Petrolina

The Petrolina Group (or “Petrolina”) is committed to protecting your privacy and handling your personal data in a transparent and legal manner. The personal data that we collect, and process will vary depending on the product or service we provide to you or to any other legal relationship with you. This notice statement applies to personal information held by members of the Petrolina Group as data controllers, as described below. It continues to apply even if your agreement or relationship and services with us ends.

This privacy policy statement (“Privacy Policy’’ or “Statement”) applies to Petrolina Limited, its subsidiaries and all of the affiliates within Petrolina Group (please refer to Section 1. Who We Are).

We have developed this Statement to explain our practices regarding the personal information we collect from you or about you either through our websites or via our apps, or due to a collaboration (or intended cooperation or collaboration with Petrolina Group) through written or other form of communications with any member of the Petrolina Group, when you either visit any of the Petrolina Group properties, or from other sources (such as through social media).

Specifically, this Privacy Policy:

provides an overview of how Petrolina collects and processes your personal data, including sensitive data, and informs you about your rights under the European Union General Data Protection Regulation (“GDPR”) and any national law supplementing or implementing the GDPR;
is directed to natural persons who are: (a) current or potential customers of Petrolina; and/or (b) beneficial owners or authorised representatives of legal entities or of natural persons which/who are current or potential customers of Petrolina; and/or (c) Petrolina’s service providers, suppliers, and business partners; and/or (d) employees (unless other policies apply);
is directed to natural persons who had a business relationship with Petrolina in the past; and
contains important information about what personal data we collect, what we do with such personal data, who we may share it with and why and your rights in relation to the personal data you have given us.

For the purposes of this Privacy Policy:

when we refer to “personal data” we mean data which identifies or may identify you and which may include, for example, your name, address, identity card number, telephone number, email address, bank account, date of birth, occupation, and family status;
when we refer to “sensitive data” we mean special categories of personal data which uniquely identify a person; GDPR considers as sensitive personal data revealing the following (1) race or ethnic origin; (2) political opinions; (3) religious and philosophical beliefs; (4) trade union membership; (5) sex life or sexual orientation; (6) physical or mental health or conditions; and (7) genetic data and biometric data for the purpose of uniquely defining a natural person;
when we refer to “processing” we mean the handling of your personal data by us, including collecting, protecting, and storing your personal data; and
when we say or refer to “we” or “us” or “Petrolina” we mean Petrolina Group companies as described in Section 1 below, which act as a data processor or controller in respect of your personal data when you have or had a business relationship with them.

Notice: Some of the links on our websites lead to other Petrolina Group entities or non-Petrolina websites with their own privacy notices, which may be different to this notice. You will need to make sure you are happy with their privacy notices when using those other sites.

1. Who we are – Petrolina Group

The Petrolina Group is a group of affiliated entities by virtue of shareholding or common management control or affiliation under Petrolina Limited (a private limited company, registered in the Republic of Cyprus under registration number HE856, having its registered office and head offices at 1 Kilkis, 6015 Larnaca, Cyprus).

Petrolina Group consists and is segregated in two sub-groups of companies; (i) “Petrolina Public Group” – those companies controlled by or directly associated or subsidiaries to Petrolina (Holdings) Public Ltd (a public listed company in the Cyprus Stock Exchange (CSE), registered in the Republic of Cyprus under registration number ΗΕ1018, having its registered office and head offices at 1 Kilkis, 6015 Larnaca, Cyprus) and (ii) “Lefkaritis Private Group” – those private companies affiliated or controlled or being subsidiaries of Petrolina Ltd and in which Petrolina (Holdings) Public Ltd has no direct shareholding.

Petrolina Public Group	Lefkaritis Private Group
Petrolina (Holdings) Public Ltd	Petrolina Ltd
Petrolina Aviation Ltd	Lefkaritis Bros Ltd
P&S LPG Gas Ltd	Linco Insurance Agent,Sub-agent and Consultants Ltd
PPT Aviation Services Ltd*	Famagusta Citrus Waste Control Company Ltd
LCA Avitation Fueling System Ltd*	Lefkaritis Indrustries Ltd
VLPG Plant Ltd*	Petrolina Solar Ltd
Hellenic Aviation Fueling Company SA*	Petrolina Electric Ltd
Petrolina Terminals Ltd	Petrolina Energy Ltd
P.W. Bunkering Services (East Med) Ltd	Centragaz Ltd
SILK OIL S.A. (Σιλκ Οιλ Ανώνυμη Βιομηχανική-Εμπορική-Εισαγωγική-Πετρολαϊκή-Τουριστική-Ναυτιλιακή και Ξενοδοχειακή Εταιρεία)*
Petrolina Bayfront Ltd	Petrogaz Ltd
	Agip Cyprus Co Ltd
	Petrolina Crude Oil Trading Ltd
	Lefkaritis Estates (Pyla) Ltd
	Lefkaritis Holdings Ltd
	Lefkaritis Bros Ocean Ltd
	Lefkaritis Bros Seas Ltd
	LV Maritime Services Ltd

For the purposes of this Privacy Policy, when we refer to Petrolina Group, we refer to all the above mentioned companies, in the sub-group structure depicted, except for those companies marked (*) which have their own, separate privacy policy statements due to their business model and operational structure and for which we may have appointed a separate Data Protection Officer (DPO).

This Privacy Policy relates to personal data collected and enforced by any Petrolina Group member listed above and any other entities that may at any time become affiliated with Petrolina Limited and are to be included herein as the case may be; and as this Privacy Policy Statement shall be updated and revised from time to time.

If you have any questions about our Privacy Policy or wish to obtain more details in relation to the personal data we hold and process about you, please contact our Data Protection Officer in writing at 1 Kilkis, 6015 Larnaca, Cyprus or via email at DataProtection@petrolina.com.cy or via telephone at 24 84 80 00.

2. How we collect your personal data

We obtain your personal data mainly through any information you provide directly to us or through information provided by third parties. Below is a list of ways in which we collect your personal data.

(a) Personal data collected directly from you, including:

when you become or contact us to become our customer;
when you become or contact us to become our supplier or vendor;
when you register for and use the Petrolina Fuel Card Scheme;
when you use the GPS systems provided by us through Petrolina Fuel Card Scheme;
when you enter our promotions, contests, and giveaways;
when you engage with or contact us through our social media accounts or websites;
when you make requests to receive our products or services;
when you visit any of our premises;
when you provide products or services on our behalf as an agent or sub-contractor;
when you partner with us;
when you contact us for an enquiry, complaint or for any other reason (including submission of an employment application);
when you become our employee

(b) Personal data collected from other sources, including:

from legal entities with whom we have a professional relationship, for example when you are an employee in a customer’s or partner’s or sub-contractor’s or agent’s company offering services or support to us;
via third parties, including:
- our agents who have passed on your personal data to us;
- our service providers;
- our subcontractors.

the internet;
the Department of Registrar of Companies and Official Receiver; and
the press and the media.

3. What personal data we collect

We may collect the following personal data from you depending on the product or service we provide to you or which we receive from you:

Contact details such as your name, address, telephone number, e-mail address and fax number.
Identification details such as your identification or passport number and driving licence details (e.g. when providing transportation services).
Financial information such as your bank account number and account details, your payment card details and other financial information.
Details of any transactions you carry out with us.
Closed Circuit Television (CCTV) recordings. We use closed circuit television (CCTV) in and around our sites and these may collect photos or videos of you as part of the procedure of offering our products or services.
Your location data when you purchase a GPS system from us.
Details of your driving behaviour through a GPS system or tachograph when you drive one of our vehicles.
Records of any correspondence and/or communications we have with you.
Details of contracts you enter with us.
Your marketing preferences.
Other information about you that you give us by filling in forms or by communicating with us, whether face-to-face, by phone, email, online, or otherwise.

Recording: To help keep you and our business interests safe (including our premises and use of business secrets), we may record details of your interactions or working with us. We may keep track of conversations you have with us including phone calls, face-to-face meetings, letters, emails, applications, live chats, video chats and any other kinds of communication. We may use these recordings to check your (or our) instructions to us (to you), assess, analyse, and improve our service, train our people, manage risk or to prevent and detect fraud and other crimes. We may also capture additional information about these interactions, e.g. telephone numbers that you call us from (or use of our devices made available to you in the course of our business or products) and information about the devices or software that you use in relation to offering services or products to us or vice versa.

4. Why we need your personal data

4.1 Personal data

We shall process and use your information where we have your consent, or we have lawful reason for using it subject to applicable law. Most commonly, we will use your personal data in the following circumstances:

(a) Where we need to perform the contract or arrangement we have entered or agreed with you or in order to take certain steps prior to entering into a contract with you

Processing is necessary for us in order to provide you with our products or services or information, and more specifically in order to:

review any proposal made by you and provide you with a quotation;
administer your contract;
communicate with you in order to manage our business relationship with you and resolve any complaints and/or enquiries you may have;
notify you about any changes to our products and/or services, including pricing;
recover any payment due to us in respect of the products and/or services we provide to you.

(b) Where we need to comply with a legal obligation

When we are required to comply with certain legal and regulatory obligations which may involve the processing of personal data. Such obligations and requirements impose on us necessary personal data processing activities for compliance with customs department, port authorities, airport authorities, other governmental regulatory bodies, court orders, tax law and/or or other reporting obligations(e.g. regulatory compliance credit checks from credit institutions or other authorities are carried out in the context of combating money laundering and fraud) for carrying out our business and be compliant with regulatory obligations imposed on us.

In some cases, we may process your personal data to pursue legitimate interests of our own or those of third parties, provided your interests and fundamental rights are not overridden by our interests. More specifically, we may process your personal data in order to:

maintain our accounts and records;
enhance the security of our network and information systems;
identify, prevent, and investigate fraud and other unlawful activities, unauthorised transactions, claims and other liabilities, and manage risk exposure and quality;
safeguard the security of our people, premises and assets and prevent trespassing or theft through video surveillance (CCTV);
manage our infrastructure, business operations and comply with internal policies and procedures;
modify or otherwise improve our products, services, and communications;
defend, investigate, or prosecute legal claims;
receive professional advice (e.g. tax or legal advice);
perform data analytics (such as market research, trend analysis, financial analysis, and customer segmentation).

(d) Where you have given us your consent

In some cases, you will have given us your consent to the processing your personal data for one or more specific purposes (e.g. for marketing purposes). You may withdraw your consent to such processing at any time. Please note that any processing that was carried out prior to the withdrawal of your consent shall not be affected in any way.

If you wish to withdraw your consent you should notify our Data Protection Officer in writing at 1 Kilkis, 6015 Larnaca, Cyprus or via email at DataProtection@petrolina.com.cy.

4.2 Sensitive data

We will only process sensitive data if one of the following conditions is met:

your explicit consent was obtained (a law may rule out this option in certain cases);
an EU or national law or a collective agreement, requires us to process the data to comply with its obligations and rights, and those of the individuals, in the fields of employment, social security and social protection law;
the vital interests of the person, or of a person physically or legally incapable of giving consent, are at stake;
the sensitive data was manifestly made public by you;
the data is required for the establishment, exercise, or defence of legal claims;
the data is processed for reasons of substantial public interest based on EU or national law;
the data is processed for the purposes of preventive or occupational medicine, assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services based on EU or national law;
the data is processed for reasons of public interest in the field of public health based on EU or national law;
the data is processed for archiving, scientific or historical research purposes or statistical purposes based on EU or national law.

5. With whom we may share your personal data

We may share your personal data with third parties as listed below. When we do so, we request from such third parties to have appropriate technical and organisational measures in place to protect your personal data. We will not share any of your personal data for any purpose other than the purposes described in this Privacy Policy, nor will we sell your personal data to anyone.

Service providers we have chosen to support us in the effective provision or marketing of our products and services to you by offering technological expertise, solutions, and support;
Auditors and accountants;
External legal consultants;
File storage companies, archiving and/or records management companies, and cloud storage companies;
Financial and business advisors;
Governmental and regulatory bodies, including customs department, port authorities and airport authorities in order to enable us to comply with its legal and regulatory requirements and law enforcement authorities in connection with enquiries, proceedings, or investigations by such parties;
Card payment processing companies;
Debt-recovery agents;
Members of the Petrolina Group;
Partners such as agents and other companies who assist us with the sale of our products and services;
People who provide guarantees or other security for any amounts you may owe us;

Although we do not share any of your personal data with recipients located in third countries (i.e. countries outside the European Economic Area (EEA)), in case we ever do, we will require recipients in third countries to comply with European data protection standards and to provide appropriate safeguards in relation to the transfer of your data in accordance with GDPR.

6. Safeguarding your data

We use a range of administrative, technical, and technological measures to keep your information safe and secure both physically and electronically. We require our staff and any third parties who carry out any work on our behalf or at our premises or servers to comply with appropriate compliance standards including obligations to protect any information and applying appropriate measures for the use and transfer of information.

7. Marketing and market research

We may use your personal data to tell you about products, services and offers that may be of interest to you or your business.

Marketing: The personal data that we process for this purpose consists of information you provide to us and data we collect and/or infer when you use our services or buy our products or submitted through our social media or apps. We will use your information to provide you with information about Petrolina Group products and services, and products and services from our partners. This includes marketing by post, email, telephone, text, secure messages or advertising to you and other people online and on social media. We study all such information to form a view on what we think you may need or what may interest you. We can only use your personal data to promote our products and services to you if we have your explicit consent to do so.

Market Research: We may use your information for market research and to identify trends. Market research agencies acting on our behalf may get in touch with you by post, telephone, email, or other methods of communication to invite you to take part in research. We will not invite you to take part in research using a communication method if you have asked us not to get in touch that way. Any responses that you provide whilst participating in market research will be reported back to us anonymously unless you give us permission for your details to be shared. You have the right withdraw your consent to the processing of your personal data for marketing purposes. If you wish to withdraw your consent you should notify our Data Protection Officer in writing at 1 Kilkis, 6015 Larnaca, Cyprus or via email at DataProtection@petrolina.com.cy or by visiting the Data Protection section on our website.

8. How long we keep your personal data (retention)

Unless a longer retention period is required by applicable laws, we will retain your information for as long as we have a business relationship with you.

Once our business relationship with you has ended, we may keep your personal data for the longest of the following periods:

(a) any retention period set out in our Data Retention Policy which is in line with regulatory requirements relating to data retention; or

(b) the end of the period in which legal action or investigations might arise in respect of the products and services provided or received.

In principle we normally keep data for a period of seven (7) years from the end of our relationship with you. This enables us to comply with legal and regulatory requirements or use it where we need to for our legitimate purposes such as processing any disputes or claims pending for any services or products.

We may need to retain your information for a longer period where we need the information to comply with regulatory or legal requirements or where we may need it to protect legitimate company interests (e.g. statute of limitations periods).

9. Your rights

You have the following rights in terms of the personal data and information we hold about you:

Receive access to your personal data. This enables you to receive a copy of the personal data we hold about you and to be informed on how we are lawfully processing it.
Request correction (rectification) of the personal data we hold about you. This enables you to have any incomplete, inaccurate, or out of date information we hold about you corrected.
Request erasure of your personal data. This enables you to ask us to erase or remove your personal data where there is no good reason for us continuing to process it. However, we may continue to retain your information if we are entitled or required to retain it under applicable law or if there is legitimate interest (e.g. there is a claim against you or Petrolina Group).
Object to processing of your personal data where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground. In such a case, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interest, rights, and freedoms.
Request the restriction of processing of your personal data. This enables you to ask us to restrict the processing of your personal data if:
- it is not accurate;
- it has been used unlawfully but you do not want us to delete it;
- it is not relevant anymore, but you want us to keep it for use in possible legal claims concerning you;
- you have already asked us to stop using your personal data, but you are waiting for us to confirm if we have legitimate grounds to use your data.
Request to receive a copy of the personal data concerning you in a format that can be easily re-used or request the transfer of such data to other organisations.
Withdraw the consent you gave us regarding the processing of your personal data for certain purposes, such as to allow us to promote our products and services to you.

Exercise of Your Rights: To exercise any of your rights, or if you have any other questions about our use of your personal data, please contact our Data Protection Officer using the contact details set out in Section 1 of this Privacy Policy or may complete the relevant Form posted on our website or by visiting our offices or by telephone. We aim to respond to your request as quickly as possible. In some instances, this could take up to one month (if legally allowed). Should we require more time to complete your request, we will let you know how much longer we need and provide reasons for the delay.

In certain cases, we may deny your request. If it is legally permitted, we will let you know in due course why we denied it. We endeavour to address all requests promptly. Should you not be satisfied with the way we have responded to your concerns you have the right to submit a complaint to us (please refer to Section 10. Right to complain).

Accuracy of personal data information: We endeavour to keep personal data collected as accurate, complete, and current taking into consideration the purposes for which it was collected and is being used.

We rely on you to maintain the accuracy and completeness of the personal data provided by you and so you should inform us if your personal details change, including the context in which the personal data was provided e.g. in connection with promotion of a specific product or service or employment application.

10. Right to complain

If you have exercised any or all of your data protection rights, or otherwise still feel that your concerns about the use of your personal data have not been adequately addressed by us, you have the right to complain by contacting our Data Protection Officer using the contact details set out in Section 1 of this Privacy Policy or visiting the Data Protection section on our website.

You also have the right to complain to the Office of the Commissioner for Personal Data Protection. You can visit their website at https://www.dataprotection.gov.cy.

11. Changes to this Privacy Policy

We may amend and update this Privacy Policy from time to time without prior notice.

We will post the changes on this Privacy Policy on our website and update the revision date at the bottom of this page. We do however encourage you to review this statement periodically as to be always informed about how we are processing and protecting your personal information.

12. Automated Decision Making

We do not use automated decision making. Automated decision making means a decision that produces legal effects concerning you or which significantly affects you and which is based solely on automated processing of data (i.e. no human intervention in the process).