Please find our Privacy Notice below
Introduction
The website https://it.coca-colahellenic.com/it/ (hereinafter, the “site”) is operated by Coca-Cola HBC Italia S.r.l., with registered office in Sesto San Giovanni (MI), Piazza Indro Montanelli, 30 - 20099 (hereinafter, "Coca-Cola HBC"), as data controller. Coca-Cola HBC Italia S.r.l. is a company of the Coca-Cola HBC Group, whose parent company is Coca-Cola HBC AG (incorporated in Switzerland under registration number CHE – 235.296.902 and with registered office at Turmstrasse 26, 6300 Zug, Switzerland).
In this Notice and in the consent collection forms, the terms “our”, “us”, “we” and “company” refer to Coca-Cola HBC.
Coca-Cola HBC is committed to preserving the privacy of all individuals who interact with us and to protecting any personal data provided by users.
This Privacy Notice is provided to enable users to understand the purposes for which we collect their personal data. By providing us with their personal data, users acknowledge that we collect, use and disclose their personal data in the manner described in this Notice. If users do not agree with this Notice, they should not provide us with their personal data.
This Privacy Notice covers the following:
- Definition of personal data
- Types and use of personal data collected
- Disclosure and recipients of personal data
- How we protect personal data
- How to contact us and data subject rights, including rights to access and update personal data
- Changes to this Privacy Notice
Definition of personal data
As defined by applicable law, personal data means information relating to an identified or identifiable individual, such as name, email address and telephone number.
Types and use of personal data collected
Coca-Cola HBC collects personal data directly from users or from authorised third parties when users interact with us as business partners, including as customers or prospective customers, consumers or job applicants. We also collect information about users through the site, although users may, in any case, visit our website without identifying themselves or disclosing personal information to us. For technical reasons, our servers collect source IP addresses, enabling users to connect to our platforms and use our services, without collecting visitors’ email addresses. In addition, for certain areas of our website, we need to collect users’ personal data for specific purposes, such as providing information requested by them or enabling users to register on the site. Data is collected and processed through the completion of online forms and whenever users contact our consumer service or send us emails containing their details. Users are not required to provide us with any additional information, where requested, that is not necessary or reasonably required to provide the services they have requested.
| Data subjects | Data collected | Purpose of collection | Legal basis for processing |
|---|---|---|---|
| Visitors to our site | IP address, domain name, browser version and operating system, traffic data, site logs | To analyse use of the site, including by measuring the number of visits, average time spent on the site and pages viewed, for the purpose of managing and improving the site and the services offered | Legitimate interest in monitoring use of the site and improving its functionality and content |
| Name and email address collected through online forms completed by visitors to our site | To respond to or manage users’ requests for information | Contractual obligation in connection with the performance of a service requested by the user | |
| Name, address, telephone number, email address; received from visitors to our site | To exercise our rights against the user and/or third parties | Legitimate interest | |
| Business customers/suppliers | Name, address, telephone number, fax number, email address, VAT number, tax details, bank details, provided directly by our business partner | For contracts for the sale and supply of goods and services, orders, deliveries, invoicing, making payments, providing or receiving the requested goods or services, and managing any disputes relating to our rights against our business partners and third parties | Performance of obligations arising from the contract |
| Name, address, telephone number, fax number, email address, provided directly by the business partner | For commercial and promotional initiatives and, in particular, to contact the business customer through telephone communications with an operator and periodic visits to the customer’s premises to promote our products and/or services and to conduct internal statistical analyses and market research | Legitimate interest | |
| Geographical location data of the display refrigerator, where provided on loan to the business customer and installed at the business customer’s premises | To disclose the data to operators of external consumer analytics platforms (such as DoveConviene S.r.l.) and their customers in order to enable the promotion to consumers of certain products marketed through the business customer’s premises when such consumers are in the vicinity of those premises, to collect information from such consumers regarding the type of customers visiting the premises and analyse such information, thereby optimising the product offering through the premises and increasing sales | Legitimate interest | |
| Creditworthiness, identity documents, credit rating | Anti-corruption checks, Know Your Customer process, credit and anti-fraud checks | Legitimate interest | |
| Name, address, telephone number, fax number, tax details, bank details | Sharing with third-party companies whose products are marketed through Coca-Cola HBC’s sales network in order to optimise the administrative management of the business customer, thereby facilitating the subsequent supply of such products to the customer | Legitimate interest | |
| Name, address, telephone number, email address, VAT number, tax details | To exercise our rights against the customer/supplier and/or third parties | Legitimate interest | |
| Name, address, telephone number, fax number, email address, VAT number, tax details, bank details | To carry out activities related to transfers of businesses or business units, acquisitions, mergers, demergers or other corporate transformations and to execute such transactions | Legitimate interest | |
| Prospective business customers/prospective suppliers | Name, address, telephone number, fax number, email address, tax details, bank details received from the business customer/supplier | To verify and assess prospective customers and suppliers (for example, in tender procedures) | Performance of pre-contractual measures and fulfilment of obligations arising from the resulting contract |
| Name, address, telephone number, fax number, email address, tax details, bank details received from the business partner | To send commercial communications for marketing and promotional initiatives | Subject to the data subject’s prior consent | |
| Creditworthiness, identity documents, credit rating | Anti-corruption checks, Know Your Customer process, credit and anti-fraud checks | Legitimate interest | |
| Business customer/supplier contact person | Name, address, telephone number, email address, personal preferences | To contact the customer/supplier to send commercial communications (for example, order confirmations and service requests) and to maintain the customer relationship | Performance of mutual contractual obligations |
| Name, address, telephone number, fax number, email address, SMS notifications | To provide customers with updates regarding marketing and promotional initiatives | Legitimate interest | |
| Consumer | Name, address, telephone number, email address | To provide the services requested by the consumer | Performance of pre-contractual measures and fulfilment of obligations arising from the resulting contract |
| Name, telephone number, address and email address, as well as any other information communicated by the consumer. In this context, the consumer may provide certain special categories of data, including data concerning their health, where the reported event relates to the quality and safety of our products. | To respond to any complaints and/or reports and/or questions about our products submitted to the consumer service toll-free number | Performance of measures following a consumer request, as well as to provide a requested service and ensure consumer satisfaction. Where management of the reported event requires the collection of special categories of personal data, including data concerning the consumer’s health, Coca-Cola HBC processes such data in order to comply with its legal obligations regarding the quality and safety of its products. | |
| Name, address, telephone number, email address | To exercise our rights against the consumer and/or third parties | Legitimate interest | |
| Candidates | Name, address, telephone number, email address, professional qualifications, work experience and education, provided by the candidate | Candidate management, to assess the application and contact the candidate by telephone or email | Performance of pre-contractual measures and obligations prior to entering into an employment contract with Coca-Cola HBC |
| Publicly available data about the candidate concerning contact information, public profiles, qualifications, professional experience and education | Candidate management and to supplement, validate and update candidate data in order to ensure its accuracy and completeness | Legitimate interest in assessing the application before entering into an employment contract with the candidate | |
| Video interview recordings | Conducting the interview process | Consent | |
| Results of tests or assessments carried out during the recruitment process | Candidate management and assessment of individual qualities and skills | Performance of pre-contractual measures and obligations prior to entering into an employment contract with Coca-Cola HBC | |
| For further information regarding your application to the Coca-Cola Hellenic Bottling Company AG ("CCHBC") team, please refer to our Global Candidate Privacy Notice. | |||
| Startup founders / Startup employees | Leader’s name, email address, links to professional social media profiles and place of work; name, title and short biography of selected core team members; startup financial data | To provide implementation support to startups and help startups grow and scale through cooperation with our business units | To assess investment and/or partnership opportunities |
With regard to personal data required for the performance of a contract with us, if users do not provide us with their personal data, we may not be able to provide the requested services as described above. Conversely, for all data processing activities for which users have provided their consent, they have the right to withhold or withdraw such consent at any time without any adverse consequences for contracts entered into with us and/or services provided to them.
When we process users’ personal data for the purposes of pursuing our legitimate interests pursuant to Article 6(f) of the GDPR, our legitimate interests are appropriately balanced against users’ interests, as the processing is carried out only to the extent strictly necessary to pursue the purposes listed above. Such processing activities are not mandatory and users may object to such processing at any time in accordance with the procedures set out in this Privacy Notice. In such cases, the data will no longer be processed for the purposes listed above, unless Coca-Cola HBC demonstrates compelling legitimate grounds that override the interests of the user or where processing is required for the establishment, exercise or defence of legal claims pursuant to Article 21 of the GDPR.
Coca-Cola HBC reserves the right, in any event, to provide data subjects with additional privacy notices in exceptional cases where further and specific processing activities are carried out on personal data.
Disclosure and recipients of personal data
The personal data provided by users is stored on servers located in Crawley, United Kingdom, operated by Rackspace, which has a secondary establishment in Ireland, and may be processed by or transferred to our staff working outside the United Kingdom and to third parties, business partners, government bodies and law enforcement agencies, legal successors to our company and suppliers to whom we entrust processing on our behalf, some of whom are established outside the European Economic Area and operate on behalf of the company for the purposes and on the grounds set out in this Notice.
| Categories of recipients | Purpose of sharing |
|---|---|
| Coca-Cola Hellenic Group companies and/or third-party service providers (i.e. IT service providers, consultants, etc.) processing data on our behalf as external data processors | To provide our products and services |
| Third-party service providers (i.e. IT service providers, consultants, etc.) and Coca-Cola HBC subsidiaries/affiliates engaged by the company in providing services requested by the user or required by the company for the purposes described above, acting as external data processors | Performance of services requested by the user |
| Business partners acting as external data processors | Performance of services requested by the user |
| Public authorities acting as independent data controllers | To comply with a legal obligation |
| Judicial authorities acting as independent data controllers | To comply with a legal obligation |
| Legal successors to our company and suppliers acting as independent data controllers | Performance of services requested by the user |
| Credit rating agencies, fraud prevention agencies, Coca-Cola Hellenic Group companies and/or third-party service providers processing data on our behalf as external data processors | Anti-corruption checks, Know Your Customer process, credit and anti-fraud checks |
Parties established outside the EU to whom users’ personal data is transferred process the data, fulfil and deliver orders and provide support services on our behalf. We may also provide third parties with general information regarding the use of our site, but such information will not include data that enables users to be identified. We reserve the right to disclose users’ personal data where required by law, or where we believe disclosure is necessary to protect our rights and/or comply with obligations relating to legal proceedings, a court order, a request from a regulatory body or any legal action brought against us.
Except where required by law, we will not share, sell or distribute personal data provided by users without their consent.
Finally, if the company enters into a joint venture or merges with another company, or if the company is sold, users’ data may be disclosed to our new business partners or owners.
Transfer of personal data outside the EU
As the company operates in many countries, users’ personal data may be processed and/or stored by staff members or suppliers in countries outside the EU whose data protection laws may be less stringent than those in force in the EU, including, in particular, Armenia, Belarus, Bosnia and Herzegovina, Moldova, Montenegro, Nigeria, Russia, Serbia, Switzerland and Ukraine. In all cases, we endeavour to ensure that users receive the same level of protection for their personal data as they would within the EU, including by ensuring that personal data is stored securely and processed in accordance with our instructions and for the specified purposes.
Certain countries outside the EU have been approved by the European Commission as providing safeguards that are essentially equivalent to those provided by EU data protection laws, and therefore no additional safeguards are required for the transfer of personal data to these jurisdictions (for the complete list, users may visit http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm). In the case of third parties established in countries not approved by the European Commission (such as Russia), we have entered into agreements incorporating the Standard Contractual Clauses approved by the European Commission, which impose equivalent data protection obligations on the recipient, unless applicable data protection law allows us to carry out the transfer without such formalities.
If users wish to learn more about the specific safeguards applied to the transfer of their personal data, they may contact us using the details provided in the "Contact Us" section.
How we protect users’ personal data
Users under the age of 16
Users under the age of 16 must obtain the consent of a parent or guardian before providing us with their personal data. Users who have not obtained such consent may not provide us with their personal data.
Other websites
Our website contains links to other websites that are not under our control and are not subject to this Privacy Notice. If users access other websites using the links provided, the operators of those websites may collect users’ information, which will be used in accordance with their own Privacy Notices, which may differ from ours. We accept no responsibility for the privacy notices of other operators or for the manner in which they process users’ personal data. Before providing personal data to third-party websites, we encourage users to read the privacy and cookie notices and the terms and conditions of the websites linked to, referred to or accessed.
Security of personal data collected and retention periods
We implement strict technical and organisational security measures to protect users’ data against unauthorised and unlawful processing, accidental loss, destruction and damage, both online and offline. We will retain users’ data for as long as necessary to fulfil the purposes for which it was collected and, thereafter, for the period required by law.
In particular, we retain personal data in identifiable form only for as long as necessary to pursue the processing purposes for which the personal data was collected. We do not retain personal data for longer than necessary to fulfil legitimately identified business purposes or for as long as required by applicable law. We establish data retention periods in accordance with relevant laws and regulations within our records of processing activities and must provide justification where personal data is retained for periods longer than the maximum period permitted under legal or corporate requirements, where applicable.
Certain data must be retained to protect the company’s interests, for evidentiary purposes and, more generally, to comply with good business practices. Reasons for retaining data may include:
- Litigation
- Incident investigations
- Security incident investigations
- Regulatory requirements
- Protection of intellectual property
Internet transfers and limitation of liability
Although the company takes reasonable measures to protect against viruses and other harmful components, the nature of the internet makes it impossible to guarantee that users’ browsing will be uninterrupted or error-free, or that a website, its servers or emails sent by us will be free from viruses or other harmful components.
How to contact us and data subject rights, including rights to access and update personal data
Access, updating and deletion of data
Users have the right to access the personal data we hold about them and may also ask us to make any necessary changes to ensure that their personal data is accurate and up to date or to delete personal data held by us. Users also have the right to request restriction of processing or to object to the processing of personal data held by us. Users may ask us to provide personal data held by us to other service providers of their choice. In such cases, users may contact us using the details provided in the Contact Us section below.
Withdrawal of consent
Where we have requested users’ consent to process their personal data, such consent may be withdrawn at any time, without affecting the lawfulness of processing based on consent carried out before its withdrawal. In such cases, users may contact us using the details provided in the Contact Us section below.
Complaints
Users may lodge a complaint with the national data protection authority. In particular, the Italian national authority is the Garante per la Protezione dei Dati Personali (Italian Data Protection Authority), whose contact details are available at www.garanteprivacy.it.
Contact Us
For any comments regarding the use of personal data or any questions about this Privacy Notice, users may contact us by email at DataProtectionOffice@cchellenic.com. We welcome users’ questions and suggestions regarding our Privacy Notice.
To formally exercise their rights in relation to the processing of personal data, users are invited to submit a specific request using the following link or contact us by email at DataProtectionOffice@cchellenic.com.
Please also note that the company has appointed a Data Protection Officer, who can be contacted at DataProtectionOffice@cchellenic.com.
Changes to this Privacy Notice
For updates regarding any changes to this Privacy Notice, please check the site periodically. We reserve the right to amend and supplement this Privacy Notice; however, in the event of material changes, we will inform users of the most significant changes by posting a notice on this site for at least 30 days following the change and, where appropriate, through email notifications.