile phone number is detected, the Data Controller sends an e-mail to the Data Subject asking the Data Subject to enter the correct mobile phone number.

5. Duration of data storage

The duration of data storage is the same as the conditions and periods specified in point II.B.1.5. of these Terms and Conditions of Use.

6. Consequence of failure to provide data

In the event that the Data Subject does not provide the Data Controller with the correct mobile phone number, communication with the Data Controller will be limited, as the Data Controller will not be able to reach the Data Subject via mobile phone calls, the Data Subject will not be able to access his/her profile using the mobile phone number, and basic functions become unavailable to the Data Subject.

7. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during this data processing:

1. MONOLITH Advanced Internet Solutions LTD the data processing company operating the registration interface

2. Konecta Hungary Kft. the company operating the customer service

1. General purpose of data processing

To analyze data in order to understand consumers and in connection with business initiatives, issues and product development, and to understand consumer habits.

2. Data Subjects of data processing

Consumers registered to the website

3. Legal basis for data processing

The legal basis for the processing is the legal basis set out in Article 6(1)f) of the GDPR, i.e. the legitimate interest of the Controller. The legitimate interest of the Controller is as follows: to offer and develop goods and services that best satisfy the needs of consumers.

4. Purpose of the personal data processed and the processing of individual data

In the event that data are not provided, the data that a consumer does not intend to provide will not be used for business analytics purposes.

5. The personal data processed and the purpose of the processing of the respective data

For registered consumers, the personal data specified in Title II.B.1.

6. Data retention period

The personal data used are deleted in the manner and at the time specified in Titles II.B.1.

7. Transfer of personal data, data processors, description of their services

In the course of this processing, the Controller uses the services of the following processors:

1.MONOLITH Advanced Internet Solutions LTD
the data processor operating the registration interface

2. Microsoft Corporation
the entity storing the underlying data of PowerBI in a cloud

3. Sii Sp. z o.o.

IT development and support partner, which performs development and data processing tasks related to the database

1. General purpose of data processing

a) Answering consumers' questions, fulfilling your requests, supporting your registration in the System, customer support, service development, efficiency measurement and planning, investigating their comments, general communication with consumers,
b) handling consumers’ complaint,
c) manage consumers’ warranty claims.
d) In the case of a hearing-impaired consumer, the purpose of processing special personal data related to hearing loss is for the Data Controller to use written communication (e-mail or other text message) instead of outgoing phone calls.

2. Data Subjects of data processing

Consumers.

3. Legal basis for data processing

a) In the course of data processing for the purpose indicated in point 1. a) of this Title, data processing is carried out on the legal basis specified in point f) of Article 6 (1) of the GDPR, i.e. on the basis of the legitimate interest of the Data Controller, which legitimate interest is the effective and high-level support of consumers.

b) In the course of data processing for the purpose specified in point 1. b) of this Title, the data processing is carried out on the one hand on the legal basis specified in Article 6 paragraph (1) point b) of the GDPR, i.e. in order to fulfill the legal obligation of the Data Controller, the CLV of 1997 on consumer protection Act 17/A. § (5) and (7), on the other hand, it takes place on the legal basis defined in Article 6 (1) point f) of the GDPR, i.e. on the basis of the legitimate interest of the Data Controller, which legitimate interest is to facilitate the proof and defense of consumer claims. On the individual legal bases of data management see also those contained in this point 5 of this Title.

c) In the case of data processing for the purposes specified in point 1. c) of this Title, the data processing is carried out on the one hand on the legal basis specified in Article 6 (1) point b) of the GDPR, i.e. in order to fulfill the legal obligation of the Data Controller and 19/2014 on the procedural rules for handling warranty claims (IV. 29.) on the basis of Section 4(1) and Section 6(1) of the NGM Decree, on the other hand on the legal basis defined in Article 6(1)(f) of the GDPR, i.e. the legitimate interest of the Data Controller takes place on the basis of which is a legitimate interest in the efficient and high-level fulfillment of consumers' warranty needs. On the individual legal bases of data management see also those contained in point 5 of this Title.

d) Data processing specified in point 1. d) of this Title, i.e. in the case of a hearing-impaired consumer, the processing of special personal data related to hearing loss is based on the legal basis set out Article 6 (1) a) of the GDPR and the exemption condition set out in Article 9 (2) a) of the GDPR based on the express consent of the Data Subject.

4. Consequence of failure to provide data

The Controller does not become aware of the issue, claim validation or complaint and thus cannot provide information or take appropriate steps in connection with the event.

5. Purpose of the personal data processed and the processing of individual data

a, The personal data that the Data Controller manages for the purpose indicated in point 1. a) of this Title:

i. Voice recording
Questions and comments made by the Data Subject on 06 80 880 500 will be recorded for the purpose of answering the question, investigating the comment and quality assurance.

ii. Last name / First name
The processing of this personal data is necessary for the purpose of identifying the Data Subject.

iii. Mobile phone number
The processing of this personal data is necessary for the purpose of contacting the Data Subject.

iv. E-mail address
It is stored for the purpose of contacting the Data Subject.

v. Consumer identifier
The Data Controller processes this data for the purpose of identifying the consumer in the System in the case of a request from a registered consumer regarding nicotine pouches.


vi. Other personal data

In the case of registered consumers:

•  Registration date of consumers in the System

•  Preliminary communications with the consumer (e.g. topics, e-mail communication),

•  the support used by the consumer in the premises of a contracted partner or at another location from the customer support expert, the description of which is recorded in the System,

•  The opinion of the registered consumer regarding the nicotine pouch and related services (e.g. would you recommend the product to others if you answer the asked questions),

•  Data on the Data Subject's interaction regarding e-mails and electronic letters sent: The Data Controller monitors with the help of the used electronic mail system whether Data Subjects open the electronic letters and informative emails sent to them and whether they click on the link(s) found in them for the purpose of improving the effectiveness of fulfilling the contractual obligation to send out information (electronic letters), improving the quality of this service, in particular by updating the managed e-mail addresses as necessary. The Data Controller also manages the data on whether the Data Subject has unsubscribed from the electronic letters.

•  Answers recorded during telephone and e-mail inquiries of consumers concerning their consumption habits, their use of the website, newsletters, and their experiences with the product:
The purpose of data processing is to improve the quality of the Data Controller's services.

•  Customer service tasks related to the consumer
The Data Controller processes this personal data in order to ensure a more personalized contact.

•  Consumer's attitude towards phone calls: this personal data is created on the basis of the operator's assessment based on the operator's phone conversation with the Data Subject, the purpose of data management is to improve the quality of the Data Controller's services.

vii. Other personal data provided by the consumer
Any other personal data provided by the Data Subject during the telephone call or in e-mail.

Language of communication (Hungarian or English):
The Data Controller processes this data to use the language (Hungarian or English) that is most suitable for the consumer during communication.

b, The personal data that the Data Controller manages for the purpose indicated in point 1. b) of this Title:

i. Name of the consumer
ii. Consumer’s address
iii. Place, time and method of presenting the complaint
iv. Detailed description of the consumer's complaint
v. Signature of the person taking the record
vi. The consumer's signature on the record
vii. In the case of a verbal complaint communicated by telephone or using other electronic communication services, the unique identification number of the complaint
viii. Response to the consumer's complaint
ix. Voice recording of the conversation with the consumer in connection with their complaint
x. Consumer identifier
xi. Unique identification data and number of devices assigned to the consumer
xii. Consumer’s mobile phone number
xiii. Consumer’s e-mail address

The processing of personal data specified in points i-viii.   is carried out on the legal basis of fulfilling the legal obligation specified in point 3. b) of this Title and the processing of personal data specified in points ix-xiii.  Is carried out on the legal basis of the legitimate interest defined in point 3. b) of this Title.

c, The personal data that the Data Controller manages for the purpose indicated in point1. c) of this Title:

i. Name of the consumer
ii. Consumer’s address
iii. The name of the movable asset sold
iv. The purchase price of the movable asset sold
v. Data needed to identify the product
vi. The consumer's mobile phone number: in the case of a replacement product, it is processed for the purpose of negotiating the delivery date
vii. Consumer's e-mail address: the protocol and notification related to claim enforcement will be sent to the consumer's e-mail address
viii. Address of the consumer:: it is processed for the purpose of determining the regional representative to be appointed to hand over the replacement product.
ix. Voice record about the conversation with the consumer.
x. Consumer identifier

The processing of personal data specified in points i-v. is carried out on the legal basis of fulfilling the legal obligation defined in point 3. c) of this Title, and the processing of personal data specified in points vi-x is carried out on the legal basis of the legitimate interests defined in point 3. c) of this Title.

d, The personal data that the Data Controller processes for the purpose indicated in point 1. d) of this Title:

Condition of hearing loss
In the case of a hearing-impaired consumer, the purpose of processing special personal data related to hearing loss is for the Data Controller to use written communication (e-mail or other text message) instead of outgoing phone calls.

6. Duration of data storage

Data Subjects can provide their personal data by e-mail or by voice message provided via phone. In the case of a voice message, as a general rule 3 months from the date of the message, complaint, in case of enforcement of a disputed warranty claim by the Data Controller 5 years from the date of the recording of the voice message.

In the case of communication by e-mail the retention period is 3 months from the date of origin of the e-mail in case of communication not considered as a complaint, and 5 years from the date of origin of the e-mail in case of a complaint.

In case of handling a warranty claim, the retention period of personal data entered in the records is 3 years from drawing up such records.

In case of handling a complaint, the retention period of personal data entered in the records is 5 years from drawing up such records.

The Data Controller considers any communication from the customer (regardless of its form or medium) as a complaint, in which the customer makes a specific complaint, and/or in which the client refers to the possible initiation of a conciliation board, official, or court proceeding, refers to a claim for compensation, health damage, deterioration of health, or the use of a legal representative.

In the case of initiating conciliation body, official or judicial procedure the Data Controller processes the data for 6 months from the final conclusion of the procedure or, in case of recourse to an extraordinary legal remedy procedure, until its completion, which period (due to the possible prolongation of the procedures) may exceed 5 years from the date of creation of the data.

7. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during this data processing:

1. MONOLITH Advanced Internet Solutions LTD
the data processing company operating the registration interface

2. Erlab Hungary Kft service provider operating a backup system in the case of a failure of the System

3. Konecta Hungary Kft.
the company operating the customer service

1. General purpose of data processing

a) Answering consumer questions, providing customer support, service development, efficiency measurement and planning, investigating consumer comments, general communication with consumers,
b) handling consumer complaints,
c) handling consumer warranty claims,
d) in case of a hearing-impaired consumer, the purpose of processing special personal data related to hearing loss is for the Data Controller to use written communication (e-mail or other text message) instead of outgoing phone calls,

e) in the case of data processed in connection with the product replacement, the Data Controller aims to prevent misuse.

2. Data Subjects of data processing

The consumer specified in Title II.B.1. of these Terms and Conditions of Use who does not have a profile in the System, i.e. is not a registered consumer.

3. Legal basis for data processing

a) In the course of data processing for the purpose indicated in point 1. a) of this Title, data processing is carried out on the legal basis specified in Article 6 (1) f) of the GDPR, i.e. on the basis of the legitimate interest of the Data Controller, which legitimate interest is effective and high-level support of consumers, appropriate product use and satisfaction with the services and the product.

b) In the course of data processing for the purpose specified in point 1. b) of this Title, the data processing is carried out on the one hand on the legal basis specified in Article 6 paragraph (1) point b) of the GDPR, i.e. in order to fulfill the legal obligation of the Data Controller, the CLV of 1997 on consumer protection Act 17/A. § (5) and (7), on the other hand, it takes place on the legal basis defined in Article 6 (1) point f) of the GDPR, i.e. on the basis of the legitimate interest of the Data Controller, which legitimate interest is supporting proof and defense related to consumer needs. On the individual legal bases of data processing see in point 5 of this Title.

c) In the case of data processing for the purposes specified in point 1. c) of this Title, the data processing is carried out on the one hand on the legal basis specified in Article 6 (1) point b) of the GDPR, i.e. in order to fulfill the legal obligation of the Data Controller and 19/2014 on the procedural rules for handling warranty claims (IV. 29.) on the basis of Section 4(1) and Section 6(1) of the NGM Decree, on the other hand on the legal basis defined in Article 6(1)(f) of the GDPR, i.e. the legitimate interest of the Data Controller takes place on the basis of which is a legitimate interest in the efficient and high-level fulfillment of consumers' warranty needs. On the individual legal bases of data processing see in point 5 of this Title.

d) Data processing specified in point 1. d) of this Title, i.e. in the case of a hearing-impaired consumer, the processing of special personal data related to hearing loss is based on the legal basis set out Article 6 (1) a) of the GDPR and the exemption condition set out in Article 9 (2) a) of the GDPR based on the express consent of the Data Subject.

e) In the case of data processing for the purposes specified in point 1. e) of this Title, the data processing is carried out on the legal basis specified in Article 6 (1) f) of the GDPR, i.e. on the basis of the legitimate interest of the Data Controller, which is the legitimate interest of preventing misuse of the nicotine pouches.

4. Consequence of failure to provide data

The Controller does not become aware of the issue, claim validation or complaint and thus cannot provide information or take appropriate steps in connection with the event.

5. Purpose of the personal data processed and the processing of individual data

a, The personal data that the Data Controller processes for the purpose indicated in point 1. a) of this Title:

i. Voice recording
Questions and comments made by the Data Subject on +36 80 880 500 or +36 80 888 222 will be recorded for the purpose of answering the question, investigating the comment and quality assurance.

ii. Last name / First name
The processing of this personal data is necessary for the purpose of identifying the Data Subject.

iii. Mobile phone number
The processing of this personal data is necessary for the purpose of contacting the Data Subject.

iv. E-mail address
It is stored for the purpose of contacting the Data Subject.

v. Consumer identifier
The Data Controller processes this data for the purpose of identifying the consumer in the System.

vi. Date of Birth
Considering that the Data Controller does not wish to communicate with individuals under the age of 18 who do not have an interested or consumer profile in the System – except in cases where it is required by law – it is necessary for the Data Subject to provide and for the Data Controller to process this data.

vii. Other personal data provided by the consumer
Any other personal data provided by the Data Subject during the telephone call or in e-mail.

b, The personal data that the Data Controller processes for the purpose indicated in point 1. b) of this Title:

i. Name of the consumer
ii. Consumer’s address
iii. Place, time and method of presenting the complaint
iv. Detailed description of the consumer's complaint
v. Signature of the person taking the record
vi. The consumer's signature on the record
vii. In the case of a verbal complaint communicated by telephone or using other electronic communication services, the unique identification number of the complaint
viii. Response to the consumer's complaint
ix. Voice recording of the conversation with the consumer
x. Consumer identifier
xi. Consumer’s mobile phone number
xii. Consumer’s e-mail address

The processing of personal data specified in points i-viii. is carried out on the legal basis of fulfilling the legal obligation specified in point 3. c) of this Title and the processing of personal data defined in points ix-xii. is carried out on the legal basis of the legitimate interest defined in point 3. c) of this Title.

c, The personal data that the Data Controller processes for the purpose indicated in point 1. c) of this Title:

i. Name of the consumer
ii. Consumer’s address
iii. The name of the movable asset sold
iv. The purchase price of the movable asset sold
v. Data needed to identify the product
vi. The consumer's mobile phone number: in the case of a replacement product, it is processed for the purpose of negotiating the delivery date
vii. Consumer's e-mail address: the protocol and notification related to claim enforcement will be sent to the consumer's e-mail address
viii. Address of the consumer: it is processed for the purpose of determining the regional representative to be appointed to hand over the replacement product.
ix. Voice record about the conversation with the consumer.
x. Consumer identifier

The processing of personal data specified in points i-v. is carried out on the legal basis of fulfilling the legal obligation defined in point 3. c) of this Title, and the processing of personal data specified in points vi-x is carried out on the legal basis of the legitimate interests defined in point 3. c) of this Title.

d, The personal data that the Data Controller processes for the purpose indicated in point 1. d) of this Title:

Condition of hearing loss
In the case of a hearing-impaired consumer, the purpose of processing special personal data related to hearing loss is for the Data Controller to use written communication (e-mail or other text message) instead of outgoing phone calls.

e, The personal data processed by the Data Controller for the purposes specified in point 1. e) of this Title: data related to the replacement of the product (name of the replaced product, number of pieces, date of product replacement).

6. Duration of data storage

According to the provisions of Title II.B.4.6. of these Terms and Conditions of Use.

7. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during this data processing:

1. MONOLITH Advanced Internet Solutions LTD
the data processing company operating the registration interface

2. Konecta Hungary Kft.
the company operating the customer service

1. General purpose of data processing

Article 5 (2) of the GDPR (principle of accountability) is the confirmation by the Data Controller that the Data Controller has acted in accordance with the applicable data protection legislation in connection with the Data Subject request submitted by the Data Subject regarding the audio recording of the Data Subject’s voice message.

2. Data Subjects of data processing

Consumers who submit the Data Subject application described in point 1. of this Title.

3. Legal basis for data processing

The legal basis for the processing is the legal basis set out in Article 6 (1) f) of the GDPR, i.e. the legitimate interest of the Data Controller. The legitimate interest of the Data Controller is as follows: on the basis of Article 5 (2) of the GDPR (principle of accountability), proof of data controller compliance with data protection legal provisions.

4. Purpose of the personal data processed and the processing of individual data

Audio recordings
The data controller handles the audio recording containing the data subject's request and the audio recording affected by the data subject's request in connection with the data subject's request.

Last name
It is necessary to process this personal data for the purpose of identifying and contacting the Data Subject.

First name
It is necessary to process this personal data for the purpose of identifying and contacting the Data Subject.

E-mail address
It is necessary to process this personal data for the purpose of identifying and contacting the Data Subject. The Data Controller sends the Data Subject the password to open the audio recording affected by the data subject's request and the file containing the audio recording in separate e-mails to the Data Subject's e-mail address.

5. Duration of data storage

The Data Controller processes the personal data for the purpose of data management defined in this Title for 5 years from the submission of the data subject's request.

6. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during this data processing:

1. MONOLITH Advanced Internet Solutions LTD
the data processing company operating the registration interface.

1. General purpose of data processing

Assessing the product preferences of Data Subjects and sending product information to them.

2. Data Subjects of data processing

Consumers who registered on the website.

3. Legal basis for data processing

The legal basis for the processing is the legal basis set out in Article 6 (1) f) of the GDPR, i.e. the legitimate interest of the Controller. The legitimate interest of the Controller is as follows: providing information that best meets consumer needs.

4. Consequence of failure to provide data

In case of failure to provide data, the Data Controller will not be in a position to provide Data Subjects with information according to their preferences.

5. Purpose of the personal data processed and the processing of individual data

Personal data relating to registration to the website
For the purpose of identifying the Data Subject.

The Data Subject's product preference
The data is processed for the purpose of assessing consumer needs.

Last name
It is necessary to process this personal data for the purpose of identifying the Data Subject.

First name
It is necessary to process this personal data for the purpose of identifying the Data Subject.

E-mail address
The data is processed for the purpose of communication with the Data Subject.

6. Duration of data storage

The personal data will be deleted in the manner and time specified in Title II.B.1.

7. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during this data processing:

1. MONOLITH Advanced Internet Solutions LTD
the data processing company operating the registration interface.

2.Konecta Hungary Kft.
the company operating the customer service.

3. Tobacco retailers,
they can contribute to the assessment of consumer preferences.

1. General purpose of data processing

Personal support by representatives of the Data Controller for the registration of Data Subjects in the System (typically during a personal meeting in a national tobacco shop), who do not yet have a registration to the website, but are requesting support in registering. The Data Subject can receive a gift for registration.

2. Data Subjects of data processing

Interested parties who do not yet have a registration to the website, but request support in registering.

3. Legal basis for data processing

The processing of personal data is based on the legal basis set out Article 6 (1) a) of the GDPR, i.e. on the basis of the Data Subject's consent. The Data Subject has the right to revoke the consent he/she has given at any time without conditions or restrictions by sending a written statement to the e-mail address indicated in the General Part of this document.

4. Consequence of failure to provide data

In the case of an intender Data Subject: the Data Subject will not receive the product information referred to in point II.B.1.1., and will not be entitled to provide feedback.

5. The processing of individual data

The data indicated in Title II.B.1. of this document in connection with the registration, as well as the consumer's name, address, telephone number and e-mail address, for the purpose of delivering the gift provided for registration and related communication to the Data Subject.

6. Duration of data storage

The data is stored for the period specified in Title II.B.1. of this document.

7. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during the data processing indicated in this data processing policy:

MONOLITH Advanced Internet Solutions LTD the data processing company operating the registration interface

1. General purpose of data processing

Identification and authentication of the consumer in cases where the fulfillment of consumer requests requires personal data already managed by the Data Controller (for example: product replacement, questions related to data management, complaints).

2. Data Subjects of data processing

Consumers who are registered to the website in the System.

3. Legal basis for data processing

The legal basis for the processing is the legal basis set out in Article 6 (1) (f) of the GDPR, i.e. the legitimate interest of the Data Controller. The legitimate interest of the Data Controller is as follows: avoiding personal data being shared with unauthorized persons and ensuring that data protection rules are fully complied with, as well as for the purpose of preventing any abuse in connection with product replacement.

4. Consequence of failure to provide data

The Data Subject's request will not be fulfilled.

5. The processing of individual data

Full name, address, registered e-mail address, date of birth, registered telephone number, interaction with the consumer (recorded in writing on the consumer's profile), , data related to product replacement (name and number of replaced products, date of product replacement), the fact whether the Data Subject receives electronic letters about the features, use and effects of the products.

6. Duration of data storage

The data is stored for the period specified in Title II.B.1. of this document.

7. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during this data processing:

MONOLITH Advanced Internet Solutions LTD the data processing company operating the registration interface

1. General purpose of data processing

The Data Controller requests, collects and stores feedback from registered consumers about its employees in the positions of commercial area representative, commercial training representative, commercial relations expert, key account expert and consumer relations representative (hereinafter: " regional representatives as well as temporary workers employed by it (the hereinafter, employees and temporary employees together: employees) in relation to their activities in national tobacco shops, other locations, or using a telecommunications device. The purpose of the data management is to identify the consumer who gave the feedback, as well as to preserve and improve the quality of the product information services provided by the Data Controller to registered consumers, as well as to evaluate the work of the regional representatives and to differentiate their remuneration based on the performance achieved by the employee and its evaluation.

2. The nature, significance and possible legal consequences of data processing

The topics of the feedback are: the communication style, flexibility and efficiency of the regional representative in relation to the transfer of information, as well as the representative's preparedness.

Forms of feedback: online questionnaire and telephone discussion. As a general rule, the feedback is provided by the required choice of answers, as well as free-text justification.

Taking the feedback and evaluations into account, the Data Controller can differentially determine the amount of basic salary increases and benefits other than the basic salary that can be given to the employees, in the case of blatantly negative feedback, adverse legal consequences may be applied by the Data Controller, including a written warning and termination of employment.

3. The source of the data, the feedback providers

Registered consumers giving feedback.

4. Data Subjects of data processing

registered consumers giving feedback.

5. Legal basis for data processing

The legal basis for the processing is the legal basis set out in Article 6 (1) f) of the GDPR, i.e. the legitimate interest of the Data Controller. The legitimate interest of the Data Controller is as follows: to ensure the adequate quality services for registered consumers, for retailers and their employees, the development of services, the encouragement of the employees of the Data Controller to provide services at an appropriate level, and to increase the quality of services.

6. The processing of individual data

The full name, e-mail address, consumer ID of the consumer giving the feedback, the content of the feedback and the evaluation by the data controller of the relationship to the feedback and the topic of the feedback, as well as the audio recording of the telephone conversation between the consumer and the Data Controller and the voice message provided via telephone.

7. Persons with access to personal data

Personal data is only processed by the manager of the evaluated employee, the employees of the Smoke-free Products (SFP) team dealing with consumer communication, the employees of the People & Culture department who manage the performance evaluation process and the disciplinary procedure process, and in the case of temporary employees, the employees of the labor hire company who work in the personnel area they can access, which the Data Controller provides with the help of IT tools, through access management.

8. Duration of data storage

3 years from the termination of employment of the employee affected by the feedback.

9. Transfer of personal data, data processors, description of their services

The Controller uses the services of the following data processors during this data processing:

MONOLITH Advanced Internet Solutions LTD the data processing company operating the registration interface.

Konecta Hungary Kft. the company operating the customer service and storing audio recordings of customer service conversations.

1. General purpose of data processing

The general purpose of this data processing activity is to make product information (hereinafter referred to as "information") specified in Government Decree No. 43/2025 (hereinafter referred to in this Title as "decree") about the characteristics, use, and effects of the nicotine pouch products (hereinafter referred to in this Title as "products")  available via electronic mail (e-mail) to registered consumers who explicitly request it, in accordance with the provisions of the decree.

2. Data Subjects of data processing

Registered consumers who explicitly request, in accordance with the provisions of the decree, that the Data Controller make the product information available to them via electronic mail (email).

3. Legal basis for data processing

The execution of data processing for the data specified in point 4.1 of this Title is based on the legal basis defined in Article 6(1)(a) of the GDPR, i.e., the consent given by the data subject. For the data specified in points 4.2-4.7 of this Title, the legal basis is defined in Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the Data Controller. The legitimate interest of the Data Controller is to deliver the information to the data subject efficiently and without delay.

The Data Subject has the right to withdraw their consent at any time. The withdrawal of consent does not affect the lawfulness of data processing based on consent before its withdrawal.

4. Purpose of the personal data processed and the processing of individual data

1. Email address
This personal data is processed by the Data Controller to make the information available to the Data Subject via email.

2. Last name and first name
This personal data is processed by the Data Controller to identify the Data Subject and to address them properly in the email.

3. Time of email opening
This personal data is processed by the Data Controller to initiate a personal consultation between the Data Subject and the Data Controller's representative at a suitable national tobacco shop if the Data Subject has not opened the information e-mail for an extended period, and to arrange the meeting.

4. Mobile phone number
This personal data is processed by the Data Controller to initiate a personal consultation between the Data Subject and the Data Controller's representative at a suitable national tobacco shop if the Data Subject has not opened the information e-mail for an extended period, and to arrange the meeting.

5. Consumer ID
This data is processed by the Data Controller to identify the consumer in the System.

6. Contact language (Hungarian or English)
This data is processed by the Data Controller to use the language preferred by the consumer during communication.

7. Data on the Data Subject's interaction regarding electronic mails and newsletters sent

The Data Controller monitors with the help of the used electronic mail system whether Data Subjects open and the type of product information e-mails sent to them and whether they click on the link(s) found in them, whether they filled out the questionnaire in the email, and how much time elapses between the time the e-mail was sent and the time of opening the e-mail or clicking on the internet link(s) that may be found in them,  for the purpose of improving the effectiveness of fulfilling the contractual obligation to send out information, improving the quality of this service, in particular by updating the managed product information electronic mail addresses as necessary. The Data Controller also manages the data on whether the Data Subject has unsubscribed from the newsletters.

5. Duration of data storage

The data will be processed for the purpose related to this data processing activity until the Data Subject withdraws their previously given consent.

6. Relationship between the failure to provide data and statutory warranty rights

If the data is not provided, the Data Subject will not have access to the information via email.

7. Transfer of personal data, data processors, description of their services

The Data Controller does not use a data processor during this data processing.

‍Description and overview of the data processing activity

Description and overview of the data processing activity

The age verification process applied by the Data Controller in the course of the data subject’s registration on the website is as follows:

Successful registration on the website is conditional upon the satisfactory completion of the age verification procedure. The age verification constitutes a legal obligation incumbent upon the Data Controller. The purpose of this process is to ensure that any data subject who has not attained the age of 18 is prevented from successfully registering in the System and, consequently, from obtaining product-related information via the website.

The age verification procedure is initiated by an automated process. Following the Data Subject’s initiation of registration on the website, the Data Controller, as a first step, engages the automated, facial age-estimation technology and application developed by the data processor (Yoti Ltd.) for the purpose of verifying the Data Subject’s age on the basis of an electronic facial image (e.g., a “selfie”) captured by means of an image-recording device. This artificial intelligence–based solution operates a neural network trained to analyze an individual’s facial image and to estimate and verify the person’s age without the need for physical identity document verification or human intervention.

The accuracy rate of the application’s age verification varies between 96.31% and 99.96%, depending on the age group to which the individual depicted in the image belongs. In the event that the Data Subject considers that the application has erroneously estimated their age to be below the threshold required for registration, thereby preventing the Data Controller and its System from permitting successful registration, the Data Subject may request the assistance of the Data Controller’s customer support service. In such cases, age verification shall subsequently be carried out by the customer support service via a live video connection, during which the Data Subject shall present their identification documents for the purpose of verifying their age.

The technology has been designed in compliance with the principle of “data protection by design” as set out in Article 25 of the GDPR.

The application does not enable the identification of a natural person and is not suitable for drawing any further inferences or generating additional information relating to the user.

The solution ensures data minimization, as the estimation of age requires solely a single facial image.

The image captured is not stored on the Data Controller’s local device, rather, it is transmitted via an encrypted data connection (TLS 1.2) to the data processor’s back-end system, which is currently located in the United Kingdom.

Upon completion of the automated age verification process, the image is immediately and permanently deleted, and no further processing, disclosure, reuse, or sale of the data takes place. The application does not store, share, reuse, or otherwise make the facial image accessible to the Data Controller, the data processor, or their respective employees. Similarly, neither the facial image nor any data contained in the identification document is recorded during the customer service–assisted, manual age verification procedure.

Although the automated age verification process involves the processing of a facial image, the technology does not qualify as biometric data processing within the meaning of the GDPR, as it is neither suitable for the unique identification or authentication of natural persons nor deployed for such purposes. The sole purpose of the processing is the probabilistic estimation of age, which does not entail identification. This interpretation has also been confirmed by the United Kingdom’s supervisory authority, the Information Commissioner's Office (ICO).

The operation of the application and the associated data processing practices are subject to regular review independent external audits conducted in accordance with the SOC 2 and PAS 1296 standards.

The signed agreements concluded with the data processor, together with their respective annexes, contain detailed provisions governing data protection, confidentiality, incident management, and liability.

The data processor has submitted its ISO/IEC 27001 certification and its SOC 2 Type 2 report, which substantiate, with respect to the data processor, compliance with applicable information security and data protection requirements.

The privacy notice relating to the automated age verification application provided by Yoti Ltd. is available here, and detailed information in English regarding the Yoti age verification application may be accessed here.

Should you have any questions, please do not hesitate to contact us using the contact details set out in point 2. of General Part, preferably via the e-mail address specified therein.

1. General purpose of data processing

In accordance with the provisions of Government Decree No. 43/2025 (III. 13.) on the special rules for the description and presentation of certain products sold in tobacco shops (with particular regard to Section 5(1) and Section 8(3)), it must be ensured that individuals under the age of 18 cannot successfully register on the website, and that any product description process, presentation, display method, or any fact, data, or information derived from it does not become accessible to minors or other unauthorized persons.

2. Data Subjects of data processing

Data Subjects initiating registration on the website.

3. Legal basis for data processing

The execution of data processing is based on the legal basis defined in Article 6(1)(a) of the GDPR, i.e., the consent given by the Data Subject. The Data Subject has the right to withdraw their consent at any time. The withdrawal of consent does not affect the lawfulness of data processing based on consent before its withdrawal.

4. Relationship between the failure to provide data and statutory warranty rights

If the Data Subject does not provide a facial image, they will not be able to complete the registration on the website.

5. Purpose of the personal data processed and the processing of individual data

Processed personal data: the data subject's facial image, the purpose of its processing is described in point 1. of this Title.

6. Duration of data storage

The facial image is processed only during the automated age verification process (a few seconds), and the image is immediately deleted after the process is completed.

7. Transfer of personal data, data processors, description of their services

The Data Controller uses the services provided by the following data processor during this data processing:
Yoti Ltd, registered office: 6th Floor, 107 Leadenhall St, London, EC3A 4AF, United Kingdom, registration number: 0899895, which operates the automated age verification system described in the introductory part of this Title.