PRIVACY NOTICE SLOVNAFT MOVE LOYALTY PROGRAMME
PRIVACY NOTICE
SLOVNAFT MOVE LOYALTY PROGRAMME
(hereafter referred to as“Privacy Notice”)
Effective: 15. 6. 2026
In the course of operating the Slovnaft Move Loyalty Programme (“Loyalty Programme” or “Slovnaft Move”), SLOVNAFT, a.s. (“Slovnaft” or “Company”) processes personal data in accordance with Article 4 (1) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”). This Privacy Notice provides details regarding data processing activities related to the Loyalty Programme.
Terms and expressions not defined in this Privacy Notice have the meanings given in the SLOVNAFT MOVE GENERAL TERMS AND CONDITIONS (“Loyalty Programme Rules”). The Loyalty Programme Rules, along with additional privacy notice(s) for other related services, are available at https://www.slovnaftmove.sk/ andhttps://slovnaft.sk/en/ .
The table below outlines the purpose, legal basis, duration, scope, and sources of data processed, the recipients of data transfers (if any), and the data processors used in the Loyalty Programme’s data processing activities.
|
Name and purpose of the data processing |
Legal basis of the data processing |
Scope and source of the data processed |
Duration of the data processing |
Data processors and their activities |
|
Running the Loyalty Programme. Data processing includes, for example, ensuring participation in the Loyalty Programme, executing actions outlined in the Loyalty Programme Rules, maintaining contact with Customers, and sending essential System Messages for the operation of the Loyalty Programme. System Messages: Refer to the Loyalty Programme Policy for more details. |
Article 6 (1) (b) of the GDPR – Processing is necessary to fulfill obligations related to the Customer’s participation in the Loyalty Programme, including Slovnaft's duties under the Loyalty Programme Rules. |
Minimum Registration Requirements: First and last name, email address, the fact that the Customer has reached the age of 18 (in case a specific service within the Loyalty Programme is only available to persons over 18), Slovnaft ID (generated by Slovnaft). Optional Data: Date of birth (for easier Customer Service identification) and phone number (to receive System Messages f. e. via SMS or Viber, upon Slovnaft’s discretion). Loyalty Account Data: Information such as acceptance of the Loyalty Programme Rules, Loyalty Card number, Loyalty Card usage data (e.g. transaction and their dates information), encrypted (hashed) password (for online registration), registration date, information on the Customer's data processing consents (e.g. for personalised marketing), communications with the Customer (e.g. statements, complaints, enquiries), benefits available to the Customer (e.g. under the Partner Benefit Program), coupons or related campaigns assigned to the Customer based on their Loyalty Level. Participation in the Referral Programme: the identity of the Inviting Customer, the identity of the Invited Customer, the referral code, the transaction made by the Invited Customer, the reward given to Inviting Customer and Invited Customer. Data Source:Data is collected directly from the Customer or during Loyalty Card use. |
Slovnaft will delete the personal data within 30 (thirty) days from the customer’s request or from the date of decision to deactivation made by Slovnaft according to the Loyalty Programme Rules. If Slovnaft is required to retain-personally identifiable transaction information for the purpose of fulfilling tax obligations[1] : the data retention period is 10 (ten) years from the last day of the calendar year in which the tax should have been declared or reported, or in the absence of such declaration or reporting, the tax should have been paid. If Slovnaft is required to retain - personally identifiable transaction information in documents supporting accounting records (e.g. invoices) for the purpose of fulfilling accounting obligations[2] : the retention period is 10 (ten) years. Other data retention periods may apply, as described at the relevant data processing purposes below. |
SFDC Ireland Limited( Salesforce) Tasks: providing assistance and information during registration, case management, communication with Customers - for example, helping to answer Customers' questions and resolve their complaints. Social Annex, Inc.( Annex Cloud) Tasks: managing the Loyalty Programme level system and storing Points and balances.
Microsoft Tasks: storing the login details of the Customer.
Company´s Service Station Operator(s) (“SeS”) Partners operating the SeS on behalf of Company in Slovak republic. The information on relevant data processors shall be shared with the Customer on request. Tasks: Support Customers in case of questions during the purchase on the SeS with regard to Loyalty Programmebenefits. IBM Magyarországi Kft.
Tasks: assessing data quality and characteristics [3] . For example:
Crystal Call, a. s.
Tasks: providing assistance and information during registration, case management, communication with Customers - for example, helping to answer Customers' questions and resolve their complaints. Qualtrics International Inc. Tasks: designing and distributing surveys and questionnaires, as well as processing the responses received. |
|
|
||||
|
Sending general marketing messages (advertising) by email, through the Slovnaft Move App or, in some cases, by other telecommunications means.
Such messages include (for example, if the Customer is encouraged to purchase):
|
Article 6 (1) (f) of the GDPR - processing is necessary for the purposes of the legitimate interests pursued by Slovnaft. Slovnaft has a legitimate interest in communicating its products and services to Customers, promoting Slovnaft's activities and the Referral Program, and obtaining Customers' opinions and expectations. The Customer may unsubscribe from general marketing (advertising) messages at any time. Legitimate interest balancing test has been conducted. |
The Customer's name, email address, telephone number (if provided during registration or after that), and Slovnaft ID and the fact that the Customer has reached the age of 18 (in case a specific marketing message within the Loyalty Programme can only be sent to persons over 18. In connection with invitations to participate in challenges, market research, satisfaction surveys, questionnaires, Slovnaft may also contact Customers (f.e. by telephone call, SMS, WhatsApp, e-mail communication and so on) and may take into account data related to the Customer's use of the Loyalty Card (e.g. nature, number or location of transactions) and may process Customer feedback. The scope of the data may vary from one advertising campaign to another - a separate privacy notice for each campaign may apply.
Source of data:Data is collected directly from the Customer or during Loyalty Card use. |
Slovnaft will process the data until the end of the Customer's participation in the Loyalty Programme, unless the Customer unsubscribes from general marketing messages through one of the following methods:
If the Customer has not used their Loyalty Card for 12 (twelve) months and there are no transactions registered in their Loyalty Account (meaning no Points have been accumulated), Slovnaft may reduce or cease sending general marketing messages to the Customer. However, Slovnaft may continue to send to the above Customers information about prize draws or notifications regarding the launch of new Slovnaft Move services, such as an information email or invitation. |
SFDC Ireland Limited( Salesforce) Taks: designing and implementing advertising campaigns, sending advertising messages. 4Service Holdings GmbH Taks: assisting in sending e-mails to Customers with feedback and statistical analysis of the responses received.
Stratis Kft. Tasks: to analyse and improve the performance and effectiveness of Slovnaft's sales practices and marketing campaigns. Slovnaft uses the above analyses and other aggregated data available to Slovnaft (e.g. revenue from SeS, products sold, etc.) to infer long-term trends in its business practices and make business decisions based on these. Qualtrics International Inc. Tasks: designing and distributing surveys and questionnaires, as well as processing the responses received. |
|
|
||||
|
Sending personalised marketing messages (advertising) by e-mail or through the Slovnaft Move App.
For example:
|
Article 6 (1) (a) of the GDPR and Article 22 (2) (c) of the GDPR (voluntary consent of the Customer). Personalised marketing messages are essentially based on the Customer's shopping habits and interests (profiling). Pursuant to Article 22(2)(c) of the GDPR, the processing is based on the Customer’s voluntary and explicit consent. The personalised marketing messages do not constitute automated decision ‑making that produces legal effects concerning the Customer or similarly significantly affects them. The Customer may withdraw their consent without giving reasons, i.e. unsubscribe from personalised marketing (advertising) messages at any time. Withdrawal of consent does not affect the lawfulness of the processing carried out prior to such withdrawal (i.e. unsubscription). Slovnaft may send location-based offers to the Customer by email and through the Slovnaft Move App only if:
The detection of such events is performed using technical information available on the Customer’s device:
Location settings can be changed not in the Slovnaft Move App, but through the device settings. The way this is done may vary from device to device and from operating system to operating system. For example, when using an Android device, the Customer will only stop receiving location-based offers if they withdraw consent to (i.e. unsubscribe from) receiving personalised marketing messages; whereas when using an iOS device, location-based offers can be disabled by turning off the location access function while the Slovnaft Move App is running in the background - there is no need to unsubscribe from personalised marketing messages. Differences in technical settings between operating systems do not affect the Customer’s rights under the GDPR. The Customer may withdraw consent to personalised marketing at any time, irrespective of the type of device or operating system used. |
Customer's name, email address, Slovnaft ID, date of birth (if provided during the registration or after that), and other optional registration data (f. e. gender, city, postal code), Loyalty Card number, Loyalty Card usage data (e.g. nature, number or location of transactions), interests in the services/products offered, other data available about the Customer (e.g. data collected during satisfaction surveys) and the fact that the Customer has reached the age of 18 (in case a specific marketing message within the Loyalty Programme can only be sent to persons over 18. Source of data:Data is collected directly from the Customer or during Loyalty Card use. |
Slovnaft will process the data until the end of the Customer's participation in the Loyalty Programme, unless the Customer unsubscribes from personalised marketing messages through one of the following methods:
Slovnaft stores information about the exact date and time a Customer crosses a country border, as well as the country whose border was crossed. This data is used to send offers based on the border-crossing event. |
SFDC Ireland Limited( Salesforce) Tasks: designing and implementing advertising campaigns, such as the creation of Customer profiles and sending marketing messages. Hiflylabs Zrt. Tasks: creation and maintenance of automated processes used to create personalised offers, participation in the creation of machine learning processes and evaluation reports. Abylon Consulting Kft. Tasks: running the development environment for sending personalised offers. 4Service Holdings GmbH Tasks: assisting in sending e-mails to Customers with feedback and statistical analysis of the responses received. Stratis Kft. Tasks: to analyse and improve the performance and effectiveness of Slovnaft's sales practices and marketing campaigns. Slovnaft uses the above analyses and other aggregated data available to Slovnaft (e.g. revenue from SeS, products sold, etc.) to infer long-term trends in its business practices and make business decisions based on these. Qualtrics International Inc. Tasks: designing and distributing surveys and questionnaires, as well as processing the responses received. |
|
Sending general and personalised third-party marketing messages (advertising) by email or through the Slovnaft Move App. For example:
|
Article 6 (1) (a) of the GDPR and Article 22 (2) (c) of the GDPR (voluntary consent of the Customer). Personalized marketing messages are essentially based on the Customer's shopping habits and interests (profiling). Only Slovnaft sends marketing messages; Slovnaft does not share personal data with the relevant third parties. Slovnaft reserves the right to modify the list of third party partners at any time. Customers will always be notified of new partners and can unsubscribe from messages at any time. The list of third party partners is available here . (https://www.slovnaftmove.sk/s/partner-list?language=en_US) |
Customer's name, email address, Slovnaft ID, date of birth (if provided during the registration or after that), gender, city, postal code, Loyalty Card number, Loyalty Card usage data (e.g. nature, number or location of transactions), interests in the services/products offered, other data available about the Customer (e.g. data collected during satisfaction surveys). Source of data:Data is collected directly from the Customer or during Loyalty Card use, or Slovnaft receives the data from a third party, for example in relation to coupons used. |
Slovnaft will process the data until the end of the Customer's participation in the Loyalty Programme, unless the Customer unsubscribes from, receiving general and personalized marketing messages regarding third parties, through one of the following methods:
|
Stratis Kft. Tasks: to analyse and improve the performance and effectiveness of Slovnaft's sales practices and marketing campaigns. Slovnaft uses the above analyses and other aggregated data available to Slovnaft (e.g. revenue from service stations, products sold, etc.) to infer long-term trends in its business practices and make business decisions based on these. Qualtrics International Inc. Tasks: designing and distributing surveys and questionnaires, as well as processing the responses received.
|
|
|
||||
|
"SeS Finder" - -Slovnaft shows nearby SeS based on the Customer's location. |
Article 6 (1) (a) of the GDPR (voluntary consent of the Customer – if the Customer has enabled location access on their device while using the Slovnaft Move App). The Customer may enable location based functionalities in two ways:
In the case of setting "(i)": Slovnaft shows the nearest SeS based on the Customer's precise location. In the case of setting "(ii)": Slovnaft shows the nearest SeS within the given radius based on the Customer's location. Location settings can be changed not in the Slovnaft Move App, but through the device settings. This does not affect the Customer’s right to withdraw consent to the processing of their location data at any time. The way location settings are managed may vary from device to device. |
The Customer's location. |
Slovnaft will process the personal data for as long as the Customer uses the SeS Finder. |
No data processor is engaged. |
|
|
||||
|
Digital marketing activities related to the Loyalty Programme.
For example: using Facebook Custom Audience to identify an "advertising target audience", using Facebook Custom Audience to identify a "similar advertising target audience", using Google Customer Match to identify an "advertising target audience", creating a "similar audience" using Google Similar Audience. Digital marketing activities related to the Loyalty Programme are governed by a specific privacy notice, namely: PRIVACY NOTICE DIGITAL MARKETING ACTIVITY RELATED TO THE SLOVNAFT MOVE PROGRAMME available here: https://slovnaft.sk/en/about-us/privacy-policy-documents/ . |
The provisions of the separate privacy notice are applied. |
Carat - Slovakia, s.r.o.
Tasks: provides comprehensive support to the Slovnaft in digital marketing activities related to the Loyalty Programme.
oh my DOT Bratislava s. r. o. Tasks: provides comprehensive support to the Slovnaft in digital marketing activities related to the Loyalty Programme.
Elite / Monday Lovers, s.r.o. Tasks: provides comprehensive support to the Slovnaft in digital marketing activities related to the Loyalty Programme. CARAT Hungary 21. Média Kft. Tasks: assisting with digital marketing activities related to the Loyalty Programme. |
||
|
|
||||
|
Preventing, detecting, and investigating potential fraud and abuse of the Loyalty Programme. For example, Slovnaft will retain the Customer's personal data if the Customer's eligibility to participate in the Loyalty Programme has been terminated due to a breach of the Loyalty Programme Rules or the terms and conditions of any other related service. Slovnaft analyses reports to identify potential fraudulent activities (e.g. unlawful sharing of Loyalty Cards based on the number of transactions per day or SeS visited). These reports may trigger further investigations. For preventing and investigating fraud and abuse, refer to the Slovnaft Code of Ethics[5]. If fraud prevention and investigation are conducted through the Slovnaft Whistleblowing System, a separate privacy notice applies, namely: PRIVACY NOTICE (GENERAL INFORMATION)[6]. |
Article 6 (1) (f) of the GDPR - processing is necessary for the purposes of the legitimate interests pursued by Slovnaft. Slovnaft has a legitimate interest in applying strict controls and measures to ensure the fair operation of the Loyalty Programme, including the payment services within the Slovnaft Move App. Effectively managing and preventing abuse helps protect the resources (assets, trade secrets, intellectual property) used to operate the Loyalty Programme, maintains the credibility of the Slovnaft brand, fosters trust and positive relationships with Customers, and ensures accountability for any irregularities. Legitimate interest balancing test has been conducted and is available on request. In the alternative, the provisions of the separate privacy notice(s) is/are applied. |
The name of the Customer and any other person involved, the Loyalty Card number and its usage data, data related to the service used, details from notifications of possible fraud or abuse, and any data generated during the investigation may be processed by Slovnaft. Slovnaft may combine this data with other information it processes, such as “block data” (including the name, item number, quantity, price, place, and time of product purchases, etc.). |
If the investigation concludes that no fraud or abuse occurred in connection with the Loyalty Programme and no further action is needed, Slovnaft will delete the personal data within 60 (sixty) days of the investigation's completion. In other cases, Slovnaft will process the data until the preparation of any action (e.g., disciplinary action, suspension of the Customer's participation in the Loyalty Programme) or legal action, and until the claim is enforced. If the Customer’s eligibility to participate in the Loyalty Programme was previously terminated by Slovnaft due to a breach of the Loyalty Programme Rules or other abuse or violation, Slovnaft will retain the Customer’s related data for 1 (one) year to verify any re-registration attempt. If the investigation leads to formal or legal proceedings, Slovnaft will process the personal data until the final conclusion of those proceedings. The official documents generated will be retained by Slovnaft in accordance with the applicable document retention rules. |
Stratis Kft. Tasks: providing IT services closely related to data processing, such as analytics and reporting — for example, checking how many transactions a Customer has made at various SeS in a specific country. |
|
|
||||
|
Handling Customer complaints. Detailed rules for handling Customer complaints will be provided to the Customer upon request. For the detailed rules for the underlying data processing, refer to the relevant privacy notice, namely: PRIVACY NOTICE concerning processing operations related to the care of the SLOVNAFT, a.s. retail customer/data subject [7]. |
The provisions of the separate privacy notice are applied. |
|||
|
Exercise of legal claims by the Company concerning the Loyalty Programme.
This includes e.g. defence in legal disputes and procedures of authority initiated by the Customers in connection with the Loyalty Programme or under Article 17 (3) (e) of the GDPR. Source of data: as specified in the relevant point.
|
Article 6 (1) (f) of the GDPR - the processing is necessary for the legitimate interests of the Slovnaft: exercising legal claims and successful defence in a potential legal or official proceeding (e.g. court proceeding initiated by a customer, administrative or out-of-court procedure etc.). Legitimate interest balancing test has been conducted. |
Name, email, phone number (only if the dispute is related to the lawfulness of its processing), date of birth, Loyalty Programme Card number and Slovnaft Loyalty Programme Card usage data if needed to exercise rights or settle legal disputes in the Loyalty Programme. |
The general period of data processing is defined in case of each data processing operation. If the data are needed to exercise legal claims or for defence against any civil law claims, the period of data processing is the time necessary to conduct the proceeding(s) and until the definitive conclusion of such proceedings or achievement of the legitimate interest by other means (e.g. conclusion of an out-of-court settlement). |
|
Consent Management Part 2
Data controller(s):
SLOVNAFT, a.s.
Vlčie hrdlo 1
824 12 Bratislava
Slovak republic
+421 2 4055 1111
Company registry number: 31 322 832
This email address is being protected from spambots. You need JavaScript enabled to view it.
MOL Plc.
Dombóvári út 28.
1117 Budapest
Hungary
+36 1 886 5000
Company registry number: Cg.01-10-041683
www.mol.hu
This email address is being protected from spambots. You need JavaScript enabled to view it.
(“MOL Plc.”)
MOL Retail Zrt.,
1117 Budapest, Dombóvári út 28., Hungary
This email address is being protected from spambots. You need JavaScript enabled to view it.
(“MOL Retail Zrt.”)
Pursuant to Article 26 of the GDPR, since Slovnaft, MOL Plc. and MOL Retail Zrt. jointly determine the purposes and methods of personal data processing within the Loyalty Programme, they are considered “joint controllers”. MOL, MOL Plc. and MOL Retail Zrt. are jointly determine the purpose and framework of the data processing; however, the actual data processing operations (such as data collection, data storage, and determination of the storage period) are carried out solely by MOL and MOL Retail Zrt. In practice, this means that they determine in a transparent manner, by mutual agreement, their responsibilities for compliance with the obligations under GDPR, especially with regard to the exercise of the rights of data subjects and their duties to provide the necessary information about personal data protection. The agreement must properly reflect the individual roles and relationships between the joint controllers. Furthermore, data subjects can submit requests for exercising their rights under GDPR to Slovnaft and/or MOL Plc and/or or MOL Retail Zrt. Slovnaft and MOL Retail Zrt. have access to the joint database of the Loyalty Programme in which user data are stored.
Slovnaft engages the services of its lawyer partners for the management and enforcement of its claims under Article 6 (1) (f) of the GDPR, based on Slovnaft 's legitimate interest, and transfers the necessary personal data to these lawyers for this purpose. These lawyers operate as independent data controllers in accordance with their own privacy notices. When lawyers are instructed for a specific case, Slovnaft will provide information about the identity of the lawyer involved, along with their contact details, activities, and the data processed, upon request by the individual.
When the Customer downloads the Slovnaft Move App, Apple Inc. (App Store) and Google Inc. (Google Play) act as independent data controllers. If the Customer registers using a Facebook or Google account, the data controller for that registration will be Facebook or Google Inc. Slovnaft only has access to the username (email address) used for login with the respective service provider.
Contact details of the MOL Plc. and Slovnaft Data Protection Officer(s):
MOL Plc. and MOL Retail Zrt. Data Protection Officer:
This email address is being protected from spambots. You need JavaScript enabled to view it.
Slovnaft Data Protection Officer:
This email address is being protected from spambots. You need JavaScript enabled to view it.
Address for correspondence: zodpovedná osoba GDPR, SLOVNAFT, a.s., Vlčie hrdlo 1, 824 12 Bratislava, Slovak republic
Data processors:
|
Name of the data processor |
Contact details |
|
SFDC Ireland Limited( Salesforce) |
Salesforce Tower Dublin, North Dock, Dublin 1, D01 W2Y3 Ireland |
|
Social Annex, Inc.( Annex Cloud) |
Los Angeles Office, 855 N. Douglas Ave, 1st Floor, El Segundo, CA 90066, USA Annex Cloud's servers are located in Frankfurt, Germany, with backup servers in Ireland, ensuring that no data is transferred outside the EU |
|
The partners operating the SeS |
Information on SeS partner(s) data is available upon request to Slovnaft's contact details |
|
IBM Magyarországi Kft. |
Neumann János u 1., 1117 Budapest, Hungary; https://www.ibm.com/contact/hu/hu/ |
|
Stratis Kft.
|
Szépvölgyi út 139., 1037 Budapest, Hungary This email address is being protected from spambots. You need JavaScript enabled to view it. ; https://www.stratis.hu/ |
|
Hiflylabs Zrt. |
Bartók Béla út 15/B., 1114 Budapest, Hungary |
|
Abylon Consulting Kft. |
Mátra u. 11., 8000 Székesfehérvár, Hungary |
|
4Service Holdings GmbH
|
Tegetthoffstraße 7, 1010 Vienna, Austria |
|
Crystal Call, a. s. |
Hálkova 1/A, 831 03 Bratislava, Slovak Republic |
|
Carat - Slovakia, s.r.o. |
POLUS TOWER II, Vajnorská 100/B, 831 04 Bratislava, Slovak Republic |
|
oh my DOT Bratislava s. r. o. |
Bajkalská 7A, 831 04 Bratislava, Slovak Republic |
|
Elite / Monday Lovers, s.r.o. |
Obchodná 58, 811 06 Bratislava, Slovak Republic |
|
CARAT Hungary 21. Média Kft. |
Kacsa utca 15-23., 1027 Budapest, Hungary (phone: +36 1 411 2240, e-mail: This email address is being protected from spambots. You need JavaScript enabled to view it.) |
|
Qualtrics International Inc. |
Qualtrics headquarters, 333 W. River Park Drive, Provo, UT 84604, United States of America Qualtrics International Inc. provides adequate guarantees for the protection of personal data (as required by the GDPR) outside the European Economic Area by participating in the so-called “Data Privacy Framework” (approved by the European Commission’s adequacy decision dated July 10, 2023). (For more information, see https://www.dataprivacyframework.gov/ ). |
Where Slovnaft utilizes service providers acting as data processors, it will ensure that appropriate data processing agreements are in place in accordance with Article 28 of the GDPR. These agreements aim to ensure that personal data processing is conducted by the processor on behalf of Slovnaft and solely based on Slovnaft's instructions.
Automated decision-making and profiling, including the logic employed, as well as the implications and consequences of data processing:
The profiling used for data processing purposes, such as “Sending personalised marketing messages (advertising) by email or through the Slovnaft Move App” and “Sending general and personalised marketing messages regarding third parties (advertising) by e-mail or through the Slovnaft Move App” primarily relies on Loyalty Card usage data. Slovnaft considers factors like purchase history, including the types of products and services used by the Customer, the frequency and value of purchases, as well as the Customer's age and gender.
For example:
- Slovnaft analyses what soft drinks women aged 35-40 typically buy with their petrol, and based on this, offers similar drinks to women in that age group participating in the Loyalty Programme during refuelling.
- To measure marketing message effectiveness, Slovnaft tracks the messages received by the Customer, their purchased products and services, the timing, frequency, and value of these purchases. This data helps Slovnaft determine future personalised messages. For instance, Slovnaft may send a birthday coupon for the Customer's favourite coffee, inferred from previous purchases. If the Customer also buys a bakery product with their coffee, this item may also be included in the marketing message.
- If the Customer has not used their Loyalty Card for 12 months and no transactions are registered in their Loyalty Account (meaning they have not accumulated any Points), Slovnaft may reduce the number of personalised marketing messages sent or decide not to send any at all.
- Sending personalised marketing messages based on the Customer’s activity or frequency of visits. For example: a discount on premium fuel for Customers who downloaded the Slovnaft Move App in the first month after registration and redeemed only the free product, or visited a service station only a certain number of times, or refueled a certain amount of fuel.
Data security measures:
|
Measure |
Description |
|
Information security management system |
Ensuring the confidentiality, integrity, and availability of organizational information by implementing policies, processes, specifications, organizational structures, software, and hardware functions. |
|
Physical access |
Ensuring the protection of physical assets containing MOL Group information. |
|
Logical access |
Ensuring that only persons approved and authorised to use the systems have access to data used by MOL Group companies. |
|
Data access |
Ensuring that only persons authorised to use the systems have access to MOL Group corporate data. |
|
Data transfer/storage/deletion |
Ensuring that MOL Group company data cannot be transmitted, read, modified or deleted by unauthorised persons during transmission or storage. In addition, ensuring the immediate deletion of MOL Group Corporate Data when the purpose for which it was collected ceases to exist. |
|
Confidentiality and integrity |
Maintaining the confidentiality and integrity of MOL Group corporate data, ensuring it remains timely and accurate. |
|
Availability |
Protecting MOL Group corporate data against accidental destruction or loss. In the event of an incident that causes such consequences, ensuring timely access to and recovery of the affected data. |
|
Data separation |
Ensuring that MOL Group company data is treated separately from the data of other Customers. |
|
Incident management |
In the event of a data breach involving MOL Group corporate data, minimising the impact of the breach and notifying the owners of the corporate data without delay. |
|
Audit |
Ensuring that the effectiveness of the above technical and organisational measures is regularly tested, reviewed and evaluated. |
Data subjects' rights and remedies in relation to data processing:
The GDPR contains in detail your data protection rights (as data subject), your possibilities of seeking a legal remedy and the restrictions thereof (especially Articles 15, 16, 17, 18, 19, 20, 21, 22, 77, 78, 79 and 82 of the GDPR). You can at any time request information about your personal data processed, you can request the rectification and erasure of your personal data or the restriction of their processing, furthermore you can object to the data processing based on a legitimate interest (including in particular the processing of “sending general marketing messages (advertising) by e-mail, through the Slovnaft Move App or, in some cases, by other telecommunications means”) and you have the right to data portability.
Below, Slovnaft summarises the data subject's most important data protection rights in relation to the purposes of the processing covered by this Privacy Notice.
The right to information
If the Company processes your personal data, it must provide you information – even without your special request thereof – concerning the main characteristics of the data processing including the purpose, legal basis and period of processing, the identity and contact details of the Company and its representative, the contact details of the data protection officer, the recipients of the personal data (in case of data transfer to third countries indicating also the adequate and appropriate guarantees), the legitimate interests of the Company in case of a data processing based on a legitimate interest, furthermore your data protection rights and your possibilities of seeking a legal remedy (including the right of lodging a complaint with the supervisory authority), the source of personal data – if you are not the source – as well as the categories of personal data, in the case you have not had yet all this information. In case of automated decision-making and profiling you must be informed by the Company in an understandable way about the logic involved, as well as the significance and the envisaged consequences of such processing for you. The Company provides the abovementioned information by making this Privacy Notice available to you.
Right of access
You have the right to obtain from the Company confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and certain information related to the data processing such as the purpose of the data processing, the categories of the personal data processed, the recipients of the personal data, the (envisaged) period of data processing, the individual’s data protection rights and possibilities of seeking a legal remedy (including the right of lodging a complaint with the supervisory authority), furthermore information on the source of the data where they are not collected from you.
Upon your request the Company shall provide a copy of your personal data undergoing processing. For any further copies requested by you, the Company may charge a reasonable fee based on administrative costs. Where you made the request by electronic means, and unless otherwise requested by you, the information shall be provided in a commonly used electronic form. The right to obtain a copy shall not adversely affect the rights and freedoms of others.
The Company gives you information on the possibility, the procedure, the potential costs and other details of providing the copy after receiving your request.
In case of automated decision-making and profiling the individual has access to the following information: the logic involved, as well as the significance and the envisaged consequences of such processing for you.
Right to rectification
You have the right to obtain from the Company without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
Right to erasure
You have the right to obtain from the Company the erasure of personal data concerning you without undue delay and the Company has the obligation to erase personal data without undue delay where certain grounds or conditions are given. Among other grounds the Company is obliged to erase your personal data upon your request for example if the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; if you withdraw your consent on which the processing is based, and where there is no other legal ground for the processing; if the personal data have been unlawfully processed; or if you object to the processing and there are no overriding legitimate grounds for the processing; if the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the Company is subject; or if the personal data have been collected in relation to the offer of information society services.
If the data processing is based on your consent the consequence of the withdrawal of the consent: we do not send or offer tailored, personalised marketing (advertising) messages, promotional offers, coupons.
We inform you that the withdrawal of your consent does not affect the legality of the data processing carried out before the withdrawal, based on your consent.
Right to restriction of processing
You have the right to obtain from the Company restriction of processing where one of the following applies:
(a) the accuracy of the personal data is contested by you, for a period enabling the Company to verify the accuracy of the personal data;
(b) the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
(c) the Company no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims;
(d) you have objected to processing, pending the verification whether the legitimate grounds of the Company override your legitimate grounds.
Where processing has been restricted according to the abovementioned reasons, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.
You shall be informed by the Company before the restriction of processing is lifted.
Right to data portability
You have the right to receive the personal data concerning you, which you provided to the Company in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the Company to which the personal data have been provided, where:
(a) the processing is based on your consent or on the performance of a contract (to which you are a party); and
(b) the processing is carried out by automated means.
In exercising your right to data portability, you have the right to have the personal data transmitted directly from one controller to another, where technically feasible.
Right to data portability shall be without prejudice to the provisions governing the right to erasure; furthermore, it shall not adversely affect the rights and freedoms of others.
Right to object
You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data by Company on the basis of legitimate and lawful interests or where is Company processing your personal data in the public interest, including profiling based on the aforementioned provisions. In such a case, Company may no longer process the personal data, unless Company can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
If the processing of personal data is for direct marketing purposes (“sending general marketing messages (advertising) by e-mail, through the Slovnaft Move App or, in some cases, by other telecommunications means”), you have the right to object at any time to the processing of personal data concerning them for these purposes - in which case the personal data may no longer be processed for these purposes. In the case of direct marketing, you always have the option to object to the processing of your personal data by clicking on the button located at the end of each marketing communication (e.g., unsubscribe).
Framework for the exercise of rights
The Company shall provide information on action taken on a request based on your abovementioned rights without undue delay and in any event within 1 (one) month of receipt of the request. That period may be extended by 2 (two) further months where necessary, taking into account the complexity and number of the requests. The Company shall inform you of any such extension within 1 (one) month of receipt of the request, together with the reasons for the delay. Where you make the request by electronic form means, the information shall be provided by electronic means where possible, unless otherwise requested by you.
If the Company does not take action on your request, the Company shall inform you without delay and at the latest within one month of receipt of the request of the reasons for not taking action and on the possibility of lodging a complaint with the competent data protection supervisory authority and seeking a judicial remedy.
In Slovak republic, the competent supervisory authority is The Office for Personal Data Protection of the Slovak Republic; in Slovak: ”Úrad na ochranu osobných údajov Slovenskej republiky” (abbreviated as “ÚOOÚ”).
Contact details of The Office for Personal Data Protection of the Slovak Republic:
Budova Park one
Námestie 1.mája 18
811 06 Bratislava
Slovak Republic
Effective June 1, 2026, ÚOOÚ will be located at:
Galvaniho Business Centrum II
Galvaniho 7/B
Bratislava
tel.: + 421 2 32 31 32 14, + 421 2 32 31 32 49
e-mail: This email address is being protected from spambots. You need JavaScript enabled to view it.
website: https://dataprotection.gov.sk
In Hungary, the competent supervisory authority is The National Authority for Data Protection and Freedom of Information; in Hungarian: “Nemzeti Adatvédelmi és Információszabadság Hatóság” (abbreviated as “NAIH”).
Contact details of NAIH:
Falk Miksa utca 9-11., 1055 Budapest, Hungary, postal address: Pf. 9., 1373 Budapest, Hungary
Tel: +36 1 391 1400, +36 (30) 683-5969 or +36 (30) 549-6838, fax: +36-1-391-1410
e-mail: This email address is being protected from spambots. You need JavaScript enabled to view it.
website: http://naih.hu/.
The information shall be provided by the Company in writing, or by other means, including, where appropriate, by electronic means. When requested by you, the information may be provided orally, provided that your identity is proven by other means.
Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR. You can read about how to contact supervisory authorities within the EU here: https://edpb.europa.eu/about-edpb/board/members_en . You shall have the right to an effective judicial remedy against a legally binding decision of a supervisory authority concerning you. You shall further have the right to an effective judicial remedy where the competent supervisory authority does not handle your complaint or does not inform you within 3 (three) months on the progress or outcome of the complaint lodged. Proceedings against a supervisory authority shall be brought before the courts of the Member State where the supervisory authority is established.
Without prejudice to any available administrative or non-judicial remedy, including the right to lodge a complaint with a supervisory authority, you shall have the right to an effective judicial remedy where you consider that your rights under the GDPR have been infringed as a result of the processing of your personal data in non-compliance with the GDPR. Proceedings against the Company or its data controller or processor partner shall be brought before the courts of the Member State where the Company, the controller or the processor has an establishment. Alternatively, such proceedings may be brought before the courts of the Member State where you have your habitual residence.
In Slovak Republic, the action falls within the jurisdiction of the General Courts of Slovak Republic.
The court may order the data controller (Company) to provide the information, to rectify, block or erase the data in question, to annul the decision adopted by means of automated data-processing systems, to honor your objection. The court may order publication of its decision, indicating the identification of the data controller or any other data controllers and the committed infringement.
The data controller concerned shall be liable for any damage caused to you as a result of unlawful processing or by any breach of data security requirements. Where any data controller violates the rights of the data subject relating to personality as a result of unlawful processing or by any breach of data security requirements, the data subject shall be entitled to demand restitution from the data controller concerned. Data controller may be exempted from liability for damages or for payment of restitution if he proves that the damage was caused by or the violation of the rights of the data subject relating to personality is attributable to inevitable reasons beyond his control.
No compensation shall be paid and no restitution may be demanded where the damage was caused by or the violation of rights relating to personality is attributable to intentional or negligent conduct on the part of the data subject.
For further information on the jurisdiction of the courts and contact details of each court, please visit www.justice.gov.sk . In Hungary, the action falls within the jurisdiction of the Regional Court (in Hungarian Törvényszék). You can find the court of your place of residence or stay at www.birosag.hu .
[1] Mandatory data retention is provided for in relevant paragraphs of Act No. 222/2004 Coll. on Value Added Tax as amended.
[2] Mandatory data retention is provided for in relevant paragraphs of Act No. 431/2002 Coll. on Accounting as amended.
[3] On the basis of the assessment, Slovnaft will either (i) correct the data itself (pursuant to Article 16 of the GDPR), for example in case of obvious spelling mistakes; (ii) or ask the Customer to verify the data that appears to be inaccurate.
[4] The Customer may receive two reminders to participate in the Referral Programme - approximately two weeks after the first invitation and approximately 3 months after the first invitation.
[5] https://slovnaft.sk/en/about-us/ethics/
[6] https://slovnaft.sk/en/about-us/privacy-policy-documents/
[7] https://slovnaft.sk/en/about-us/privacy-policy-documents/