Privacy Policy

Introduction

For the purposes of this policy, C.A.C. Papantoniou Trading Ltd, "the Company", with registration number H.E. 211975, the owner of the trademark "Papantoniou Supermarkets" ("Papantoniou") is the controller of the personal data. For our Company, the respect and protection of your personal data is of the highest priority for us. We are taking all necessary technical and organizational measures in order to comply with applicable laws.

Customers, employees, partners and visitors to our website must feel safe and confident when giving, collecting and processing their data, and to consider the implementation of data protection as a characteristic of the quality of service provided. For Papantoniou, safeguarding the processing of personal data is an integral part of the ongoing effort to improve its services and is committed to comply with current legislation and implement this policy.

This current policy statement is a brief on how we collect and process customer, employees and visitor personal information to provide them services, update them for new offers, and promote new services through the use of appropriate security tools and techniques. It also aims to inform them about their rights in accordance with applicable law.

Papantoniou reserves the right to renew or update this policy without any notice in accordance with applicable national and Community legislation. When a change is made, we will make earlier versions available on request so that you can see what those changes are. If these changes change key elements of this Policy or its meaning, we will notify you in advance of these changes.

Explained terms used in this policy:

"Personal Data" is any information through which an individual is identifiable or identifiable. (Article  4(1) GDPR).

"Processing of Personal Data" is any action taken by using personal data such as collecting, storing, using them, disclosing to third parties who assume the management of personal data in the name and on behalf of Papantoniou in order to achieve a specific business purpose (Article 4(2) GDPR).

"Data Controller" means a natural or legal person, public authority, service or other body which, individually or jointly with others, determines the purposes and manner of processing personal data where the purposes and manner of such processing determined by Union law or the law of a Member State, the controller or the specific criteria for his appointment may be laid down by Union law or the law of a Member State (Article 4 (7) GDPR).

"Data processor " means a natural or legal person, public authority, service or other entity that processes personal data on behalf of the Data Controller (Article 4 (8) GDPR).

"Data subject" means the natural person to whom the data relate and whose identity is known or can be identified, that is to say it can be identified directly or indirectly, in particular on the basis of an identification number or one or more specific elements characterizing the substance in terms of physical, biological, mental, economic, cultural, political or social.

"Legal basis" is in accordance with Article 6 of the General Regulation for the Protection of Personal Data the basis for which the processing of Personal Data takes place.

"Legitimate interests" The processing of personal data is essential for the improvement of Papantoniou’ s services (processing of statistics and non-identifiable data) to identify fraud and to safeguard its legitimate interests.

1. Our Basic Principles governing the Safeguarding of Personal Data Protection
2. Collection and processing of data solely for business purposes and promotion of improvement of the services provided

1. Collecting and managing the absolutely necessary data for the purpose of the processing
2. Compliance with applicable laws and regulations.
3. Maintain transparency regarding the use and processing of the Personal Data held as well as to update the data subjects honestly.

1. Taking appropriate technical and organizational measures in relation to the security of personal data processed by us.

2. How Papantoniou collects Personal Data

Papantoniou collects Personal Data in a variety of ways.

The information gathered is what you provide directly when you deal with us in one of the following ways:

i. Provide services to us either by entering into a contract or by invoicing
ii. By creating Papantoniou Gift Card
iii. By Subscribing to our newsletter
iv. Communicate or deal with us:

• through our website
  • through our pages in social media
  • by email
  • by phone
  • by Customer surveys
  • by submitting a complaint
  • Investigating accidents occurring within our premises
  • Participating in competitions (within stores or through Social Media Networks)

1. send CVs either on paper or electronically
   vi. Through CCTV system that is installed on our premises.
   vii. Admission and browsing our site may result in the collection of some personal information through the use of automated technologies - cookies, server logs etc.

viii. By downloading and registering on our application (Papantoniou app)

3. What kind of Personal Data is collected by Papantoniou?

Papantoniou collects only the necessary data which is related to the purpose of the processing.

1. Personal information: Name, gender, identity card, title, occupation, date of birth, marital status - information on family members, nationality, language, business license, photo (in case of winner of competitions), workplace, occupational history, health status
2. Contact details: e.g. Postal address, e-mail address

• Bank details: e.g. bank account number / IBAN for people who have a payment right from us

1. Website: e.g. Information about your activity
2. Any other information you share with us: e.g. for personalized service to you, or for any other purpose

4. Why we process your personal data and on what legal basis

As abovementioned, we are committed to protecting your privacy and handling your data in an open and transparent manner, therefore, we process your personal data in accordance with the GDPR and the Cyprus Data Protection Act for one or more of the following reasons:

A. For the execution of a contract

We process personal data with the specific legal basis in cases involving suppliers and / or partners, with whom there is relevant contract in place.

B. For compliance with a legal obligation

There are certain legal obligations arising from the relevant laws that are applicable to us as well as they are legal requirements. Such obligations and requirements may impose on us the necessary personal data processing activities for identity verification, compliance with court decisions / court decrees and reporting obligations of tax or other legislation.

C. For reasons of protecting our legitimate interests

We process personal data in order to safeguard the legitimate interests pursued by us. There is a legitimate interest when we have a business or commercial reason for which we use your information. But, even then, you should not unjustly oppose what is right and best for you.

D. With your consent

We process personal data after your explicit consent. Examples of processing your personal data after your consent are the sending of informative/promotional material by Papantoniou.

5. How Papantoniou uses your Personal Data

Promotional offers / actions: We would like to send you informational material to inform you about new offers, contests and other promotions provided that we have received from you explicit and free consent to this.

You can change your mind and opt out of this type of communication at any time by following the instructions included in each communication method.

We may process your personal data to inform you about products, services and offers that may be of your interest or your business. The contents of the newsletter include promotions (offers, discount offers, contests, etc.) as well as Papantoniou products and services.

With your consent, we analyze your shopping behavior on the websites related to Papantoniou, in the mobile applications, as well as in our newsletters. The evaluation of the usage behavior includes in particular the areas of the respective website, the mobile application or the newsletter in which you visited and the links that you activated. With this information we create user profiles that are classified by person and / or e-mail address, in order for the advertising of offers, especially in the form of newsletters, advertising on the website and print advertising, to better adapt to your personal interests and to improve our offers.

The legal basis for the processing of data in this context is consent in accordance with Article 6 (1) (a) of the GDPR regulation. You can change your mind and opt out of this type of communication at any time by following the instructions in each communication method.

Processing data for marketing / profiling: The personal data we process for this purpose consists of information you provide to us and data we collect and / or infer when you use our services, such as information about your purchases. We study all this information to form an opinion on what we think you may need or what you may be interested in. In some cases, profile training may be used, ie we process your data automatically in order to evaluate certain personal information, in order to provide you with targeted marketing information regarding products and / or offers.

We may use your personal information to promote our products and offers to you only if we have your express consent to it or if, in certain cases, we consider it in our legitimate interest to do so.

You have the right to object at any time to the processing of your personal data for marketing purposes, including profiling, by contacting us using the contact method listed below.

These forms of communication can be used when you are using our website or the Papantoniou App.

Closed TV Circuit: We collect data from the closed television circuit that we have installed in our stores solely for the protection of the health of the employees, customers and visitors of Papantoniou as well as for the protection of our legitimate interests.

Photos for promotional purposes: Each winner of the Papantoniou contests is photographed when accepting gifts exclusively for promotional purposes where their photos may be uploaded to social media, the Company's website or the media. The posting of the photos is always done after your explicit and clear consent. You can change your mind and cancel the post at any time by following the instructions in each communication method.

Your registration in the loyalty program: It is essential for us to contact you as well as to receive the privileges of the loyalty program as well as your ability to participate in the various draws / competitions.

Communicating with you: We use your information to help you better, such as optimizing your complaint management, updating your data security policy, participating in satisfaction surveys.

Cookies policy: We use your online footage to improve our site's experience of browsing, anonymous traffic statistics, Google Analytics advertising features, and targeting our ads.

You have the option to disable Cookies wholly or partially from your Computer, even you can place the setting to receive alerts when the sites have cookies enabled.

Please note that if you choose to block or partially block cookies, some parts of our site may not work as expected.

For more information, please refer to our cookies policy.

Other Goals: We will only use your personal information for the purposes for which we have collected, unless we reasonably believe we should use it for any other reason and that the reason is compatible with the original purpose.

If we need to use your personal information for an irrelevant purpose, we will notify you and explain the legal basis that allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in accordance with the above rules, when required by law.

6. Protecting your Information

Papantoniou applies high levels of security, both technically and organizationally, when collecting and processing your data. This is regularly reviewed to ensure that these measures remain effective and updated through internal feedback as well as current technological developments.

7. Keeping Information

Papantoniou makes every effort to limit the retention of your Data to the minimum possible. In order to be sure that we meet our legal obligations as they arise from the legislation in force, we only keep your information as long as we really need it and only for the purposes we first acquired.

In most cases, this means we will keep your information as long as you continue to shop with us or use our services and if you decide to stop shopping from us for some time after you stop so that do not lose your rights if you start shopping with us again. After that either we will delete or anonymize your data with a specific algorithm so that it can no longer be linked to your individual.

In cases where your personal data is anonymised, it will only be for research or statistical purposes, so we may use this information indefinitely without further notice to you.

In addition, in accordance with applicable laws, we need to keep basic information about our clients and associates (including contact, identity, financial information and transactions) for six years from the time they cease to be customers for tax purposes.

In addition, if you exercise your right of cancellation as described in paragraph 10, Section IV, it will be impossible to observe any of our contractual obligations, such as product warranty, unless you retain a relevant document proving our contractual obligation.

In some cases, you may want to delete your data: see section 8 (The rights of persons undergoing edits) below for more information.

8. Social media networks

Your interactions with various social media features and widgets that are on the site either by a third party or are hosted directly by our Company, governed by the privacy policy of the company providing this service.

Depending on your own settings or social media and messaging policies such as Facebook, Instagram or Twitter, you may be able to access certain information on Papantoniou and other organizations. You should check with these services to make sure you are happy with sharing this information.

9. Personal Data of Minors

Protecting and preserving the privacy of minors in Papantoniou is of major importance and we are trying to avoid collecting such data.

When and where it is necessary to collect such information, we apply procedures appropriate to that age group.

Particularly for the loyalty program of the children after the affiliation program has been confirmed, children's names are shadowed in a way that they cannot be recovered from any of the minors' data

If the age of the minor is under 14, we always ask for the consent of at least one of his / her parents or guardians according to the "The Protection of Individuals Against the Processing of Personal Data and the Free Movement of this Data Act of 2018 (125 (I) / 2018)".

10. Transfer of Your Personal Information to third parties

Papantoniou, in the context of promoting the well-meaning interests of its activities, may share information with carefully selected organizations that offer some services necessary for the conduct of its business. These include:

• Specialized service companies
• Training Organizations
• Insurance Companies
• Suppliers in the context of the individual competitions

No information is shared with any organization outside the EU.

11. The rights of data subjects on data processing

Papantoniou takes seriously and promotes your own rights with respect to the collection and processing of your Personal Data. If you wish to exercise any of your following rights you can do that by email at This email address is being protected from spambots. You need JavaScript enabled to view it. or at the postal address at the end of this policy.

For your own security and for our fuller legal compliance, we reserve our right to request further information necessary to confirm your identity when responding to an existing request. If you cannot identify yourself, we also reserve our right to refuse to respond to your request.

1. Right to Review: You have the right to request information from us about your personal data stored in us, the purpose of the processing, and any third party recipients.
2. Right of Correction: You have the right to request the immediate correction and / or completion of your personal data stored on us.
3. Right to limit processing: You have the right to request the restriction of the processing of your personal data if you dispute the accuracy of your data stored in us, if the processing is illegal and if the data is no longer necessary, but you do not wish to delete the data and you require data for the foundation, exercise or support of legal rights, or in case you have notified your objection to the disclosure work.
4. Right to Delete: You have the right to request the deletion of your personal data stored by us

Note: When exercising the right to delete, we may be required to maintain or store data in accordance with applicable laws, contractual obligations, in the public interest, for the establishment or defense of legal claims or for the exercise of our legitimate rights. Such data will be limited instead of deleted so as to prevent their use for other purposes.

Also, if you exercise your right to delete and avoid your own inconvenience, we point out the provisions of Article 6 (6) above, concerning product warranties.

1. Right to data portability: You are entitled to receive a copy of the data you have provided to us, which will be sent to you or a third party in a structured, commonly used and readable format. In case you request the direct sending of data to another data controller, this will only be done if it is technically feasible.
2. Right of objection: If your personal data is processed by legitimate interests pursuant to Article 6 (1) (f) of the GDPR, you have the right to opt-out at any time in accordance with Article 21 of the GDPR.

• Right of Withdrawal of Consent: You have the right to withdraw your consent to the collection of the data at any time, which will be revoked for the future. Data collected until the revocation becomes legally valid is not affected by it. We hope you understand that processing your recall may take some time for technical reasons and that you may still receive messages from us in the meantime.
• Right to submit a complaint to the Supervisory Authority: In such case where you think that your personal data processing violates data protection law or if your data protection rights have been violated in any other way, do not hesitate to contact us to inform us or file your complaint to the email This email address is being protected from spambots. You need JavaScript enabled to view it. or write us at the post address shown at the end of this document in order to assess it and for our internal improvement or alternatively you can file your complaint to the Data Protection Office http://www.dataprotection.gov.cy, the data protection supervisory authority of the Republic of Cyprus.

12. Data Protection Officer

The Data Protection Officer of Papantoniou (DPO) oversees compliance with this privacy notice. If you have any questions or concerns about this privacy notice or how we handle your personal information, please contact the Data Protection Officer as follows:

• Sending us a message at the e-mail address This email address is being protected from spambots. You need JavaScript enabled to view it.

or

• Writing to us at:

Personal Data Protection Officer

Papandoniou Supermarkets

C.A.C. Papantoniou Trading Ltd

1, Ellados Avenue

8020 Paphos

Cyprus

Version: August 2022