This EKO Smile Privacy Policy (“Policy”) is designed to give you (by “you”, we mean the data subject, be it an EKO Smile Member or other user of our EKO Smile website) information about what personal data we process about you under or in relation to the EKO Smile Programme, in relation to your use of this website www.ekosmile.bg (hereinafter referred to as the ‘”EKO Smile Website” or the “Website”), in relation to your use of the EKO Smile App or in other cases when you interact with us by any other means under or in relation to the EKO Smile Programme.  Further, this Policy provides information on how we use your personal data and why, under what circumstances we may share it, and your choices and rights with respect to your personal data.
All terms used in capital letters which have not been defined hereunder, shall have the meaning given to them under the EKO Smile Programme General Terms and Conditions, the most recent version of which is published on www.ekosmile.bg.  The principal rules for the EKO Smile Programme are set forth under the EKO Smile Programme General Terms and Conditions. 

The data controller of your personal data processed in accordance with this Policy is
Personal Data Protection Officer of EKO Bulgaria EAD - contact details:
Ms. Desislava Vassileva
E-mail: office@eko.bg
Contact phone: + 359 2 448 5500
Address: 3 Lachezar Stanchev Str., Litex Tower Complex, fl. 9, 1756 Sofia, Bulgaria. 

a) EKO Smile Account Information
When you create your EKO Smile Account you will be asked to specify your:
(i)     first name and family name ;
(ii)    salutation;
(iii)   mobile number;
(iv)   e-mail ;
(v)    EKO Ekonomy card number or your plastic EKO Smile Loyalty Card number (if you have such);
(vi)   city of residence;
(vii)  date of birth.

b) Transaction Information
c) Programme Analytics
This is personal data regarding how you interact with EKO and the EKO Smile Programme. This includes:
•    Your EKO Smile Member ID;
•    the EKO purchases you make;
•    which offers and promotions you engage with and use;
•    the EKO Smile Loyalty Points Redemptions you make;
d) Surveys and Market Research
e) Contact Centre Information
f) Competitions Data
g) Device information, Cookies & Similar Technologies
a) Data from EKO Smile Partners
b) Data from third party data companies
c) Anonymous data
When personal data has identifying details removed, that information can become anonymous. This can happen if we remove details such as names and addresses, or aggregate personal data into groups and keep only the information about the groups (e.g. information about people at a post code level or a report of shopping behaviour broken down by age), or when we create models from personal data that identify certain characteristics associated with certain traits (e.g. customers likelihood to buy a particular product or category).  
Pseudonymised data is similar but slightly different from anonymous data. Although identifying details such as names and addresses are removed, it is possible to identify the data subjects by reference to a ‘key’ held separately. Pseudonymised data may be used to enhance security and privacy by enabling data to be processed at an individual level without requiring identifying details to do so. Pseudonymised data remains personal data and is covered by this Policy.

This section explains how and why we process your personal data, and our legal basis for this. We may use an automated decision-making process, for example, when marketing to you, we might take into account Transaction Information, your EKO Smile Account information and Programme Analytics.
In some cases, you have the right not to be subject to a decision based solely on automated processing, including profiling, which has legal effects for you or affects you in a similarly significant way. If you are seeking to exercise this right, please contact us using the details in the “Contact Us” section below.

We combine the personal data we have and analyse it to look for patterns, trends and characteristics that align with a particular outcome – for example, items that are often purchased together, or popular times to redeem points. We use this analysis to create a framework that maps out these patterns, trends and characteristics on an anonymous basis - we call these frameworks “data models” and the process of making them “data modelling”.

Data modelling helps us to analyse the way that groups of people are shopping. For instance, we might look at transaction information at EKO and see that buyers of premium fuels are starting to buy coffee - which could be useful information for EKO Smile Partners who offer coffee machines for the redemption of EKO Smile Loyalty Points

We can then apply data models to a personalised data set, to help us tailor the offers that we show EKO Smile Members. For example, sending coffee machine offers to buyers of EKO coffee.

The EKO Smile Programme is wholly owned and operated by EKO. We share your personal data within the EKO network (a network of entities and individuals that participate in EKO’s business activity in Bulgaria as well as the members of the HelleniQ Energy Group) for purposes such as:
• To operate the EKO Smile Programme
• Analyse your use of the EKO Smile Programme
• Market to you based on your Smile Profile
• Competitions
• Conduct Surveys and Market Research
• Create and apply data models
We may share your personal data with EKO Smile Partners, for purposes such as:
• To operate the EKO Smile Programme
The types of personal data we share with EKO Smile Partners include:
• Transaction Information
• Competitions Data
We work with different companies so that they can help us run the EKO Smile Programme, as well as deliver other services you require from us or we think you might be interested in. We share the personal data we have with those suppliers and service providers for the following purposes:
•    To operate the EKO Smile Programme, e.g.:
  o    Affiliate marketing networks to bring you some of our offers
  o    Companies that provide IT and Cloud infrastructure services and support
•    Market to you based on your EKO Smile profile, e.g.:
  o    Online and social platforms such as Google or Facebook
  o    Advertising and marketing agencies
  o    Companies which help us deploy our emails
  o    Companies which help us deploy SMS and other campaigns through electronic means
  o    Companies which shall issue the Coupons you might receive
  o    Providers of messenger services.  
•    Analyse your use of the EKO Smile Programme, e.g.:
  o    Companies that provide analytics support
  o    Companies that provide data matching support
•    Competitions, e.g.:
  o    Companies who administer competitions for us so they run smoothly and fairly
•    Surveys and Market Research, e.g.:
  o    Companies who conduct market research on our behalf or in conjunction with us
•    Provide Customer Service Support, e.g.:
  o    Companies who run our contact centres, which need your personal data to identify or contact you as well as deal with your query, including with our Customer Service Centre.  
•    Create Data Models and anonymise data, e.g.:
  o    Companies which offer anonymisation and data modelling services
We may also share your personal data with other organisations including:
• If we are required to by law, under any code of practice by which we are bound or where we are asked to do so by a public or regulatory authority
• If we need to do so in order to exercise or protect our legal rights, users, systems and services
• In response to requests from individuals (or their representatives) seeking to protect their rights or the rights of others. We will only share your personal data in response to requests which do not override your privacy interests. For example, we will not share your personal data with individuals who are merely curious about you, but we will share your personal data to e.g. insurers, solicitors, law enforcement etc. which have a demonstrable legitimate interest in your personal data.

EKO will generally not transfer your personal data outside of the European Union. In case we transfer your personal data to countries outside of the EU, such transfer will be carried out only upon your explicit consent or under a contract or other lawful basis.  When we do this, your personal data will continue to be subject to one or more appropriate safeguards set out in the applicable EU legislation.

If you would like to request deletion of your personal data, please see the ‘Your choices and rights’ section below.

You have a number of rights under data protection legislation which, in certain circumstances, you may be able to exercise in relation to the personal data we process. If you would like to exercise one of your rights as set out in the “Your choices and rights” section, or you have a question or a complaint about this Policy, or the way your personal data is processed, please contact us through the options given in the Contact Us section at the end of this Policy.  
1.    Right to receive Information and Access your Personal Data:
You have the right to require information about if and what personal data of yours is being processed. You have the right to access your processed personal data and demand information on the conditions for processing.

2.    Right of rectifying your Personal Data:
You have the right to require the rectification of inaccurate personal data. In case the personal data is incomplete, you have the right to require that it is completed.  

3.    Right to Erasure (“to be forgotten”):
You are entitled to require the erasure of your personal data and EKO will erase it without undue delay in case:
(a)    the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;
(b)    you have withdrawn your consent on which the processing is based, when there is no other grounds for the processing;
(c)    you have objected against the processing and EKO does not have sufficient grounds to keep processing the data;
(d)    the personal data has been unlawfully processed;
(e)    the personal data has to be erased for compliance with a legal obligation pursuant to law that is applicable in the territory/country to which you are a member;
(f)    the information has been collected in relation to offer of information society services.

4.    Right to restrict the Processing:
You are entitled to have the processing restricted if:
(a)    if you have contested the processing of your personal data, you may require a restriction for a period in which EKO will be examining the accuracy of your contest;
(b)    the processing of your personal data is unlawful and you wish to have the processing of your data restricted rather than have it erased;
(c)    EKO no longer needs your personal data, but you demand your personal data for the purposes of establishing, exercising or defending a legal claim;
(d)    you have filed a complaint with the Bulgarian Personal Data Protection Authority (pls. See Item 10. below “Right to file a complaint”) that s pending verification.
5.    Right to Data Portability:
6.    Right to object to the Data Processing
You have the right to object to the data processing for reasons that relate to your particular situation at the given moment, when your data is being processed on the grounds of legitimate interest. You are also entitled to object to any processing carried out with the purposes of direct marketing, including profiling.
7.    Right to withdraw your consent
Where we rely on consent as the legal basis on which we process your personal data, you may withdraw that consent at any time. To do so, please contact the Customer Service Centre using the details in the Contact Us section of this Policy. Please note that withdrawing your consent does not impact the lawfulness of our processing of your personal data based on that consent, before the date of its withdrawal.

8.    Other Rights that You Have
You can use the account section of our website or app to:
• access and update the contact and personal details we hold about you
• view your EKO Smile Loyalty Points Ballance and EKO Smile Programme Account transaction history
• exercise your rights under data protection law
    • to request a copy of the personal data we hold about you, or to correct inaccurate personal data that you cannot change using our website or app, please contact the Customer Service Centre using the details in the Contact Us section of the web site/App
     •  to request that we delete the personal data we hold about you and close your membership account, please contact the Customer Service Centre using the details in the Contact Us section of the web site/App.
    • To opt-out via your EKO Smile account of receiving marketing communications to your device and/or by SMS, and email from us.
9.    Right to file a complaint with the Bulgarian Personal Data Protection Authority:
Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592.
Е-mail: kzld@cpdp.bg
We would appreciate if you address your complaint first with us.  

CONTACT US
Via the DPO
E-mail: office@EKO.bg (Attn. Personal Data Protection Officer of EKO Bulgaria EAD, Ms. Desislava Vassileva)
Contact phone: + 359 2 448 5500
via the Customer Service Centre:
E-mail: customer.service@eko.bg, or
Contact phone: 0700 30 107

CHANGES IN THIS POLICY
We may update this EKO Smile Privacy Policy from time to time to reflect changes in the functionalities of the EKO Smile Programme, EKO Smile Website, EKO Smile App or for other operational, legal, or regulatory reasons. Please review this Policy periodically for any updates.
Last amended: 09/08/2023

EKO Bulgaria EAD