Hotline*0001

TERMS AND CONDITIONS

By signing the said card, the applicant confirms that:

1.     The personal data of the new Energy Card holder specified in the application is correct.

2.     In case of registering a new Energy Card in the customer’s name, the old Energy card (if any) will be canceled automatically, but at the same time, all the data available on the old card (accumulated points, amount of discount,  data of accrued fuel, etc.) will be transferred automatically to the new Energy Card, except for the non-standard discount on natural gas, to transfer the said discount to the new card you should contact us on SOCAR Georgia Petroleum hotline *0001. Also, in case of taking a new card, the special discount shall not be transferred to the new card, in order to transfer it to the new card, the customer must apply to the company to resend his/her data to the relevant department of SOCAR.

3.     In the case of a standard card, the amount of discount on natural gas depends on the amount of consumption of the same product, not on the total consumption of different products. In the case of a standard card, the amount of the discount is calculated once a month, at the end of the corresponding calendar month.

*This term is valid only in case of  natural gas purchase.

4.     The company reserves the right to unilaterally change the amount of the discount, as well as the method of determining the discount and accruing points. In the case of a special discount, the customer who purchases at least 100 liters of one type of gasoline or/and diesel fuel, and 80 m³ in the case of natural gas during the month preceding use of discount, shall benefit from the agreed discount. The minimum fuel purchase obligation does not apply to the month of registration.

5.     Accumulated points can be used until the end of the following year.

6.     The card is active for 3 years after the last operation. After expiry of the mentioned term, validity of the card shall be terminated and it shall be deactivated.

7.     The customer has familiarized himself/ herself with and agrees to the terms and conditions of electronic purchase of fuel with the company’s card and agrees that the company may make amendments  to these terms and conditions at any time.

8.     Read and agreed to the terms of website use.

9.     The customer agrees to participate in various types of raffles organized by the company.

10.  The terms of data processing by the company for direct marketing purposes are detailed in the personal data processing policy.

11.  Prior to entry into force of this agreement, consent or refusal stated from a specific number shall be void.

12.  The company confirms and undertakes to fully inform and explain the rights, obligations and all other conditions provided for in this agreement to those individuals who will directly use/use the company’s Energy Card.

13.  Information about any changes/updates to the Energy Card will be available at www.sgp.ge.

14.  The customer has familiarized  with and confirms by signing  that the authorized persons for  processing his/her personal data are SOCAR Energy Georgia LLC,  address: 24, 300 Aragveli  and BMS Applications LLC,  address: №7, Gr. Peradze str., apt 35.

15.  Processing of personal data specified in the application is carried out by SOCAR Georgia Petroleum LLC and persons authorized to process it for the purpose of using the Energy Card (exchange of accumulated points, receiving informational and promotional SMS messages, etc.).

 

Personal Data Processing Policy

General information about the personal data processing policy

The purpose of the Personal Data Processing Policy (hereinafter - the Policy) of SOCAR Georgia Petroleum LLC (hereinafter - SOCAR) is to promote transparency of processing of your personal data (hereinafter - the Data) by SOCAR within the framework of the Loyalty Program. SOCAR respects and protects basic human rights and freedoms, including the rights to inviolability of personal and family life, personal space and communication.

SOCAR processes your data in accordance with the law of Georgia On Personal Data Protection, for specific, clearly defined purposes and on the grounds defined by the same law.

SOCAR processes only the data that is necessary to achieve SOCAR’s legitimate purposes.

When processing your data, all principles of data processing defined by the law of Georgia on Personal Data Protection are observed.

We protect your data as much as possible and to fulfill this we have implemented appropriate organizational and technical security measures.

SOCAR has a personal data protection officer who helps us to ensure a high standard of data protection in the organization. Personal data protection officer is the main contact person for data subjects, information about which is provided on the sgp.ge website.

The terms used in the policy have the meaning defined by the Law of Georgia on Personal Data Protection.

 

What kind of data we process

We process only the data that you provide to us voluntarily, after receiving the corresponding information, when you take your SOCAR loyalty card and register it. Registration is possible both through the mobile application and the website.

We process the following customer data:

·       Mandatory data:

§   Name;

§  Surname;

§  signature;

§  Personal number;

§  Loyalty card number;

§  Mobile phone number;

§  Password;

§  Information about the transactions made using  the loyalty card.

·       Optional data:

§  Information about gender;

§  Email address;

§  Date of birth;

§  Referral code.

When using our website or/and application, additional data specified in this policy (for example, ready  records “Cookies”) is also processed.

 

How data is processed

SOCAR issues a discount card, called -Energy Card to its customers, through which the card holder can accumulate points and get a discount when purchasing fuel at a SOCAR petrol station. Accumulation of points on the Energy Card is also done when purchasing a product at SOCAR petrol stations. In addition, the card holder can exchange accumulated points for fuel and products sold at SOCAR petrol stations.  

Energy Card is opened at the customer’s request and a certain discount is provided for SOCAR partners. The customer is responsible for the accuracy of the provided information, who confirms the accuracy of the data by signing the application. In the application, the customer indicates the necessary data defined by this policy. Mandatory application fields are marked with so-called Asterisk symbol.

The data obtained based on the application shall be reflected in the Energy Card registration module available on the electronic portal. In addition, the data obtained in the process of issuing the card is also processed through the Energy Card editing program available on the electronic portal, which, among other things, allows you to obtain information about discounts, points, fuel, transaction history and, at the request of the customer, to exchange accumulated points for fuel, as well as data (except for card and personal number) editing.

 

Data processing objectives

Without specifying your data, you will not be able to become a member of SOCAR Loyalty Club and you will not be able to take advantage of the discounts and benefits applicable within the framework of the said program.

The purposes of aforementioned data processing are:

• Encouraging loyal customers and giving them benefits;
• Sending informational and marketing messages to customers;
• In case of using  Loyalty card, providing financial transactions and calculating the points available on the Loyalty card;

 

Grounds  for data processing

Your data is processed according to the relevant legal basis defined by the Law of Georgia on Personal Data Protection.  Grounds for data processing   are:

Data	Purpose	Grounds
Name, last name, personal number, customer password, signature, Loyalty card number, mobile phone number.	Customer regstration, identification[1] and Log in[2]	To fulfill the obligation assumed under transaction concluded with the data subject,[3] to provide services to him/her[4].
Information about transactions made through the Loyalty card.	Loyalty card usage, in particular,  correct accrual of points on the card,  use of accumulated points, correct administration of accrued and spent points. Statistical and marketing analysis.	To fulfill the obligation assumed under the transaction concluded with the data subject[5], to provide services to him/her.[6] To protect the significant legitimate interest of the person responsible for processing[7].
Referral code	Accumulation of additional points on the Energy Card.	To fulfill the obligation assumed under the transaction concluded with the data subject[8], to provide services to him/her.[9]
Information about gender, date of birth.	Statistical and marketing analysis. Implementation of International Women’s Day greetings and gift offers for women.	Data subject consent[10].
Mobile phone number or email address.	Communication with customer. Direct marketing. Receiving information about transactions and balances by the customer.	Data subject consent.
Ready - records (so-called Cookies)	Improving  quality of using the website  or/and  application	Data subject Consent. Protection of important legitimate interests of SOCAR.

Additional data processing through the website and application

In order to protect the important legitimate interest of SOCAR,  to detect possible information security incidents, which is necessary, among others, to ensure integrity of SOCAR electronic systems and maintain continuity of activities - additional data is collected through the website/application.

The date, time and method of customer entry to the website, Internet protocol address, referral and other data reflecting the activities carried out by the customer on the website are recorded on the server.

When using SOCAR website or application, ready-records (so-called cookies) are used. Ready-records are of various types and some of them must be processed in order to protect an important legitimate interest of SOCAR. Ready records that are not processed to protect an important legitimate interest are processed only on the basis of the consent of the data subject. For detailed information regarding ready-records, please refer to SOCAR ready records’ (so-called cookies) policy, which is available on our website.

 

Transfer of data to third parties

In the process of data processing, SOCAR uses the services of  SOCAR Energy Georgia LLC and BMS Applications LLC on the basis of  the respective agreements signed with them. The companies mentioned in the said relationship represent the persons authorized to processing, and SOCAR - the person responsible for processing. Considering the nature of the task to be performed by the mentioned contractor companies, they have access to the customer data obtained in the process of issuing the card.

SOCAR Energy Georgia LLC performs server, network and software management, administration and support of the information base for SOCAR based on its material and technical base.

BMS Applications LLC provides administration, support, development of existing software  and its integration with other systems for SOCAR.

The above-mentioned companies are obliged to comply with the Law of Georgia on Personal Data Protection and to ensure data security.

Cooperation with the aforementioned companies is made  only on the basis of a corresponding written agreement, where data processing and security issues are taken into consideration, including the fact that the person authorized to processing  only processes the data for the purposes of  SOCAR activities. 

Data storage

The data obtained in the process of issuing the card (material application, as well as data reflected in the programs) are stored for entire validity period  of the card, so that the customer can use the card. The application is kept for the purpose of verifying the information specified on the application in case of data inaccuracy and it is a document where the consent of the customer regarding the opening of the card is indicated.

Storage of customer information also depends on use of points accrued on the card. In particular, if data deletion/card cancellation is requested by a customer whose card is not accrued with points SOCAR will delete the customer’s data available in electronic form and destroy the application materially filled out by him/her within 5 days of the customer’s request about deletion. If the customer has exchanged points, the data is stored for 3 years. Information about accumulated points is stored until the end of the following year. And if the card is used only for refueling of a vehicle with natural gas, the data shall be deleted, since no points are accumulated for using this service.

Even if the old card is canceled and the new card is activated, the application made at the time of issuing the old card is not destroyed and SOCAR keeps it until termination of the relationship with the customer, since the application filled in at the time of issuing the old card certifies the period of the commencement of the relationship between the customer and SOCAR.

 

Data security

Data security is ensured in accordance with SOCAR’s information security policy. Corresponding organizational and technical measures are taken to ensure data security on the website and application (including penetration tests, password hashing, use of the principle of least privilege when accessing data for customers whose direct functions and responsibilities include data processing). Data stored in programs can only be accessed from work computers using an internal network. All persons authorized to access have their own, personalized username and password.

The server of the program is located on the server of SOCAR Energy Georgia LLC, which is located in the territory of Georgia. Databases are located on the same server. Data is backed up daily.

The program uses 2 (two) relational and non-relational databases. There is no direct access to the database and its security is protected in accordance with the best international standards.

Entry into the program and access to the database is strictly limited in SOCAR as well as for those authorized to process the data, and access is governed by the principle of least privilege.

Passwords created by customers are hashed.

Actions against all data available in the electronic database are recorded (logging system).

Written agreements signed with persons authorized to process data include issues related to data security.

Customers’ applications about creation of Energy Card are stored in a secure place and access to them is strictly limited.

Effectiveness of the technical and organizational measures taken for security of personal data is regularly checked and evaluated in SOCAR, as well as with the authorized persons indicated above.

Personnel employed by SOCAR are provided with corresponding training related to personal data protection.

SOCAR is served by a personal data protection officer who is involved in all important decision-making processes related to data processing, constantly advising SOCAR and taking care to raise awareness of data protection in the organization.

 

Data subject rights

You are entitled to cancel the Energy Card obtained under the Loyalty program at any time, after which the corresponding service will be terminated. Upon termination of the service, processing of your data shall cease, unless there is a ground for data processing defined by the Law of Georgia On Personal Data Protection and a specific and clear purpose of processing.

Data subject is authorized, at any time, free of charge, without any explanation or justification, to withdraw his/her consent to the processing the data for direct marketing purposes. In this case, at the request of the data subject, data processing for direct marketing purposes shall be terminated. Withdrawal of consent given in connection with direct marketing does not limit your ability to use the Energy Card and receive the corresponding benefits.

Withdrawal of consent is as easy as issuing it: by responding to the received SMS message (so-called sms off) in the same form, by making a request to the official e-mail - info.sgp@socar.ge or to the hotline number - *0001, through the mobile application, website.

SOCAR is obliged to stop processing data for direct marketing purposes (you will no longer receive marketing messages) within a reasonable time after receiving your request, but no later than 7 working days.

Sending marketing messages in the form of SMS is carried out by the authorized third party(ies) determined by SOCAR (the person authorized to processing), within the framework of the relevant contractual relationship, during which protection of your rights is guaranteed.

When processing data for direct marketing purposes, SOCAR records the time and fact of giving consent by the data subject to the processing of data about him/her and withdrawing consent, information about which is kept during validity period of the card.

In the event of termination of data processing for direct marketing purposes, your phone number and email address may be processed again if there is a relevant legitimate purpose and specific basis.

The data subject is also entitled   in accordance with the Law of Georgia On Personal Data Protection and in the cases defined by the same law, to receive information about  processing of his/her data, to request access to the data and to receive a copy, to request updating, correction or completion of the data, to request  termination of data processing or  deletion of data by withdrawing  consent, also to  request data blocking.

In order to exercise your rights, as well as in case of need for any kind of advice regarding processing  your data, please contact our Personal Data Protection Officer: Data Protection Team LLC (e-mail: dptinfo@proton.me).

Restriction of Website User Rights

In accordance with the legislation of Georgia, the above-mentioned rights of the data subject may be limited, if this is directly provided for by the legislation of Georgia, this does not violate basic human rights and freedoms, is a necessary and proportionate measure in a democratic society, and exercise of these rights may pose a threat to:

• State security, information security, cyber security or/and defense interests;
• Public safety interests;
• Crime prevention, crime investigation, criminal prosecution, administration of justice, execution of imprisonment, execution of non-custodial sentences and probation, operative-searching  activities;
• Interests related to financial or economic (including monetary, budgetary and tax), public health and social protection issues important for the country;
• Detection of violation of professional, including regulated profession, ethics norms by the data subject and imposing responsibility on him/her;
• The rights and freedoms of the data subject or/and  other persons, including freedom of expression;
• Protection of state, commercial, professional and other types of secrets stipulated by law;
• Justification of the legal claim or counterclaim.

The measure provided for restriction  of the data subject’s right may be used only to the extent necessary to achieve the purpose of restriction.

When there are grounds for restricting the right, SOCAR’s decision shall be communicated to the data subject so that the purpose of restriction of the right is not harmed.

 

Policy Update

In case of changes in particular issues related to data processing, the policy shall be updated  as necessary.