Terms of use

The operator of this website is Philip Morris Hungary Ltd. (1085 Budapest, Kálvin tér 12.), a member of Philip Morris International (henceforth: PMI). You use the website on your own responsibility; by using it you accept the Terms and Conditions listed below. We take no responsibility and provide no (express or indirect) guarantee with regard to the website or its use.



The website uses cookies and similar technologies for recording certain user information automatically. In order to learn more about how you can enable or disable cookies, please read our notice about cookies and cookie settings.



The term "tobacco heating device" used in the Terms and Conditions of Use refers to devices which heat tobacco sticks and which are distributed by Philip Morris Hungary Ltd.



The purpose of the website, usage rights



The purpose of the website is to inform smokers above the age of 18, who live in Hungary, about

  • the points of sale of tobacco heating device and its accessories and basic information about device’s technology, and the science and research behind tobacco heating device,
  • the use, operation, technical specifications, troubleshooting, warranty conditions of tobacco heating device, including answers for frequently asked questions,
  • our services related to our tobacco heating devices,
  • to provide adequate information and education for registered users through E-COACH videos and additional product information.



    • To view the restricted contents of the website and the application developed by PMI available only for registered users, a user account has to be set up by registering the consumer and the product through the system provided by Philip Morris Hungary Ltd. (website registration) which requires for application usage a password to be set up on receiving an e-mail notification and requires for website usage a password to be set up or direct access is available with one-time code requested and sent to the registered phone number or e-mail address. Thereafter, the restricted contents of the website will also be available to registered consumers. The tobacco heating device buyer / user can register in the point of sale of the tobacco heating device during the purchase or after it through our Customer Care via phone. Some personal data have to be provided by the buyer/user for registration, which we process in accordance with our Privacy Notice and with the "Protection of your data" section in these Terms and Conditions of Use. It is important that users should provide accurate, complete and up-to-date information when setting up their account. The registered user agree to ensure that the provided data will always be accurate, complete and up-to-date and to inform Philip Morris Hungary Ltd. of any changes therein by modifying profile information in the website or via Customer Care.




    Only those adult smokers are authorized to register and use the website who have bought a tobacco heating device, live in Hungary and have made a statement of being over 18 years old.


    Additional conditions of registration include the acceptance of these Terms and Conditions of Use, acknowledgement of having noted of the Privacy Notice and statement about the given tobacco heating device Club membership and participation in market research.


    Philip Morris Hungary Ltd. reserves the right to monitor the activities below of registered users related to the device and

  • in case of claim for replacement check with a personal / physical inspection that the device is defective and the cause of the defect,
  • limits the number of devices that can be registered to the profile, - either in general or for specific consumers- or draws the consumer's attention to the possibility of the restriction if the number of device registrations to the consumer profile has exceeded the average number of registered devices to consumers.

    • If users fail to meet the above conditions, they cannot register and may not visit the content of the website available only for registered users.



    Registered users shall manage their user name and password enabling login to the website confidentially and inaccessibly to others and if any suspicion arise that these were acquired by an unauthorized person, they shall immediately notify Philip Morris Hungary Ltd. by sending an e-mail to PMHU.GDPR@pmi.com.



    Registered users are responsible for all activities conducted in their accounts, whether or not they are aware of them.



    Registered users are not to use either the password or the account of another person. They may not attempt to make any unauthorized access to the website. In the event that they attempt to do so, or assist others in doing so, or if they distribute any guidance, software or devices to that end, the account will be closed.



    It is possible to transfer the device(s) assigned to the profile of an existing registered user to another profile, this can be initiated by any party, via the website or Customer Service.



    If the registered user passed away and the heir wants to register the device under his/her own name, it can be done based on the instructions of the Customer Service and by filling out the document "Declaration for the registration of the device of the owner of a deceased tobacco heating device".



    If users exchange their device with someone, Customer Service can provide assistance in exchanging the devices by having one or both parties fill in the "Consent to transfer of data" document, so Customer Service can release the contact information of the user who gave the consent to the other party.



    Protection of your data



    We handle the personal data provided by you in the manner described below in our Privacy Policy and in these Terms and Conditions of Use.



    Please note that if a registered user deletes the registered profile (which can be done after login to the profile on the website or through our Customer Care following the necessary identification) Philip Morris Hungary Ltd. does not retain the data or statements needed for creating the profile and the data generated in the course of the website use, so it will not be able to provide such information retroactively after deletion. The personal data related to the registered user's profile will be deleted within 30 days from the profile deletion from all our systems. If you only want to disconnect one of your devices from your profile, do so and do not delete your profile, in this case your profile will remain with the remaining registered device.



    The profile deletion is the consumer’s responsibility if the consumer is no longer a smoker or no longer uses tobacco heating device.



    Other data processing activities related to the consumer, such as business analytical activities, complaints, warranty claim protocols, telephone conversations with customer service, telephone conversations with support and feedback teams, and personal data handled in the context of a personal customer support expert visit are handled, stored and then deleted in accordance with the provisions of the Privacy Policy.



    The profile of the registered user is deleted by Philip Morris Hungary Ltd. - except in the following cases - only at the request of the user:

  • in case of buyback of the registered product - if the user does not register another product - the profile will be deleted after 3 months;
  • or if the registered users with or without tobacco heating device CLUB membership do not log in their profile for 3 years, do not contact our Customer Service team or our customer support experts, do not update their profile, do not register new device to their profile, and do not open any e-mails sent by us, then after 3 inactive years - even if we tried to contact the user in the meantime - the profile will be deleted.
  • or if no device has been registered for a consumer profile for more than 75 days, despite an attempt of being contacted in the meantime.



    • The registered users accept that automatic messages will be sent to the registered e-mail address and will be received by them to ensure the proper provision of information about several steps in relation with their registered tobacco heating device and/or the handling of their user profile (like registration, new password creation, personal data modification, cancellation, etc.).



    The registered users accept that other technical emails what promotes the proper use of the devices will be sent them to their registered email address (for example the importance of software update).



    Detailed data processing information:



    I. GENERAL PART
    Content and purpose of this Privacy Policy This Privacy Policy contains relevant information related to the data processing activities of the Controller, which are the subject of data processing activities, the personal data of consumers (hereinafter collectively referred to as: consumer data processing). The General Part of this consolidated Privacy Policy contains the provisions governing all consumer data processing described in the Special Part, and the Special Part contains the rules applicable to each consumer data processing described therein. For data processing activities not covered by this detailed Privacy Policy, the provisions of the PMI General Consumer Privacy Policy shall apply. The referenced privacy policy and this Terms and Conditions of use can be found at the visited website.
    The Controller Philip Morris Hungary Ltd.
    Address: 1085 Budapest, Kálvin tér 12.

    Phone:+36 80 888 222

    E-mail: PMHU.GDPR@pmi.com
    Rights of the Data Subject Data Subjects are entitled to request the following from the Controller

    1. access to personal data concerning him as a Data Subject,

    2. supplementation, correction, deletion or restriction of the processing of their personal data,

    3. they may object to the processing of their personal data. In this case, the Controller shall not further process such personal data, unless data processing is justified by compelling legitimate reasons which take precedence over the interests, rights and freedoms of the Data Subject or which are related to the submission, enforcement or protection of legal claims.

    „We recommend to use the following form for submitting a request: „https://hu.iqos.com/documents/en/Elektronikus_nyomtatvany_erintetti_joggyakorlas_EN.pdf”, please send the completed form to PMHU.GDPR@pmi.com”



    4. The protection of your data is very important to us, so we ask that if you have any problem with the protection of your data, contact us at one of the following contact details in order to find a satisfactory solution as soon as possible: Phone: +36 80 888 222 E-mail: PMHU.GDPR@pmi.com

    5. The Data Subject has the right to submit a complaint to the supervisory authority (National Authority for Data Protection and Freedom of Information, 1055 Budapest, Falk Miksa utca 9-11., https://naih.hu, telephone number: +36 (1) 391-1400, postal address: 1363 Budapest, Pf. 9., e-mail: ugyfelszolgalat@naih.hu). If the Data Subject is a foreign citizen, they may also submit a complaint to the supervisory authority of their place of residence.


    6. Data Subjects may go to court if their rights are violated. The court shall act with priority in the case. Data protection lawsuits fall within the jurisdiction of the tribunal, which may, at the choice of the Data Subject, be sued in the court of the Data Subject's domicile or residence.

    The Controller informs the owner of the personal data that any person who has suffered pecuniary or non-pecuniary damage as a result of a breach of law is entitled to compensation from the Controller for the damage suffered in accordance with the rules of civil law.

    Before contacting the supervisory authority or the court with your complaint, please contact our Company, if possible, at the e-mail address indicated in The Controller section of this policy.
    Automatic decision making There is no automatic decision making during data processing.
    Nature of reporting The provision of personal data is voluntary.


    II. SPECIAL PART

    II.1. PMHU customer and product registration system / Data processing activities related to tobacco heating device profile registration
    General purpose of data processing The purpose of data processing is to enable the Controller to perform the contract for the provision of additional services to the Data Subjects in connection with product warranty and product support information, as well as the right of withdrawal.
    Data Subjects of data processing Data Subjects of data processing are consumers who purchase a tobacco heating device (hereinafter: device) and who choose to register the device in the Controller's customer and product registration system using a tablet displayed in the national tobacco shop that distributes the device, through the website of the purchased device, or through the Controller's customer service in order to be able to
  • hire additional warranty services and product information support related to the purchase of the device; and
  • exercise the right of withdrawal in the case of an undamaged, complete device.


    • For the purposes of applying this privacy policy, an individual is also considered to be a Data Subject who purchases the device for another individual and also registers the profile with his or her own data.
    Legal basis for data processing Processing is carried out on the legal basis set out in Article 6 (1) b) of the GDPR, i.e. the processing is necessary for the performance of a contract to which the Data Subject is a party.
    Purpose of the personal data processed and the processing of individual data Mobile phone number
    The mobile phone number is used for several purposes. On the one hand, as a first step in registration, it is necessary to provide this personal data by the Data Subject in order to avoid double registration. On the other hand, if the Data Subject requests the replacement of the device, the Controller will perform a (remote) inspection of the product with regard to registration and in case of a favourable assessment of the warranty claim, the Controller will send an SMS containing the replacement code to the Data Subject's mobile phone number. The consumer will also receive a unique identification code via SMS before performing operations requiring consumer identification. Instead of entering the password the registered consumer can request a one-time verification code to enter the profile on the website, the code will be sent via SMS to the registered mobile phone number.
    Simultaneously with registration, a user account is automatically created for the Data Subject for the website of the purchased device (hereinafter: the website), which account allows the Data Subject to view the content available only to registered Data Subjects on the website. The mobile number (or e-mail address) is required in addition to the password generated by the Data Subject and known only to the Data Subject in order for the Data Subject to access the website and view restricted content in the “Products” and “Product Use Videos” menu item. In the event that the Data Subject has forgotten their password, they will receive a one-time code via SMS from the system to their mobile phone number, which will allow them to reset the password required to log in to the website. The registered consumer can login also with a one-time verification code, which is sent to the registered mobile phone number via SMS.

    Last name
    It is necessary to process this personal data for the purpose of identifying the Data Subject as a contracting party to the Controller in order to be entitled to extra warranty and product support information, as well as to the right of withdrawal.

    First name
    The processing of this personal data is necessary for the purpose of identifying the Data Subject as a contracting party to the Controller in order to be entitled to extra warranty and product support information, as well as the right of withdrawal.

    Consumer identifier
    The Controller processes this data in order to identify the consumer in the system.

    E-mail address
    Registered Data Subjects will receive automatic system messages to the e-mail address provided during registration.
    By using the e-mail address with a password, Data Subjects can access the website, reset their password and change their telephone number. The registered consumer can login also with a one-time verification code, which is sent to the registered e-mail address via e-mail.
    The mobile phone number and e-mail address are alternatives to each other in the operations described. For example, Data Subjects can access the website with either an e-mail address and a password, or a mobile phone number and a password. Access to the website is also possible with one-time code requested and then sent to the registered e-mail address or phone number.
    In case of the validation of a warranty claim, Data Subjects will also receive the related minutes and notifications to their e-mail address. The e-mail address is processed for the above purposes.
    Delivery of the electronic document certifying the purchase of the device to the Data Subject.

    Date of birth
    Date of birth as personal data shall be processed for the following two purposes:

    1. considering that only persons who have reached the age of 18 may register under the Terms of Use, the date of birth must be provided by the Data Subject and processed by the Controller in order to verify this circumstance,
    2. on the other hand, the Controller prepares cumulative reports and analyses in order to improve the quality of its services to an even more appropriate level for consumers, and in the course of this data processing activity it also processes the birth date constituting the consumer's personal data for the purpose indicated herein.

    Address
    The address of the Data Subject is managed by the Controller in order to be able to contact the Data Subject by post if other channels (e.g. mobile phone, e-mail) are not available in order to facilitate the enforcement of warranty claims, as well as to develop and enhance services for consumers, the Controller shall take into account the address of the consumers.

    Smoking condition
    Based on the terms of use, only persons who already smoke can register, as the device has also been developed for adults who already smoke, so this data of the Data Subject is processed by the Controller in order to check compliance with the terms of use.

    Unique identification data and number of devices assigned to the consumer
    To identify and handle the device used by the Data Subject.

    Gender (an optional, non-compulsory data field)
    The Controller handles this personal data in order to ensure a more personalised contact.

    Data relating to the fact of watching or not watching product usage e-coach videos
    The Data Controller processes this personal data in order to evaluate whether the right to buyback (withdrawal) is met, according to which the registered consumer must watch the product usage e-coach videos.

    Registration date of consumers in the system
    The Data Controller processes this personal data in order to ensure a more personalized contact.

    Customer service tasks related to the consumer
    The Data Controller processes this personal data in order to ensure a more personalized contact.
    Duration of data storage The data processing between the parties is based on the duration of the contract for the additional services outlined above (i.e. the period between registration and cancellation of registration) and the validity of the warranty claim. In the event that a Data Subject cancels their registration, this will also lead to the deletion of their data.
    In case of surrender (withdrawal), the profile will be deleted after 3 months.
    In case a registered Data Subject is inactive for 3 years, their registration will be cancelled.
    In case of no device is registered to the data subject’s profile for 75 days, the profile will be deleted.
    Relationship between failure to disclose data and statutory warranty rights Failure to disclose data shall not affect the Data Subject's statutory warranty rights attached to the device.
    Transfer of personal data, data processors, description of their services The Controller uses the services of the following data processors during the data processing indicated in this data processing policy:

    1. MONOLITH Advanced Internet Solutions LTD the data processing company operating the registration interface
    2. Konecta Hungary Kft. the company operating the customer service
    3. Erlab Hungary Kft service provider operating a backup system in the case of a failure of the data controller's customer and product registration system
    4. Tobacco retailers
    (a) if assistance is provided in the registration of the device at the express request of the Data Subject,
    (b) if the device is being replaced.

    5. People Group Kommunikációs Kft. the company involved in customer support


    II.2.
    PMHU customer and product registration system / Data processing activities related to incorrect phone number
    General purpose of data processing The purpose of data processing is for the Data Controller to delete from PMHU's customer and product registration system the mobile phone number that, due to its inaccuracy or change, cannot be linked to the registered consumer whose profile contains the given mobile phone number.
    Data Subjects of data processing Consumer who is indicated in point II/1 of these Terms of Use and has a profile in the Data Controller's customer and product registration system
    Legal basis for data processing The legal basis for the processing is the legal basis set out in Article 6 (1) f) of the GDPR, i.e. the legitimate interest of the Controller. The legitimate interest of the Controller is as follows: compliance with point d) of Article 5 (1) of the GDPR (principle for data accuracy) and storing only accurate and up-to-date personal data in the customer and product registration system of the Data Controller.
    Purpose of the personal data processed and the processing of individual data Registered incorrect phone number
    In the event that the Data Controller determines that the mobile phone number assigned to the profile of a particular Data Subject is incorrect, i.e. cannot be linked to the Data Subject (which may be due to e.g. a typo or a change in the data subject's mobile phone number in the meantime in such a way that the data subject does not reflect the change on his/her profile does not transfer, etc.), the Data Controller deletes the incorrect mobile phone number from the Data Subject's profile.

    Correct mobile phone number
    If the Data Subject provides the correct mobile phone number linked to the Data Subject, it will be stored in the Data Subject's profile.

    Last name
    The processing of this personal data is necessary for the purpose of contacting the Data Subject via e-mail.

    First name
    The processing of this personal data is necessary for the purpose of contacting the Data Subject via e-mail.

    E-mail address
    If an incorrect mobile phone number is detected, the Data Controller sends an e-mail to the Data Subject asking the Data Subject to enter the correct mobile phone number.
    Duration of data storage The duration of data storage is the same as the conditions and periods specified in point II/1 of these Terms of Use.
    Consequence of failure to provide data In the event that the Data Subject does not provide the Data Controller with the correct mobile phone number, communication with the Data Controller will be limited, as the Data Controller will not be able to reach the Data Subject via mobile phone calls, the Data Subject will not be able to access his/her profile using the mobile phone number, and basic functions (e.g. new device registration) become unavailable to the Data Subject.
    Transfer of personal data, data processors, description of their services The Controller uses the services of the following data processors during the data processing indicated in this data processing policy:

    1. MONOLITH Advanced Internet Solutions LTD the data processing company operating the registration interface

    2. Konecta Hungary Kft. the company operating the customer service


    II.3.
    Data processing activities related to IQOS (in the following: tobacco heating device) Club membership
    General purpose of data processing The purpose of data processing is to enable the Controller to fulfil the contract for the provision of additional services, discounts to the Data Subject, i.e. beyond the registration as regards warranty and product support related to tobacco heating device Club membership, in connection with the Data Subject's choice of tobacco heating device CLUB membership and assess how the Data Subject received the phone call.

    In case of a hearing-impaired consumer, the purpose of processing special personal data related to hearing loss is for the Data Controller to use written communication (e-mail or other text message) instead of outgoing phone calls.
    Data Subjects of data processing Data Subjects of data processing are consumers who purchase a tobacco heating device (hereinafter: device) and who decide to choose tobacco heating device CLUB membership in order to use the tobacco heating device Club membership-related,
  • i.e. additional warranty services beyond those provided by registration, and
  • extra product support, information (phone and e-mail support, streamed or audio-visual materials made available for all Data Subjects at the same time, answering questions, product usage assistance, feedback)
    • in addition to registering the device on the website of the purchased device or by using a tablet placed at the national tobacco shop that sells the device or through the Controller's customer service in case they chose the tobacco heating device Club membership.
    Legal basis for data processing Processing is carried out on the legal basis set out in Article 6 (1) b) of the GDPR, i.e. the processing is necessary for the performance of a contract to which the Data Subject is a party.

    In case of a hearing-impaired consumer, the processing of special personal data related to hearing loss is based on the legal basis set out Article 6 (1) a) of the GDPR and the exemption condition set out in Article 9 (2) a) of the GDPR based on the express consent of the data subject.
    Purpose of the personal data processed and the processing of individual data Voice recording, listening in
    The customer service conversation with the Data Subject is recorded for the purpose of subsequent service quality inspection, improvement the quality of services and later demonstration of what has been said. The Controller’s competent staff may listen in the conversation in real time in order to monitor customer service quality and to improve the quality of services.

    Mobile phone number
    If the Data Subject has a request to replace the device, the identification SMS sent to their mobile phone number can prove that they are entitled to use the additional warranty service based on tobacco heating device CLUB membership, as well as to receive additional support, answers to their questions, product usage assistance and to give feedback. The consumer will also receive a unique identification code via SMS before performing operations requiring consumer identification.
    The mobile phone number is also processed for the purpose of organizing the delivery of any prizes to the Data Subject won in the prize games organized on the virtual events.

    Last name
    It is necessary to process this personal data for the purpose of identifying the Data Subject as a contracting party to the Controller in order to be entitled to the extra warranty, product support and information.

    First name
    It is necessary to process this personal data in order to identify and to address in e-mails personally the Data Subject as a contracting party to the Controller in order to be entitled to the extra warranty, product support and information.

    Consumer identifier
    The Controller processes this data in order to identify the consumer in the system.

    E-mail address
    The Data Subject joined to the tobacco heating device CLUB (visit the website for detailed terms and conditions of membership) will receive automatic system messages to the e-mail address provided by him or her.
    With tobacco heating device CLUB membership, the Controller not only provides additional warranty services, but also customer support and other product information to the Data Subject, such as the most basic technological information about the device, news, product range and price changes; knowledge of the use, operation, technical knowledge and troubleshooting of the device. Data Subjects may provide feedback on their device, product usage habits, and the tobacco heating device Club. The Data Subject can use his/her e-mail address to register and participate in the virtual events announced by the Data Controller, in the Prize game held as part of them, and in their prize draw.
    In case of the enforcement of a warranty claim, Data Subjects will also receive the related minutes and notifications to the e-mail address. Data Subjects will receive this information as an additional product support service via e-mail.
    The e-mail address is processed for the above purposes.

    Address
    The address of the Data Subject is processed by the Controller in order to be able to contact the Data Subject by post if other channels (e.g. mobile phone, e-mail) are not available in order to facilitate the enforcement of warranty claims.
    Also, if the Data Subject cannot be reached via another channel (e.g. mobile phone, e-mail), the Data Controller should be able to send him/her a notification of important information by post.
    Furthermore, the Controller reserves the right to give gifts and prizes at any time in return for the Data Subject’s feedback on the tobacco heating device Club, as well as in the case of fulfillment of the prize conditions and drawing as a winner on the virtual events and to deliver such gifts, prizes to the provided address.

    Unique identification data and number of devices assigned to the consumer
    To identify and handle the device used by the Data Subject.

    Gender (an optional, non-compulsory data field)
    The Controller handles this personal data in order to ensure a more personalised contact.

    Data related to product usage, feedback and areas of interest
    The Controller obtains data on product use, feedback and areas of interest from Data Subjects (e.g. consumers’ opinion about the tobacco heating device and whether they would recommend the product to others) within the framework of feedback from Data Subjects in order to improve its services and personalise its shipments and information, as well as to use the data in a statistical way in order to develop its strategy and business plans.

    Registration date of consumers in the system
    The Data Controller processes this personal data in order to ensure a more personalized contact.

    Customer service tasks related to the consumer
    The Data Controller processes this personal data in order to ensure a more personalized contact.

    Answers recorded during telephone and e-mail inquiries of consumers (supporting and anniversary inquiries)
    The purpose of data processing is to improve the quality of the Data Controller's services.

    Data on the Data Subject's interaction regarding e-mails and newsletters sent:
    The Data Controller monitors with the help of the used electronic mail system whether Data Subjects open the newsletters and informative emails sent to them and whether they click on the link(s) found in them for the purpose of improving the effectiveness of fulfilling the contractual obligation to send out information (newsletters), improving the quality of this service, in particular by updating the managed e-mail addresses as necessary. The Data Controller also manages the data on whether the Data Subject has unsubscribed from the newsletters and thereby terminated the IQOS Club membership.

    Consumer's attitude towards phone calls:
    This personal data is created on the basis of the operator's assessment based on the operator's phone conversation with the Data Subject, the purpose of data management is to improve the quality of the Data Controller's services.

    Segment name:
    Within the IQOS Club membership, consumers are divided into groups based on registration and interaction data, the purpose of which is to improve the quality of the Data Controller's services

    IP address and other IT related personal data
    The cookie information contains additional information about the relevant circumstances of the management of this data.

    The fact that the person concerned is over 18 years old
    Confirmation of this fact is a condition for registering for the virtual events.

    Status as a smoker or user of products containing nicotine
    Confirmation of this fact is a condition for registering for the virtual events.

    Data relating to the fact of watching or not watching product usage e-coach videos
    The Data Controller processes this personal data in order to determine whether the condition of the entitlement to the additional warranty undertaken in the case of physical injury due to one's own fault (even resulting from improper use) is met, according to which the consumer who is an IQOS Club member must watch the product usage e-coach videos.

    Personal data relating to IQOS CLUB membership
    On the one hand this data is processed by the Data Controller with the aim of verifying whether the given consumer has an IQOS CLUB membership, and based on this, are the specific discounts and services available that the Data Controller provides only to consumers with IQOS CLUB membership, on the other hand this personal data is processed by the data controller for the express purpose of providing specific discounts and services to consumers with IQOS CLUB membership.

    Data relating to hearing loss
    In the case of a hearing-impaired consumer, the purpose of processing special personal data related to hearing loss is for the Data Controller to use written communication (e-mail or other text message) instead of outgoing phone calls.

    Other personal data
    This includes the personal data that the Data Controller processes with the aim of being able to determine that the Data Subject has fulfilled the conditions for participation in the prize draw of a given virtual event that conveys basic knowledge about the proper use of the product (e.g. whether the Data Subject answered all the questions asked or not).


    Duration of data storage Data processing between the parties is based on the duration of the contract for additional services outlined above (i.e. the period between the start of tobacco heating device CLUB membership and its termination by the Data Subject) and on the term of enforceability of warranty claims. In the event that a Data Subject cancels their registration, this will also lead to the deletion of their data managed in connection with tobacco heating device CLUB membership. (The Data Subject's entire profile will be deleted, so if there are more than one tobacco heating devices assigned to the Data Subject, the CLUB membership and related data for each device will be deleted.) The Data Subject may at any time decide to cancel tobacco heating device CLUB membership only, in which case the data processing of the Data Subject for purposes related to tobacco heating device CLUB membership will be terminated; however, data supplied earlier by the Data Subject (e.g. the fact and description of phone conversations, the fact and description of discussions with a customer support expert), and the registration previously performed by the Data Subject (see point II/1) will remain until the date of cancelling the registration.
    The period of retention of customer service voice recordings is 3 months from the date of recording; voice recordings will be deleted afterwards. In case of a complaint, a warranty claim disputed by the Data Controller, the period of retention is specified in section II/6. in point 6. In case of surrender (withdrawal), tobacco heating device CLUB membership – together with the profile – will be cancelled after 3 months. In case a Data Subject is inactive for 3 years, their registration and tobacco heating device CLUB membership will be cancelled.
    Data regarding the opening of e-mails and newsletters is managed by the Data Controller until the IQOS Club membership is terminated.

    Information about the retention period of IP addresses and other IT-related personal data is contained in the cookie information of the specific cookie.
    Relationship between failure to disclose data and statutory warranty rights Failure to provide data shall not affect the Data Subject's statutory warranty rights attached to the device.
    Transfer of personal data, data processors, description of their services The Controller uses the services of the following data processors during the data processing indicated in this data processing policy:

    1. MONOLITH Advanced Internet Solutions LTD
    the data processing company operating the registration interface

    2. Konecta Hungary Kft.
    the company operating the customer service

    3. Tobacco retailers,
    a) if assistance is provided during the registration of the device for the selection of tobacco heating device CLUB membership at the expressed request of the Data Subject,
    b) if the device is replaced

    4. Erlab Hungary Kft
    service provider operating a backup system in the case of a failure of the data controller's customer and product registration system

    5. The service provider preparing the delivery of the gift for the Data Subject’s feedback as tobacco heating device CLUB member, the registered seat of which is in Hungary.

    6. The service provider making arrangements for the delivery of the gift for the Data Subject’s feedback as tobacco heating device CLUB member, the registered seat of which is in Hungary.

    7. IPSOS Zrt. (headquarter: 1139 Budapest, Pap Károly utca 4-6.) the company performing tasks related to customer feedback

    8. People Group Kommunikációs Kft. the company involved in customer support

    9. Battle Royal GmbH – provider providing the IT background for webinars.


    II.4.
    Business analytics
    General purpose of data processing To analyze data in order to understand consumers and in connection with business initiatives, issues and product development, and to understand consumer habits.
    Data Subjects of data processing Registered consumers and tobacco heating device Club members
    Legal basis for data processing The legal basis for the processing is the legal basis set out in Article 6(1)f) of the GDPR, i.e. the legitimate interest of the Controller. The legitimate interest of the Controller is as follows: to offer and develop goods and services that best satisfy the needs of consumers.
    Purpose of the personal data processed and the processing of individual data In the event that data are not provided, the data that a consumer does not intend to provide will not be used for business analytics purposes.
    The personal data processed and the purpose of the processing of the respective data For registered consumers, the personal data specified in section II.1. For tobacco heating device Club members, the personal data specified in section II.3.
    Data retention period The personal data used are deleted in the manner and at the time specified in sections II.1 and II.3.
    Transfer of personal data, data processors, description of their services In the course of the processing described in this privacy notice, the Controller uses the services of the following processors:

    1.MONOLITH Advanced Internet Solutions LTD
    the data processor operating the registration interface

    2. intecs data, s.r.o.
    the team developing the analytics interface

    3.Microsoft Corporation
    the entity storing the underlying data of PowerBI


    II.5.
    Data processing activities related to quantitative market research activities
    General purpose of data processing Understanding consumer perception in relation to various business initiatives, issues, product development, learning about consumer switching. The purpose of processing the personal data on the list of those who unsubscribed is to prevent the Controller from contacting those Data Subjects for market research purposes who withdrew their consent earlier granted thereto.
    Data Subjects of data processing Consumers who have given their consent to participate in market research. In case of the list of those who unsubscribed, those consumers who withdrew their consent earlier granted to the Controller to contact them for market research purposes.
    Legal basis for data processing In the course of market research activities, processing is carried out on the legal basis set out in Article 6 (1) a) of the GDPR, i.e. on the basis of the Data Subject's consent.
    In the course of voucher management activities, processing is carried out on the legal basis set out in Article 6 (1) (b) of the GDPR, i.e. for the performance of a contract to which the Data Subject is a party; and in case of the list of those who unsubscribed, on the legal basis set out in Article 6 (1) (f) of the GDPR, i.e. in the legitimate interests pursued by the Controller, namely to prevent legal disputes by the fact that the Controller shall not contact those Data Subjects for market research purposes who withdrew their consent earlier granted to the Controller to contact them for such purpose.
    Consequence of failure to provide data In case of any failure to provide data, the consumer shall not have the opportunity to participate in the market research.
    Purpose of the personal data processed and the processing of individual data The processing of personal data by the Controller takes place only for the following purposes:

    1. for the performance of the quantitative market research activities,

    2. in connection with the related voucher management,

    3. and in connection with the processing of the list of those who unsubscribed.

    1. With the consent of the Data Subject, the following personal data will be transferred to the data processor for market research purposes: Consumer identifier, full name, e-mail address, age, gender, date of device purchase, and a reference to whether the Data Subject has viewed the video presenting the device. Based on the Data Subject's consent, the Data Controller also processes data on whether the Data Subject has completed the questionnaire sent to him/her or not for market research purposes. In the case of personal data other than those mentioned above, in relation to any data collected by the Market Researcher (IPSOS MORI UK Ltd.), e.g. for taxation and accounting purposes, the Market Researcher shall be considered as Controller.

    2. On the legal basis of performing a contract to which the Data Subject is a party, the following personal data of participants entitled to be involved in market research will be transferred to the data processor in order to incentivize consumers’ participation in market research, for the purposes of gift voucher delivery, answering questions related to voucher use, and claims management: the Data Subject’s name and e-mail address. The data processor obtains the following personal data from the voucher service provider: voucher code, voucher validity, date of sending the voucher to the Data Subject.

    3. The list of those who unsubscribed, generated by the data processor, contains the Data Subjects’ consumer identifier and e-mail address. The legal basis for processing the personal data included in the list of those who unsubscribed is the legitimate interest pursued by the Controller, the purpose of which is to prevent the Controller from contacting those Data Subjects for market research purposes who withdrew their consent earlier granted for such purpose.

    In the case of personal data other than those mentioned above, in relation to any data collected by the data processor, the Market Researcher shall be considered as Controller.
    Duration of data storage The processing of personal data lasts until the withdrawal of the Data Subject's previous consent for market research purposes or the deletion of the profile, provided that data will be processed for voucher management purposes during the 1-year validity period of the voucher.
    Transfer of personal data, data processors, description of their services The Controller uses the services of the following data processor during the data processing indicated in this data processing policy:

    1. IPSOS Mori UK Ltd (3 Thomas More Square, London, E1W 1YW, UK) the company carrying out the market research activity

    Data transfer guarantee: COMMISSION IMPLEMENTING REGULATION (EU) 2021/1772 (28 June 2021) on the adequate level of protection of personal data in the United Kingdom pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, which can be viewed here.


    II.6.
    Data processing activities related to customer service and customer support .
    1. General purpose of data processing a) Answering consumers' questions, customer support, service development, efficiency measurement and planning, investigating their comments, general communication with consumers,
    b) handling consumers’ complaint,
    c) manage consumers’ warranty claims.
    d) In the case of a hearing-impaired consumer, the purpose of processing special personal data related to hearing loss is for the Data Controller to use written communication (e-mail or other text message) instead of outgoing phone calls.
    2. Data Subjects of data processing Consumers.
    3. Legal basis for data processing a) In the course of data processing for the purpose indicated in point II.6.1. a), data processing is carried out on the legal basis specified in point f) of Article 6 (1) of the GDPR, i.e. on the basis of the legitimate interest of the Data Controller, which legitimate interest is the effective and high-level support of consumers.

    b) In the course of data processing for the purpose specified in point 1 b), the data processing is carried out on the one hand on the legal basis specified in Article 6 paragraph (1) point b) of the GDPR, i.e. in order to fulfill the legal obligation of the Data Controller, the CLV of 1997 on consumer protection Act 17/A. § (5) and (7), on the other hand, it takes place on the legal basis defined in Article 6 (1) point f) of the GDPR, i.e. on the basis of the legitimate interest of the Data Controller, which legitimate interest is to facilitate the proof and defense of consumer claims. On the individual legal bases of data management II.6.l. also those contained in point 5.

    c) In the case of data processing for the purposes specified in point II.6.1 c), the data processing is carried out on the one hand on the legal basis specified in Article 6 (1) point b) of the GDPR, i.e. in order to fulfill the legal obligation of the Data Controller and 19/2014 on the procedural rules for handling warranty claims (IV. 29.) on the basis of Section 4(1) and Section 6(1) of the NGM Decree, on the other hand on the legal basis defined in Article 6(1)(f) of the GDPR, i.e. the legitimate interest of the Data Controller takes place on the basis of which is a legitimate interest in the efficient and high-level fulfillment of consumers' warranty needs. On the individual legal bases of data management l. also those contained in point II.6.

    d) Data processing specified in II.6.1. d) point, i.e. in the case of a hearing-impaired consumer, the processing of special personal data related to hearing loss is based on the legal basis set out Article 6 (1) a) of the GDPR and the exemption condition set out in Article 9 (2) a) of the GDPR based on the express consent of the data subject.
    4. Consequence of failure to provide data The Controller does not become aware of the issue, claim validation or complaint and thus cannot provide information or take appropriate steps in connection with the event.
    5. Purpose of the personal data processed and the processing of individual data a, The personal data that the Data Controller manages for the purpose indicated in the II.6.1. a) point:

    i. Voice recording
    Questions and comments made by the Data Subject on +36 80 888 222 will be recorded for the purpose of answering the question, investigating the comment and quality assurance.

    ii. Last name / First name
    The processing of this personal data is necessary for the purpose of identifying the Data Subject.

    iii. Mobile phone number
    The processing of this personal data is necessary for the purpose of contacting the Data Subject.

    iv. E-mail address
    It is stored for the purpose of contacting the Data Subject.

    v. Consumer identifier
    The Data Controller processes this adata for the purpose of identifying the consumer in the system in the case of a request from a registered consumer regarding a non-traditional product (i.e. tobbacco heating devices, e.g. IQOS).

    vi. Unique identification data and number of devices assigned to the consumer
    In the case of a non-traditional product, identification and management of the device used by the registered consumer.

    vii. Other personal data
    In the case of registered consumers:

    Registration date of consumers in the system
    The Data Controller processes this personal data in order to ensure a more personalized contact.
  • Preliminary communications with the consumer (e.g. topics, e-mail communication),
  • the support used by the consumer in the premises of a contracted partner or at another location from the customer support expert, the description of which is recorded in the Data Controller's system,
  • Data related to participation in the program announced by the Data Controller, the description of which is recorded in the Data Controller's system (e.g. in relation to product use, cleaning of the device, online registration, software update, device check, services used, completion of program announcement or other circumstances),
  • The opinion of the registered consumer regarding the IQOS device and related services (e.g. would you recommend the product to others if you answer the asked questions),
  • Data on the Data Subject's interaction regarding e-mails and newsletters sent:
    The Data Controller monitors with the help of the used electronic mail system whether Data Subjects open the newsletters and informative emails sent to them and whether they click on the link(s) found in them for the purpose of improving the effectiveness of fulfilling the contractual obligation to send out information (newsletters), improving the quality of this service, in particular by updating the managed e-mail addresses as necessary. The Data Controller also manages the data on whether the Data Subject has unsubscribed from the newsletters and thereby terminated the IQOS Club membership.
  • Answers recorded during telephone and e-mail inquiries of consumers (supporting and anniversary inquiries)
    The purpose of data processing is to improve the quality of the Data Controller's services.
  • Customer service tasks related to the consumer
    The Data Controller processes this personal data in order to ensure a more personalized contact.
  • Consumer's attitude towards phone calls: this personal data is created on the basis of the operator's assessment based on the operator's phone conversation with the Data Subject, the purpose of data management is to improve the quality of the Data Controller's services.


    • viii. Other personal data provided by the consumer
    Any other personal data provided by the Data Subject during the telephone call or in e-mail. Personal data (first name, last name, mobile phone number, e-mail address, e-mail subject, message) provided by the Data Subject in the Contact Us electronic form on the website.

    b, The personal data that the Data Controller manages for the purpose indicated in the II.6.1. b) point:

    i. Name of the consumer
    ii. Consumer’s address
    iii. Place, time and method of presenting the complaint
    iv. Detailed description of the consumer's complaint
    v. Signature of the person taking the record
    vi. The consumer's signature on the record
    vii. In the case of a verbal complaint communicated by telephone or using other electronic communication services, the unique identification number of the complaint
    viii. Response to the consumer's complaint
    ix. Voice recording of the conversation with the consumer
    x. Consumer identifier
    xi. Unique identification data and number of devices assigned to the consumer
    xii. Consumer’s mobile phone number
    xiii. Consumer’s e-mail address

    The i-viii. for the processing of personal data specified in point II.6.3. c) on the legal basis of fulfilling the legal obligation specified in points ix-xiii. and the processing of personal data defined in point II.6.3. c) is carried out on the legal basis of the legitimate interest defined in point 3. c)..

    c, The personal data that the Data Controller manages for the purpose indicated in the II.6.1. c) point:

    i. Name of the consumer
    ii. Consumer’s address
    iii. The name of the movable asset sold
    iv. The purchase price of the movable asset sold
    v. Data needed to identify the product
    vi. The consumer's mobile phone number: in the case of a replacement product, it is processed for the purpose of negotiating the delivery date
    vii. Consumer's e-mail address: the protocol and notification related to claim enforcement will be sent to the consumer's e-mail address
    viii. Address of the consumer:: it is processed for the purpose of determining the regional representative to be appointed to hand over the replacement product.
    ix. Voice record about the conversation with the consumer.
    x. Consumer identifier
    xi. Device codentify code

    The processing of personal data defined in the i-v. points is carried out on the legal basis of fulfilling the legal obligation defined in the II.6.3. c) point, and the processing of personal data defined in the vi-xi points is carried out on the legal basis of the legitimate interests defined in the II.6.3. c) point.

    d, The personal data that the Data Controller processes for the purpose indicated in point II.6.1. d).:

    Condition of hearing loss
    In the case of a hearing-impaired consumer, the purpose of processing special personal data related to hearing loss is for the Data Controller to use written communication (e-mail or other text message) instead of outgoing phone calls.
    6. Duration of data storage Data Subjects can provide their personal details by phone or by e-mail.
    In the case of a voice recording, as a general rule 3 months from the date of the recording, complaint, in case of enforcement of a disputed warranty claim by the data controller 5 years from the date of the recording. In the case of communication by e-mail the retention period is 3 months from the date of origin of the e-mail in case of communication not considered as a complaint, and 5 years from the date of origin of the e-mail in case of a complaint.
    In case of handling a warranty claim, the retention period of personal data entered in the records is 3 years from drawing up such records. In case of handling a complaint, the retention period of personal data entered in the records is 5 years from drawing up such records.

    The retention period for questions and complaints sent in private message on Facebook is 4 years from the date of receipt of the message.
    The Data Controller considers any communication from the customer (regardless of its form or medium) as a complaint, in which the customer makes a specific complaint, and/or in which the client refers to the possible initiation of a conciliation board, official, or court proceeding, refers to a claim for compensation, health damage, deterioration of health, or the use of a legal representative.
    In the case of initiating conciliation body, official or judicial procedure the Data Controller processes the data for 6 months from the final conclusion of the procedure or, in case of recourse to an extraordinary legal remedy procedure, until its completion, which period (due to the possible prolongation of the procedures) may exceed 5 years from the date of creation of the data.
    7. Transfer of personal data, data processors, description of their services The Controller uses the services of the following data processors during the data processing indicated in this data processing policy:

    1. MONOLITH Advanced Internet Solutions LTD
    the data processing company operating the registration interface

    2. Erlab Hungary Kft service provider operating a backup system in the case of a failure of the data controller's customer and product registration system

    3. People Group Kommunikációs Kft .
    the company involved in customer support as a service provider

    4. Konecta Hungary Kft.
    the company operating the customer service

    5. Associate companies belonging to the PMI group of companies partner companies participating in the international assistance program and handling the request of the Data Subject


    II.7.
    Data processing activity related to the contact profile of an unregistered consumer .
    1. General purpose of data processing a) Answering consumer questions, providing customer support, service development, efficiency measurement and planning, investigating consumer comments, general communication with consumers,
    b) handling consumer complaints,
    c) handling consumer warranty claims,
    d) in case of a hearing-impaired consumer, the purpose of processing special personal data related to hearing loss is for the Data Controller to use written communication (e-mail or other text message) instead of outgoing phone calls.
    2. Data Subjects of data processing The consumer specified in point II/1 of these Terms of Use who does not have a profile in the customer and product registration system of the Data Controller, i.e. is not registered consumer.
    3. Legal basis for data processing a) In the course of data processing for the purpose indicated in point II.7.1. a), data processing is carried out on the legal basis specified in point f) of Article 6 (1) of the GDPR, i.e. on the basis of the legitimate interest of the Data Controller, which legitimate interest is effective and high-level support of consumers, appropriate product use and satisfaction with the services and the product.

    b) In the course of data processing for the purpose specified in point II.7.1 b), the data processing is carried out on the one hand on the legal basis specified in Article 6 paragraph (1) point b) of the GDPR, i.e. in order to fulfill the legal obligation of the Data Controller, the CLV of 1997 on consumer protection Act 17/A. § (5) and (7), on the other hand, it takes place on the legal basis defined in Article 6 (1) point f) of the GDPR, i.e. on the basis of the legitimate interest of the Data Controller, which legitimate interest is supporting proof and defense related to consumer needs. On the individual legal bases of data processing see in point 5.

    c) In the case of data processing for the purposes specified in point II.7.1 c), the data processing is carried out on the one hand on the legal basis specified in Article 6 (1) point b) of the GDPR, i.e. in order to fulfill the legal obligation of the Data Controller and 19/2014 on the procedural rules for handling warranty claims (IV. 29.) on the basis of Section 4(1) and Section 6(1) of the NGM Decree, on the other hand on the legal basis defined in Article 6(1)(f) of the GDPR, i.e. the legitimate interest of the Data Controller takes place on the basis of which is a legitimate interest in the efficient and high-level fulfillment of consumers' warranty needs. On the individual legal bases of data processing see in point 5.

    d) Data processing specified in II.7.1. d) point, i.e. in the case of a hearing-impaired consumer, the processing of special personal data related to hearing loss is based on the legal basis set out Article 6 (1) a) of the GDPR and the exemption condition set out in Article 9 (2) a) of the GDPR based on the express consent of the data subject.
    4. Consequence of failure to provide data The Controller does not become aware of the issue, claim validation or complaint and thus cannot provide information or take appropriate steps in connection with the event.
    5. Purpose of the personal data processed and the processing of individual data a, The personal data that the Data Controller manages for the purpose indicated in the II.7.1. a) point:

    i. Voice recording
    Questions and comments made by the Data Subject on +36 80 888 222 will be recorded for the purpose of answering the question, investigating the comment and quality assurance.

    ii. Last name / First name
    The processing of this personal data is necessary for the purpose of identifying the Data Subject.

    iii. Mobile phone number
    The processing of this personal data is necessary for the purpose of contacting the Data Subject.

    iv. E-mail address
    It is stored for the purpose of contacting the Data Subject.

    v. Consumer identifier
    The Data Controller processes this adata for the purpose of identifying the consumer in the system in the case of a request from a registered consumer regarding a non-traditional product (i.e. tobbacco heating devices, e.g. IQOS).

    vi. Other personal data provided by the consumer
    Any other personal data provided by the Data Subject during the telephone call or in e-mail. Personal data (first name, last name, mobile phone number, e-mail address, e-mail subject, message) provided by the Data Subject in the Contact Us electronic form on the website.

    b,The personal data that the Data Controller manages for the purpose indicated in the II.6.1. b) point:

    i. Name of the consumer
    ii. Consumer’s address
    iii. Place, time and method of presenting the complaint
    iv. Detailed description of the consumer's complaint
    v. Signature of the person taking the record
    vi. The consumer's signature on the record
    vii. In the case of a verbal complaint communicated by telephone or using other electronic communication services, the unique identification number of the complaint
    viii. Response to the consumer's complaint
    ix. Voice recording of the conversation with the consumer
    x. Consumer identifier
    xi. Device codentify code
    xii. Consumer’s mobile phone number
    xiii. Consumer’s e-mail address

    The i-viii. for the processing of personal data specified in point 3. c) on the legal basis of fulfilling the legal obligation specified in points ix-xiii. and the processing of personal data defined in point 3. c) is carried out on the legal basis of the legitimate interest defined in point 3. c).

    c, The personal data that the Data Controller manages for the purpose indicated in the II.7.1. c) point:

    i. Name of the consumer
    ii. Consumer’s address
    iii. The name of the movable asset sold
    iv. The purchase price of the movable asset sold
    v. Data needed to identify the product
    vi. The consumer's mobile phone number: in the case of a replacement product, it is processed for the purpose of negotiating the delivery date
    vii. Consumer's e-mail address: the protocol and notification related to claim enforcement will be sent to the consumer's e-mail address
    viii. Address of the consumer:: it is processed for the purpose of determining the regional representative to be appointed to hand over the replacement product.
    ix. Voice record about the conversation with the consumer.
    x. Consumer identifier
    xi. Device codentify code

    The processing of personal data defined in the i-v. points is carried out on the legal basis of fulfilling the legal obligation defined in the II.7.3. c) point, and the processing of personal data defined in the vi-xi points is carried out on the legal basis of the legitimate interests defined in the II.7.3. c) point.

    d, The personal data that the Data Controller processes for the purpose indicated in point II.7.1. d):

    Condition of hearing loss
    In the case of a hearing-impaired consumer, the purpose of processing special personal data related to hearing loss is for the Data Controller to use written communication (e-mail or other text message) instead of outgoing phone calls..
    6. Duration of data storage According to the provisions of point II/6/6 of these Terms of Use.
    7. Transfer of personal data, data processors, description of their services The Controller uses the services of the following data processors during the data processing indicated in this data processing policy:

    1. MONOLITH Advanced Internet Solutions LTD
    the data processing company operating the registration interface

    2. Konecta Hungary Kft.
    the company operating the customer service


    II.8.
    Feedback on product by registered consumers (NPS))
    General purpose of data processing 1. Reception and analysis of consumer opinions supplied on questionnaires and in the course of communication by phone in respect of consumer experience with the IQOS device and consumer support provided by consumer support experts present at the premises of a contracted partner, in order to improve device quality and the quality of related services.

    2. Reception of consumer opinions supplied on questionnaires and in the course of communication by phone, in order to increase consumer satisfaction and to turn rejecting consumers into supportive consumers based on feedback; in case of negative opinions supplied by consumers, identification of problems and reconciliation of opinions with consumers, and proposals for solution if possible.
    Data Subjects of data processing Those registered consumers who fill in the electronic questionnaire to provide their opinions on the IQOS device and who supply answers of evaluation by phone.
    Legal basis for data processing Processing is carried out on the legal basis defined in Article 6 (1) (f) of the GDPR, i.e. in the legitimate interest of the Controller. Legitimate interest of the Controller: to understand market processes in order to improve the IQOS device, the offer, the related services and the customer service; to understand the behaviours of consumers and potential consumers, as well as to understand consumer preferences in order to improve the quality of services and to increase consumer satisfaction.
    Consequence of failure to provide data The Controller is unable to take into consideration the Data Subject’s opinion in respect of the development of the IQOS device and related services; the Data Subject loses the opportunity, in case of negative opinions supplied by consumers, for the identification of problems, reconciliation of opinions, and proposals for solution with consumers.
    Purpose of the personal data processed and the processing of individual data
    		Full name:consumer identification

    Consumer identifier: consumer identification

    Mobile phone number: contact and reconciliation of consumer opinions

    E-mail address: contact

    Scores given by consumer: getting to know the Data Subject’s opinion on the IQOS device and related services so that, in case of negative opinions supplied by consumers, the identification of problems and reconciliation of opinions with consumers can be carried out.

    Consumer opinions supplied in reply to open questions on the questionnaire: getting to know the Data Subject’s opinion on the IQOS device and related services so that, in case of negative opinions supplied by consumers, the identification of problems and reconciliation of opinions with consumers can be carried out.
    Opinions by registered consumers about the IQOS device and in relation to the services provided in connection therewith (e.g. whether they would recommend the product to someone else, provided that they answer the questions posed).

    Consumer opinions supplied in the course of subsequent communication by phone: getting to know the Data Subject’s opinion on the IQOS device and related services so that, in case of negative opinions supplied by consumers, the identification of problems and reconciliation of opinions with consumers can be carried out.
    Opinions by registered consumers about the IQOS device and in relation to the services provided in connection therewith (e.g. whether they would recommend the product to someone else, provided that they answer the questions posed).
    Duration of data storage In the case of data provided on the questionnaire:
    Mobile phone numbers and e-mail addresses are stored for 7 calendar days from the date of collection.
    The Controller maintains a connection between the opinion provided by the consumer and the identification data of the given consumer for 1 year by pseudonymisation; afterwards, the Controller cancels such connection, as a result of which the opinion provided by the consumer will become anonymous, i. e. it will cease to be considered as personal data.

    Consumer opinions supplied in the course of subsequent communication by phone:
    The data is processed until the consumer profile is deleted.
    Transfer of personal data, data processors, description of their services The Controller uses the services of the following data processors during the data processing indicated in this data processing policy:

    1. Kantar– generates an NPS opinion survey link; provides a web-based connection for collecting consumer opinions; stores consumers’ NPS opinions and the results of NPS telephone conversations on its own servers in Germany; makes consumer opinions available to the Controller’s competent staff.

    2. MONOLITH Advanced Internet Solutions LTD the data processing company operating the registration interface

    3. Konecta Hungary Kft. the company operating the customer service


    II.9.
    Data processing activities related to device purchase (buyback)
    General purpose of data processing Activities related to the surrender of a device, receipt of a device, contract of sale and transfer of the price of the device.
    Data Subjects of data processing Registered consumers who initiate the buyback of the device within 14 (in case of devices with heating blade) or 30 (in case of devices without heating blade) days of purchase.
    Legal basis for data processing Processing is carried out on the legal basis set out in Article 6 (1) b) of the GDPR, i.e. the processing is necessary for the performance of a contract to which the Data Subject is a party.
    Consequence of failure to provide data The device buyback will not be processed.
    Purpose of the personal data processed and theprocessing of individual data Full name: consumer identification

    Address: contact

    Bank account number: required to make a purchase price refund

    Unique device identification code: allows the device to be identified

    Mobile phone number: contact

    E-mail address: contact
    Duration of data storage 10 years from the date of buyback of the device
    Transfer of personal data, data processors, description of their services The Controller uses the services of the following data processors during the data processing indicated in this data processing policy:

    1. Konecta Hungary Kft.
    the company operating the customer service

    2. Technical service companies whose residence is in Hungary controlling the technical condition and the return of the (buyback) device and the accessories of the device.

    3. A service company involved in coordination, contact, activities, administration and other transaction of affairs related to the surrender of the buyback device, whose residence is in Hungary.

    4. erLab Hungary Kft., company participating in the buyback of the devices

    II.10.
    Special device purchase offer for consumers not registered in the data controller's customer and product registration system, check for lack of registration
    General purpose of data processing In the case of type(s) of tobacco heating device unilaterally selected by the data controller in the national tobacco shops operating in the geographical area(s) unilaterally selected by the data controller, a special device purchase offer is given for the given consumer if a purchase intention expressed which includes a discounted price, and if the consumer is not registered in the customer and product registration system of the data controller. The condition for using the discounted price is the completion of consumer and device registration. The data controller may limit the number of devices that can be purchased using the discounted price. The Data Controller is entitled to unilaterally determine the amount of price discounts. Before giving the consumer the opportunity to purchase at a discounted price, whether the customer is being checked in the data controller’s system whether the consumer is not registered in the Customer and Product Registration System of the data controller, because a registered consumer cannot use the discounted price. The primary purpose of data processing t is to help verify whether the consumer is registered in the data controller's customer and product registration system.
    Data Subjects of data processing All those who wish to take advantage of the opportunity to purchase a device at a discounted price, and whose registration status is checked in the Data Controller's system.
    Legal basis for data processing Processing is carried out on the legal basis set out in Article 6 (1) b) of the GDPR, i.e. the processing is necessary for the performance of a contract to which the Data Subject is a party.
    Purpose of the personal data processed and theprocessing of individual data Mobile phone number
    This data is used to verify that the consumer really does not have registration and is entitled to the option of purchasing the device at a discounted price, considering that the Data Controller offers the discounted price only to consumers who are not registered in the data controller's customer and product registration system.

    Last name
    This data is used to verify that the consumer really does not have registration and is entitled to the option of purchasing the device at a discounted price, considering that the Data Controller offers the discounted price only to consumers who are not registered in the data controller's customer and product registration system.

    First name This data is used to verify that the consumer really does not have registration and is entitled to the option of purchasing the device at a discounted price, considering that the Data Controller offers the discounted price only to consumers who are not registered in the data controller's customer and product registration system.

    Duration of data storage The data will only be processed during the registration (or lack of the registration) verification process.
    Relationship between failure to disclose data and statutory warranty rights In the event of failure to disclose data, the Data Subject will not be entitled to purchase the device at a discounted price.
    Transfer of personal data, data processors, description of their services The Controller uses the services of the following data processors during the data processing indicated in this data processing policy

    Tobacco retailers, who carry out the registration check (lack of registration).


    II.11.
    Data processing activity related to the answers given by the data subject to the questions asked by the data controller in connection with the purchase and device usage
    General purpose of data processing For registered users service development and understanding of consumer behavior, for IQOS Club members provision of more personalized services, service development and understanding of consumer behavior.
    Data Subjects of data processing Registered users and IQOS Club members who answered the questions asked by the Data Controller.
    Legal basis for data processing The legal basis for the processing is the legal basis set out in Article 6(1)f) of the GDPR, i.e. the legitimate interest of the Controller. The legitimate interest of the Controller is as follows: service development, understanding of consumer behavior, provision of more personalized services for Data Subjects.
    Purpose of the personal data processed and the processing of individual data Last name
    It is necessary to process this personal data for the purpose of identifying the Data Subject.

    First name
    It is necessary to process this personal data for the purpose of identifying the Data Subject.

    Consumer identifier
    The Data Controller processes this data for the purpose of identifying the consumer in the system.

    Answers given by the Consumer to the Data Controller's questions
    The purpose of processing this data is to improve the service, understand consumer behavior, and provide more personalized services to Data Subjects.

    Duration of data storage In the case of a non-IQOS Club member, until the relevant person's registration is cancelled, in the case of an IQOS Club member, until the relevant IQOS Club membership is terminated.
    Relationship between failure to disclose data and statutory warranty rights The consequence of not providing data is that the responses of the data subject are not used for the purpose of improving the services and, in the case of IQOS Club members, they cannot benefit from more personalized services.

    Transfer of personal data, data processors, description of their services The Controller uses the services of the following data processors during the data processing indicated in this data processing policy:

    1. MONOLITH Advanced Internet Solutions LTD the data processing company operating the registration interface

    2. Konecta Hungary Kft. the company operating the customer service


    II.12.
    Data processing related to the Data Subject rights regarding audio recordings
    General purpose of data processing Article 5 (2) of the GDPR (principle of accountability) is the confirmation by the Data Controller that the Data Controller has acted in accordance with the applicable data protection legislation in connection with the Data Subject request submitted by the Data Subject regarding the audio recording of the telephone conversation between the Data Controller's customer service employee and the Data Subject. .
    Data Subjects of data processing Consumers who submit the Data Subject application described in point II/10/1.
    Legal basis for data processing The legal basis for the processing is the legal basis set out in Article 6 (1) f) of the GDPR, i.e. the legitimate interest of the Controller. The legitimate interest of the Controller is as follows: on the basis of Article 5 (2) of the GDPR (principle of accountability), proof of data controller compliance with data protection legal provisions.
    Purpose of the personal data processed and the processing of individual data Audio recordings
    The data controller handles the audio recording containing the data subject's request and the audio recording affected by the data subject's request in connection with the data subject's request.

    Last name
    It is necessary to process this personal data for the purpose of identifying and contacting the Data Subject.

    First name
    It is necessary to process this personal data for the purpose of identifying and contacting the Data Subject.

    E-mail address
    It is necessary to process this personal data for the purpose of identifying and contacting the Data Subject. The Data Controller sends the Data Subject the password to open the audio recording affected by the data subject's request and the file containing the audio recording in separate e-mails to the Data Subject's e-mail address.
    Duration of data storage The Data Controller processes the personal data for the purpose of data management defined in this chapter for 1 year from the submission of the data subject's request.
    Transfer of personal data, data processors, description of their services The Controller uses the services of the following data processors during the data processing indicated in this data processing policy:

    1. MONOLITH Advanced Internet Solutions LTD
    the data processing company operating the registration interface.

    2. Konecta Hungary Kft.
    the company operating the customer service.

    3.Associate companies belonging to the PMI group of companies partner companies participating in the international assistance program and handling the request of the Data Subject


    II.13.
    Assessing consumer product preferences
    General purpose of data processing Assessing the product preferences of Data Subjects and sending product information to them.
    Data Subjects of data processing Tobacco heating device Club members.
    Legal basis for data processing The legal basis for the processing is the legal basis set out in Article 6 (1) f) of the GDPR, i.e. the legitimate interest of the Controller. The legitimate interest of the Controller is as follows: providing information that best meets consumer needs.
    Consequence of failure to provide dataIn case of failure to provide data, the Data Controller will not be in a position to provide Data Subjects with information according to their preferences.
    Purpose of the personal data processed and the processing of individual data Personal data relating to IQOS CLUB membership
    For the purpose of identifying the Data Subject.

    The Data Subject's product preference
    The data is processed for the purpose of assessing consumer needs.

    Last name
    It is necessary to process this personal data for the purpose of identifying the Data Subject.

    First name
    It is necessary to process this personal data for the purpose of identifying the Data Subject.

    E-mail address
    The data is processed for the purpose of communication with the Data Subject.
    Duration of data storage The personal data will be deleted in the manner and time specified in point II.2.
    Transfer of personal data, data processors, description of their services The Controller uses the services of the following data processors during the data processing indicated in this data processing policy:

    1. MONOLITH Advanced Internet Solutions LTD
    the data processing company operating the registration interface.

    2.Konecta Hungary Kft.
    the company operating the customer service.

    3. Tobacco retailers,
    they can contribute to the assessment of consumer preferences.

    4.People Group Kommunikációs Kft .
    the company involved in customer support as a service provide.


    II.14.
    Birthday greeting
    General purpose of data processing Greeting the Data Subject on his birthday and assessing the Data Subject's product preferences using a questionnaire. Sending a gift to those who fill out the questionnaire.
    Data Subjects of data processing Tobacco heating device Club members.
    Legal basis for data processing The legal basis for the processing is the legal basis set out in Article 6 (1) f) of the GDPR, i.e. the legitimate interest of the Controller. The legitimate interest of the Controller is as follows: assess consumer needs.
    Consequence of failure to provide dataThe consequence of failure to provide data is that the Data Controller cannot assess the Product Preferences of the Data Subjects and cannot give gifts to survey participants.
    Purpose of the personal data processed and the processing of individual data Personal data relating to IQOS CLUB membership
    for the purpose of identifying the Data Subject.

    Month and day of date of birth
    The data is processed for the purpose of the appropriate timing of the birthday e-mail.

    The Data Subject's product preference
    The data is processed for the purpose of assessing consumer needs.

    Last name
    It is necessary to process this personal data for the purpose of identifying the Data Subject.

    First name
    It is necessary to process this personal data for the purpose of identifying the Data Subject.

    E-mail address
    the data is processed for the purpose of communicating with the Data Subject and delivering the gift voucher.

    Address
    data is processed for the purpose of delivering the gift.
    Duration of data storage The personal data will be deleted in the manner and time specified in point II.2..
    Transfer of personal data, data processors, description of their services The Controller uses the services of the following data processors during the data processing indicated in this data processing policy:

    1. MONOLITH Advanced Internet Solutions LTD
    the data processing company operating the registration interface.

    2.Konecta Hungary Kft.
    the company operating the customer service.

    3.People Group Kommunikációs Kft .
    the company involved in customer support as a service provide.

    II.15.
    Personal support for consumer registration
    General purpose of data processing Personal support by representatives of the data controller for the registration of consumers in the data controller's customer and product registration system (typically during a personal meeting in a national tobacco shop), who already have a tobacco heating device distributed by the Data Controller, but their registration in the system has not yet been completed. The consumer can receive a gift for registration.
    Data Subjects of data processing Consumers who already own a tobacco heating device sold by the Data Controller, but have not yet registered in the system.
    Legal basis for data processing The processing of personal data is based on the legal basis set out Article 6 (1) a) of the GDPR, i.e. on the basis of the Data Subject's consent. The data subject has the right to revoke the consent he/she has given at any time without conditions or restrictions by sending a written statement to the e-mail address indicated in the General part of this document.
    Consequence of failure to provide data The data subject and his/her device will not be registered, and because of that the data subject will not be entitled to the additional services provided by the Data Controller in relation to the accessory warranty and product support information and the right of withdrawal described in point II/1 of this document, and since the registration will not take place, the Data Subject will not be entitled to a gift related to registration.
    The processing of individual data The data indicated in point II/1 of this document in connection with the registration, as well as the consumer's name, address, telephone number and e-mail address, for the purpose of delivering the gift provided for registration and related communication.
    Duration of data storage The data is stored for the period specified in point II/1. of this document.
    Transfer of personal data, data processors, description of their services The Controller uses the services of the following data processors during the data processing indicated in this data processing policy:

    MONOLITH Advanced Internet Solutions LTD the data processing company operating the registration interface

    II.16.
    Identification and authentication of the consumer
    General purpose of data processing Identification and authentication of the consumer in cases where the fulfillment of consumer requests requires personal data already managed by the Data Controller (for example: product replacement, buyback, questions related to data management, complaints).
    Data Subjects of data processing Consumers who are registered in the customer and product registration system of the Data Controller and registered consumers who are also members of the Tobacco Heating Device Club.
    Legal basis for data processing The legal basis for the processing is the legal basis set out in Article 6 (1) f) of the GDPR, i.e. the legitimate interest of the Controller. The legitimate interest of the Controller is as follows: avoiding personal data being shared with unauthorized persons and ensuring that data protection rules are fully complied with.
    Consequence of failure to provide data The Data Subject's request will not be fulfilled.
    The processing of individual data full name, address, registered e-mail address, date of birth, registered telephone number, interaction with the consumer (recorded in writing on the consumer's profile), identification code of the device (charging case and heater), color and type of the registered device, number of registered devices , the fact whether the person receives tobacco heating device Club newsletter
    Duration of data storage The data is stored for the period specified in point II/3. of this document.
    Transfer of personal data, data processors, description of their services The Controller uses the services of the following data processors during the data processing indicated in this data processing policy:

    MONOLITH Advanced Internet Solutions LTD the data processing company operating the registration interface

    II.17.
    Data management activity related to the Twilio Livechat service
    General purpose of data processing Keeping contact with the person using the livechat service in order to provide reactive information (provided in response to consumer questions) about the Data Controller's products, consumer support and to raise the level of the services provided by the Data Controller, to ensure a personalized service.
    Data Subjects of data processing Adult smokers who use the Twilio livechat service.
    Legal basis for data processing The processing of personal data is based on the legal basis set out Article 6 (1) a) of the GDPR, i.e. on the basis of the Data Subject's consent. The data subject has the right to revoke the consent he/she has given at any time without conditions or restrictions by sending a written statement to the e-mail address indicated in the General part of this document.
    Consequence of failure to provide data The Data Controller cannot communicate with the Data Subject with appropriate content.
    The processing of individual data Personal data uploaded by the data subject when using the Twilio livechat service (e.g. personal data mentioned in the written text, personal data in the uploaded attachment).
    Duration of data storage The data will be processed until the date of deletion at the request of the Data Subject.
    Transfer of personal data, data processors, description of their services The Controller uses the services of the following data processors during the data processing indicated in this data processing policy:

    Twilio Inc. (375 Beale Street, Suite 300, San Francisco, CA 94105, USA) the provider operating the livechat service

    Data transfer guarantee:
    IMPLEMENTING DECISION OF THE COMMISSION (10/07/2023) according to Regulation (EU) 2016/679 of the European Parliament and of the Council on the adequate level of protection of personal data provided by the EU-US data protection framework, and Commission Implementing Decision (EU) 2021/914 (June 4, 2021) based on the general contractual terms and conditions for the transfer of personal data concluded with the data processor (SCC '21)




    Copyright, ownership of information

    All copyrights and related intellectual property rights connected to the visited website as well as the title of supervision to the entire web interface is held by Philip Morris Hungary Ltd. and its related companies (members of the PMI Group) and/or our dedicated service suppliers.

    Accuracy, completeness and timeliness of information provided on the website

    Philip Morris Hungary Ltd. takes no responsibility for the accuracy, completeness or up-to-date status of information disclosed on its website. Any information published by Philip Morris Hungary Ltd. on the website provides general information only and cannot be used as an exclusive basis for important decisions without comparison to other sources of information that are more accurate, more complete or more current. Philip Morris Hungary Ltd. reserves the right to modify the content of the website at any time, but takes on no obligation to update the information published on the website. It is the user's responsibility to follow up changes on the website.

    Use of the materials published on the website

    The website and all its content (including the software, files, graphics, data, images and other content) fall under the property of Philip Morris Hungary Ltd. and others within the PMI Group and are subject to copyright, trademark and other legal protection, as provided by Hungarian legal regulations and/or those of other countries. By entering to the website and opening the automatic e-mails, the user agrees not to make the website, any material or information on it, nor the content of the automatic e-mails available or accessible in any form on the website itself or on any other interface, neither for other smokers nor for other third parties.

    The user agrees not to copy, publish and forward materials (including photos and videos) from the website and in case of registered users the content of automatic e-mails in any form or through any medium. The user also agrees not to modify, sell or publish any of the published documents (uploaded to the website) as well as content of automatic e-mails sent by Philip Morris Hungary Ltd. (including photos and videos) available on the website, including in particular uploading a given document to the Internet or disclosing it to the public, including making it accessible online in any other way.

    Violation of copyright and related rights, other intellectual property rights and business secrets may have severe consequences under civil or criminal law, as the case may be, including suing for damages and reporting to the police.

    Trademarks

    The logos on the website and in automatic e-mails or constituting parts furthermore the product and service trademarks are the property of Philip Morris Hungary Ltd. and the Philip Morris International Group; our company has exclusive authorization to use them.

    Disclaimer

    This website is accessible to and may be used exclusively by the users as detailed above. Philip Morris Hungary Ltd. reserves the right to alter the content of the website at any time without prior notice, to discontinue the website or shut down the operation of any part and block access to it. Philip Morris Hungary Ltd. does not accept any responsibility for the authenticity and the up-to-date status of the information on the website, or for the errors or deficiencies in its content. Philip Morris Hungary Ltd. takes no responsibility any unauthorized use of the information presented on the website.

    Limitation of liability

    Neither Philip Morris Hungary Ltd., nor any other content provider third party used for the operation of the website and its services take any responsibility for any direct or indirect, accidental, special, consequential, criminal or other damage arising from the use of the website or that of any other websites via links provided therein, or from any unsuitability usage, or from any action or inaction by the website following the receipt of electronic mail sent to it by users.

    This includes damage arising because of the following, such as errors, dropouts, disruptions, problems and delays, computer viruses, lost profit, loss of data, unauthorized access, falsification of data or communications and other perceptible and non-perceptible damage.

    User liability

    In the event that a user causes any technical error on the website or in the systems delivering the website, that user will be fully liable for all costs (including legal costs) arising as a result of such an error.

    Jurisdiction

    The provisions of Hungarian and European Union legal regulations in force at all times shall govern the website.

    Amendment of these Terms and Conditions of Use

    Philip Morris Hungary Ltd. reserves the right to amend the Terms and Conditions of Use presented herein at its own discretion by uploading the amended Terms and Conditions of Use to the website or to supplement them with new ones at any time.

    The user of the website shall be responsible for regularly checking whether any change has been made in the Terms and Conditions of Use. The amended Terms and Conditions of Use are accepted by the user if s/he continues to use the website even after the amended Terms and Conditions of Use are uploaded to this website.

    Other rights according to the Terms and Conditions of Use

    If the user fails to comply with these Terms and Conditions of Use or Philip Morris Hungary Ltd. is unable to enforce its rights according to these Terms and Conditions of Use or if it can do so only with a delay, it does not, in any way, mean that Philip Morris Hungary Ltd. waives its right to take action against the user in the event of any such violation or that the user would not be under an obligation to subsequently comply with its obligations thereunder. If Philip Morris Hungary Ltd. decides to waive its right to enforce its rights in the event of the violation of these Terms and Conditions of Use, it will do so in writing only.

    Every single point of these Terms and Conditions of Use is valid separately. This means that a court or a competent authority should decide that any of its provisions is illegal, is in conflict with the law or cannot be enforced, the remaining points shall remain valid in an unchanged form.

    Contact us!

    Please, contact us at any contact provided on the website:
    • if you believe that the website violates a copyright or presents some content which in your view is illegal, offensive, or is in breach of the rights of the user or of others, or
    • if you have any question in relation to these Terms and Conditions of Use or the website.

    Latest update: 10.04.2024.
    Important information: This product is not risk free and provides nicotine, which is addictive. Only for use by adult smokers.