Circle K group respects your privacy. That is why Circle K has developed this privacy statement, so you would have an overview on how we collect, use, store and share personal information we have about you.
Circle K Privacy notice
- Who are we? Close
Alimentation Couche-Tard is a Canadian based group and a world leader in the convenience store sector. In Europe, Couche-Tard, through its Circle K brand, is a leader in convenience store and road transportation fuel retailing in Scandinavian and Baltic countries, Ireland and with a significant presence in Poland and Russia.
All main decisions regarding privacy, personal data protection and other procedures for safe processing of data on a corporate level are taken by senior management and aligned with the Data Protection Officer (DPO) and other appropriate personnel.
The data controller is Circle K AS, registry code 995532921, Schweigaards gate 16, 0191 Oslo, Norway, who collects the personal data and determines the purpose and means of the processing.
- How and when does privacy notice apply? Open
This privacy notice describes the data processing activities carried out by Circle K in cases where Circle K acts as a data controller, collecting the personal data of customers, suppliers or employees and deciding the purpose and means for the processing. This privacy notice also provides information on how Circle K acts as data processor, meaning how Circle K engages on processing data on behalf of our corporate customers or partners based on the instructions they provide.
This privacy notice applies to all processes in Circle K, including websites, applications (otherwise known as apps), and other products or domains within Circle K branded services or products. If a different privacy statement to this one is displayed on a Circle K website, application or other product, then that specific privacy statement shall apply.
If you disagree with the actions described in this privacy statement hereinafter, unfortunately, Circle K will not be able to provide you with various services.
- How does Circle K act as data controller? Open
Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to identification of a particular person, also constitutes personal data. Circle K acts as the data controller when Circle K determines the purposes for which and the manner in which personal data is processed.
Processing personal data is necessary for Circle K to prepare for or fulfill contracts we have entered into, provide our customers with services and products, offer them discounts and personalized offers. This includes (but is not limited to) providing you with services through various initiatives, such as Circle K EXTRA Club, private label cards (B2C) cards, Circle K ID and others.
- Why we collect your personal data? Open
- Circle K collects and processes personal data about our customers, employees and vendors as a part of our way of conducting business and as means to reach our strategic goal – to become the world’s preferred destination for convenience and fuel. We collect personal data and process personal data of the following data subjects:
Existing and potential customersOpen
To provide services, manage our customer relations and to deliver on our promises to our existing or potential customers, Circle K needs information on who you are, what is your position as a user of our services and products and information how to reach you or what is your role as a contact person. The reasons for processing this information are mainly as follows:
To reach out to larger market, we shall pursue our legitimate interest and process data also on potential customers for direct marketing initiatives. To provide relevant content to potential customers, Circle K shall process personal data of potential customers that were collected during sales negotiations or when a person had expressed interest in receiving offers from Circle K.
- Preparing for and delivering on agreements made with customers and providing requested offers and information to our customers.
- Executing and delivering of services stipulated within contract between Circle K and the involved party.
- Providing support to users of our products and services.
- Improving continuously our services through customer feedback.
- Preventing misuse of our products and services, including using CCTV for that purpose.
- Ensuring health, safety and environment standards.
- Invoicing, processing of purchases, making payments and conducting other financial tasks.
- Providing offers on products and services to our customers, based on such as Circle K EXTRA Club, private payment cards, B2B cards, private label cards, Circle K ID portal, or other.
- Managing credit enquiries for users who have applied for Circle K cards that require credit assessments.
- Administrating and managing bulk orders.
- Providing opportunities to participate in various marketing activities organized by Circle K.
- Creating profiles of customers in certain cases to promote more relevant products or services for specific customers.
Legal basis for abovementioned activities are consent, contract and legitimate interest, however you can be sure that any electronic direct marketing message you will receive, will come with an option to opt-out of future marketing communication. If by any chance such option is not provided, please do not hesitate to contact our customer service and let us know – see “Contact us” page for more.
Existing and potential employeesOpen
If you are an employee we shall process your personal data to fulfill the contract with you and to comply with statutory regulations, such as labor laws, tax laws, and other regulations. We shall do so on basis of contract and legal obligation and ensure appropriate retention periods for processing such data.
If you are looking for job opportunities within Circle K, we will process your personal data in order to evaluate your skill relevance for the position you apply. We shall do so on basis of your consent and will ensure appropriate retention periods for processing such data.
You can get more information about retention periods for different categories of data from HR business partner in respective Circle K business unit.
Vendors and partnersOpen
We will process personal data of individuals who are representing our vendors, suppliers and business partners on basis of pursuing our legitimate interests of acquiring new partners and new markets, as well as to fulfill the contract that Circle K has with the other party.
In case we have concluded a sales contract with a company to sell our products or offer services, we might collect and process limited amount of personal data (such as name, address, social security number) about the employees or other representatives of such company to fulfill the contract. The legal basis for such processing is legitimate interest and we only process personal data for the purpose of fulfilling the contract with our customer and for the period the contract is effective and applicable statutory retention period after contract expires.
Visitors to the office or our service stationsOpen
In order to comply with HSE (health, safety, environment) standards, and pursue our legitimate interests, protect our business secrets, employees, customers and others, we may process your personal data by deploying CCTV surveillance within our support office headquarters and fuel station forecourts and convenience stores. Individuals shall be informed via notice when such action is taking place. CTV surveillance videos shall be stored for the retention period applicable in each respective Circle K business unit.
As an addition to that, to protect our premises, employees and confidential information – we monitor access to our support office premises. We will process our visitor data when visiting our office headquarters by registering them in our visitor system. Visitors hall be informed via notice when such action is taking place.
Any personal data processing is not allowed without appropriate legal ground as per General Data Protection Regulation (GDPR) article 6. Therefore, we at Circle K apply one of the following legal grounds as defined in GDPR to any processing of your personal data
- Consent: the individual has given clear consent for you to process their personal data for a specific purpose.
- Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
- Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).
- Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.
- How we collect your personal data? Open
In general, Circle K collects your personal data directly from you, meaning you have freely provided this data to us to receive certain products or services or to enter into contract with us. Sometimes we might collect information on you from persons directly linked to you – for example, your manager provided your work contact information to us as a point of contact. We may have your images recorded on our CCTV camera systems.
In other cases, we may also collect information on you from other sources. These sources may vary, but usually they are Circle K’s marketing partners, public sources or public information from social networks from third-party. Circle K may combine data acquired from one source together with data obtained from another source. This is only done to ensure data accuracy, and to have an understanding of you that represents reality, so we can offer you more relevant products and have more personalized approach that you prefer.
With whom is your personal data shared?
Intragroup data sharing.Open
Intragroup data sharing means that your personal data is shared across legal entities under the Circle K brand, which means while the legal entity of the data holder may change hands, the data still remains within Circle K systems and protected in compliance with applicable standards. Circle K is a brand that consists of many different subsidiaries across Europe, therefore it is likely that customer will engage in business with more than one Circle K legal entity.
Circle K is focused on providing only the best to our customers, and delivering our promises to those who uses our products and services. Hence it is important to maintain a correct overview of the customer profile, and to deliver the best service we shall share personal data of our customers amongst our Circle K subsidiaries in Europe or European Economic Area.
We do not transfer your personal data to Circle K subsidiaries outside of European Union or European Economic Area. Hhowever, if we need to transfer your personal data to other Circle K entities outside of EU/EEA, we will make sure there are special safeguards in place to protect your data.
Data sharing with external parties.Open
Circle K may use third party service providers to help us to administer certain activities on our behalf, such as fulfilling purchases, processing credit card payments, performing credit checks, sending emails and post, providing advertisements, tracking effectiveness of our marketing campaigns and analyzing usage of our websites and apps, or even allowing users to connect to their social network. As such, to execute such services we may have to share personal data about you with respective business partners, but only to the extent to perform the service they carry out on our behalf and making sure that they comply with data protection rules.
Circle K might share your personal information with external parties in within the following cases:
Our suppliers, vendors and business partners.
We may share your personal data with our business partners or suppliers if there is a legitimate case to do so from business management perspective and statutory regulations allows us to do so or when you have consented to such exchange of data. For example, some of Circle K’s server storage spaces may be rented from one of our certified suppliers. Thus, technically some of the personal data may be shared with external providers. Other example, you purchase service or product that Circle K provides to you through our partner. In situations like these, Circle K and appropriate business partner may share your personal data in order to provide you with the service or product.
Public authorities such as internal revenue services, police, courts, insurance companies or other government institutions may ask Circle K to provide them with any data we hold about you. In such cases, Circle K will comply with requests from public authorities and government institutions only if there is sufficient legal basis to fulfill such request.
If you engage on commenting or expressing opinions on Circle K user communities or pages on social networks, where such information can be seen and used by anyone with access to such community, for purposes that are beyond the control of Circle K, Circle K carries no responsibility for any content you submit on such communities.
- Automatic data processing and profiling tools. Open
- Circle K branded websites uses automatic data collection tools and Circle K engages is using digital tracking technologies to collect information about your movements and interaction with our websites.
A cookie is a small piece of text sent to your browser by a website you visit. It helps the website to remember information about your visit, like your preferred language and other settings. That can make your next visit easier and the site more useful to you. Cookies play an important role. Without them, using the web would be a much more frustrating experience. Due to their core role of enhancing/enabling usability or site processes, disabling cookies may prevent users from using certain websites.
For our apps we use Identifier for Advertising (IDFA) for iOS and Google Advertising ID (AAID) for Android. All this data is collected anonymously, meaning that we cannot connect the data to an individual user or authenticated user through our authenticated online services.
Google Analytics services and reCaptcha.Open
Circle K branded websites and applications use Google Analytics to collect data how our users use our websites and apps. This data is mainly collected through services provided by Google Analytics which terms and conditions apply.
To protect against inappropriate usage we may use Google Invisible reCAPTCHA that collects hardware and software information, such as device and application data and the results of integrity checks, as well as unique online identifications such as IP address, and sends that data to Google for analysis.
By using this service you are consenting to providing the personal data to Google Analytics for integrity checks and for implementing measures necessary for safe use of the webpage only.
Third-party social network cookies.Open
Third parties involved may use these tracking methods such as but not limited to cookies to achieve their own business goals and purposes by relating and combining information about your usage of our sites or applications to any other personal data they may have collected on you. We may also obtain and use analytical and statistical information from third-party social networks to help us measure performance and effectiveness of content we display on social networks, for example, my measuring impressions and clicks on the content Circle K promotes.
Third Party Services and social media channels where we are present are governed by the privacy policies of the respective services.
Robotics process automatization.Open
Robotic process automation (RPA) is the application of technology that allows employees in a company to configure computer software or a “robot” to capture and interpret existing applications for processing a transaction, manipulating data, triggering responses and communicating with other digital systems.
RPA is a rule-based virtual employee that imitates the actions of another business user to execute the same tasks and processes by connecting to business systems and applications.
Circle K mainly uses RPA software to assist our personnel with credit assessments on customers who have applied for Circle K credit payment cards. Credit assessments are done based on applicant’s consent or company’s legitimate interest, and can be replicated by Circle K personnel. RPA software would not make any decision that a Circle K employee wouldn’t make, thus this software is used only as a tool to save our employee time so they can focus on delivering better services to our clients.
You have the right not to be subject to automated decisions and request that such automated task is performed by a person.
- What kind of personal data does Circle K collect and processes? Open
Circle K may process the following personal data on you:
As a controller, Circle K does not process sensitive personal data to provide you with goods and services, however in some cases processing such data is a requirement for us to comply with legal as well as ethical obligations set forth to us. Sensitive personal data mainly may be collected in following cases:
- General information and contact details like name, surname, telephone number, e-mail and address.
- Demographic data such as date of birth or gender.
- Information on national identification number.
- Feedback on our services and products.
- Various requests from you to our customer service.
- Photos or videos of you recorded within our support office headquarter or service station forecourt or convenience store premises.
- Content you upload to our websites, apps and social network pages, such as photos or videos.
- Applications to our services which are provided on contractual basis.
- Financial information, such as your bank account information, credit card information, or credit rating.
- Tracking information actively sent to us via our websites, apps and generic online services. This includes information such as IP address, internet browser you use or language settings.
- Unique user information such as login ID, password, security questions
- E-mail behavior, meaning we analyze whether you open e-mails sent to you from Circle K or not.
- Shopping behavior based on your purchases in our stations using your Circle K card.
- Previous employment and education information, such as title, position, responsibilities, background, interests in professional context.
- Information you have made public and have freely given away on third party-party social networks.
- If you are an employee who is on sick-leave, we might process some sensitive personal information regarding your health life as is dictated by labor law and we shall do so within the legal framework of each respective country where the subsidiary employing individual is located.
- If you are an individual who have had an incident within our premises, we might be obliged to process data on your health life to comply with HSE standards, as well as to record such incident to avoid it in future.
- If you are a customer who believes health issues are caused by food poisoning or other hazard from our products, we will be obliged to process sensitive personal data.
- How does Circle K safeguard your personal data? Open
Personal data within Circle K is processed within safe and secure manner. At Circle K we do our best to make sure any IT systems that are built, integrated, purchased or in general – used in Circle K – abides by the privacy by design principle to maximize safe and secure processing of personal data. We use encryption and pseudonymization where appropriate. We limit access to personal data to those persons who have need for it. We have guidelines, policies and trainings available for employees processing personal data in Circle K.
When we need to use processor for processing personal data we very closely evaluate the business partners we share your personal data with to make sure they comply with applicable data protection legislations. Further on, to impose the data processing standards, Circle K requests our business partners – who act as processors, whereas Circle K acts as a controller – to sign personal data processing agreement with Circle K. Through that, processor enters a binding agreement and promises to ensure safe and secure information practices.
Personal data is not processed longer than necessary. Circle K’s standard retention policy is 6 months, however the retention period may vary based on agreements, legitimate interests of Circle K, or statutory requirements regulating otherwise (for example, archiving laws, anti-money laundering laws, and other). If you have any specific questions, please do not hesitate to contact our customer service – see contact page for more information.
Circle K abides by the data minimization principle, and makes sure that when providing you with products and services, only the minimum amount of personal data is collected which is needed for the execution of service or delivery of product.
- When does Circle K use processors? Open
- Circle K may use third party service providers as processors for personal data for following purposes: mailing of invoices and marketing materials; printing and mailing payment cards; data storage; handling customer relations; providing CCTV solution; performing credit rating checks and debt collection; employee data management and similar. List of personal data processors can be requested from relevant Circle K business unit.
- What are your rights and how to use them? Open
You have the right to request access to the personal information we hold about you. We do however need to be sure who you are before we release any such information. You have the right to object to personal data processing, withdraw consent, request erasure or rectification of your personal data or object to personal data processing and rights to data portability.
If you want to request access to your data, erase or rectify the data, or object to personal data processing, or exercise your rights of data portability, please contact customer service.
Finally, you also have a right to file a complaint with the data protection authorities with regards to our processing of your personal data.
- Contact us. Open
- You may contact our data protection officer by sending e-mail to firstname.lastname@example.org or sending a letter to Data Protection Officer, Circle K AS, Pb 1176 Sentrum, 0107 Oslo, Norway.
- Changes to this statement. Open
We may periodically update this statement. For visitors to our websites, an updated policy will always be available on the website. For app users, an updated policy will always be available via respective app store.
This privacy statement is effective as of May 25th 2018.