Privacy Policy

British American Tobacco HELLAS S.A., with registered office in Maroussi, Attica, 27 Agiou Thoma Street (hereinafter “ΒΑΤ” or “Company”), as Data Controller, wishes to inform its customers (both existing and future), tobacco/nicotine product consumers, generally all visitors of the website https://www.velo.com/en-gr/ (hereinafter "Website"), as well as the retailers with whom it cooperates , about the purposes and methods of processing their personal data.

More specifically, the website https://www.velo.com/en-gr/ was initially developed to inform the public about the Company's product "Velo" and in particular to share information about its price, nicotine level, flavors, ways of use and disposal, etc. In addition, through the website, any interested visitor can subscribe to the Company's newsletter to receive updates and offers on its existing or new products and, in a second stage, through the website, the visitors will also be able to purchase the "Velo" product they wish.

In particular, with regard to the forthcoming new function of the website, which will provide every interested user with the possibility of online shopping, we inform you that, in this context, the Company manages certain functions of the website through the use of electronic platforms of cooperating third party companies, where data are entered and kept of customers who place orders and complete their purchases online and provide their consent where required by the applicable legal framework for the purpose of receiving informative & promotional material and invitations to events and competitions.

The cooperating third party companies, for the purposes of the General Data Protection Regulation (GDPR), as regards the specific operations they have undertaken in each case, act as data processors. For these operations, the Company remains responsible for the processing of your personal data and specifies the details of the processing, and has signed data processing agreements with the companies to which it has assigned the performance of processing activities, in order to ensure that the processing is carried out in accordance with the applicable legal framework and that any data subject can freely and without obstruction exercise his/her rights under the legal framework. The Company has legally ensured that the parties performing the processing on its behalf meet the requirements and provide sufficient assurances for the implementation of the appropriate technical and organizational measures, in order to protect your personal data.

For any issue regarding the processing of personal data, please contact directly the Data Protection Officer (DPO), PISTIOLIS-TRIANTAFYLLOS & ASSOCIATES LAW FIRM, ANDERSEN LEGAL, email: dpo@bat.com.

CATEGORIES OF PERSONAL DATA COLLECTED FROM YOU

We collect the following personal data you provide us when you subscribe to our newsletter:

  • First Name
  • Last name
  • Phone number
  • E-mail address
  • Gender (in combination with the rest of your personal data)
  • Date of Birth

Once the new functionality of the website is implemented and, in this context, if you wish to make an online purchase, we will collect some or all, as the case may be, of the information listed below:  

  • First name
  • Last name
  • Phone number
  • Email
  • Gender (in combination with your other personal data)
  • Coupon / discount code (in combination with your other personal data that identifies you as a beneficiary and if you enter it)
  • Invoice details (name of sole proprietorship company, professional activity, Tax Reg. No.), of our suppliers or customers in case of purchase of products from our physical stores network or from our website. 
  • Address (which in case of an electronic transaction can be distinguished between shipping address and billing address)
  • Date of birth
  • Name, registered office, business address and contact details such as telephone number and email address (regarding each retailer with whom the Company cooperates, if it is a sole trader)
  • Contact details (name, telephone number, email) of the legal representative of each retailer or of the person who has been appointed to communicate with the
  • Company on behalf of the retailer. 
  • Smoking habits as potential health data
  • Current location (city or postal code, in combination with your other personal data), if you wish to enter such information to find the nearest physical "Velo" store that serves you.

We inform in particular our customers that the credit/debit card details potentially required for the completion of the online purchase will be not stored in any database of our Company during the transaction but will be entered directly in a secure environment of the cooperating bank which is responsible for the confirmation and the general management of the financial transaction.

WAYS OF COLLECTING YOUR PERSONAL DATA 

We collect the personal information you provide us whenever:

  • You place an order and make an online purchase, through our e-shop that is available on our website;
  • You purchase our products in our partners’ physical stores ;
  • You subscribe to our newsletter;

We may obtain data from other third-party sources, for example when our partners collect your data when you express your interest in our products, or as mentioned above, when you purchase products through our authorized partners, in the context of social or other promotional events, or when active customers recommend to us that we contact you to resolve problems related to the operation of the device or for information you wish to receive about our products. Regarding the retailers, we collect their personal data from the network of our distributors, following orders they receive from retailers for our company’ s products. 

The personal data we collect from you is necessary to allow us to fulfil our duties towards you or others. For example, when you make an online purchase you will be asked for information that is necessary for the conclusion and performance of the contract, while you may also be asked for information to facilitate the delivery of your order (e.g. shipping address). Also, when you subscribe to our Newsletter in order to receive email notifications, we must collect your personal data in order to be able to process your request. In addition, other information may be required to ensure the commencement and smooth development of our contractual relationship, such as your date of birth, in order to determine if you meet the legal requirements for the use of tobacco products.

In the event that you refuse to disclose certain personal data to us, which is deemed necessary for meeting each purpose of the processing, we may not be able to provide the services you desire or we may not be able to satisfy a request you may have. 

LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA

In accordance with European Regulation 679/2016 for the protection of personal data, there are specific reasons for which we may legally process your personal data. These reasons are:

a)    When the processing of your data is done in the context of the provision of our services (sale of tobacco products) and for the proper fulfilment of our contractual obligations.

For the purchase of our products through our e-shop that is available on our website or with physical presence from stores of our authorized partners, for the management of your order and its delivery to the address you wish, as well as for your general convenience for any issue related to the provision of the "Velo" product sales services to you, it is necessary to process your personal data, so that we can fulfil our contractual obligations to you and to provide you with the services you wish. In the cases where you choose physical transactions, we can provide the above services to you through the network of our authorized partners’ physical stores.

The processing of our retailers’ personal data is carried out in the context of the execution of our broader commercial cooperation for the promotion and distribution of our Company's products to consumers through our retailers. 

b)    The consent you provide to us under the specific conditions set by the legal framework for the use of your personal data

When you subscribe to our newsletter, we ask for your consent in order to process your personal data for marketing purposes and in particular to send you invitations to events, newsletters, updates and offers about our existing and/or new products, through one or more communication channels of your choice.  

You have the right to withdraw your consent at any time either by choosing to unsubscribe in each communication or by sending an email to dpo@bat.com. However, the withdrawal of consent does not affect the legality of the processing based on the consent prior to its withdrawal.


c)    Protection of our legitimate interests

We use your personal data to protect the legitimate interests of our Company, provided that these interests do not override your rights and interests. The legitimate interests pursued by our Company may include, among others, the following:

  • Ensuring the proper functioning of our website.
  • Ensuring the security of the network and information and protecting your personal data from loss or damage, theft, or unauthorized access.
  • Helping us objectively assess and improve the products and services we offer. For this reason, we use your data (name, phone, or email) to conduct customer satisfaction surveys or market research among Velo consumers.
  • Helping us better understand the needs of visitors to our website and provide them with useful information and the appropriate services.

d)    When the processing of your personal data is necessary in order to comply with the obligations imposed by law.

We are required to use your personal data when this is expressly mandated by a provision of the law or in the framework of regulatory compliance, for example when we process your data for tax purposes or to ensure that the use and the purchase of tobacco products is held according to the law, only by adults.

e)    The reason justifying processing of data that may be considered as falling within the special categories of data (ie. Smoking habits as potential health data) is that this kind of data is manifestly made public by the data subject upon expression of the latter’s interest in our products (e.g. through the quiz available on the website).


PURPOSES OF PERSONAL DATA PROCESSING

Your personal data is processed mainly electronically, for the following indicative purposes:

α) Provision of services for the sale of "Velo" products by physical transaction or execution of electronic orders: In order to properly fulfill the services of selling "Velo" products that we have undertaken towards you, including the management of your orders, the delivery of your orders to the address you wish and for your general convenience in any matter relating to the provision of our services to you, we will need to process the personal data that you disclose to us, such as, but not limited to, your full name, address, date of birth, contact details, etc.

b) For marketing/promotional activities, such as sending invitations to events, newsletters, updates, and offers for our existing or new products, as well as information about competitions, when you indicate that you wish to be informed about our products through one or more communication channels of your choice. 

c) To carry out research and statistical analysis on the Company's product "Velo" and in particular to monitor its demand in the market. Please note that for this purpose your demographic data is collected, in particular your gender and age.

d) Compliance with the legal framework: To ensure that we promote and sell tobacco products to adults only, to inform you of any product safety or recall issues, etc.

e) Ensuring the best and most efficient operation of the website.

f) The processing of our retailers’ personal data is carried out for the fulfilment of the scope of our broader commercial cooperation and in particular to enable the promotion and distribution of our Company's products to consumers, through our retailers, and the communication with the latter regarding any issue that may arise during our transactional relationship. 


STORAGE PERIOD

When the processing of your personal data is based on the execution of the contract between us, your personal data are stored for as long as necessary for the execution of the contract and the provision of the services we have undertaken towards you or for as long as stipulated by law for the establishment, exercise, and/or support of legal claims under the contract. 

For the purpose of product and services marketing activities, your personal data are stored until the withdrawal of your consent. You may withdraw your consent at any time. Withdrawal of consent shall not affect the lawfulness of the processing based on the consent given in the period prior to its withdrawal.

Where processing is mandatory under the applicable law, your personal data will be stored for the period provided by the relevant provisions applicable in each case.

Personal information will be processed in accordance with applicable regulations and, in any case, in a way that guarantees their security and confidentiality, preventing their disclosure or unauthorized use, modification or destruction.


DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

The Company uses third parties in certain cases that require the processing of your personal data.

The third parties involved in these activities are carefully selected, are specialized, competent, reliable and provide adequate guarantees as regards their compliance with the applicable data processing laws and regulations, including the security profile of such personal information.

For some processing activities the Company has appointed such third parties as Data Processors or in each case has explicitly authorized them for the processing described in this statement. In these cases, the Company remains responsible for the processing of your personal data, determines the individual elements of the processing and signs Data Processing Agreements with the third parties to whom it entrusts the performance of processing activities, in order to ensure that the processing is carried out in accordance with the applicable legal framework and that each data subject can freely and without restriction exercise his or her rights. 

The Company will periodically check that third parties perform their respective duties and that they comply with the measures for the protection of personal information.
The Company cooperates with third companies, organized in a network of physical stores, in order to make its products available on the physical market and to consumers who prefer physical transactions. When purchasing products, our authorized partners, resellers, process the personal data of our customers, in order to complete the purchase of products, or to resolve any problem the customer may encounter from the use of the device, or even to service the warranty of the purchased product, as well as to register on behalf of the Company the corresponding positive statements of consumers for receiving informative material through various channels, if the latter so wish.  

In the case of an electronic transaction, the Company, in order to complete an online purchase through its website and to deliver the products to the customer, cooperates with third companies that forward, organize the order and invoice the products of the transaction, as well as with cooperating courier companies. When cooperating companies resell the relevant products in respective permitted channels in accordance with the applicable terms agreed with the Company, they act as independent controllers for the purpose of the resale.

The Company may also forward your personal data to third parties, so that they are processed for the purpose of conducting market analysis and processing of data, statistical or targeted, for products that are for sale.

The Company may also provide access to your personal data, when required, to third party contractors for the purpose of technical support and maintenance of its database [e.g., online platform providers, IT support technicians].

The Company may also disclose your personal information to public or other authorities or law enforcement bodies, if required by laws, regulations, administrative or judicial measures, etc.

The Company may disclose your data, for processing and independent use, to other companies in the British American Tobacco Group based abroad, for the conduct of market analysis and processing, on an anonymized/ aggregated form .

We inform you that your personal data is not transferred to third countries, i.e. countries outside the European Economic Area in the context of this webpage. 


YOUR RIGHTS WITH RESPECT TO YOUR PERSONAL DATA

Any data subject whose data is being processed by BAT has the following rights:


Right to withdraw consent:

If we have obtained your consent to the processing of your personal data for certain activities, you may revoke your consent at any time and we will stop processing your data for the purpose for which you consent, unless we consider that there is an alternative legal basis to justify the continued processing of your data for this purpose, in which case we will notify you of such processing.

For this purpose, you can send your request in writing to the E-mail: dpo@bat.com . In addition, each advertising email has a link that allows you to disable the sending of our newsletters and other promotions.


Right of access:

You have the right to be aware and verify the legitimate nature of the processing. So, you have the right to access your personal data and receive additional information about how we process it.


Right to rectification:

You have the right to study, correct, update or modify your personal data by contacting the Data Protection Officer (DPO) at the above contact details.


Right to erasure:

You have the right to request deletion of your personal data when we process it on your consent or in order to protect our legitimate interests. In all other cases (such as, where there is a contract, obligation to process personal data legally required, or public interest), this right is subject to specific restrictions or shall not exist, as the case may be.


Right to restriction of processing:


You have the right to request a restriction of the processing of your personal data in the following cases: (a) when the accuracy of the personal data is contested and until the accuracy is verified (b) when you oppose the deletion of your personal data and request the restriction of their use instead, c) when personal data are not needed for processing purposes, they are however required for the establishment, exercise, or defense of legal claims, and (d) when you object to the processing and the decision on your objection to processing is pending.


Right to object to processing:

You have the right to object at any time to the processing of your personal data where, as described above, the processing is based on the legitimate interests we pursue as Data Controller, as well as, for the purposes of direct marketing and consumer profiling, if applicable.


Right to data portability:

You have the right to receive your personal data free of charge in a format that allows you to access, use, and edit them with commonly used editing methods. You also have the right to ask us, in case it is technically feasible, to transmit the data directly to another controller. Your right to do so exists for the data you have provided to us and is processed by automated means based on your consent or for the execution of a relevant contract.

In order to exercise any of the above rights you may directly contact the Data Protection Officer of BAT, PISTIOLIS-TRIANTAFYLLOS & ASSOCIATES LAW FIRM, ANDERSEN LEGAL, by e-mail at: dpo@bat.com.

You can also contact us to ask questions or exercise your rights in the following ways: a) by post to Maroussi, Attica, 27 Agiou Thoma Street, P.C. 15124 or b) on the phone number 8005001450.


Right to lodge a complaint with a Supervisory Authority

You have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr) through its dedicated online portal (https://eservices.dpa.gr/). For more information you may consult the Hellenic Data Protection Authority’s site. 


CHANGES TO THIS PRIVACY POLICY

We may make changes to this Privacy Policy at any time by posting a copy of the modified notice on the Website, so please ensure to check back regularly.