Maxima App Privacy Policy

We process the personal data provided by you to us when registering an app account and using it in the manner specified in the terms. 
 
If you are a user of the app and create an app account during registration, we process your personal data to ensure the proper functioning of the app and your app account, to improve, monitor and manage the functions of the app and your app account (such as to enable you to scan purchases at a point of sale with the app and pay for your purchases at checkout; to give you the opportunity to use a virtual THANK YOU card, THANK YOU account and all the benefits; so that you can see your virtual shopping receipts in your app account and loyalty account; so that you can use the app and contact us if necessary (ask questions, submit complaints, requests, opinions, etc.)), and/or so that we can contact you in connection with the use of the app, provide answers to your questions, as well as provide you with the necessary information about the operation of the app, changes, updates, etc. and perform other actions necessary to ensure the proper functioning of the app. 

Please note that in order to ensure the functionality of the app, it must have access to the information and functions of your smart device mentioned in this section. When you download the app to your smart device, it can access the following data on your smart device: the operating system of your smart device and the factory code of your smart device. If you do not want the app to have access to the said data, do not download the app to your smart device (in case you did not read the policy through the platform mentioned in the conditions before downloading, delete the app from your smart device immediately and stop using it). You will not be able to use the app without the mentioned data of your smart device, because the seller cannot guarantee the operation of the app on your smart device. 
 
Please note that if you enable the appropriate accesses for the app on your smart device, the app will have access to your smart device's text messages (SMS), notifications, camera, biometric data (fingerprint if you choose to log in to your app account in this way), the recordings on your smart device, your smart device's location, etc. 

If you do not want the app to access the said data or send you notifications, check the settings of your smart device and make the necessary changes to limit access to your smart device. If you do this, unfortunately we cannot guarantee that all or some of the following app functions will work, such as: 

• if the app does not have access to your smart device's operating system notifications, we will not be able to send you notifications to your smart device through the app; 
• if the app does not have access to your smart device's text messages (SMS), you must enter the code received by text manually when registering for the app; 
• if the app does not have access to the memory of your smart device, you cannot use the app's help and feedback forms to post photos or videos of sales points (Maxima stores) and to ask us questions or submit complaints about sales points and the goods or services provided; 
• if the app does not have access to the location data of your smart device, you cannot use information about the nearest point of sale (Maxima store) and you must manually determine which store you are shopping at (by searching from the list of points of sale) 
• if the app does not have access to use the video camera on your smart device, you will not be able to scan purchases at points of sale, use the payment (billing) function of the app (you will not be able to link a payment card to the app, scan QR codes at points of sale (stores) or pay for your purchases with the app by making a payment at the time of purchase); 
• if there is no access to use biometric data (such as fingerprints, facial recognition), you cannot use your biometric data to secure the app or to confirm payment for purchases through the app, but you must use a four-digit security code as stated in the terms. 

We emphasize that we do not collect or store your biometric data (such as fingerprints or facial images), even if you use them to protect access to the app. If you choose the type of authentication described in the terms above, this data will only be stored on your smart device. It is also important to note that if you provide access to your smart device text messages (SMS), camera, smart device memory, we will not have access to your smart device text messages (SMS), photos (except those you choose to submit to us and send as feedback to the app or in connection with a complaint) or other data on your smart device, and we do not collect them. 

If you are a participant in the THANK YOU Loyalty Program or wish to become one, and you use the app with a THANK YOU loyalty program account (with an existing THANK YOU card or by creating a new virtual THANK YOU card), we process your personal data in the app to manage your participation in the loyalty program in accordance with the Terms and Conditions of the THANK YOU Loyalty Program and the Privacy Policy of the THANK YOU Loyalty Program. Personal data is processed when registering with the THANK YOU loyalty program and during participation in the THANK YOU loyalty program based on your consent to use the corresponding benefits of the THANK YOU loyalty program (such as consent to receive commercial information and offers about the benefits and campaigns of the program). Information about how we process your personal data within the framework of the THANK YOU loyalty program is presented in the Privacy Policy of the THANK YOU Loyalty Program available at https://www.maxima.ee/privaatsus. 

If you decide to link your app account to a THANK YOU account (THANK YOU card) or create a virtual THANK YOU card, we process the following data when linking your app account to a THANK YOU account or after creating a THANK YOU account: 

• Information you provide when you create a virtual THANK YOU card (login information, your virtual THANK YOU card and THANK YOU account creation information), as described in the Privacy Policy of the THANK YOU Loyalty Program; 
• information about how you interact with the app (smart device type, operating system and version, etc.); 
• information about activities when using the THANK YOU card in the app (app login data, dates, settings, rights, menu changes and other actions performed in the app) 
• other general data (data provided during registration with the THANK YOU loyalty program, purchase history, etc.), which are stipulated and described in the Privacy Policy of the THANK YOU Loyalty Program 

Data collected when using a THANK YOU card with the app and a THANK YOU account in the app will be stored for the periods specified in the Privacy Policy of the THANK YOU Loyalty Program or according to the criteria specified therein. 

If you participate in the THANK YOU loyalty program and decide to link the app to your payment card, we will process your payment data so that you can pay for purchases using the app: 

Data collected about a THANK YOU account in the app as part of the THANK YOU loyalty program is stored in accordance with the terms set forth in the Privacy Policy of the THANK YOU Loyalty Program or the criteria set forth therein. 

If you give your consent in accordance with the terms of the app to give up shopping receipts on paper and thereby your consent to receive digital shopping receipts, you will have the opportunity to see your digital shopping receipts in your app account and THANK YOU loyalty program account. 

Data collected about a THANK YOU account in the app as part of the THANK YOU loyalty program is stored in accordance with the terms set forth in the Privacy Policy of the THANK YOU Loyalty Program or the criteria set forth therein. 

The app is designed to provide advantages and added value to both you and our company. We constantly strive to ensure that our points of sale, product and service range, product sales promotions and discounts on goods and services best meet the needs of our customers, that our goods and services can be easily and easily accessed, that our customers at our points of sale feel great and that users of the app can find the necessary information about goods and services and points of sale through the app. 

We use automated data processing to conduct statistical, market and app user activity research, as well as to generate reports for our company. During the analysis of statistics, market and app user activity, we use non-personalized data and do not process your name, contact details or other information that can identify you. 
 
During the analysis of statistics, market and app user activity, we only see general data about all users of the app (such as the age group of the app user, region, other data from the user's Google or Apple account (this data comes from Google Play or App Store or from Google and/or Apple as an operating system provider, platform provider). Google and Apple's privacy policies and information on their data processing can be found on the websites: https://policies.google.com/privacy; https://www.apple.com/privacy/. 
 
Data analysis for statistical, market and app user behaviour research helps us make important business decisions regarding product range, pricing of goods and services, development of sales points based on the location and needs of our app users. 
 
We may also use Google Analytics, an analysis service provided by Google, to collect and analyze this information. If we use an analysis service (such as Google Analytics), your anonymized (pseudonymized) data may be shared with third parties. You can read more about how Google collects and uses this data in Google's privacy policy (https://policies.google.com/privacy). 
 
Unfortunately, you cannot continue to use the app if you do not want such information to be collected. You can stop using the app by deleting it from your smart device. 

If you have consented and allowed your smart device to receive commercial messages and individual offers and you have set up access to location data (geolocation with the accuracy as provided by your smart device), we will process your personal data using the app by sending (including in the manner selected by you in the app: SMS, e-mail, mobile (WhatsApp, Viber, Messenger, etc.), in-app notifications) commercial notifications to you (information about the nearest Maxima store, changes in the opening hours of Maxima stores, etc.), as well as general information about promotions, discounts and news of goods and services of Maxima stores, as well as other useful and up-to-date information about ongoing activities and individual offers. We believe that this information is useful, important and relevant to all users of the app. 
 
In order to be able to provide you with the said notices and offers, we collect the following information: 

If you consent to receive up-to-date and valuable announcements and individual offers in the app, we will process your personal data in an automated manner and send you commercial announcements and individual offers via the app (profile analysis). It is important to emphasize that our data analysis activities do not affect your individual rights or interests in any way. 
You can withdraw your consent to receive commercial communications and individual offers through profile analysis at any time. 
If you do not consent to receive commercial offers (in the form of pop-up notifications and/or geolocation notifications) or withdraw your consent, we unfortunately cannot offer you all the benefits of the app (if the app does not have access to your smart device's location data (geolocation), we cannot offer you information about the nearest point of sale (Maxima store) or changes in its working hours, as well as other information important to you through other benefits or offers provided to app users by geolocation), as well as those related to ensuring the functions of parts of the app and sending relevant information (such as changes to this policy or conditions). 
 
If you connect the app to the THANK YOU loyalty program and choose to receive loyalty program offers and/or individual offers (in the form of pop-up notifications and/or geolocation notifications) in your THANK YOU account, we will send you the loyalty program offers and individual offers in the ways you choose. You can at any time disagree or opt out of receiving individual offers by withdrawing your consent, or change the chosen ways (channels) of receiving notifications by making the appropriate changes in the app settings. If you do not give consent or withdraw your consent to receive individual offers, unfortunately we cannot offer you all the benefits of the app (such as individual offers according to your shopping habits) 
 
With the above in mind, we recommend that you regularly review the policy and terms, paying attention to any changes made.

We are constantly working to improve the functions of the app, to create innovative solutions and make it  convenient for the users. 
If you use the app and purchase age-restricted goods by choosing the option to perform age identification via Mobile-ID or Smart-ID, we will process your personal data necessary for identity recognition and age detection using Mobile-ID or Smart-ID. 

If you do not want the above-mentioned data to be processed by us, you always have the option to have your age identification performed by a store's customer service representative when purchasing an age-restricted product. 

We collect almost all of your personal data only from you. When you download the app and create an account, you provide data directly to us, while purchase data is provided by using a THANK YOU card at points of sale and by visiting app accounts and THANK YOU accounts. Payment card data is collected from the bank that issued the payment card. 
 
General data (see policy section 5 for more details) about all users of the app (age group of the app user, region, other data from the user's Google or Apple account) is obtained from Google Play or App Store, or from Google and/or Apple as an operating system and platform provider, where the respective service providers are considered third parties in data processing, therefore we recommend that you read the privacy policy of these service providers.

We may transfer your data for processing to data recipients who assist us in operating and managing the app, app accounts and the THANK YOU loyalty program. Such persons may include app developers, app management service providers, data centres, maintenance and cloud service providers, smart device app monitoring service providers, direct marketing service providers, commercial offers and information notifications, market research or business analytics service providers, etc. In any case, we transfer only the amount of data that is necessary to perform a specific task or provide specific services by the data processor. Our data processors may only process your personal data in accordance with our instructions and may not use them for other purposes or pass them on to other people without our consent. In addition, they must ensure the protection of your data in accordance with the requirements of current legislation and the written agreements concluded with us, which stipulate, among other things, that your data must be permanently deleted after the completion of the task assigned to us or the termination of cooperation. 
Data may also be transferred to business partners and service providers who ensure and support the operation of the app or its functions (banks that issue payment cards, payment service providers, etc.). 
Please note that your anonymized (pseudonymized) personal data may be transferred to companies operating outside the European Economic Area, for example in the USA (Google and others), for the purpose of statistics, market and app user behaviour research. As a result of pseudonymization, third parties have no possibility to associate the collected data with your person. The seller ensures that personal data is processed in the manner stipulated in the General Data Protection Regulation of the European Union and other applicable legislation. For more information on what data is transferred outside the European Economic Area and why, as well as other related issues, see section 4 of the policy or send an e-mail to dpo@maxima.ee 

Data may also be forwarded to competent state authorities or law enforcement agencies, such as the Police and Border Guard, the State Prosecutor's Office, courts, control or supervisory institutions, but only in response to their requests and only if it is necessary in accordance with the applicable legislation or in the cases and procedures provided for in the legislation, to ensure our rights, the safety of our customers, employees and resources, to present, assert and defend legal claims.

Due to the legislation on personal data protection, we undertake to provide you with and you have the opportunity to exercise the following rights related to personal data protection:

1. Right to receive information about whether we process your personal data and, if we do, what personal data is processed 

You have the right to receive our confirmation as to whether we are processing your personal data, as well as the right to access your processed personal data, information on the purposes of data processing, the category of data being processed, the category of data recipient, the period of data processing, data sources, automated decision-making, including profiling, as well as about their meaning and consequences. The above information is provided to you in this policy and we believe it is useful to you. If you are a user of an app account or have linked your app account to a THANK YOU account (with an existing THANK YOU card) or created a new virtual THANK YOU card, you can view your personal data that we process in your app account, for example to check your current information, data, consents you have given, cancel consents already given or give new ones, review valid individual offers, get an overview of your purchase history of at least the last 2 years (adding and using MAXIMA money) using the app or THANK YOU card, check the balance of your MAXIMA money. Please note that the app and your THANK YOU account are linked to a specific THANK YOU card, so only the usage history of your valid THANK YOU card is shown on the account. If you exchange your THANK YOU card, your app account will not display the usage history of your old card, even if you have connected the cards. If the information provided in this policy and your app account is not sufficient for you, you can always contact us in the manner provided in this policy. 

2. Right to request correction of your personal data 

If the data provided by you has changed or you see that the information being processed about you is inaccurate or incorrect, you have the right to request that this information be changed, clarified or corrected. 
 
You may self-correct your data in your app account or provide us with updated data by contacting us as described in this policy and requesting correction or clarification of your data. 

3. Right to withdraw consent 

If we process your data based on your consent, you have the right to withdraw your consent at any time and the processing of data based on your consent will be terminated. 
 
For example, at any time you may withdraw your consent to receive commercial offers and information from the app, as well as your consent to profiling in order to provide you with personalized offers. Withdrawal of these consents does not limit your further use of the app or participation in the THANK YOU loyalty program or the ability to use its other benefits, but it means that we cannot make you good individual offers, etc. 
 
You may correct your consent by revoking it or re-granting your previously revoked consent by providing the app with updated information in your app account or smart device, by changing the terms of the consent, or by contacting us as described in this policy. 
 
If your consent expires or is withdrawn or revoked, we will delete the data processed with your consent, unless there is another basis for processing it to achieve other data processing purposes set out in the policy - but in the cases set out in the policy, we will anonymize the data permanently. 
 
In any situation, we can keep your consent and its proof for a longer period of time, if it is necessary to protect our rights in connection with any demands and claims made against us. 

4. Right to appeal 

If it seems to you that we are processing your data in violation of the requirements of the legislation on the processing of personal data, we recommend that you immediately contact us directly. We believe that we can dispel all your doubts, satisfy your requests and correct errors, if any. 
 
If you are not satisfied with the solutions we offer or if, in your opinion, we do not take the necessary measures, you have the right to file a complaint with the supervisory authority, which in the Republic of Estonia is the Data Protection Inspectorate (more information available at https://www.aki.ee/et) 

5. Right to object to data processing if it is based on a legitimate interest 

You have the right to object to the processing of your personal data if it is processed on the basis of our legitimate interest. However, considering the purposes and operating principle described in the terms and policies of your app account and the THANK YOU loyalty program, as well as the balance of the legitimate interests of both parties - you as a data subject and us as a data processor, it should be noted that your objections may mean that we will be unable to guarantee you the opportunity to use an app account and participate in the THANK YOU loyalty program in the future. 
 
If you wish to exercise a right set out in this section, please send a written request to our data protection officer using the contact details provided in the policy. 

6. Right to request deletion of data (right to be forgotten) 

If there are important circumstances specified in the legislation governing the processing of personal data (in particular, the grounds specified in Article 17 of the General Data Protection Regulation), such as if personal data is processed illegally or the legal basis for data processing has disappeared, you have the right to demand that we delete your personal data. If you wish to exercise a right set out in this section, please send a written request to our data protection officer using the contact details provided in the policy. 
 
You can also delete your personal data at any time. In order to delete your account, you must submit a corresponding application to klienditugi@maxima.ee following the instructions given in the Terms of Use of the App. When you delete your account, all personal data that is necessary for your app account to function will be permanently deleted. If your personal data processed while being a user of the app are used for other purposes specified in this policy and the legal basis for their processing is not consent, we may retain the relevant information to ensure the achievement of those purposes, such as to comply with the requirements arising from legislation governing the circulation of accounting documents, if you have paid for purchases through the app, or to ensure evidence is available in case you file a claim that may be related to your experience as a user of the app. 

7. Right to request restriction of data processing 

If the legislation on data processing refers to important circumstances, such as if personal data is processed illegally, you dispute the accuracy of the data or object to data processing based on our legitimate interests, you have the right to restrict the processing of your data. Please note, however, that due to data processing restrictions and while such restrictions are in effect, we may not be able to provide you with all the conveniences and benefits of a user of the app. 
If you wish to exercise a right set out in this section, please send a written request to our data protection officer using the contact details provided in the policy. 

8. Right to transfer data 

You have the right to request the transfer of such data that you have provided to us in digital form. After receiving your data transfer request, we will ensure the realization of your right by issuing the data in a common and computer-readable format or by sending the data you want in digital form to the recipient of your choice, taking into account the information provided in your request. 
If you wish to exercise a right set out in this section, please send a written request to our data protection officer using the contact details provided in the policy. 

9. Application processing procedure 

In an effort to protect the data of all users and customers of our app from illegal disclosure, when we receive a data request from you or to ensure your other rights, we must make sure that you are the actual user of the app and/or that the THANK YOU card has been issued to you. For this purpose, we may ask you to submit up-to-date data provided in your app account or THANK YOU account (such as first name, last name, date of birth, e-mail address or mobile phone number) and compare whether the data you provide corresponds to the data in the app account or THANK YOU account. During this verification, we may send a verification notification on the contact details you have provided, by text message or e-mail requesting authorization. If the verification fails, such as if the data you provide does not match the data in your app account or if you do not authorize after receiving a text message or e-mail, we are forced to state that you are not the data subject of the requested data and reject your request. 
 
If we have received your request to ensure one of your rights and have successfully completed the above verification, we undertake to provide you with information on the progress of your request without delay, but in any case no later than one month after receiving your request and completing the verification. Considering the complexity of the application and the number of applications, we have the right to extend the one-month period by another two months, but we will inform you of this before the end of the first month and give reasons for such an extension. 
 
If your request is submitted digitally, we will also send you a response using digital means, unless this is not possible due to the large volume of information, or if you ask us to respond in another way, or if you cannot be identified. 
 
If we are forced to reject your request due to circumstances stipulated in the legislation, we will inform you of the refusal in writing and justify the refusal in accordance with the requirements stipulated in the legislation. 

Data subjects may submit an application to exercise the above-mentioned rights (including withdrawing consent or prohibiting the use of your data), as well as complaints, notices or requests by e-mail at dpo@maxima.ee. The rights are exercised according to the conditions, restrictions and exceptions set forth in the legislation. 
 
You can stop using the app at any time by deleting it from your smart device. In this case, we will stop collecting data related to your use of the app. In order to delete the data collected during your use of the app, you must submit an application in accordance with the terms and policies. 

Deletion/removal of the app does not eliminate your app account or THANK YOU account or block your THANK YOU card, which means that even after deleting the app, we will continue to collect and process the personal data contained in your THANK YOU loyalty program privacy statement according to the procedures and conditions set out in the THANK YOU loyalty program. 

For all questions related to the processing of personal data, you can contact us in the following ways: 

By writing to the e-mail address: info@maxima.ee or to the postal address: Aiandi 13/2, Tallinn 12918, or 
by calling our free helpline on: 8000 2121 

Contact details of our data protection officer: 
E-mail address: dpo@maxima.ee 
Postal address: Aiandi 13/2, Tallinn 12918 
The addressee: MAXIMA Data Protection Officer (Data Protection Officer at MAXIMA Eesti OÜ). 

Our details as personal data processors: 
MAXIMA Eesti OÜ 
Registry code 10765896 
Legal address: Harju maakond, Tallinn, Mustamäe linnaosa, Aiandi tn 13/2, 12918

The policy has been in effect since 15 June 2020. If we change this policy, we will publish its updated version in the app, we will also notify you of the changes using the contact details provided by you and invite you to read them.