1. General
Processors, their information and contact details. Application of Apollo Group data protection terms and conditions. Processing relationships
1.1. Application. These data protection terms and conditions of Apollo Group and companies belonging to the Apollo Group and members of Apollo Club (hereinafter referred to as Apollo Group) (hereinafter referred to as data protection terms and conditions) establish general principles on the basis of which Apollo Group processes personal data of the customers and users who are natural persons. The data protection terms and conditions apply to all customers and users who purchase goods and products of group companies of Apollo Group, consume their services, visit websites, stores, cinemas or restaurants of the group companies of Apollo Group or otherwise consume other products or services of group companies of Apollo Group.
1.2. About us. Apollo Group OÜ, registry code 12383236, address Tartu mnt 80d, Tallinn 10112, is a group with the following companies engaged in entertainment and the provision of food services in the Baltics (Estonia, Latvia and Lithuania): Apollo stores; Apollo cinemas in the Baltics; Blender cafés; Ice Cafe cafés; O’Leary’s restaurants in the Baltics; film distribution and production units of Estonian and Baltic Film Distribution, IT solution provider APL Digital Solutions; restaurants operating under the KFC trademark in the Baltics and Finland, and also restaurants operating under the Vapiano trademark in the Baltics and Finland. The list of companies belonging to Apollo Group can be found here.
1.3. Apollo Club. Apollo Club is an ID-card-based loyalty programme that offers customers registered with Apollo Club loyalty rebates and adventures in Apollo stores, Apollo cinemas, O’Leary’s entertainment centres, IceCafe and Blender juice bars, Vapiano restaurants. The list of Apollo Club companies can be found here. The data controller of Apollo Club is Apollo Group OÜ. Data subjects join the Apollo Club under their consent; other processing operations in the Apollo Club may also be carried out on other grounds (e.g. keeping records of club benefits and collected products/amounts for the purpose of offering the club service on a contractual basis; club development on the basis of legitimate interest, etc.). Companies offering Apollo Club services may share information for the purpose of offering Apollo Club benefits, services and for club development and marketing activities. The Apollo Club is subject to the data protection terms and conditions.
1.4. Processing relationships. Apollo Group companies may provide services to each other and have various processing relationships. In any case, Apollo Group companies follow the requirements of the GDPR and enter into data processing agreements with processors. Each Apollo Group company is the controller when providing its core service (unless otherwise specified); for example, Apollo Cinema is the controller when selling cinema tickets, Apollo stores is the controller when selling products from Apollo stores, each Apollo Group company is a controller for its website, etc. Apollo Group OÜ is the controller when the Apollo Club service is provided.
1.5. Data protection terms and conditions. These data protection terms and conditions are the general terms and conditions for the processing of personal data by Apollo Group companies. The data protection terms and conditions apply to the processing by Apollo Group companies to the maximum extent possible, but Apollo Group companies may have set out specific terms in their privacy notices.
1.6. Contact details. In matters related to the processing of personal data by Apollo Group, you can contact each company of Apollo Group, using the contact details listed below, or the data protection officer of Apollo Group by sending an e-mail to andmekaitse@apollogroup.ee. Apollo Group OÜ, registered office Tartu mnt 80d, Tallinn 10112, e-mail address or andmekaitse@apollogroup.ee. The Apollo Group consists of the companies included in the following list and their contact details are as follows:
- Apollo Club –
- Apollo stores –
- Apollo cinemas –
- Blender cafés and Ice Cafe cafés –
- Restaurants operating under the KFC trademark –
- Restaurants operating under the O’Leary’s trademark –
- Restaurants operating under the Vapiano trademark –
- Film distribution and production units of Film Distribution –
- APL Digital Solutions OÜ –
1.7. Other websites and social media. The information behind the links on our website or in social media is regulated by the privacy policies of the respective service providers. Also, your personal data are processed in various social media channels according to the privacy policies of those platforms
1.8. Cookies. Information on the use of cookies can be found via the cookie solution on the Apollo Group company pages.
1.9. General principles. We and our partners are guided by the principles set out in the GDPR (lawfulness, fairness, accuracy, transparency, purpose limitation, minimum data processing, retention limitation, reliability and confidentiality, and data protection by default and by design).
2. Definitions
2.1. Definitions The terms relating to personal data have the same meaning as defined in the EU Regulation 2016/679 on the protection of personal data (the GDPR). To make it easier to read the data protection terms and conditions, we have included the meanings of the most commonly used terms.
2.2. Data subject (hereinafter also referred to as You/Your/Yourself) is a natural person whose personal data are processed by Apollo Group.
2.3. Personal data are any information about You that enables your identity to be established. Apollo Group mostly collects personal data from You directly, according to your connection with Apollo Group or, for example, within the framework of providing services to You or selling the goods and products offered to You.
2.4. Controller is the legal person who determines the purposes and means of processing of personal data. For more detail regarding processing relationships, see section 1.4.
2.5. Processor is a natural or legal person who processes personal data on behalf of a company of Apollo Group as the controller (above all cooperation partner, service provider) on the basis of a contract entered into with Apollo Group. For more detail regarding processing, see section 9.3.
3. Categories of Data Subjects
Whose personal data are processed by Apollo Group?
3.1. Categories of data subjects. The personal data processed by Apollo Group include the personal data of the following data subjects:
3.1.1. visitors and users of the websites of Apollo Group companies (for example, users of sales environment/e-shop);
3.1.2. users of services/products, that is, customers;
3.1.3. representatives (natural persons) of cooperation partners;
3.1.4. employees of Apollo Group companies (information to employees regarding the processing of personal data will be provided internally).
3.2. Processing of children’s data. If we process children’s data, we do so on the basis of the parent’s or guardian’s wishes (e.g. consent to have the child join the Apollo Club).
4. Personal data to be processed
Which personal data are processed by Apollo Group?
4.1. Categories of personal data. Apollo Group processes Your personal data only if it is necessary and in accordance with the purpose of the processing, always having a lawful basis for the processing. We collect the following types of personal data:
4.1.1. personal data that You have provided us, for example, when You enter Your contact details (incl. name, postal address, phone number, e-mail address, preferred contact method) on our website or elsewhere (e.g. stores, cinemas);
4.1.2. personal data generated in the course of ordinary communication (e.g. personal data transmitted via correspondence or the communication app on the website);
4.1.3. personal data You have clearly disclosed (e.g. leaving a comment or reaction in the social media of Apollo Group companies);
4.1.4. personal data given when entering into and performing the contract (e.g. name, contact information, shopping list, payment information, delivery method, and where applicable, address when ordering online);
4.1.5. personal data generated upon consuming services (e.g. upon using our self-service or, for example, upon making a purchase or placing an order in our stores, restaurants or online stores when saving contact details or data concerning purchase preferences);
4.1.6. personal data generated as a result of your visit to and use of the website; for example, customer account information or information stored through cookies when You use the website. Cookies are installed based on Your choices. More information about the information collected through cookies can be found in the website’s cookie solution;
4.1.7. personal data received from third parties (where applicable), e.g. information verifying the right of representation of the representatives (natural persons) of our cooperation partners;
4.1.8. personal data created and combined by us (e.g. order history).
For more details on the purpose, the processing relationships and the personal data processed, see section 5.3. If You would like more information about the categories of personal data or other data that we have collected about You, please contact us (see the contact details in section 1.6).
5. Purposes of and Grounds for Processing
5.1. General purposes for processing personal data. Apollo Group processes your personal data according to the legislation in force, above all for the following purposes:
5.1.1. for entering into and performing a customer contract, managing the customer account and communicating with the data subject;
5.1.2 for providing goods, products and services aimed at the customer, including the loyalty programme service (Apollo Club);
5.1.3. for fostering and analysing customer relationships;
5.1.4. for responding to enquiries made by the data subject;
5.1.5. for providing services and products to the data subject;
5.1.6. for organising polls and carrying out prize draws;
5.1.7. for direct marketing;
5.1.8. for managing and developing services;
5.1.9. for enabling the use of websites and improving websites;
5.1.10. for preparing statistics or reports;
5.1.11. for processing legal claims;
5.1.12. for performing obligations arising from legislation;
5.1.13. for any other purpose set out in Apollo Group’s data protection terms and conditions or otherwise made known to the data subject.
For more details on the purpose, the processing relationships and the personal data processed, see section 5.3.
5.2. New purpose. If personal data are processed for a purpose that is new in comparison to the one for which the personal data was initially collected or if they are not processed based on the consent given by the data subject, we carefully assess the permissibility of such new processing. In order to determine whether the processing for the new purpose is compatible with the purpose for which we originally collected the personal data, we will take into account, inter alia: i) the relationship between the purpose for which the personal data were originally collected and the purpose of the planned further processing; ii) the context in which the personal data were collected, in particular the relationship between the data subject and us; iii) the categories of personal data; iv) the possible consequences of the planned further processing for data subjects; v) the use of appropriate safeguards.
5.3. Grounds for and purpose of processing of personal data. Apollo Group companies will always process personal data under a lawful basis. We may use various grounds for processing, for example, the following.
5.3.1. Consent. We process personal data within the limits of the consent and for the purposes stated in the consent. When asking for consent, it is either stated or clearly understood what personal data will be processed on the basis of consent. Consent can be given by a clear action, such as ticking a box or clicking a button, if the action is indicated as consent. For example, we may use Your consent for the following processing actions: i) to inform You of product news, promotions and upcoming events (newsletter; e-mail address processed; list of interests (if any); newsletter subscription); ii) to register You as an Apollo Club member (name, country, customer type, personal identification code, contact information); iii) to send You an SMS notifying You that Your order is ready (e.g. when ordering food from the Vapiano self-service checkout or Apollo Group order apps; phone number); iv) to carry out other processing based on Your consent where consent has been requested. You may withdraw your consent at any time, for example by contacting us using the contact details in section 1.6. If you do not wish to be on our newsletter list or receive notifications about the products or services that may be of interest to You, You may remove Yourself from the target audience at any time. The withdrawal of consent does not influence the lawfulness of the data processing that took place on the basis of Your consent before it was withdrawn.
5.3.2. Performance of contractual obligations We may process Your personal data if it is necessary for the purposes of a contract with You, i.e. if processing of personal data is necessary for the performance of a contract with You or for taking steps at Your request prior to entering into a contract (for example, a customer contract). We may also process personal data, for example, to identify the customer to the extent required by the duty of care (name of representative, information on right of representation, name, where applicable, information on an identifiable document or strong authentication information); to fulfil our obligations to the customer in relation to the provision of our services (e.g. we use address or phone number for delivery of goods; when offering discounts we may process purchase history or other relevant pre-requisite information; order information in the order app); to communicate with the customer (contact information) and to ensure that the customer complies with their payment obligations (customer identification information, payment information). The purpose of the processing of personal data may be further set out in a specific contract with You.
5.3.3. In regard to the purposes of entering into an employment contract and legitimate interest (for making a similar new offer), we process the following personal data of the job applicant: personal data provided by the job applicant to us for the purposes of entering into an employment contract (name, CV information, motivation letter (if provided)); personal data of the person indicated by the job applicant as a referrer and, in the absence of a referrer, of a previous employer; personal data collected from public (social) media. If the job applicant is not selected, we will keep the personal data collected for the purpose of entering into an employment contract so that we can make an employment offer to the job applicant when a suitable position becomes available.
5.3.4. Compliance with legal obligation. We may process personal data in order to comply with a legal obligation, i.e. where the processing of personal data is necessary for the performance of a legal obligation of Apollo Group. For example, legal obligations include processing payments or complying with anti-money laundering regulation, accounting requirements, employment law obligations, etc.
5.3.5. In exceptional cases, we may process personal data on the basis of the vital interests of the data subject or on the basis of an overriding public interest.
5.3.6. Legitimate interest. We may exercise a legitimate interest in the management, administration and operation of a company within Apollo Group to enable us to provide the best possible services or products on the market. Before exercising the legitimate interest, we will assess whether the processing of personal data is necessary for the legitimate interest of Apollo Group or a third party and whether this outweighs any contradictory interest of the data subject. We will only use legitimate interest if the result of the legitimate interest assessment is positive. In the case of processing on the basis of a legitimate interest relating to the data subject, the data subject retains the right to obtain an assessment of the relevant legitimate interest (to do so, please contact us using the contact details in section 1.6). We may use legitimate interest in the following situations:
(i) for ensuring a trusting customer relationship, including for preventing fraud and applying KYC measures (processed data: full name of the person, personal identification code, identity verification information, contract information, product/service information, if applicable, verification information – e.g. strong authentication/signature information);
(ii) for managing and analysing the customer base in order to improve the availability, selection and quality of services (including Apollo Club offerings) and to make the best and most personalised offers to customers with their consent (customer identifier, information on customer’s service/product consumption);
(iii) for sending marketing offers, where the data subject has previously purchased a similar product/service and where the data subject is always given the possibility to easily opt out of such communications (provided that such processing is permitted in the relevant jurisdiction) (processed data: e-mail address, name, information on customer’s service/product consumption);
(iv) for organising campaigns (if it is not consent-based), including personalised and targeted campaigns, customer satisfaction surveys and measuring the effectiveness of marketing activities carried out (depending on the specific campaign/survey, but generally the name, the information/response provided by the customer (e.g. like/share on social media or feedback given));
(v) for making recordings. We may record messages and orders given on our premises as well as by means of communication (e-mail, telephone, etc.), also information and other operations we have performed, and if necessary, we use these recordings as proof of orders or other operations;
(vi) for measures taken for network, information and cybersecurity reasons, such as to combat piracy and ensure website security, and to make and store back-up copies (depending on the situation, but generally log information, network identifier information, other technical information);
(vii) for organisational purposes. In particular, for financial management but also for service and product development and business planning and management, and for the transfer of personal data within the group for internal management purposes, including the processing of personal data of customers or employees (generally non-personal financial data, but there may also be personalised information such as employee names and positions);
(viii) For business and product development and marketing activities, including in the context of the Apollo Club (except where consent is required) (generally non-personal data, but development may require the processing of personal information such as customer identifier, activities within a service);
(ix) we may share personal data when we conclude business transactions or hold negotiations about a business transaction, which covers our entire business or the sale or transfer of property. These transactions may cover any merger, financing, acquisition or bankruptcy transaction or proceedings (generally non-personal information, but we may also share e.g. names of employees and agents, positions, remuneration models);
(x) for the establishment, exercising or defence of legal claims (the data processed depend on the specific situation; typically the name, the circumstances of the situation);
(xi) where applicable, we may also use the data to send You special notifications about manufacturer-issued safety notices or recall programmes (name, fact of product/service purchase, e-mail, notification);
(xii) for using security cameras in our stores and restaurants. The purpose of using the cameras and processing the recordings is to protect the property of the employees, visitors and Apollo Group companies; ensure security; defend and exercise claims; resolve complaints. Recordings will be deleted at the latest after 30 days when the storage space is full (unless recordings are needed for longer to protect legal claims).
(xiii) If the data subject has opted out of direct marketing offers, we will retain this information to avoid sending direct marketing offers.
6. Security Cameras (Video Surveillance)
How do we use security cameras?
6.1. Purposes for the use of security cameras. Security cameras (video surveillance) are installed on the premises of Apollo Group companies, such as in stores, cinemas, restaurants, for the protection of persons and property, for the protection and verification of legal claims and for the verification of actions and activities.
6.2. Storage of recordings. Video recordings of the cameras are generally stored for 30 days. If necessary, e.g. when dealing with legal claims, recordings are kept for longer.
6.3. Access to video and recordings. All video recordings can only be accessed by the persons who have the right to examine the video recordings according to their official duties. Where necessary, upon request or in cases provided for by law, recordings may be forwarded to law enforcement authorities.
6.4. Controller’s information. The controller of the video recordings is the Apollo Group company and Apollo Group OÜ, which owns the camera or on whose premises the camera is installed.
7. Security Measures
How do we ensure the security of personal data?
7.1. Security measures. Apollo Group implements necessary organisational, physical and information technology security measures in order for your personal data to be protected against any misuse, unauthorised access, disclosure, alteration or destruction. Access to Your personal data is limited to the authorised persons and our processors. The use of an encrypted bank data link guarantees the safety of the personal data and bank details of the person making a purchase. In the event of a personal data breach, we will take all necessary measures to mitigate its consequences and to address relevant risks in the future. We will register all incidents and, if required, inform the Data Protection Inspectorate and the data subjects. All the data on the websites, online stores and maintenance databases of Apollo Group companies are encrypted to the necessary extent and treated as confidential information.
8. Profiling, Direct Marketing, Surveys
8.1. Profiling and automated decisions. Apollo Group may carry out profiling in respect of your personal data in order to better understand Your expectations and, based on this, provide better products and services, enabling more accurate direct marketing. Profiling entails no legal or other significant effects for you. Apollo Group does not engage in profiling or automated decisions within the meaning of Article 22 of the GDPR (i.e. there are no significant effects). If we are going to use profiling or automated decisions with significant effects, we will inform data subjects beforehand and ensure that You can exercise other related rights under the GDPR.
8.2. Marketing and surveys. Apollo Group may use Your personal data in order to send You information about discount offers and campaigns, and conduct customer surveys, such as satisfaction surveys. If You no longer wish to receive direct offers, You have the right to withdraw Your consent for the processing of Your personal data by contacting the Apollo Group company whose direct offers You want to opt out of.
9. Transfer of Personal Data
9.1. Transfer within group companies. Apollo Group has the right to transfer Your personal data to Apollo Group companies (Apollo stores, Apollo cinema, Blender juice bars, IceCafe ice-cream bars, O’Leary’s restaurants, Vapiano restaurants, KFC restaurants, etc.), for example, to receive special offers, a purchase bonus or Apollo Club offers or discounts, for reporting and for developing the Group’s business or for other legitimate interests.
9.2. Use of partners. We may share Your personal information with third party service providers that we use to provide our services or for other business purposes. We will only use partners who follow the requirements of the GDPR. In the case of a processor, we enter into a data processing agreement.
9.3. Third parties include, for example, our partners who are responsible for transporting the goods sold in our online store or providing hire-purchase services, advertising and marketing partners; the partner providing payment services; the partner providing recruitment-related services, companies organising customer satisfaction surveys, debt collection service providers, payment default registers, providers of various technical services, invoice transmission service providers. The transfer will only take place on the condition that the purpose of the transfer is lawful and the third party is processing the information on the basis of a contract in which, among other things, the third party undertakes to keep the shared information confidential. If you would like more information about our partners, please contact us using the contact details in section 1.6.
9.4. Other transfer. In addition to third parties, Apollo Group companies have the right to transfer your personal data to supervisory, investigation and law enforcement authorities and to third parties if such an obligation arises from legislation in force or the third party has an overwhelming legitimate interest in it.
10. Transfer of Personal Data of Third Countries
10.1. As a general rule, we do not transfer personal data to countries outside the European Union or the European Economic Area. If we transfer personal data to countries outside the European Union or the European Economic Area, we only do that in compliance with the requirements of data protection legislation.
10.2. Transfer out of the EEA. Apollo Group companies or our partners may, where necessary, use international service providers or partners from third countries to process personal data. Third countries are deemed to be countries outside the European Union or the European Economic Area. In this case, the appropriate basis for transfer from Chapter V of the GDPR is used. We generally use the EU standard contractual clauses for data processing in these situations.
11. Your Rights with Regards to Processing of Personal Data
11.1. Access to personal data and obtaining a copy. You have the option to access the personal data collected about You at any time in Your Apollo Club account or Your account of a respective Apollo Group company. You can also apply for access to the personal data collected by Apollo Group and ask for a copy of the personal data collected about You.
11.2. Alteration and rectification of personal data. You have the right to alter and rectify the personal data collected about You at any time. Your contact details are updated automatically according to the new contact details submitted by You to companies of Apollo Group or to Apollo Club.
11.3. Data portability. You have the right and opportunity to download your personal data from Your Apollo Club account and transmit these on Your own to another data processor. The right of portability extends only to certain types of personal data, e.g. it does not extend to personal data generated by Apollo Group as a result of an analysis; it extends, however, to personal data provided by You directly to us.
11.4. Restriction of processing of personal data. If You submit a request to restrict or prohibit the processing of Your personal data, Apollo Group will only store Your personal data if this is necessary on other legal grounds.
11.5. Erasure of personal data. You have the right to request the erasure of Your personal data at any time, except if there are any legal grounds for processing of personal data, such as an obligation arising from law. With the erasure of Your data, You will no longer be eligible for any personal discounts.
11.6. Right to object. You have the right to object to the processing of Your personal data, for example, if we process Your data on the basis of a legitimate interest.
11.7. Compensation for damage. You have the right to claim compensation for the damage caused by the breach of the personal data processing requirements.
11.8. Exercise of data subject rights. Please note that rights relating to personal data are not absolute. We will comply with Your request if the conditions for exercising the right are met. We may also ask to identify You before responding to You. This is to ensure the security of personal data and to avoid giving out personal data to the wrong person. This means that You will be required to submit a digitally signed application or, if this is not possible, an identity document with possible identification by video link (or other means where there is reasonable assurance of identity). We may restrict the exercise of Your rights in order to protect the rights of others, e.g. if your personal data relates to data of others, we may make the data unreadable or remove it before granting you access or providing a copy. You will be able at any time to view, modify and update your personal information on the Apollo Club website or on the websites of Apollo Group companies in the ‘My Account’ (Minu konto) section (where applicable).
In all the above cases, You can also contact us by sending an e-mail to or to the e-mail address of a respective company of Apollo Group set out above.
Withdrawal of consent. You have the right to withdraw Your consent to the processing of Your personal data at any time by contacting us at www.apollo.ee/klubi/, by unsubscribing via the link in our newsletter or by contacting Apollo Group Customer Support at info@apollo.ee.
11.9. Responding to requests. The Apollo Group will respond to Your request as soon as possible, but no later than within one (1) month of the receipt of the request. The Apollo Group reserves the right to extend the deadline for responding by two (2) months if the request is more complex or time-consuming.
11.10. Resolution of complaints. If You have any questions about the Apollo Group’s data protection terms and conditions, or if You believe that an Apollo Group company is violating Your rights with regard to the processing of Your personal data, You have the right to contact the relevant Apollo Group company by using the contact details above, the Apollo Group Data Protection Specialist at , the Data Protection Inspectorate (www.aki.ee) or a court at any time.
12. Storage and Deletion of Personal Data
12.1. Storage. Apollo Group will retain Your personal data for as long as it is necessary to achieve the purpose for which Your personal data is processed or until the expiry of any statutory time limits. More specifically:
(i) personal data provided on the basis of consent will generally be stored until consent is withdrawn (e.g. You unsubscribe from the newsletter); if You have consented to the use of Your phone number in our self-service checkouts to receive a notification of fulfilled food orders, Your phone number will be deleted from the self-service checkouts system immediately after the notification is sent;
(ii) the basic personal data of a loyal customer (i.e. Apollo Club member) (full name, contact details, Club membership status) are stored for seven years from the last use of the customer account, after which the customer’s personal data are automatically deleted; purchase history is stored for one year (this is related to the granting of discounts); if the customer requests the deletion of their data which Apollo Group does not require by law or in the overriding legitimate interest, the relevant personal data are deleted as soon as possible after the request for deletion is received;
(iii) in the case of mandatory processing arising from law, the relevant personal data will be stored for the period specified in the law, e.g. accounting data for seven years, employment contract data for 10 years;
(iv) video recordings from cameras are generally kept for 30 days; in the event of a dispute or to prove a claim, the recording may be kept for longer.
If You would like more information about the storage of your personal data, please write to us at andmekaitse@apollogroup.ee.
13. Amendment of Data Protection Terms and Conditions
13.1. Amendments. By accessing our website or completing the application to create a loyal customer account, You confirm that You have read and accepted these terms and conditions. Apollo Group has the right to amend and modify these Data Protection Terms and Conditions at any time in order to bring them into compliance with the legislation in force and with the principle and goals of Apollo Group. We reserve the right, where necessary, to amend the general terms and conditions of the data protection policy, by giving notice on our websites and, if possible, by e-mail.
13.1. Contact details of data protection specialist. If You have any questions or concerns about personal data processing, please contact us at andmekaitse@apollogroup.ee.
The data protection terms and conditions were amended on 15 March 2023.