Privacy Notice

Coca-Cola HBC Schweiz AG, with its registered office in 8152 Opfikon, Thurgauerstrasse 134 (hereinafter, “CCHBC”) is the owner of this refrigerator on which a camera with a motion detector is installed that allows taking photographs when the door is opened. It is possible, although quite unlikely, that users of the refrigerator may be accidentally captured, in whole or in part, in the photographs; therefore, CCHBC, as the Data Controller, provides this notice pursuant to the European Regulation for the Protection of Personal Data no. 679/2016 and applicable local privacy legislation. The processing of personal data will be carried out in full compliance with the principles of fairness, legality, and transparency, as well as the rights and privacy of the data subject.

1. Processed Data, Purposes, Legal Basis

During the normal functionality of the refrigerator, CCHBC may accidentally come into possession of some personal data of the users of the same, collected and captured through photographs taken automatically by the camera installed on the refrigerator when the door is opened. The photographs could portray parts of the user’s body in such a way as to make them unrecognizable, without being able to exclude that in some cases the user may be portrayed in a way that makes them identifiable. Purpose: the photographs that are taken automatically by the camera installed on the refrigerator door are used by CCHBC to control and verify that the refrigerators are loaded and filled with CCHBC products as provided by the agreement in place with the operator of the point of sale. The photographs accidentally portraying, in whole or in part, the users of the refrigerator will not be used by the operator and will be deleted by CCHBC within the timeframes mentioned below. - Legal basis: legitimate interest of the owner.

2. Communication of Data to Third Parties

The photographs taken automatically by the camera installed on the refrigerator will be transmitted, at regular intervals and within a maximum term of 24 hours, to the CCHBC cloud platform, VisionIOT Platform in MS Azure North Europe, managed by Microsoft, whose data center is located in Ireland, in the European Union. The cloud platform manager is appointed as the Data Processor according to the provisions of the European Regulation for the Protection of Personal Data no. 679/2016.

3. Data Retention Period

Once the images have been transferred to the MS Azure cloud, they are automatically deleted from the photo device installed on the refrigerator. The photos transferred to the cloud platform are automatically checked for quality within a maximum of 48 hours, and any photos of sub-optimal quality and/or showing users of the refrigerator in whole or in part are not used. This process is fully automated and requires no human intervention. The photos are deleted from the cloud platform within a maximum period of 12 months.

4. Users’ Rights and Contacts

Since this is an automated processing that takes place in a very short time, not all user rights guaranteed by the European General Data Protection Regulation no. 679/2016 are technically enforceable. Nevertheless, the user has the right, at any time and free of charge, to obtain confirmation from the controller of the existence or not of data concerning him/her, their content and the times of their deletion.

CCHBC has appointed a Data Protection Officer who can be contacted at the following email address [email protected] for any questions related to this information and the processing described therein.