VOICE OF CUSTOMER - Data Protection Notices

General Information

a) Introduction
The following data protection notices are intended to inform you about the processing of your personal data and your rights according to the General Data Protection Regulation (GDPR) and similar applicable data protection laws relating to this processing.

b) Data Controller
We, METRO Pakistan Private Limited are the data controller according to GDPR, and thus responsible for the outlined data processing.

Insofar as we are exceptionally jointly responsible with other METRO companies, this is indicated accordingly below. General information on joint responsibility between METRO companies can be found at: https://www.metroag.de/de/datenschutz/jointcontrol

c) Data Protection Officer
You can contact our data protection officer at any time at the following contact details:
METRO Pakistan Private Limited, Data Protection Officer, 2-KM, Multan Road, Thokar Niaz Baig, Lahore, e-mail: [maria.tahir@metro.pk].
​

Information regarding the Processing of Personal Data

Customer Surveys

​You are receiving this customer survey because you gave us your consent to receive these surveys as part of the customer registration process or at any other convenience. Your consent comprised the respective channel on which we are contacting you, e.g. by e-mail, SMS or push notification via our Companion App. Sending this customer survey to you is therefore based on Art. 6 s. 1 p. 1 lit. a) GDPR. You can withdraw your consent with future effect at any time, for example by sending an email to feedback@metro.pk

When responding to the survey, you have the option to provide your consent to allow us to call you to discuss the details of your responses to the survey and to share your customer experience with us. In this case, the processing of your personal data is based on Art. 6 s. 1 p. 1 lit. a) GDPR. You can withdraw your consent with future effect at any time, for example by sending an email to the email address as set out above.]

We process your personal data, which we collect as part of the customer registration process, business transactions and callback, for the purpose of performing this customer survey and customer satisfaction research, which helps us to improve the services that we offer to our customers. This may include your name, business name, position in the company, gender, language, email address, telephone number, mobile phone number, postal address, card and customer number, customer and cardholder segment and categorization, transaction data, delivery number, transaction date and time, purchased product groups, visited stores and invoice total. This also includes the responses you provide.

Your personal data is transferred to METRO AG, the group holding company, where central functions of the METRO company group are placed, as joint controller (with control limited to the execution of these central functions). Central functions support and advise country units in the functions’ respective field. Central functions therefore need access to survey information on customer level in order to analyze the customer feedback properly and to derive appropriate measures from this. Overall purpose of the data processing from METRO AG central functions is learning and improving from customer feedback, in the respective fields of each individual central function. Please note that one of the central functions is the global customer experience team which supports country units in setting up and handling this survey process. The global customer experience team may also use the personal data for administration and evaluation purposes, in order to support and improve the survey process as such.

Your response may further be used to analyze our customer satisfaction process as such on a superior level, by way of examining the relations between answered surveys of customers over a period of time and their purchasing behavior, detecting the impact the survey might have on customers and whether survey feedback is processed properly.

The processing of your personal data is strictly limited to internal and confidential use. The results of this survey in public domains may only be published in anonymized and aggregated forms. The processing is legally based on Art. 6 s. 1 p. 1 lit. a) GDPR. Your participation and responses to the survey are voluntary. You are neither obliged to provide your personal data to us, nor is this provision necessary to fulfil a statutory or contractual requirement or a requirement necessary to enter into a contract. If you do not provide your personal data to us for this purpose, this will not result in any consequences for you.

Should your response include a specific business request, we use your personal data including your contact details for processing the request. This also applies if your response indicates a specific complaint. In this case we may need to contact you to process and remedy the complaint. Your personal data are therefore processed for the purposes of managing our business relationship to you and complaint management. In each case the processing of your personal data is legally based on Art. 6 s. 1 p. 1 lit. b) GDPR.

Your personal data will be retained for as long as your consent is valid, except where we are legally obliged by law to further retain your data for the purposes of submitting it to public authorities, for example to tax authorities. The retention is based on Art. 6 s. 1 p. 1 lit. a) GDPR or, in case you have submitted a business request or a specific complaint, it is based on Art. 6 s. 1 p. 1 lit. b) GDPR. The retention and transmission of your personal data to authorities for the purpose of fulfilling a legal obligation is based on Art. 6 s. 1 p. 1 lit. c) GDPR.

Your above-mentioned personal data will be transmitted to an external service provider, who contacts you for the customer survey and analyses your feedback on our behalf. This data transmission includes a transmission into countries outside the EU and the EEA. The data transmission is based on appropriate security measures, i.e. the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. You can make an informal request for further information or copies of these protective measures to our data protection officer at the contact details listed above.

Your Rights

As the data subject, you can contact our data protection officer at any time by sending an informal communication to the contact details mentioned above to exercise your rights according to GDPR. These rights are as follows:

• The right to receive information about the data processing and a copy of the processed data (Right of access, Art. 15 GDPR).
• The right to demand the rectification of inaccurate data or the completion of incomplete data (Right to rectification, Art. 16 GDPR).
• The right to demand the erasure of personal data and, if the personal data has been made public, the information towards other controllers about the request of erasure (Right to erasure, Art. 17 GDPR).
• The right to demand the restriction of the data processing (Right to restriction of processing, Art. 18 GDPR)
• The right to receive the personal data concerning the data subject in a structured, commonly used and machine-readable format and to request the transmittance of this data to another controller (right of data portability, Art. 20 GDPR)
• The right to object to the data processing in order to stop it (Right to object, Art. 21 GDPR)
• The right to withdraw a given consent at any time to stop a data processing that is based on your consent. The withdrawal has no affect on the lawfulness of the processing based on the consent before the withdrawal (Right of withdrawal, Art. 7 GDPR).
• The right to lodge a complaint with a supervisory authority if you consider the data processing to be an infringement of the GDPR (Right to lodge a complaint with a supervisory authority, Art. 77 GDPR).

Information about your right of objection according to Art. 21 GDPR
You have the right to object at any time to the processing of your data on the basis of Art. 6 s. 1 p. 1 lit. f) GDPR (data processing on the basis of a balance of interests) if there are reasons for this arising from your particular situation.
If you object, we will no longer process your personal data, unless we can prove compelling and applicable reasons for the processing, which outweigh your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
The objection can be made without formality and should be addressed to our data protection officer.

Due to possible changes in the processing described above or the relevant laws, a change of these data protection notices may be required. In this case, we will inform you about such changes. Insofar as the changes affect a processing which is based on your consent, we will ask you for a new consent, if necessary.

v 2.0