PRIVACY POLICY

Our Company, British American Tobacco HELLAS S.A., with registered office in Maroussi, Attica, 27 Agiou Thoma Street (hereinafter referred to as "BAT" or "Company"), as Data Controller, wishes to inform its customers (existing and future), the consumers of tobacco and nicotine products and in general any visitor of the website https://www.velo.com/gr/en (hereinafter referred to as "Website") regarding the purposes and the way of processing their personal data.

More specifically, https://www.velo.com/gr/en is a brochure webpage developed to inform the public about the Company’s new product named “Velo” and in particular to share information about its price, nicotine level, flavors, the ways to use it and dispose it etc. Moreover, through the Website the visitors who are interested can subscribe to the Company’ s newsletter in order to receive updates and offers on our existing or new products.

For any issue regarding the processing of personal data, please contact directly the Data Protection Officer (DPO), PISTIOLIS-TRIANTAFYLLOS & ASSOCIATES LAW FIRM, ANDERSEN LEGAL, email: dpo@bat.com.

CATEGORIES OF PERSONAL DATA COLLECTED FROM YOU

We collect the following personal data you provide us when you subscribe to our newsletter:

• First Name
• Last name
• Phone number, in case you wish to receive communications through the channels mentioned in the respective option
• E-mail address
• Gender (in combination with the rest of your personal data collected)
• Date of Birth

We collect your personal data upon filling the subscription form to our newsletter.

LEGAL BASIS FOR PROCESSING YOUR PERSONAL DATA

Under the European Regulation 679/2016 regarding the protection of personal data, there are specific reasons why we can lawfully process your personal data. These reasons are the following:

a) The consent you provide us under the specific conditions set by the legal framework for the use of your personal data

When you subscribe to our newsletter, we ask for your consent in order to process your personal data for marketing purposes and in particular to send you invitations to events, newsletters, updates and offers about our existing and/or new products, through one or more communication channels of your choice.

b) The protection of our legitimate interests

We may use your personal data in order to protect our Company’ s legitimate interests and provided that the latter do not prevail over your rights and interests. The legitimate interests pursued by our Company may include, but are not limited to, the following:

• To ensure the smooth operation of our website.
• To ensure network and information security and to protect your personal information against loss or damage, theft or unauthorized access.

c) Our compliance with our legal obligations

We are obliged to use your personal data when this is expressly required by the Law or in the context of regulatory compliance, for example processing your personal data such as your date of birth to ensure that we are promoting tobacco products only to adults.

d) The reason justifying processing of data that may be considered as falling within the special categories of data (ie. smoking habits as potential health data) is that this kind of data is manifestly made public by the data subject upon expression of the latter’s interest in our products.

PURPOSES OF PROCESSING YOUR PERSONAL DATA

Our Company processes your personal data electronically and for the following purposes:

a) For marketing / promotional activities, such as sending invitations to events, newsletters, updates and offers on our existing or new products, information on competitions, when you declare that you wish to be informed about our products through one or more communication channels of your choice.

b) To conduct surveys and statistical analyses regarding the Company's new product Velo and in particular to keep track on its demand in the market. Please note that for this purpose, your demographic information is collected and, in particular, your gender and age.

c) For our compliance with the legal framework (promoting tobacco and nicotine products only to adults, notifications on any product safety or product recall issues etc.).

d) To ensure the best and most efficient performance and operation of the Website.

STORAGE PERIOD

When processing is based on your consent your personal data is retained until you withdrawn your consent. Such withdrawal may be effected at any time without affecting the lawfulness of the consent-based processing in the period prior to its withdrawal.

When processing is required as an obligation under the applicable laws, your personal data will be stored for the period prescribed in the relevant provisions applicable to each case.

DISCLOSURE OF PERSONAL DATA TO THIRD PARTIES

The Company transfers your personal data to the following categories of recipients:

• The Company’ s Partners: BAT maintains partners to whom it assigns the processing of personal data on its behalf [e.g. web platform providers, IT support technicians]. In these cases, the Company remains responsible for the processing of your personal data, defines the specific elements of the processing and signs Data Processing Agreements with the third parties to whom it assigns the performance of processing activities, in order to ensure that the processing is carried out in accordance with the applicable legal framework and that each data subject can freely and without restrictions exercise its rights.
• State authorities, law enforcement bodies: When necessary, within the competence of the authorities and in accordance with the prescribed legal procedures.
• Other companies of the British American Tobacco Group  on an anonymized/ aggregated form.

We inform you that your personal data is not transferred to third countries, i.e. countries outside the European Economic Area in the context of this webpage.

YOUR RIGHTS WITH RESPECT TO YOUR PERSONAL DATA

Any data subject whose data is being processed by BAT has the following rights:

Right to withdraw consent:

If we have obtained your consent to the processing of your personal data for certain activities, you may revoke your consent at any time and we will stop processing your data for the purpose for which you consent, unless we consider that there is an alternative legal basis to justify the continued processing of your data for this purpose, in which case we will notify you of such processing.

For this purpose, you can send your request in writing to the E-mail: dpo@bat.com . In addition, each advertising email has a link that allows you to disable the sending of our newsletters and other promotions.

Right of access:

You have the right to be aware and verify the legitimate nature of the processing. So, you have the right to access your personal data and receive additional information about how we process it.

Right to rectification:

You have the right to study, correct, update or modify your personal data by contacting the Data Protection Officer (DPO) at the above contact details.

Right to erasure:

You have the right to request deletion of your personal data when we process it on your consent or in order to protect our legitimate interests. In all other cases (such as, where there is a contract, obligation to process personal data legally required, or public interest), this right is subject to specific restrictions or shall not exist, as the case may be.

Right to restriction of processing:

You have the right to request a restriction of the processing of your personal data in the following cases: (a) when the accuracy of the personal data is contested and until the accuracy is verified (b) when you oppose the deletion of your personal data and request the restriction of their use instead, c) when personal data are not needed for processing purposes, they are however required for the establishment, exercise, or defense of legal claims, and (d) when you object to the processing and the decision on your objection to processing is pending.

Right to object to processing:

You have the right to object at any time to the processing of your personal data where, as described above, the processing is based on the legitimate interests we pursue as Data Controller, as well as, for the purposes of direct marketing and consumer profiling, if applicable.

Right to data portability:

You have the right to receive your personal data free of charge in a format that allows you to access, use, and edit them with commonly used editing methods. You also have the right to ask us, in case it is technically feasible, to transmit the data directly to another controller. Your right to do so exists for the data you have provided to us and is processed by automated means based on your consent or for the execution of a relevant contract.

In order to exercise any of the above rights you may directly contact the Data Protection Officer of BAT, PISTIOLIS-TRIANTAFYLLOS & ASSOCIATES LAW FIRM, ANDERSEN LEGAL, by e-mail at: dpo@bat.com.

You can also contact us to ask questions or exercise your rights in the following ways: a) by post to Maroussi, Attica, 27 Agiou Thoma Street, P.C. 15124 or b) on the phone number 8005001450.

Right to lodge a complaint with a Supervisory Authority

You have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr) through its dedicated online portal (https://eservices.dpa.gr/). For more information you may consult the Hellenic Data Protection Authority’s site.

CHANGES TO THIS PRIVACY POLICY

We may make changes to this Privacy Policy at any time by posting a copy of the modified notice on the Website, so please ensure to check back regularly.