Πολιτική απορρήτου

We take your privacy very seriously. Please read this privacy policy carefully as it contains important information on who we are and how and why we collect, store, use and share your personal data. It also explains your rights in relation to your personal data and how to contact us or supervisory authorities in the event you have a complaint.

This privacy notice applies to the access and use of the Q-Pass application, Q-Pass website available at https://www.q-pass.gr/ as well as any other multimedia medium, webpages or applications that relates or is owned by us (collectively the “Q-Pass Platform”).

We collect, use and are responsible for certain personal data about you. When we do so we are subject to the applicable data protection regulation pursuant to Law 4624/2019 and Law 2774/1999, the decisions and guidelines issued by our competent supervisory authority and the EU General Data Protection Regulation (EU GDPR) in relation to goods and services we offer to individuals and our wider operations in the European Economic Area (EEA).

Key terms

It would be helpful to start by explaining some key terms used in this policy:

We, us, our	Q-Digital Services, a private company with registration number 800666870, having its registered office at Nea Isodo, Akovitika, Kalamata, 241000, administrator and exclusive beneficiary of the website www.q-pass.gr and the corresponding application for mobile devices and tablets.
Personal data	Any information relating to an identified or identifiable individual
Data subject	The individual who the personal data relates to
Favourite Store(s)	The user`s ability to select one or more stores as their favourite, which allows stores to communicate directly with the user for information, including exclusive offers, promotions, or new products and/or services and other information.
Partner Stores	Stores that provide services and/or products through platform Q-Pass

Personal data we collect about you

Q-Pass provides a platform on which Users can purchase products and/or services from the Partner Stores of their choice. In order to initiate the interaction between us or with the Partner Stores you are required to provide certain personal information. We may collect and use the following personal data about you:

We may process data enabling us or Partner Stores to get in touch with you ("Contact Data"). The contact data may include your name, email address, telephone number, postal address and/or social media account identifiers. If you log into our website using a social media account, we will obtain elements of the contact data from the relevant social media account provider.
We may process data that identifies you, such as your photo, if you choose to add to your account as publicly available information, in order for us or our affiliated stores to recognize you and contribute to the more effective provision of our services and products.
We may process your user account data ("Account Data"). The account data may include your account identifier, name, email address, sex, business name, account creation and modification dates, website settings, stores you have selected as Favourite Stores and marketing preferences. If you log into our website using a social media account, we will obtain elements of the account data from the relevant social media account provider.
We may process information relating to transactions, including purchases of goods and/or services, that you perform with us and/or through our Platform ("Transaction Data"). The transaction data may include your name, your contact details, your payment card details (or other payment details) in pseudonymized format and the transaction details.
We may process information contained in or relating to any communication that you send to us (www.q-pass.gr/contact) or that we send to you ("Communication Data"). The communication data may include the communication content and metadata associated with the communication.
We may process data about your use of our Platform and services ("Usage Data"). The usage data may include your IP address, geographical location, browser type and version, operating system, referral source, length of visit, page views and website navigation paths, as well as information about the timing, frequency and pattern of your service use.
We may process information about your order and shipment information ("Order Data"). This data may include order history, order number, and delivery address.

We collect and use this personal data to provide our products and services to you. If you do not provide personal data we ask for, it may delay or prevent us from providing our products and services to you.

How your personal data is collected

We collect most of this personal data directly from you, however, we may also collect information:

from publicly accessible sources
directly from a third party, eg:
- third parties we use to help deliver our products or services to you, eg payment service providers
- third parties you link to us for the creation of your account such Facebook, Instagram and Twitter
from cookies on our website—for more information on our use of cookies, please see our cookie policy (www.q-pass.gr/cookies)
via our IT systems, eg:
- through automated monitoring of our websites and other technical systems, such as our computer networks and connections, access control systems, communications systems, email and instant messaging systems

How and why we use your personal data

Under data protection law, we can only use your personal data if we have a proper reason, eg:

where you have given consent.
to comply with our legal and regulatory obligations.
for the performance of a contract with you or to take steps at your request before entering a contract or
for our legitimate interests or those of a third party.

A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own.

The table below explains what we use your personal data for and why.

What we use your information for	Our reasons
To provide you with our services and fulfil our contractual obligations	For the purpose of performing your requests, execution and delivery of your order (execution of the contract with us or with the Partner Stores or to take action at your request before entering into the contract) or to handle any payments or refunds (where applicable) and to provide the Partner Stores with the necessary information for the preparation or delivery of your order.
Preventing and detecting fraud and illegal activity against you or us	For our legitimate interests or those of a third party, i.e., to minimise fraud and illegal activity that could be damaging for you and/or us
Conducting checks to identify our customers and verify their identity	To comply with our legal and regulatory obligations
Operational reasons, such as improving efficiency, training and quality control	For the purposes of operating our Platform, the processing and fulfilment of orders, providing our services, supplying our goods, generating invoices, bills and other payment-related documentation, and credit control. The legal basis for this processing is our legitimate interests, namely the proper administration of our website, services and business or the performance of a contract between you and us and/or taking steps, at your request, to enter into such a contract.
Ensuring the confidentiality of commercially sensitive information	For our legitimate interests or those of a third party (such as Partner Stores), i.e. to protect trade secrets and other commercially valuable information To comply with our legal and regulatory obligations
Statistical analysis to help us manage our business, eg in relation to our financial performance, customer base, product range or other efficiency measures	For our legitimate interests or those of a third party (such as Partner Stores), i.e. to be as efficient as we can so we can deliver the best service and user experience.
Updating and enhancing customer records	To perform our contract with you or to take steps at your request before entering into a contract To comply with our legal and regulatory obligations For our legitimate interests or those of a third party (such as Partner Stores), e.g. making sure that we can keep in touch with our customers about existing orders and new products
Marketing our services and those of selected third parties to: existing and former customers third parties who have previously expressed an interest in our services third parties with whom we have had no previous dealings.	For our legitimate interests or those of a third party (such as Partner Stores), ie to promote our business to existing and former customers
Calculate delivery or time of arrival	Fulfilment of your request, execution and delivery of your order. We collect location data, such as information about the location of your device, which can be either accurate or inaccurate. The amount of information we collect depends on the type and settings of the device you use to access the Platform. For example, we may use GPS and other technologies to collect location data that tells us your current location (based on your IP address). You may opt out from allowing us to collect this information either by denying access to the information or by disabling the location setting on your device. Note, however, if you choose to opt out, you may not be able to use certain aspects of the Services, or there may be a delay in preparing your order.
Sending Push Notifications	Optimize the provision of our services to the user and more efficient utilization of the application. We may ask you to send you a promotional notice about your account or certain app features. if you want to opt out of receiving these types of communications you can disable your device settings
To respond to any questions, complaints or communication you have had with us
Research and analysis	For the purposes of researching and analysing the use of our website and services, as well as researching and analysing other interactions with our business.
Record keeping	For the purposes of creating and maintaining our databases, back-up copies of our databases and our business records generally. The legal basis for this processing is our legitimate interests, namely ensuring that we have access to all the information we need to run our business properly and efficiently in accordance with this notice.
Security	For the purposes of security and the prevention of fraud and other criminal activity. The legal basis of this processing is our legitimate interests, namely the protection of our Platform, services and business, and the protection of others.
Insurance and risk management	For the purposes of obtaining or maintaining insurance coverage, managing risks and/or obtaining professional advice. The legal basis for this processing is our legitimate interests, namely the proper protection of our business against risks.
Legal claims	For the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure. The legal basis for this processing is our legitimate interests, namely the protection and assertion of our legal rights, your legal rights, and the legal rights of others.
Legal compliance and vital interests	We may also process your personal data where such processing is necessary for compliance with a legal obligation to which we are subject or to protect your vital interests or the vital interests of another natural person.

Where we process special category personal data, we will also ensure we are permitted to do so under data protection laws, e.g.:

we have your explicit consent.
the processing is necessary to protect your (or someone else’s) vital interests where you are physically or legally incapable of giving consent or
the processing is necessary to establish, exercise or defend legal claims.

Marketing

We may use your personal data to send you updates (by email, text message, telephone or post) about our products or services, including exclusive offers, promotions or new products or services.

We may also share your personal data with Partner Stores which you have selected as Favourite Stores in order to enable them to forward updates to you about their products or services, including exclusive offers, promotions or new products or services.

We have a legitimate interest in using your personal data for marketing purposes (see above ‘How and why we use your personal data’). This means we do not usually need your consent to send you marketing information. However, where consent is needed, we will ask for this separately and clearly.

You have the right to opt out of receiving marketing communications at any time by:

contacting us at www.q-pass.gr/contact or
using the ‘unsubscribe’ link in emails or ‘STOP’ number in SMS texts or
updating your marketing preferences on profile page in the q-pass app

We may ask you to confirm or update your marketing preferences if you ask us to provide further products or services in the future, or if there are changes in the law, regulation, or the structure of our business.

We will always treat your personal data with the utmost respect and never sell it with other organisations for marketing purposes.

Who we share your personal data with

We routinely share personal data with:

Companies within our group
Partner Stores for the facilitation of your order or request.
Partner Stores that you selected as Favourite Stores for the purpose of sending updates about their services and products, including exclusive offers, promotions or new products or services
third parties we use to help facilitate your order, e.g. payment service providers

We only allow our service providers to handle your personal data if we are satisfied, they take appropriate measures to protect your personal data. We also impose contractual obligations on service providers to ensure they can only use your personal data to provide services to us and to you.

We may also need to:

share personal data with external auditors, e.g. in relation to the audit of our accounts
disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations.
share some personal data with other parties, such as potential buyers of some or all of our business or during a restructuring—usually, information will be anonymised but this may not always be possible, however, the recipient of the information will be bound by confidentiality obligations.

If you would like more information about who we share our data with and why, please contact us (see ‘How to contact us’ below).

Where your personal data is held

Personal data may be held at our offices and those of our third-party agencies, service providers, representatives and agents and Partner Stores as described above (see above: ‘Who we share your personal data with’).

Some of these third parties may be based outside the EEA. For more information, including on how we safeguard your personal data when this happens, see below: ‘Transferring your personal data out of the EEA’.

How long your personal data will be kept

We will keep your personal data while you have an account with us or we are providing products or services to you. Thereafter, we will keep your personal data for as long as is necessary:

to respond to any questions, complaints or claims made by you or on your behalf
to show that we treated you fairly
to keep records required by law.

We will not keep your personal data for longer than necessary. Different retention periods apply for different types of personal data. When it is no longer necessary to keep your personal data, we will delete or anonymise it.

Transferring your personal data out of the EEA

If your data will be transferred to entities or other third parties whose headquarters or place of data processing is not located in a member state of the European Union or the European Economic Area, we ensure before forwarding the data that, outside of legally permitted exceptional cases pertaining to the recipient, either an appropriate level of data protection exists (e.g., through an adequacy decision of the European Commission, through suitable guarantees, or the agreement of EU standard contractual clauses between us and the recipient), or your sufficient consent exists.

Your Rights

You have the following rights, which you can exercise free of charge:

Access	The right to be provided with a copy of your personal data
Rectification	The right to require us to correct any mistakes in your personal data
Erasure (also known as the right to be forgotten)	The right to require us to delete your personal data—in certain situations
Restriction of processing	The right to require us to restrict processing of your personal data in certain circumstances, eg if you contest the accuracy of the data
Data portability	The right to receive the personal data you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations
To object	The right to object: —at any time to your personal data being processed for direct marketing (including profiling) —in certain other situations to our continued processing of your personal data, eg processing carried out for the purpose of our legitimate interests.
Not to be subject to automated individual decision making	The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you

If you would like to exercise any of those rights, please:

complete a data subject request form — available on our website at www.q-pass.gr/contact or email us at help-desk@q-pass.gr or call us at +30 2107103987 or write to us at our formal address - see link below: Contact information
and
provide enough information to identify yourself (eg your full name, address and customer or matter reference number) and any additional identity information we may reasonably request from you
let us know what right you want to exercise and the information to which your request relates.

Your requests are completed within one (1) month and at no cost. If it cannot be completed within one (1) month, you will be informed by e-mail of the reasons for the delay (e.g. due to the complexity of the request or multiple requests) and the deadline may be extended for an additional one (1) month.

In case you wish to complain about the way we handle your personal data you can also contact us in the above way. We will investigate your complaint and work with you to resolve it. If you still believe that we have not handled your personal data in accordance with the law, you can submit your complaint to the office of the competent supervisory authority at:

Hellenic Data Protection Authority

Kifissias 1-3, PC 115 23, Athens, Greece

Telephone: +30-210 6475600

Ε-mail: contact@dpa.gr

Keeping your personal data secure

We have appropriate security measures to prevent personal data from being accidentally lost or used or accessed unlawfully. We limit access to your personal data to those who have a genuine business need to access it. Those processing your information will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

Changes to this privacy policy

This privacy notice was published on 10.08.2021 and last updated on 10.08.2021.

We may change this privacy notice from time to time—when we do we will inform you via email.