Privacy policy

Circle K respects your privacy. That is why Circle K has developed this privacy statement, so you would have an overview on how we collect, use, store and share your personal information (personal data).

Who are we?

Alimentation Couche-Tard is a Canadian based group and a world leader in the convenience store sector. In Europe, Couche-Tard, through its Circle K brand, is a leader in convenience store and road transportation fuel retailing in Scandinavian and Baltic countries, Ireland and with a significant presence in Poland and Russia.

All main decisions regarding privacy, personal data protection and other procedures for safe processing of data on a corporate level are taken by senior management and aligned with the Data Protection Officer (DPO) and other appropriate personnel. See “Contact us” page for more information.

The data controller for each Circle K group company is the local business unit who collects the personal data and determines the purpose and means of the processing.

How and when does privacy statement apply?

This privacy statement describes the data processing activities carried out by Circle K in cases where Circle K acts as a data controller, collecting the personal data of customers, suppliers or employees and deciding the purpose and means for the processing. This privacy statement also provides information on how Circle K acts as data processor, meaning how Circle K engages in processing data on behalf of our corporate customers or partners based on the instructions they provide.

This privacy statement applies to all processes in Circle K, including websites, applications (otherwise known as apps), and other products or domains within Circle K- branded services or products. If a different privacy statement to this one is displayed on a Circle K website, application or other product, then that specific privacy statement shall apply.

If you disagree with the actions described in this privacy statement hereinafter, unfortunately, Circle K will not be able to provide you with various services.

How does Circle K act as data controller?

Personal data is any information that relates to an identified or identifiable living individual. Different pieces of information, which collected together can lead to identification of a particular person, also constitutes personal data. Circle K acts as the data controller when Circle K determines the purposes for which and the manner in which personal data is processed.

Processing personal data is necessary for Circle K to prepare for or fulfill contracts we have entered into, provide our customers with services and products, offer them discounts and personalized offers. This includes (but is not limited to) providing you with services through various initiatives, such as Circle K EXTRA Club, private label cards (B2C) cards, Circle K ID and others.

Why we collect your personal data?

Circle K collects and processes personal data about our customers, employees and vendors in order to conduct business and as a means of reaching our strategic goal – to become the world’s preferred destination for convenience and fuel. We collect personal data and process personal data of the following data subjects:

Existing and potential customers

To provide services, manage our customer relations and to deliver on our promises to our existing or potential customers, Circle K needs information on who you are, what is your position as a user of our services and products, and information on how to reach you or what your role is as a contact person. The reasons for processing this information are mainly as follows:

Preparing for and delivering on agreements made with customers and providing requested offers and information to our customers.
Executing and delivering of services stipulated within a contract between Circle K and the relevant party.
Providing support to users of our products and services.
Improving continuously our services through customer feedback.
Preventing misuse of our products and services, including using CCTV for that purpose.
Ensuring health, safety and environment standards.
Invoicing, processing of purchases, making payments and conducting other financial tasks.
Providing offers on products and services to our customers, based on such as Circle K EXTRA Club, private payment cards, B2B cards, private label cards, Circle K ID portal, or other.
Managing credit enquiries for users who have applied for Circle K cards that require credit assessments.
Administrating and managing bulk orders.
Providing opportunities to participate in various marketing activities organized by Circle K.
Creating profiles of customers in certain cases to promote more relevant products or services for specific customers.

To reach out to larger markets, we shall pursue our legitimate interest and also process data on potential customers in direct marketing initiatives. To provide relevant content to potential customers, Circle K shall process personal data of potential customers that were collected during sales negotiations or when a person had expressed interest in receiving offers from Circle K.

The legal basis for the abovementioned activities are consent, contract and legitimate interest, however you can be assured that any electronic direct marketing message you receive, will come with an option to opt-out of future marketing communication. If by any chance such option is not provided, please do not hesitate to contact our customer service and let us know – see “Contact us” page for more.

Existing and potential employees.

If you are an employee, we shall process your personal data to fulfill the contract with you and to comply with statutory regulations, such as labour laws, tax laws, and other regulations. We shall do so on the basis of contract and legal obligation and ensure appropriate retention periods for processing such data.

If you are looking for job opportunities within Circle K, we will process your personal data in order to evaluate your skill relevance for the position for which you apply. We shall do so on the basis of your consent and will ensure appropriate retention periods for processing such data.

You can get more information about retention periods for different categories of data from the HR business partner in the respective Circle K business unit.

Vendors and partners.

We will process the personal data of individuals who are representing our vendors, suppliers and business partners on the basis of pursuing our legitimate interests of acquiring new partners and new markets, as well as to fulfill the contracts that Circle K has with those parties.

Where we conclude a sales contract with a company to sell our products or offer services, we might collect and process limited amounts of personal data (such as name, address, social security number) about the employees or other representatives of such company to fulfill the contract. The legal basis for such processing is legitimate interest and we only process personal data for the purpose of fulfilling the contract with our customer and for the period the contract is effective and any applicable statutory retention period after contract expiry.

Visitors to the office or our service stations.

In order to comply with HSE (health, safety, environment) standards, and pursue our legitimate interests, protect our business secrets, employees, customers and others, we may process your personal data by deploying CCTV surveillance within our support office premises, other facilities and fuel station forecourts and convenience stores. Individuals shall be informed via notice when such activity is taking place. CCTV surveillance hardware shall be stored for the retention period of no more than 60 days unless it is required for legal purposes.

In addition to that the above, to protect our premises, employees and confidential information – we monitor access to our support office premises. We will process personal data of visitors to our support office premises and other facilities by registering them in our visitor system. Visitors shall be informed via notice when such activity is taking place.

Legal basis.

Any personal data processing is not allowed without an appropriate legal ground as per the General Data Protection Regulation (GDPR) article 6. Therefore, we at Circle K apply one of the following legal grounds as defined in GDPR to any processing of your personal data:

Consent: the individual has given clear consent for us to process their personal data for a specific purpose. Consent can be withdrawn at any time.
Contract: the processing is necessary for a contract we have with the individual, or because they have asked us to take specific steps before entering into a contract.
Legal obligation: the processing is necessary for us to comply with the law (not including contractual obligations).
Vital interests: the processing is necessary for us to protect someone’s life.
Public task: the processing is necessary for us to perform a task in the public interest or for our official functions, and the task or function has a clear basis in law.
Legitimate interests: the processing is necessary to pursue our legitimate interests or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.

How we collect your personal data?

In general, Circle K collects your personal data directly from you, meaning you have freely provided this data to us in order to receive certain products or services, or to enter into contract with us. Sometimes we might collect information on you from persons directly linked to you – for example, your manager providing your work contact information to us as a point of contact. We may have your images recorded on our CCTV camera systems.

We also use cookies and other tracking technologies in Circle K branded websites to provide generic online services. We collect information that the user actively sends to us via our websites, apps and services, such as name, email and phone number. We also collect data on how our users interact with our websites and apps. In addition to this, we also collect information from your computer or device such as the IP address, the internet browser you use and language settings. This data is collected via services, such as and not limited to Google Analytics Solutions. With your consent, the apps also allow you to use location services for services such as finding a nearby Circle K station or track your drive, and send you push notifications.

In other cases, we may also collect information on you from other sources. These sources may vary, but usually they are Circle K’s marketing partners, public sources or public information from social networks from a third-party. Circle K may combine data acquired from one source together with data obtained from another source. This is only done to ensure data accuracy, and to have an understanding of you that represents reality, so we can offer you more relevant products and have a more personalized approach.

With whom is your personal data shared?

Intragroup data sharing.

Intragroup data sharing means that your personal data is shared across legal entities under the Circle K brand, which means while the legal entity holding the data may change, the data still remains within Circle K systems and protected in compliance with applicable standards. Circle K is a branded group that consists of many different subsidiaries across Europe, therefore it is likely that a customer will engage in business with more than one Circle K legal entity.

Circle K is focused on providing only the best to our customers, and delivering our promises to those who use our products and services. Hence it is important to maintain a correct overview of the customer profile; and to deliver the best service we shall share personal data of our customers amongst our Circle K subsidiaries in Europe or the European Economic Area.

We do not transfer your personal data to Circle K subsidiaries outside of European Union or European Economic Area. However, if we need to transfer your personal data to other Circle K entities outside of EU/EEA, we will make sure there are special safeguards in place to protect your data.

Data sharing with external parties.

Circle K may use third party service providers to help us to administer certain activities on our behalf, such as fulfilling purchases, processing credit card payments, performing credit checks, sending emails and post, providing advertisements, tracking effectiveness of our marketing campaigns and analyzing usage of our websites and apps, or even allowing users to connect to their social network. As such, to execute such services we may have to share personal data about you with our business partners, but only to the extent necessary to perform the services they carry out on our behalf, and making sure that they comply with data protection rules.

Circle K might share your personal information with external parties in the following cases:

Our suppliers, vendors and business partners.

We may share your personal data with our business partners or suppliers if there is a legitimate interest in so doing from a business management perspective and where statutory regulations allow us to do so, or when you have consented to such exchange of data. For example, some of Circle K’s server storage spaces may be rented from one of our certified suppliers. Thus, technically some of the personal data may be shared with external providers. Another example: you purchase service or product that Circle K provides to you through a partner. In situations like these, Circle K and the appropriate business partner may share your personal data in order to provide you with the service or product.

Public authorities.

Public authorities such as internal revenue services, police, courts, or other government institutions may ask Circle K to provide them with any data we hold about you. In such cases, Circle K will comply with requests from public authorities and government institutions only if there is sufficient legal basis to fulfill such request.

User communities.

If you engage in commenting or expressing opinions on Circle K user communities or pages on social networks, where such information can be seen and used by anyone with access to such community, for purposes that are beyond the control of Circle K, Circle K carries no responsibility for any content you submit on such communities.

Automatic data processing and profiling tools.

Circle K branded websites use automatic data collection tools and Circle K engages in using digital tracking technologies to collect information about your movements and interaction with our websites.

Cookies.

A cookie is a small piece of text sent to your browser by a website you visit. It helps the website to remember information about your visit, like your preferred language and other settings. That can make your next visit easier and the site more useful to you. Cookies play an important role. Without them, using the web would be a much more frustrating experience. Due to their core role of enhancing/enabling usability or site processes, disabling cookies may prevent users from using certain websites.

By using Circle K branded websites or applications you consent to storing and accessing of cookies. We use cookies on our websites to identify users as unique but anonymous individuals. It helps us to register the number of visitors and gives us statistics and information about how many users we have on our websites and what they do. We use the statistics to best be able to simplify and clarify the page and make it as user friendly as possible.

For our apps we use Identifier for Advertising (IDFA) for iOS and Google Advertising ID (AAID) for Android. All this data is collected anonymously, meaning that we cannot connect the data to an individual user or authenticated user through our authenticated online services.

Google Analytics services and reCaptcha.

Circle K branded websites and applications use Google Analytics to collect data on how our users use our websites and apps. This data is mainly collected through services provided by Google Analytics whose terms and conditions apply.

To protect against inappropriate usage we may use Google Invisible reCAPTCHA that collects hardware and software information, such as device and application data and the results of integrity checks, as well as unique online identifications such as IP address, and send that data to Google for analysis.

By using this service, you are consenting to providing the personal data to Google Analytics for integrity checks and for implementing measures necessary for safe use of the webpage only.

Third-party social network cookies.

Third-party social networks that provide interactive plug-ins to enable social network features – for example to allow you to connect to Facebook – on Circle K branded websites or applications may use cookies to gather information on your use of our websites and applications. How this collected data is used by third parties is dependent on the privacy policy of the social network which is available on the appropriate parties’ website. Circle K encourages you to review the privacy policies of third parties as well.

Third parties involved may use these tracking methods such as but not limited to cookies to achieve their own business goals and purposes by relating and combining information about your usage of our sites or applications to any other personal data they may have collected on you. We may also obtain and use analytical and statistical information from third-party social networks to help us measure performance and effectiveness of content we display on social networks, for example, by measuring impressions and clicks on the content Circle K promotes.

Third Party Services and social media channels where we are present are governed by the privacy policies of the respective services.

Robotics process automation.

Robotic process automation (RPA) is the application of technology that allows employees in a company to configure computer software or a “robot” to capture and interpret existing applications for processing a transaction, manipulating data, triggering responses and communicating with other digital systems.

RPA is a rule-based virtual employee that imitates the actions of another business user to execute the same tasks and processes by connecting to business systems and applications.

Circle K mainly uses RPA software to assist our personnel with credit assessments on customers who have applied for Circle K credit payment cards. Credit assessments are done based on applicant’s consent or company’s legitimate interest, and can be replicated by Circle K personnel. RPA software would not make any decision that a Circle K employee wouldn’t make, thus this software is used only as a tool to save our employee time so they can focus on delivering better services to our clients.

You have the right not to be subject to automated decisions and request that such automated task is performed by a person.

What kind of personal data does Circle K collect and process?

Circle K may process the following personal data on you:

General information and contact details like name, surname, telephone number, e-mail and address.
Demographic data such as date of birth or gender.
Information on national identification number.
Feedback on our services and products.
Various requests from you to our customer service centre.
Photos or videos of you recorded within our support office premises, other facilities, service station forecourt or convenience store premises.
Content you upload to our websites, apps and social network pages, such as photos or videos.
Applications to our services which are provided on a contractual basis.
Financial information, such as your bank account information, credit card information, or credit rating.
Tracking information actively sent to us via our websites, apps and generic online services. This includes information such as IP address, the internet browser you use or language settings.
Unique user information such as login ID, password, security questions.
E-mail behavior, meaning we analyze whether you open e-mails sent to you from Circle K or not.
Shopping behavior based on your purchases in our stations using your Circle K card.
Previous employment and education information, such as title, position, responsibilities, background, interests in professional context.
Information you have made public and have freely given away on third party-party social networks.

As a controller, Circle K does not process sensitive personal data to provide you with goods and services, however in some cases processing such data is a requirement for us to comply with legal as well as ethical obligations. Sensitive personal data may mainly be collected in the following cases:

If you are an employee who is on sick-leave, we might process some sensitive personal information regarding your health life as is dictated by labour law and we shall do so within the legal framework of each respective country where the subsidiary employing individual is located.
If you are an individual who have had an incident within our premises, we might be obliged to process data on your health life to comply with HSE standards, as well as to record such incident to avoid it in future.
If you are a customer who believes health issues are caused by food poisoning or other hazard from our products, we will be obliged to process sensitive personal data.

How does Circle K safeguard your personal data?

Personal data within Circle K is processed in a safe and secure manner. At Circle K we do our best to make sure any IT systems that are built, integrated, purchased or in general – used in Circle K – abide by the privacy by design principle to maximize safe and secure processing of personal data. We use encryption and pseudonymization where appropriate. We limit access to personal data to those persons who have need for it. We have guidelines, policies and training available for employees processing personal data in Circle K.

When we need to use a processor for processing personal data we very closely evaluate the business partners we share your personal data with to make sure they comply with applicable data protection legislation. In addition, to impose the data processing standards, Circle K requests those business partners acting as processors, (Circle K acts as the controller) – to sign personal data processing agreements with Circle K. Through that, each processor enters a binding agreement and promises to ensure safe and secure information practices.

Personal data is not processed longer than necessary. Circle K’s standard retention policy is 6 months, however the retention period may vary based on agreements, legitimate interests of Circle K, or statutory requirements regulating otherwise (for example, archiving laws, anti-money laundering laws, and other). If you have any specific questions, please do not hesitate to contact our customer service – see contact page for more information.

Circle K abides by the data minimization principle, and makes sure that when providing you with products and services, only the minimum amount of personal data is collected which is needed for the execution of service or delivery of product.

When does Circle K use processors?

Circle K may use third party service providers as processors for personal data for the following purposes: mailing of invoices and marketing materials; printing and mailing payment cards; data storage; handling customer relations; providing CCTV solutions; performing credit rating checks and debt collection; employee data management, recruitment and health services and similar. List of personal data processors can be requested from the relevant Circle K business unit.

What are your rights and how to use them?

You have the right to request access to the personal information we hold about you. We do, however, need to be sure of your identity before we release any such information. You have the right to object to personal data processing, withdraw consent, request erasure or rectification of your personal data or object to personal data processing and rights to data portability.

If you want to request access to your data, erase or rectify the data, or object to personal data processing, or exercise your rights of data portability, please contact our customer service centre.

If you are browsing the web and if you prefer not to have any personal data processed by your visit to our web-site through cookie services, we advise you to turn on private browsing in your web browser. If you are using our app, you can delete the app from your smartphone (as you are complying with privacy policy by using our app).

Finally, you also have a right to file a complaint with the data protection authorities with regard to our processing of your personal data.

Contact us.

You may contact our data protection officer by sending e-mail to privacy@circlekeurope.com or sending a letter to Data Protection Officer, Circle K AS, Pb 1176 Sentrum, 0107 Oslo, Norway.

For any inquiries please contact your local Circle K customer service.

Changes to this statement.

We may periodically update this statement. For visitors to our websites, an updated statement will always be available on the website. For app users, an updated statement will always be available via respective app store.

This privacy statement is effective as of May 25^th 2018.