The Cepsa App mobile application

In compliance with the legislation in force, CEPSA COMERCIAL PETRÓLEO S.A.U. (hereinafter, "CEPSA" or "CCP") informs the user that the personal data provided through the use of this application (hereinafter, “Personal Data"), will be processed in accordance with the following: 

Who is responsible for the processing of your personal data?

The Data Controller is CEPSA COMERCIAL PETRÓLEO, S.A.U., holder of Tax ID No.: A80298896, registered address at Torre Cepsa, Paseo de la Castellana, 259 A, Postal Code 28046 Madrid, Spain.

If you have contracted products and/or services with COMPAÑÍA ESPAÑOLA DE PETRÓLEOS, S.A.U., (Tax ID No.: A28003119), RED ESPAÑOLA DE SERVICIOS, S.A.U., (Tax ID No. A25009192), or with registered offices located at Paseo de la Castellana, 259 A, CP 28046 Madrid (Spain), each of the above-mentioned companies will be considered as the Data Controller.

Contact details of the Data Protection Officer: dpo@cepsa.com 

What data are processed, for what purpose, and on what basis of legitimacy?

The Personal Data will be processed for the following purposes and on the following bases of legitimacy:

- Purpose 1 – Provision of the services included in the App.

• Description of the purpose: To provide the services included in the App and/or provide the requested information, either via the App (contact forms or contact chat), web, email, or telephone. Phone calls may be recorded for the purpose of guaranteeing the quality of the service. Emails may register confirmation of receipt and reading.
  
• Basis of legitimacy: Undertaking the contract. 
• Data processed for this purpose:  Identification data (e.g.: First name, last name, email address, phone number) and any other information provided by the data subject.

- Purpose 2 – Geolocation of users for the provision of services.

• Description of the purpose: To provide, when requested, services that required knowing the geographical location of the application user, such as map and navigation functionalities to reach the nearest service stations. Before accessing this data, the device will request the user's permission to know the geolocation.
• Basis of legitimacy: Execution of the relationship with the user and provision of the requested service, according to the terms and conditions of the application. Additionally, before accessing this data, the application will request the user's permission to know the geolocation. 
• Data processed for this purpose: Position of the device used by the user to access geolocation services.

- Purpose 3 – Incident management and fraud prevention.

• Description of the purpose: To resolve all incidents that may arise in connection with the use of the application. A User may be contacted if a suspected fraud or identity theft is detected.
• Basis of legitimacy: CEPSA's legitimate interest in implementing sufficient measures to prevent the commission of illicit and/or improper acts. 
• Data processed for this purpose: Identifying data (e.g.: First name, last name, email address, phone number).

- Purpose 4 – Profiling with internal sources.

• Description of the purpose: to elaborate profiles among the users of the application through marketing studies, obtaining and inferring conclusions and applying segmentation techniques that, subsequently, make it possible to modify and introduce improvements in the offer of products and services made, adapting them to the preferences of each profile. Profiling may involve the extraction, aggregation, storage and/or analysis of data, based on which the aforementioned segmentation is carried out and classifies data subjects according to certain patterns, such as, for example, consumption patterns or reactions to the different actions, promotions and/or new items introduced by the data controller in its business processes.

• Basis of legitimacy: CCP's legitimate interest in optimizing its commercial offerings, aiming them at customers for whom it has legitimate authority to send commercial communications, communications related to products and services customized to their preferences, thus increasing the effectiveness of marketing campaigns. The purpose described for profiling is independent of the purpose of sending commercial communications.
• Data processed for this purpose: Identification data (first name, last name, email address) and other data provided in the application as commercial data (products purchased and likes and preferences).

- Purpose 5 – Own commercial communications.

• Description of the purpose:To send advertising and commercial information, by different means (emails, SMS, push notifications, etc.), about Cepsa and Cepsa's own products and services, similar to those previously contracted/acquired by the application user, for the duration of their previous customer relationship.  
• Basis of legitimacy: legitimate interest of Cepsa, consisting of promoting the contracting of its products and services, in accordance with the requirements and conditions set forth in Law 34/2002, on information society services and electronic commerce.
• Data processed for this purpose: Identification data (first name, last name, email address) and commercial data (products purchased and likes and preferences).

- Purpose 6 – Commercial communications from third parties.

• Description of the purpose: To send advertising communications and commercial information, by different means (emails, SMS, push notifications, etc.) from entities of the Cepsa Group or third parties (always through Cepsa itself, as a result of its collaboration agreements with them), about its activities, products, services, offers, contests, special promotions, as well as documentation of various kinds that may be of interest or useful to the user, related to the sectors of energy, leisure, travel, culture, cards and means of payment, automotive, insurance, distribution and financing, gifts, fashion, home, or technology.
• Basis of legitimacy: User consent. 
• Data processed for this purpose: Identification and contact data (first name, last name and email address).

In relation to those purposes whose basis of legitimacy has been identified as a legitimate interest of CEPSA, the user may contact dpo@cepsa.com for further information on the weighting made between that interest and the right to the protection of personal data of those affected.

On the other hand, in relation to those purposes whose basis of legitimacy had been identified as the consent given by the data subject, the user is informed that they can revoke consent at any time at no cost to them.

To whom are the Personal Data communicated? Are they transferred internationally?

The user is informed that their Personal Data may be communicated to the entities listed below, for the purpose indicated in each case:

• If necessary to provide any of the requested services, to companies of the Cepsa Group, which can be consulted at www.cepsa.es for administrative purposes and management of the relationship with the client, based on CEPSA's legitimate interest to that effect. The legitimate interest for the aforementioned purpose of transfer would consist of guaranteeing better organization and optimization, as well as unified management of the resources of the Cepsa Group in cases in which, internally, it is necessary for the effective execution of the activity undertaken in the Website.
• The Public Administrations and Justice Administration, in compliance with the regulations applicable in each case and always for the legally established purposes.

No international transfer of participants’ personal data is foreseen. However, in the event of any international transfer, it will be carried out in compliance with the criteria and requirements of the regulations in force, through the adoption of appropriate legal guarantees, which may consist of the formalization with the recipient of the data of (i) Standard Contractual Clauses approved by the European Commission to legitimize the international transfer of data to third countries or (ii) in another valid legal instrument that allows guaranteeing an adequate level of protection equivalent to that of the European Economic Area.

If you wish, you may obtain additional information on international transfers by contacting our DPO at dpo@cepsa.com 

How long will the Personal Data be kept?

The personal data supplied will be kept for as long as you are a user of the App and, when applicable, for the entire term of the contractual relations, provided you do not request that they be deleted, and shall not be eliminated insofar as it is necessary to fulfill a legal obligation and to formulate, exercise and defend against claims.

In case of revocation of consent with respect to the processing covered by the same or exercise the right of deletion, the data will be kept blocked at the disposal of the Administration of Justice during the periods established by law to meet the possible responsibilities arising from the processing of the same.

What rights does the user have?

The user is hereby informed of the right to access, rectify, delete or suppress their data, as well as to limit or oppose the processing carried out and not to be subject to automated decisions with legal effects. If consent has been given for a specific purpose, the user has the right to withdraw such consent at any time.

The rights indicated above may also be exercised, under the same terms, by any third party whose personal data have been communicated by the user to CEPSA. The user declares that they have informed said third parties of the rights indicated above and how to exercise them.

To exercise these rights, you must send a written communication to that effect to CEPSA's registered office or to the email address derechos.arco@cepsa.com.

Additionally, the user is informed of the right to request protection from the Spanish Data Protection Agency.

Additional Information 

Permission management.

The App has a Geolocation service whose main purpose is to indicate to the user, among others, the service stations under the Cepsa brand, butane sales points, and Órbita workshops closest to their location. CCP merely provides this service without accessing your location data in any case.

Once you access the application, CCP will offer you the geolocation service that you can accept or reject through the application, based on your preferences. If the App requires permissions to access any other functionality on your mobile device (e.g. call management related to the functionality of contacting Cepsa customer service), your consent will be requested. In any case, you can choose to enable and disable the App permissions from your mobile device in the Settings section of the device's operating system.

Other Cepsa Group services.

The App has functionalities that direct users to the services that they can contract or have already contracted with CEPSA and that require prior registration, such as Porque Tu Vuelves, Cepsa Hogar or the Cepsa Customer Reserved Area. When accessing these services, their respective Terms and Conditions of Use and Privacy Policies will apply, which will be identified on the forms or web pages to which the App will redirect you.