DATA PROTECTION TERMS AND CONDITIONS OF APOLLO GROUP and Group Companies
GENERAL
These Data Protection Terms and Conditions of Apollo Group and companies belonging to the Apollo Group (hereinafter referred to as Apollo Group) and members of Apollo Club establish general principles on the basis of which Apollo Group processes personal data of the customers and users who are natural persons. The Data Protection Terms and Conditions apply to all customers and users who purchase goods and products of group companies of Apollo Group, consume their services, visit websites, stores, cinemas or restaurants of the group companies of Apollo Group or otherwise consume other products or services of group companies of Apollo Group.
Apollo Group OÜ, registry code 12383236, address Tartu mnt 80d, Tallinn 10112, is a group with the following companies engaged in entertainment and the provision of food services in the Baltics (Estonia, Latvia and Lithuania): Apollo stores; Apollo cinemas; Blender cafés; Ice Cafe cafés; O’Leary’s restaurants; film distribution and production units of Estonian and Baltic Film Distribution, IT solutions oriented unit APL Digital Solutions as well as restaurants operating under the KFC trademark in the Baltics and Finland, and also restaurants operating under the Vapiano trademark in the Baltics and Finland.
Apollo Club is an ID-card-based loyalty programme that offers customers registered with Apollo Club loyalty rebates and adventures in Apollo stores, Apollo cinemas, O’Leary’s entertainment centres, IceCafe and Blender juice bars, Vapiano restaurants.
The controller of the processing operations described in these Data Protection Terms and Conditions is Apollo Group OÜ, registry code 12383236, address Tartu mnt 80d, Tallinn 10112.
DEFINITIONS
Data subject (hereinafter also referred to as You/Your/Yourself) is a natural person whose personal data are processed by Apollo Group.
Personal data are any information about You that enables Your identity to be established.
Apollo Group or a group company of Apollo Group mostly collects personal data from You directly, according to Your connection with Apollo Group or, for example, within the framework of providing services to You or selling the goods and products offered to You.
Controller is the legal person who determines the purposes and means of processing of personal data.
The controller of the personal data processed by Apollo Group is Apollo Group OÜ, registered office Tartu mnt 80d, Tallinn 10112, e-mail address .
The group of Apollo Group consists of the companies included in the following list and their contact details are as follows:
Apollo Club
Apollo stores
Apollo cinemas
Blender cafés and Ice Cafe cafés
Restaurants operating under the KFC trademark
Restaurants operating under the O’Leary’s trademark
Restaurants operating under the Vapiano trademark
Film distribution and production units of Film Distribution
APL Digital Solutions OÜ, 14994211, info@apollodigital.eu.
In matters related to the processing of personal data by Apollo Group, You can contact each company of Apollo Group, using the contact details listed above, or the data protection officer of Apollo Group, sending an e-mail to .
Processor is the natural or legal person who processes personal data on behalf of a company of Apollo Group as the controller (above all cooperation partner, service provider) on the basis of a contract concluded with Apollo Group. Apollo Group uses processors for performing the obligation arising from law (e.g. for providing accounting service), but also for the purpose of better service provision (e.g. website developers, etc.). Apollo Group as the controller concludes a contract with all of its cooperation partners who are authorised persons and ensures confidentiality of Your personal data therein. The details of the authorised cooperation partners of companies of Apollo Group are available on the website of each company or can be obtained by directly contacting the company.
Public authorities as authorised persons process personal data for the performance of a task carried out in the public interest or in the exercise of an official authority for the purpose of performing obligations arising from legislation, provided that the obligation to transmit data arises from legislation that is in force (e.g. transmission of personal data to supervisory, investigative and law enforcement authorities, etc.) and no separate contract for the processing of data is concluded with them.
Whose personal data are processed by Apollo Group (categories of data subjects and processing of special categories of personal data)?
The personal data processed by Apollo Group include, but are not limited to, the personal data of the following data subjects – visitors to and users of the websites of companies of Apollo Group, their customers, users of their sales environment, consumers of their services, etc.
Which personal data are processed by Apollo Group?
Apollo Group processes Your personal data only where necessary and for service provision or employment relationship purposes, and the personal data processed include, but are not limited to, Your name, personal identification code, phone, e-mail address and, where necessary, postal and delivery address, direct marketing consents, purchases registered while acting as a customer or user.
We collect personal data of the following type:
- The personal data disclosed to us by You. For example, when You enter Your contact details (incl. name, postal address, phone number, e-mail address, preferred contact method) on our website or elsewhere (e.g. stores, cinemas).
- The personal data generated in the course of ordinary communication (e.g. personal data transmitted via correspondence or the communication app on the website).
- The personal data You have clearly disclosed (e.g. in the social media of companies of Apollo Group).
- The personal data generated upon consuming services (e.g. upon using our self-service or, for example, upon making a purchase or placing an order in our stores, restaurants or online stores when saving contact details or data concerning purchase preferences (a company of Apollo Group may ask You to voluntarily enter personal data and personal information in certain website fields.
- The personal data generated as a result of visiting and using the website. For example, through the customer’s account information or via cookies saved upon using the website.
- Personal data obtained from third parties.
- The personal data created and combined by us (e.g. the order history list).
Upon visiting websites of Apollo Group, companies of Apollo Group may also collect from You anonymous (non-personal) data, which cannot be linked to any particular person (gender, age, language preference). Non-personal data also include the time of the visit to the website, the information downloaded from the website, browser name and operating system, Internet service provider and other similar data for the purpose of improving the functionality of the website. We may also collect data about generalised customer activities in our stores and on our website. These data are consolidated and used for providing useful information to our customers, and also for determining which parts of the website, products and services are the most attractive.
Purposes of processing personal data
Apollo Group processes Your personal data according to the legislation in force, above all for the following purposes:
- for concluding and performing a customer contract, managing the customer account and communicating with the data subject;
- for providing goods, products and services aimed at the customer;
- for fostering and analysing customer relationships;
- for responding to enquiries made by the data subject;
- for providing services and products to the data subject;
- for organising polls and carrying out prize draws;
- for direct marketing;
- for managing and developing services;
- for enabling the use of websites and improving websites;
- for preparing statistics or reports;
- for processing legal claims;
- for performing obligations arising from legislation.
Basis for processing of personal data
Consent
The explicit consent given by You for operations with Your personal data in order to notify You of product news, campaigns and future events. If You do not want to be on our newsletter list or receive notifications about the products or services that may be of interest to You, You can remove Yourself from the target audience at any time. Withdrawal of the consent does not affect the lawfulness of processing the personal data that has taken place on the basis of Your consent prior to its withdrawal.
Performance of contractual obligations
Processing of personal data is necessary for the performance of a contract to which You are a party or in order to take steps at Your request prior to concluding a contract (e.g. a customer contract). For example, identification of the customer to the extent required by the due diligence obligation; performance of the obligations to the customer in respect of the provision of our services (e.g. for the delivery of goods); for communicating with the customer and for ensuring the performance of the customer’s payment obligation.
Please note that the purpose of processing personal data may be additionally provided in the specific contract concluded with You.
In order to conclude an employment contract, processing of the personal data of our job applicant includes, on the basis of the interest in concluding the contract and legitimate interest, the following:
- processing of the data transmitted by the job applicant for the purpose of concluding an employment contract;
- processing of the personal data obtained from the person indicated as a referee by the job applicant and, upon absence of a referee, from the former employer;
- processing of the personal data collected from public (social) media;
- if the job applicant is not selected for the job, we retain the personal data collected for concluding an employment contract in order to make a job offer to the job applicant when a suitable position becomes vacant.
Compliance with legal obligation
Processing of personal data is necessary for compliance with a legal obligation to which Apollo Group is subject.
We also process Your personal data for compliance with an obligation arising from legislation. For example, obligations arise from legislation upon processing payments or adhering to money laundering rules. In addition, we may be required to process a video recording on the basis of law for an investigative authority specified in law.
Protection of vital interests
Processing of personal data is necessary in order to protect Your vital interests or those of another natural person.
Legitimate interest
Legitimate interest means the interest of a group company of Apollo Group in running or managing the company and enabling the provision of the best possible services or products on the market. We process Your personal data on the basis of a legitimate interest for the following purposes:
- for ensuring a customer relationship of trust, which covers processing of personal data for preventing fraud;
- for managing and analysing the customer base to improve the availability, range and quality of services, and to make the best and more personal offers to the customer with the consent of the latter;
- identifiers and personal data collected upon using websites, and social media sites and services of group companies of Apollo Group. We use the collected data for conducting web analytics or analytics of information society services, ensuring and improving the operation of the channels, compiling statistics and analysing Your behaviour and user experience, and providing a better and more personal service;
- for organising campaigns, including organising personalised and targeted campaigns, conducting customer satisfaction surveys and measuring the efficiency of the marketing activities performed;
- for making recordings. We may record messages and orders given on our premises as well as by means of communication (e-mail, phone, etc.), also information and other operations we have performed and, where necessary, we use the recordings for proving the orders or other operations;
- for network, information and cyber security considerations, e.g. the measures taken to combat piracy and guarantee website security, make and save backup copies;
- organisational purposes. Primarily for financial management and transmission of personal data within the group for internal administrative purposes, including for processing the personal data of customers or employees;
- we may share personal data when we conclude business transactions or hold negotiations over a business transaction, which covers the sale or transfer of our business or assets in its/their entirety. These transactions may cover any merger, financing, acquisition or bankruptcy transaction or proceedings;
- for establishing, exercising or defending legal claims;
- we also use the data to send You special messages with regard to the security factors issued by the manufacturer or product recall programmes, if necessary;
- we use security cameras in our stores and restaurants. The purpose of using the cameras and processing the recordings is to protect the property of the employees, visitors and group companies of Apollo Group; ensure security; defend and exercise claims; resolve complaints and use the recording as learning material. Recordings are deleted no later than 30 days after the storage space becomes full.
Processing of personal data is necessary if Apollo Group or a third party has a legitimate interest and if this overrides the person’s fundamental rights and freedoms. Whether Your legitimate interest in processing Your personal data overrides the interests of other persons must be assessed on a case-by-case basis.
Cameras (video surveillance)
The territory, e.g. stores, cinemas and restaurants, of the companies of Apollo Group is/are provided with cameras (video surveillance) for the purpose of protecting persons and property.
Video recordings of the cameras are generally stored for 30 days.
All video recordings can only be accessed by the persons who have the right to examine the video recordings based on their official duties.
The controller of the video recordings is the company of Apollo Group who owns the camera, or in whose company the camera has been installed and the processor is the employee of the company of Apollo Group who has access to the video recordings arising from their official duties.
In the cases provided in law, Apollo Group shares the recordings with law enforcement authorities.
Security measures
Apollo Group implements necessary organisational, physical and information technology security measures in order for Your personal data to be protected against any misuse, unauthorised access, disclosure, alteration or destruction. Only an employee authorised for this purpose is provided with access to Your personal data. An encrypted data communications channel with banks ensures the security of the purchaser’s personal data and bank details. If any personal data breach occurs, we take any necessary measures to mitigate the consequences and manage the relevant risks in the future. Among others, we register all incidents and notify, in the event and pursuant to the procedure prescribed for this purpose, the Data Protection Inspectorate and the data subjects thereof. All the data on the websites, online stores and maintenance databases of the group companies of Apollo Group are encrypted and treated as confidential information.
Profiling, direct marketing, surveys
Apollo Group may carry out profiling in respect of Your personal data in order to better understand Your expectations and, based on this, provide better products and services, enabling more accurate direct marketing. Profiling entails no legal consequences for You.
Apollo Group may use Your personal data with Your consent in order to send You information about discount offers and campaigns, and carry out customer surveys, such as satisfaction surveys. If You no longer want to receive direct offers, You have the right to withdraw Your consent for the processing of Your personal data by contacting the company of Apollo Group whose direct offers You want to opt out.
Transmission of personal data
Apollo Group has the right to transmit Your personal data to companies of Apollo Group (Apollo Kauplused, Apollo Kino, Blender juice bars, IceCafe ice-cream bars, O’Learys restaurants, Vapiano restaurants, KFC restaurants, etc.) for example for receiving special offers, a purchase bonus or loyalty rebate of Apollo Club.
Apollo Group has the right, without a separate consent, to send You information about the contracts concluded between You and group companies of Apollo Group and about the performance thereof as well as about Apollo Club (information related to reward points, information about amendments, etc.), and also messages essential for You and other relevant essential information.
Your personal data may be shared with third-party service providers whose service is unavoidable for performing the contracts concluded with group companies of Apollo Group OÜ and for providing services and with whom corresponding contracts are concluded for the protection of personal data and maintenance of confidentiality of the information to be transmitted.
Third parties include, for example, our partners who are responsible for transporting the goods sold in our online store or providing hire-purchase services, advertising and marketing partners; the partner providing payment services; the partner providing recruitment-related services, companies organising customer satisfaction surveys, debt collection service providers, payment default registers, providers of various technical services, invoice transmission service providers. Transmission takes place only on the condition that the purpose of the transmission is lawful and the third-party processes personal data on the basis of a contract in which the third party agrees, among other things, to maintain confidentiality of the information shared.
In addition to third parties, companies of Apollo Group have the right to transmit Your personal data to supervisory, investigation and law enforcement authorities and to third parties if such an obligation arises from legislation in force.
Transmission of personal data to third countries
As a general rule, we do not transmit personal data to countries outside the European Union or the European Economic Area. If we transmit personal data to countries outside the European Union or the European Economic Area, we only do that in compliance with the requirements of data protection legislation.
Your rights with regard to the processing of personal data
Access to personal data
You have an opportunity to access the personal data collected about You at any time in Your Apollo Club account or Your account of a respective company of Apollo Group.
You can also apply for access to the personal data collected by Apollo Group and ask for a copy of the personal data collected about You.
Alteration and rectification of personal data
You have the right to alter and rectify the personal data collected about You at any time.
Your contact details are updated automatically according to the new contact details submitted by You to companies of Apollo Group or to Apollo Club.
Data portability
You have the right and opportunity to download Your personal data from Your Apollo Club account and transmit these on Your own to another data processor.
Apollo Group has the right to refuse to directly transmit personal data to another data processor if, according to Apollo Group, the transmission of the data to a third party is not secure.
Restriction of processing of personal data
If You express Your request to restrict or prohibit the processing of Your personal data, Apollo Group will store Your personal data only if this is necessary on other legal grounds.
Erasure of personal data
You have the right to request the erasure of Your personal data at any time, except if there are any legal grounds for processing of personal data, such as an obligation arising from law. With the erasure of Your data, You will no longer be eligible for any personal rebates.
You can see, alter and supplement Your personal data on the website of Apollo Club or on websites of the group companies of Apollo Group in the “Account Information” area.
Access to personal data:
https://www.apollo.ee/privaatsus/tutvumise_taotlus
Erasure of personal data: https://www.dropbox.com/s/u7vskg5xvsygzos/Apollo_Klubi_isikuandmete_kustutamise_taotlus2.docx?dl=0
In all the above cases, You can also contact us by sending an e-mail to or to the e-mail address of a respective company of Apollo Group set out above.
Apollo Group or a group company of Apollo Group has the right to request establishment of Your identity before processing of personal data at Your request. This means that You are requested to submit a digitally signed application or, if it is not possible to submit the same, present Your identity document together with possible establishment of Your identity via a video bridge.
Storage of personal data, time limits therefor and erasure of personal data
Apollo Group stores Your personal data as long as it is necessary for achieving the purpose of processing Your personal data or until expiry of the time limits arising from legislation. Customer’s personal data are generally stored for 10 years as of the last use of the customer account and thereafter the customer’s personal data are erased automatically.
The personal data the time limit of whose storage has expired are destroyed or anonymised, using the best practice for that purpose.
Personal data provided on the basis of consent are stored until the consent is withdrawn.
Apollo Group and a group company of Apollo Group also stores Your personal data for the performance of obligations arising from legislation for the purposes and until the expiry of the time limits provided in legislation (e.g. accounting documents or for taxation and legal purposes until the expiry of the time limits arising from law).
Withdrawal of consent
You have the right to withdraw Your consent granted for the processing of Your personal data at www.apollo.ee/klubi/ or unsubscribe from the newsletter via the link set out in the newsletter or contacting Apollo Group customer support by sending an e-mail to .
Withdrawal of the consent for processing of personal data does not affect the processing of personal data that has taken place prior to the withdrawal of Your consent.
Your rights regarding Your personal data breach and resolution of complaints
If You have any questions in connection with the Data Protection Terms and Conditions of Apollo Group or You find that any group company of Apollo Group infringes Your rights in the processing of personal data, You have the right to contact the respective company of Apollo Group by using the contact details set out above, the data protection official of Apollo Group by sending an e-mail to , the Data Protection Inspectorate (www.aki.ee ) or a court.
Apollo Group or a group company has the right to request establishment of Your identity at any time. This is necessary in order to achieve the purpose of secure processing of Your personal data. To establish Your identity, You are requested to submit an application, which has been signed digitally by You, or, if it is not possible to submit the same, present Your identity document together with possible establishment of Your identity via a video bridge or in a manner, which is accepted by Apollo Group and enables Your identity to be established.
Apollo Group responds to Your applications as soon as possible, but no later than within one (1) month of receiving the application. Apollo Group has the right to extend the term for responding to the application by two (2) months due to the complex and time-consuming procedure for granting the application.
Amendment of Data Protection Terms and Conditions
By starting to use our website or filling in a petition for creating a loyal customer account, You confirm that You have examined and taken notice of these principles and Terms and Conditions. We reserve the right, where necessary, to amend the general terms and conditions of the data protection policy, notifying thereof on our websites and, if possible, by e-mail.
If You have any questions or concerns regarding processing of personal data, please contact us by sending an e-mail to or .
Apollo Group has the right to amend and modify these Data Protection Terms and Conditions at any time in order to bring them into compliance with the legislation in force and with the principle and goals of Apollo Group.
These Data Protection Terms and Conditions were amended on 18 October 2021.