Privacy Statement for Circle K Application and Circle K ID

Who are we?

Circle K is part of Alimentation Couche-Tard group. Alimentation Couche-Tard is a Canadian based group and a world leader in the convenience store sector. In Europe, Couche-Tard is known through its Circle K trademark.

Circle K AS is a company registered in Norway with office at Schweigaards gate 16 Oslo, Norway, with company number 995532921, and its affiliates (collectively, “Circle K”, the “Company”, “we”, “us” or “our”) in the European Union / European Economic Area countries where this privacy statement is posted. Relevant Circle K entity in the region is the controller to the data processing described in this privacy statement.

This privacy statement will help you to understand how we process your personal data. This statement will tell you things like what information we use to provide you with services, what we do to keep your data safe, what partners we engage to process our data, and what are your privacy rights.

How and when does privacy statement apply?

This privacy statement describes the personal data processing in Circle K application (“the application” or “the app”). The privacy statement consists of general Circle K application privacy information, and service-specific privacy information.

The application is the platform to many of Circle K offered services most of which are accessed through Circle K ID profile. Each service available in this application has different service-specific privacy statement which you can review. See below the applicability of this privacy statement:

This application

This privacy statement applies to all processes carried out via Circle K application, which are described further in this statement.

Circle K ID

In order to access most of the services this application offers you will need a Circle K ID account. Circle K ID is the identity management tool that we use, and it serves as a single point for customers to easily interact with and manage their subscription to different Circle K offered services.

This privacy statement also covers Circle K ID privacy information since the application is intended to be used with a registered Circle K ID account, but for your convenience we have published Circle K ID privacy statement separately here. Both statements hold equal value.

Different services in this application

The service-specific privacy statement shall apply only if you decide to opt in to the services you like. Service specific privacy statements are available here:

Circle K ID
Forecourt payment – payment for single car wash and fuel
Car wash subscription
Pay by Plate
Circle K Gaming
Loyalty Extra Program

If you disagree with the operations described in this privacy statement hereinafter, unfortunately, Circle K will not be able to provide you with most of the services available on this application.

Purposes of the processing

We will process personal data to provide you with services available in the application, and to ensure application functionality. The different purposes of data processing are described below.

To ensure application functionality and measure performance

We will process some personal data in order to ensure the app safety and functionality, resolve app crashes, improve overall app usability, and analyze errors and bugs occurring the app.

In addition, we will measure the app usage and performance. We will use data on user interactions on an aggregated level or in anonymized state to measure and improve the performance of the app and the services.

The legal basis for collection and processing is legitimate interest of Circle K to process this data.

To provide you with guest services

The application offers a possibility to locate any station near you without creating a Circle K ID profile. You may access this service by clicking on the map with GPS location turned out to view your position on the map and your closest Circle K station.

The legal basis for this data processing is acceptance of contract between Circle K and the individual which you agree to by using the application.

To access other services described previously, you must log in as a Circle K ID member.

To provide you with services available through Circle K ID membership

We will process personal data so we can provide you with the services available in the application. The services you wish to opt in to are up to you, and you can stop using the services any time.

In order to access these services, you will need to have the application downloaded on your device and you must register a Circle K ID account.

Once a profile is created and you are logged in, you can browse the services that are available in the application and select the ones of you are interested in. To start using them you need to accept the service-specific Terms and Conditions to selected services to add them to your Circle K ID account. The acceptance to the services shall be recorded and used to maintain your account and your accesses to selected services.

The legal basis for processing personal data to provide you with Circle K ID and other Circle K ID member services in the application is contract between Circle K and the individual which you agree to by clicking acceptance button to our Terms and Services when registering account with us and when opting into services.

We may from time to time rely also on other legal bases when:

It is necessary to process personal data to protect an individual’s life.
It is necessary to comply with legal obligations to process certain data, for example, when there is request from regulatory authority to disclose certain personal data.
We have received a clear, informed consent from you to process your personal data for another specific purpose.

If you are interested in the different purposes for which your data is processed as a part of the different services available in the application, please refer to the service-specific privacy statements of your interest (available in paragraph 2 of this statement).

What personal data we process

The personal data we will process about you depends on the services you wish to use, however, we will collect and process some data about you in order to maintain your account and to enable the application functionality and ensure security regardless of the services you decide to use.

Personal data processed to ensure application functionality, security and measure performance

The personal data we will collect to ensure application functionality and security is described below:

Crash logs.
User interactions with the application and interactions with different services.
Diagnostic data such as IT system problems, transaction performance, errors that may originate from user interaction with the app, but usually does not contain any user data.

The data used for application and service performance measurement is mainly user interactions such as user ID and related information to account, app launches, device ID such as device’s advertising identified, taps, clicks, scrolling information, media views, performance data such as launch time or energy use, or other information about how you interact with the app. The data shall be used on aggregated level or anonymized state.

Personal data processed to provide you guest services

In order to provide you with services that do not require you to register account with Circle K, we shall process the following personal data:

Geolocation of the user.
Language preferences.

This data shall not be transferred to Circle K and will remain on your device and will be deleted when you uninstall the application.

Personal data processed to provide you access to Circle K ID member services

When registering to Circle K ID to access further services, you will have to provide some base personal data to create an account:

First name
Last name.
E-mail address.
Mobile phone number.
Password (your password is stored in encrypted format).
Country.
Consent to Terms and Conditions.

In addition, you may provide some personal data optionally:

Date of birth.

As you use our services, we will create unique information that will be associated with your account. The following information will be generated during while you use the application:

Unique Circle K ID identifier.
Data on user interaction with and subscription to services which are accessed through Circle K ID.
If applicable, consent to marketing of services associated with Circle K ID account and communication preferences.

This information shall be retrieved as you opt in to further services that are available in the application. Please note that some services may require additional pieces of personal data, for example, if service enables virtual payments, we may ask for payment instrument information.

To see what personal data we process as a part of the different services available in the application, please refer to the service-specific privacy statements of your interest (available in paragraph 2 of this statement).

What are your rights?

Exercising your rights

You may exercise your rights as a data subject, including the right to object, right to restrict processing, or ask us questions by contacting Circle K via e-mail, phone, or post, or through the Circle K ID page: https://id.circlekeurope.com. The contact details are available in paragraph 10 of this statement. Some requests, like access to data, specific question related to data analysis as such or any other question you can request further access needs to be made in writing.

Right to information

These terms and conditions constitute the special information about how we will process your personal data and what data will be processed as part of the Services and supplement the general Circle K Privacy Policy which is available on: https://www.circlek.eu/privacy-policy

Access to data

You have the right to at any time request from us a copy of the information about you that we store. Such request shall be in writing. If you have specific question related to data analysis as such or any other question you can request further access. Most information is available to you at the mobile application which contains the necessary personal data we store about you to provide you with the Services. Request for access to data shall be made in writing, see more at https://id.circlekeurope.com.

Rectification of data

If your personal data changes, you can rectify (correct) your own personal data in the account settings of the applications.

If you have specific questions or experience problems related to rectification as such or any other question you can request further assistance by contacting Circle K. Such request shall be made in writing.

Right to data portability

You have the right to ask that we transfer the information you gave us to another. This only applies to information you have given us. Commercially sensitive information that was created based on your anonymized data shall not be transferred.

Rights related to profiling and automated decision-making

You have right not to be subject to a decision based solely on automated processing, including profiling. You may submit an objection to any automated decision we have made and ask that a person reviews it.

Deletion of personal data

You have the right to request deletion of some parts of your personal data. Some data, such as transactions must be retained in accordance with local jurisdiction requirements.

If you choose to delete your personal data and terminate your account, many of the application services will not be available to you, and you may continue using this application only as a guest. If you wish to continue using the majority of the services, you will have to register again.

Right to object

You may have the right to object to processing if we are processing your information on the basis of legitimate interests. You may submit an objection to any automated decision we have made and ask that a person reviews it.

Right to restrict processing

You have the right to ask us to restrict the processing of your information in certain circumstances. This means that your data can only be used for certain things, such as legal claims or to exercise legal rights.

You may exercise your right to restrict processing by contacting Circle K via e-mail, phone, or post, or through the Circle K ID page: https://id.circlekeurope.com. The contact details are available in paragraph 10 of this statement.

Dispute resolution

Should you have any concerns related to personal data processing, you may reach out to privacy@circlekeurope.com to resolve the issue and if you wish you can request group Data Protection Officer involvement.

Our supervisory authority in most cases is the Norwegian Data Protection Inspectorate, whose contact information is available here: https://www.datatilsynet.no.

You may also contact your local Data Protection Supervisory Authority if you wish to lodge a complaint. Contact details can be found here: https://edpb.europa.eu/about-edpb/about-edpb/members_en

Data processors and transfer of data

Circle K will share the personal data gathered through the application with its partners (also known as “data processors”) in order to administer registered customer accounts and to ensure application’s functionality and availability, as well as to provide you with the services available on the application.

For different services we will engage different partners to help us administer them. Below you will find a list of the data processors that we will engage to help us administer the application and ensure its functionality.

Syrenis

Purpose: To support Circle K in managing the Circle K ID platform and user consent database.

Organization location: The headquarters of “Syrenis” are located in United Kingdom, however the datacenters are located in Ireland, and the customer data will not be accessed by parties outside of EU / EEA.

Data: “Syrenis” shall access data that you provide to us via registration to Circle K ID, services you have opted in to and communication preferences.

Applicable region: Every region where the service is available.

Okta

Purpose: To support Circle K in managing authentication procedures in Circle K ID and to ensure additional security and prevent unauthorized access to your account. You can read more about Okta privacy policy here.

Organization location: The headquarters of “Okta” are located in USA, however the datacenters are located in Ireland and Germany, and the customer data will not be accessed by parties outside of EU / EEA.

Data: “Okta” shall access Circle K ID profile data that you provide to us via registration to Circle K ID and passwords.

Applicable region: Every region where the service is available.

Développements Third Bridge Inc

Purpose: To support Circle K in managing content displayed in the application.

Organization location: The headquarters of “Développements Third Bridge Inc” are located in Canada, but the data centers relevant for the applications are located in Sweden.

Data: In case a mobile coupon is redeemed, the user id & records of the user's mobile coupon redemptions may be accessed.

Applicable region: Every region where the service is available.

If you are interested who are the data processors supporting us to administer the different services available in the application, please refer to the service-specific privacy statements of your interest (available in paragraph 2 of this statement).

At the same time, we may process some of the personal data in our internal systems that we use in order to maintain our business. In most cases are supported either by Microsoft, Oracle, or other partners specializing in ICT services.

Circle K datacenters, and datacenters of our partners enabling you to receive Circle K ID services generally are located in EU / EEA, or in countries recognized by European Commission to provide an adequate level of data protection. In case Circle K shall engage partners from other countries outside of EU / EEA (also known as “third countries”), Circle K shall ensure that relevant data protection procedures are in place to comply with applicable data protection laws, such as but not limited to GDPR.

Personal data retention

Circle K will retain user data for as long as necessary for the purposes for which the data was originally collected.

This means that we will retain different categories of data for different time periods depending on the data type, the service it relates to and the purposes for which this data was collected.

Hereinafter are described the rules for data retention periods:

Your personal data shall be stored for as long as you have an active Circle K ID account. If your account is closed, the personal data will be either deleted or anonymized along with any personal data that was used for services available through Circle K ID membership. In some cases, some data may be retained if it is required to meet any legal obligations, for accounting purposes, for dispute resolution, or other similar purposes where applicable legal basis can be identified.

Data relating to transactions, such as receipts or invoices, shall be stored for 10 years or as per legal requirements in your jurisdiction. If you delete your account, the data on transactions will be retained in order to comply with accounting regulations.

In case of criminal offences, fraud, or any dispute with individual, the data shall be retained for as long as necessary until the matter is resolved and in accordance with Circle K internal and state legal requirements.

The historical data on user’ purchases and usage of the application shall be retained as long as the user has an active account, and after the account is deleted, the data shall be anonymized or deleted.

Please be reminded that by uninstalling the Circle K application from your device does not delete your account or your personal data from Circle K systems.

If you have not used the application 6 months and have no services associated with your Circle K ID account, we will reach out to you to confirm if you wish to keep your account active for future use. If we do not receive a reply in reasonable time period, the account will be closed, and your data will be either deleted or anonymized unless there is a reason for us to retain this data for any of the purposes mentioned earlier in this privacy statement.

Protecting your personal data and respecting privacy

Circle K will not gather, use, or disclose any personal data about a customer that is not aligned with the original purposes and without ensuring appropriate legal basis. We will never sell your data. We will maintain the security and confidentiality of the information according to the relevant laws and industry standards, and we will ensure that only authorized personnel may access your personal data.

We may grant our partners accesses to personal data. This will be done to the extent necessary to provide the support to us to maintain and administer the application and customer accounts.

Data that may be used for our research, scientific and business performance analysis purposes is anonymized so you cannot be identified from it.

Updates to this statement

We hope you will find this privacy statement easy to understand.

Data protection laws are important – they strengthen your rights and ensure fair and transparent information processing by organizations. While many of these rules may appear complicated, most of them derive from common sense and general respect towards each other and environment. We take our data protection responsibilities seriously, and we require the same from our partners.

We may periodically update this statement in order to improve it as a part of our commitment to protecting your privacy. For app users, an updated policy will always be available via App Store, Google Play and within the app.