Source: https://de.iqos.com/en/ueber-iqos/datenschutz
Timestamp: 2019-04-22 00:46:02+00:00

Document:
We take privacy seriously. This notice tells you who we are, what information about you we collect, and what we do with it. Click on "find out more" in each section for further information.
PMI: : Philip Morris International, a leading international tobacco group. It is made up of a number of companies or "affiliates".
PMI affiliates: Each member of the Philip Morris International group of companies is a "PMI affiliate". "We" (or "us" or "our") refers to the PMI affiliate that first collected information about you.
In this notice, we refer to all the methods by which you are in contact with us as “PMI touchpoints”. PMI touchpoints may be either physical (for example, retail outlets and events) or digital (for example, apps and websites).
we may collect information that enables us to verify your age, (see under purpose of “age verification”).
This will typically be a combination of information that you provide to us (for example, your name and contact and social media details), information that we collect automatically (for example, using technology to monitor use of PMI touchpoints) and (where permitted by law) information that we acquire from third parties (such as public social media posts).
We use it on the grounds that we have a legitimate business interest to market our products, to operate PMI touchpoints and to customize your experiences in these ways that is not overridden by your interests, rights and freedoms to protect information about you.
This will typically be a combination of information that you provide to us (for example, your name and contact and social media details), information that we collect automatically (for example, using cookies and similar technologies) and (where permitted by law) information that we acquire from third parties (such as public social media posts).
We use it on the grounds that we have a legitimate business interest to market these products, services, outlets and events that is not overridden by your interests, rights and freedoms to protect information about you.
This will typically be a combination of information that you provide to us, information that we collect automatically and (where permitted by law) information that we acquire from third parties.
We use it on the grounds that we have a legitimate business interest to analyze and to improve our business performance, our products, PMI touchpoints, outlets and events, and to invite others to get involved in promoting PMI products, that is not overridden by your interests, rights and freedoms to protect information about you.
We may share information about you with PMI affiliates’ carefully selected third party business partners and advertisers (in line with the kind of thing you might associate with our products, for example because they have similar or complementary image, style, or functionality) so that they can contact you with products, services and promotions that they think may interest you, in accordance with your preferences.
• necessary to discharge obligations under a contract between you and us (or the implementation of pre-contractual measures taken at your request) or for the conclusion or performance of a contract concluded in your interest between us and a third party, such as in relation to travel arrangements.
If you contact customer care, we will make a record of the matter (including details of your enquiry and our response) and retain it while it remains relevant to our relationship. Temporary records (for example, an automated recording of a telephone call in which you ask us to direct you to a retail outlet) may be relevant only until more permanent records are made, and will be retained only temporarily.
We offer you easy ways to exercise these rights, such as “unsubscribe” links, or giving you a contact address in messages you receive.
if we use the information about you on the basis of legitimate interest for purposes other than direct marketing, you can object to our using it for those purposes, giving an explanation of your particular situation, and we will consider your objection.
You can find their contact details here:.
To verify your age, we send information about you to SCHUFA Holding AG, Kormoranweg 5, 65201 Wiesbaden, tel.: +49 (0) 6 11-92 78 0. The SCHUFA company data protection officer may be reached at the address listed above, attn. Department of Data Protection, or by e-mail at datenschutz@schufa.de.
SCHUFA processes personal data in order to provide recipients with a legitimate interest information needed to evaluate the creditworthiness of individuals and legal entities. Scores are calculated and provided to this end. It only provides information if a legitimate interest in such information is credibly shown in a particular case and processing such information is permissible upon weighing all interests concerned. A legitimate interest is present upon entering into transactions with a financial default risk. A credit assessment serves to protect the recipient against losses in the lending business and, at the same time, provides an opportunity to protect borrowers from unreasonable indebtedness by providing counselling. Furthermore, data is processed for purposes of fraud prevention, integrity assessment, money laundering prevention, identity and age verification, address location, customer service or risk management as well as tariff classification and assessing conditions. Pursuant to Art. 14 (4) GDPR, SCHUFA will provide information regarding any changes to the purposes for which it processes data.
SCHUFA processes information on the basis of the provisions of the General Data Protection Regulation. Data is processed on the basis of consent as well as on the basis of Art. 6 (1) (f) GDPR, provided that processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party and such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. Consents may be revoked at any time by declaration to the relevant contractual partner. This applies in like manner to consents provided prior to the effective date of the GDPR. The revocation of consent does not affect the legality of personal data processed prior to revocation.
SCHUFA receives its data from its contractual partners. They are institutions, finance companies and payment service providers domiciled in the European Economic Area and Switzerland as well third countries as applicable (to the extent an adequacy decision from the European Commission is available) that are exposed to a financial default risk (e.g. banks, savings banks, cooperative banks, credit card, factoring and leasing companies) as well as additional contractual partners who use SCHUFA products for the purposes described above, in particular (mail order) retailers, e-commerce companies, service providers, leasing, energy supply, telecommunications, insurance or collections companies. Furthermore, SCHUFA processes information from generally accessible sources such as public registries and official publications (e.g. debtor registers, insolvency announcements).
Recipients comprise contractual partners domiciled in the European Economic Area and Switzerland as well other third countries as applicable (to the extent an adequacy decision from the European Commission is available for such countries). Additional recipients may include external contractors of SCHUFA pursuant to Art. 28 GDPR as well as external and internal SCHUFA recipients. SCHUFA is furthermore subject to the statutory powers of intervention held by public authorities.
In relation to SCHUFA, every person concerned has the right of access under Art. 15 GDPR, the right of rectification under Art. 16 GDPR, the right to erasure under Art. 17 GDPR and the right to restrict processing under Art. 18 GDPR. SCHUFA has set up a consumer service centre for the concerns of data subjects. It may be reached in writing at SCHUFA Holding AG, Privatkunden ServiceCenter, Postfach 10 34 41, 50474 Cologne, by telephone at +49 (0) 6 11-92 78 0 and via an online form available at www.schufa.de. Furthermore, it is also possible to contact the supervisory authority responsible for SCHUFA, the Commissioner for Data Protection of Hesse. Consents may be revoked at any time by declaration to the relevant contractual partner.
The SCHUFA credit report may be supplemented by a so-called score. Scoring involves the creation of a forecast of future events on the basis of information collected and past experience. SCHUFA fundamentally calculates all scores on the basis of information stored by SCHUFA regarding the relevant person; this information is provided in response to a request pursuant to Art. 15 GDPR. Furthermore, SCHUFA complies with the provisions of § 31 Federal Data Protection Act (BDSG). On the basis of entries stored in association with an individual, the individual is assigned to a statistical group of persons who had similar entries in the past. This process is described as “logical regression” and is a well-founded mathematical-statistical method that has proven itself over time for forecasting risk probabilities. The following forms of data are used by SCHUFA when computing a score, whereby not every form of data is used to compute every score: General data (date of birth, gender or number of addresses used in business dealings), prior payment problems, credit activity for the previous year, credit utilisation, length of credit history as well as address data (only if little personal credit-related information is available). Certain information is neither stored nor used for scoring purposes, for example: Information regarding nationality or particular categories of personal data such as ethnic origin or information about political or religious beliefs in accordance with Art. 9 GDPR. Similarly, the assertion of rights pursuant to the GDPR, i.e. access to data stored by SCHUFA under Art. 15 GDPR, has no influence on the calculation of a score. Scores that are provided support the contractual partners in the decision making process and are considered as part of risk management. Risk assessment and the evaluation of creditworthiness are performed solely by the direct business partner, whilst only it has a wide variety of additional information available to it - for example information from the credit application. This even applies in the event the business partner relies solely on information and scores provided by SCHUFA. However, by itself a SCHUFA score is not a sufficient basis to decline the conclusion of a contract. Additional information on the scoring process or the recognition of unusual circumstances is available at www.scoring-wissen.de.
Pursuant to Art. 21 (1) GDPR, data processing may be objected to on grounds relating to the particular situation of the data subject.
Privatkunden ServiceCenter, Postfach 10 34 41, 50474 Cologne.
We may update this notice (and any supplemental data privacy notice), from time to time. We will notify you of the changes where required by law to do so.
Last modified 22 May 2018. You can find previous versions of this notice .

References: Art. 14
 Art. 6
 Art. 28
 Art. 15
 Art. 16
 Art. 17
 Art. 18
 Art. 15
 § 31
 Art. 9
 Art. 15
 Art. 21