Customer Privacy and Cookie Policy

Customer Privacy Policy – Avolta

This Privacy Policy explains how Dufry International AG (“Avolta”) and its affiliated companies (collectively, “Avolta Group”) collect, use, and protect personal data pertaining to you, as one of our customers (“Customers”). This applies when you use our mobile applications (such as the Club Avolta App if you are a member of Club Avolta loyalty program or other mobile applications, collectively “Apps”), visit our websites (“Websites”), when you visit or make purchases at our stores, use our Reserve & Collect service, or when you otherwise purchase or make use of our products or services (collectively, “Services”). 

For information on how we use cookies and similar tracking technologies on our online services or tools, please refer to our Customer Cookie Policy, or to the Cookie Policy otherwise made available to you in the Apps or Websites you are visiting. The Cookie Policy provides details on the types of cookies we use, their purposes, and how you can manage your preferences. We do not currently respond to browser do-not-track signals, unless required by law.

Please note that, depending on your location, you may have some additional rights or there may be more specific information of which you should be aware. Please review the “Country Specific Information” below to see if any applies to you. 

1. Who is the data controller? 

The entity responsible for the processing of your personal data is Avolta. Avolta determines the purposes and means of the processing activities described in this Privacy Policy, including those related to your contractual relationship with Avolta and your participation in our loyalty programs (such as Club Avolta), if you are a member.

At the same time, please note that if you visit the Website of another entity of the Avolta Group, purchase or make use of our Services at a store operated by another entity of the Avolta Group, or if another entity of Avolta Group otherwise collects your personal data (e. g., through the store’s CCTV system), that entity will be responsible for processing your personal data. 

Avolta or the respective entity of the Avolta Group determines the purposes and means of your personal data processing and therefore acts as the data controller(s) for your personal data (referred to in this Privacy Policy as “Company,” “we,” or “us”). The Company is responsible for ensuring compliance with applicable data protection laws in its jurisdiction regarding the processing of your personal data.

For any doubts regarding the specific contact details and / or the identity of the data controller for your personal data, please reach out to us by using the contact details in Section 9 below (“How can you contact us?”).

Please note that this Privacy Policy does not create contractual rights or obligations.

2. What personal data do we process? 

The Company processes different types of your personal data, to the extent permitted under applicable laws and for the purposes set out below in Section 3 (“Why and how we use your personal data?”). If you do not provide certain personal data when requested, we may not be able to enter into or perform a contract with you or we may be prevented from complying with our legal obligations. At the time of data collection, we will indicate whether the data collection is optional and what are the consequences of failing to provide us with that personal data. 

In particular, depending on your interaction with us (e.g., whether you are a member of our loyalty programs or whether you are not a member but visit one of our stores), we collect and process the following categories of personal data: 

- Personal identifiers and contact information: your name, surname, contact details (e.g., email address, phone number), customer ID (if you are a member of one of our loyalty programs), flight number, Passenger Name Record (PNR), flight destination and passport number (when you make purchases at our stores). If you choose to participate in one our surveys following your visit to one of our stores, we also collect your nationality, age, reason for the visit, and the store that you have visited;

- Transaction information: information about the products you buy, their prices, payments methods and other personal data necessary to process your payments (e.g., last digits of your credit card / payment instrument information) for purchases online or in store;

- Account information: if you have set up an account on our Websites or signed up on our Apps, we will also process your username and password;

- Other personal data: any additional personal data that you provide to us when you interact with us or use our Services (e.g., when you reach out to us by email, telephone, or when you make a request or interact with our customer support service);

- Browsing data and other information: this includes information that is automatically collected by the Website and / or Apps as part of their routine operations, such as user interactions, events, demographic properties, traffic source information, session data, conversion data, ecommerce data and aggregated metrics;

- Images: if you visit our stores, we also collect your images caught on camera by our CCTV systems (where these are present). 

Sensitive Personal Data

Generally, we do not intentionally collect or process personal data revealing your racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic data, biometric data for uniquely identifying purposes, or data concerning your health, sex life, or sexual orientation (“Sensitive Personal Data”). We therefore kindly ask you to refrain from sharing any Sensitive Personal Data with us. Please note that, should we receive personal data that qualifies as Sensitive Personal Data, we will proceed with the immediate deletion of such information.

3. Why and how we use your personal data?  

(i) Why we process your personal data and on what grounds? 

We process your personal data for the following purposes and on the following legal bases:

- Providing you our Services – We will process your personal data for the provision of the Services that you have requested, under the terms of our contractual agreement with you. This includes the processing of your personal data for the establishment and subsequent management of our contractual relationship with you, such as the management of your account (if you have set up one on our Websites or Apps), loyalty program management and the sending of communications related to the performance of such contractual relationship. This also includes communications to assist with your shopping experience, such as reminders about products you have added to your shopping basket and other notifications regarding your orders. The processing of your personal data for this purpose is based on the necessity to perform and manage our contractual relationship with you;

- Responding to your inquiries and support requests – We will process your personal data to respond to requests for information or support requests you may have. The processing of your personal data for this purpose is based on the necessity to perform and manage our contractual relationship with you; 

- Complying with legal obligations – Your personal data is processed for the purpose of meeting our legal obligations, including recordkeeping and internal and external reporting requirements under various global legal frameworks. This also includes compliance with any other applicable legal requirement in the relevant jurisdiction (e.g., tax obligations, or responding to legal requests from competent authorities). The legal requirements to which we are subject serve as the legal basis for the processing of your personal data for this purpose; 

- Protecting our interests and those of third parties – Where needed, your personal data may be used to investigate and address legal claims or to otherwise protect our rights and interests and those of third parties in legal proceedings, as well as in pre-contentious situations. This purpose also includes the processing of your personal data for ensuring the security of our systems and premises, for reporting potentially illegal activities perpetrated against us, and for preventing or detecting any abuse or fraudulent activity against us. This includes ensuring compliance with the terms and rules of our loyalty programs (such as Club Avolta), if you are a member. The processing of your personal data for this purpose is based on our legitimate interest, or another adequate legal basis depending on the specific jurisdiction, in protecting our rights and those of third parties; 

- CCTV – When you visit our stores, we may process your personal data through our CCTV systems (where these are established). The purpose of CCTV usage is to ensure the safety and security of our property, premises, and staff, as well as to prevent and detect criminal activities. The recording of CCTV footage is based on our legitimate interest, or another adequate legal basis depending on the specific jurisdiction, in maintaining security at our locations; 

- Marketing – We may process your personal data to send you personalised communications or notifications promoting our Services via email, SMS, WhatsApp, push notifications, or WeChat (where applicable). Additionally, we may contact you to conduct market research, invite you to participate in customer satisfaction surveys, or seek your opinion on our Services. Please note that you have the option to specify your preferred contact channels when providing your consent. Additionally, you can update your preferences at any time by accessing the Preference Page or the dedicated area of your account (if you are a registered user), as detailed in Section 9 (“How can you contact us?”). This processing is based on your prior consent. Please note that in certain jurisdictions, we may be able to send you marketing communications related to products and services similar to those you have already purchased without the need to collect your prior consent, subject to your right to object to such communications. With your consent, we may also use your travel details, including information from your Passenger Name Record (PNR), to offer you personalized travel services and offers while you navigate our Websites or use our Apps;

- Customer satisfaction surveys and Services improvement – If you voluntarily choose to participate in one of our customer satisfaction surveys (in particular, by scanning the QR available at one of our stores), we also process your personal data to collect your opinion and evaluation of our Services. The processing of your personal data for this purpose is based on our legitimate interest in collecting your feedback to improve our Services; 

- Mergers and acquisitions – Your personal data may also be processed in connection with corporate transactions we may undertake, such as mergers, acquisitions, or the sale or transfer of all or part of our assets or business, including the related due diligence process. The processing activities conducted for this purpose are based on our legitimate interest in conducting and managing such corporate transactions. 

Where required by applicable law, we have carried out balancing tests for the data processing based on our or a third party’s legitimate interests to ensure that such legitimate interest is not overridden by your interests, fundamental rights, or freedoms. For more information on our balancing tests, you may reach out to us by using the contact details in Section 9 below (“How can you contact us?”). 

Please also note that, in certain jurisdictions, we may need to seek your consent before conducting one or more processing activities described above, where so required by applicable local law. 

(ii) How we process your personal data 

Your personal data will be processed by the Company by electronic means as well as by organized filing systems of hardcopy documents.

Currently, we do not use automated decision-making processes or profiling in the context of Customers processing activities that may produce legal effects and that may otherwise significantly affect you.

4. Where do we collect your personal data?  

Your personal data may be collected: 

- Directly from you (e.g., when you sign up on our Websites or our Apps, submit queries or responses to our customer satisfaction surveys, or otherwise communicate or interact with us); 

- Automatically from your interaction with us (e.g., when you browse our Websites or use our Apps); 

- Information from other sources and, in particular, from other Avolta Group entities, from our partners, and, where applicable, service providers. 

Third parties sharing your personal data with us are required to have a legal basis for doing so: once received, we process your personal data according to this Privacy Policy and any applicable laws.

5. With whom do we share your personal data? 

Where necessary for the Company to offer its Services to you, to perform its contract with you, and for the other purposes described in this Privacy Policy, we may share your personal data on a strict need-to-know basis with other entities within the Avolta Group. This sharing will occur only where it is lawful and required for the purposes outlined in Section 3 above (“Why and how we process your personal data?”). 

Additionally, we may share your personal data with the following categories of recipients globally, in accordance with applicable data protection laws:

- Avolta senior management, legal department, compliance personnel, and human resource managers and staff for any of the purposes described in Section 3 above (“Why and how we process your personal data?”);

- Governmental organizations or agencies: including law enforcement, immigration authorities, and port/airport/railway authorities in various countries, as required by law or for security clearance purposes. This includes applicable tax, and mandatory fund administrators;

- External advisors: such as legal counsel and auditors operating internationally or in specific regions. This also includes financial consultants and professional advisers;

- Commercial partners: only if permitted by applicable laws and with appropriate safeguards in place. This includes Avolta Group service providers or other third parties where this is helpful to developing the business (for example, to compete for, or meet obligations under, an existing or possible contract);

- Airport authorities or other operators or landlords who govern your access to their premises at secure locations at the airports or other venues and require restricted access rights to be administered by such authorities to allow such access to be granted to you;

- Third-party service providers: These include vendors that assist us in operating our business and in offering and providing our Services, such as providers of information technology and IT support services, marketing agencies, and other service providers connected to or supporting the provision of our Services. These providers process personal data on our behalf under strict contractual agreements that ensure data security and confidentiality in line with global best practices and local legal obligations. These providers generally act as data processors on our behalf;

- Judicial authorities, arbitration tribunals, and counsel and advisors involved in the relevant litigation or dispute (where applicable);

- In the event of a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, purchase or sale of assets, or transition of service to another provider, your information may be sold or transferred as part of such a transaction, as permitted by law and/or contract.

In addition, we may provide data to a third party if we believe in good faith that we are required to do so for legal reasons or that this is necessary to prevent harm or injury to us, our staff, users or members of the public, or if we need to do so to defend our legal rights. For example, we may provide personal data if we are ordered by a court to do so.

The Company takes appropriate measures to ensure that anyone receiving your personal data maintains its confidentiality and security in accordance with global standards and local requirements.

6. For how long do we retain your personal data? 

Our retention policies require that personal data be retained for no longer than required to fulfil the purposes for which it was collected.

In general, the following criteria apply: 

- Personal data that is collected in connection with the provision of our Services to you is retained for the time strictly necessary to manage our contractual relationship with you and for the time permitted by applicable laws to protect our interests (including any statutory limitation periods for potential claims arising from that relationship, which is generally set in ten years);

- Personal data processed in compliance with the legal obligations to which we are subject will be kept for the period required by law;

- Personal data processed in the context of surveys that we conduct to understand your level of customer satisfaction or to otherwise collect your feedback and opinion on our Services will be anonymized and aggregated, once the individual analysis of your responses is complete; 

- Personal data processed to protect our interests and those of third parties is kept for the time permitted by applicable law to protect our interests and those of third parties;

- Personal data processed on the basis of your consent is retained for as long as we maintain your consent to such processing activities, unless a shorter retention period is applied in accordance with our policies and applicable legislation; 

- CCTV footage is typically retained for the time permitted by applicable law and unless a longer retention period is justified for the purposes of detecting or investigating potential security threats at our locations or where so requested by competent enforcement authorities according to applicable law.

Please note that the retention periods indicated above may be subject to changes and adjustments in specific jurisdictions, as needed to comply with applicable legal requirements. In specific circumstances, and in accordance with applicable law, the Company may also retain your personal data for longer periods of time (such as for the duration of the relevant statute of limitation), so that we have an accurate record of your conduct in the event of any dispute. In all cases, where your information is no longer required, the Company will ensure it is disposed of in a secure manner.

For more detailed information on the retention periods that we apply to the different data categories, please reach out to us by using the contact details provided in Section 9 below (“How can you contact us?”).

7. Do we transfer your personal data outside your country/region? 

As a global multinational company operating worldwide, we may need to transfer your personal data to countries outside your country or region. This may occur, for example, when the entities of the Avolta Group or its service providers are located in other countries that may have different data protection laws than your country of residence. 

For all such international transfers, we implement appropriate safeguards or other transfer tools in accordance with applicable data protection laws, including but not limited to:

- Standard contractual clauses approved by relevant authorities (e.g., the European Commission's EU Standard Contractual Clauses) alongside any necessary supplementary measures where applicable;

- Adequacy decisions adopted by the European Commission or other competent body in the relevant jurisdiction under which it is established that the recipient country provides an adequate level of data protection;

- Any other lawful transfer mechanisms as permitted by local laws, including, where so required, your consent to the transfer (in which case we will take appropriate steps to seek your consent).

We will also implement any necessary supplementary measures to ensure that your personal data receives an adequate level of protection in the recipient country, in accordance with applicable legal requirements. We will also be mindful of any data localization requirements in specific regions.

8. What are your rights? 

Depending on the data protection laws applicable in your jurisdiction, you may be entitled to exercise the following rights by contacting us as specified below in Section 9 (“How can you contact us?”):

- Access: to obtain confirmation as to whether or not your personal data is being processed and to access such personal data;

- Rectification: to request the correction of inaccurate or incomplete personal data;

- Erasure (or “right to be forgotten”): to request the deletion of your personal data;

- Restriction: to request the restriction of the processing of your personal data; 

- Data portability: to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another data controller;  

- Object: to object to the processing of your personal data in certain situations, based on relevant grounds related to your particular situation, which you believe must prevent us from processing your personal data;

- Withdraw consent: to withdraw your consent (if the processing of your personal data is based on your consent under applicable law), at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

You also have the right to lodge a complaint with the relevant data protection supervisory authority in the country of your habitual residence, place of work, or place of any alleged infringement, if you believe our processing of your personal data infringes applicable laws. Depending on the specific laws applicable in your jurisdiction, you may also be entitled to the right to claim compensation for the damages arising from the unlawful processing of your personal data.  

The specific rights available to you may vary depending on your location and the applicable data protection laws.

9. How can you contact us? 

If you wish to exercise your rights or to otherwise request additional information on the processing of your personal data, you can contact us by sending a written request to the following e-mail address: privacy@avolta.net or to the following postal address: Dufry International AG, Brunngässlein 12 Basel, 4052 Switzerland Attention: Global Data Protection Officer. 

Regarding marketing communications, you may also adjust your preferences through our Preference Page. If you are an authenticated user (i.e., you have set up your account on one of our Websites or on our Apps), you may also adjust your marketing preferences by using the dedicated section within your account. Alternatively, you may revoke your consent to receiving marketing communications by clicking the “Unsubscribe” link located in the footer of such communications. 

To process your request, we may need to verify your identity. In compliance with applicable data protection law, we aim to respond to your request within one month of receipt (or a shorter period if required by local laws). If we are unable to respond within this timeframe, we will inform you of this delay and the reasons for it. Please note that, in some cases, it is possible that our response will be delayed, limited, or excluded based on applicable local legislation.

We will generally respond to your requests free of charge. However, under certain circumstances (e.g., if your requests are manifestly unfounded or excessively repetitive), we may charge a reasonable fee based on administrative costs, as permitted by applicable law. In some jurisdictions, rights related to the personal data of deceased individuals may be exercised by their legal representatives or family members as per local regulations.

10. What is not covered by this Privacy Policy? 

This Privacy Policy explains and covers the processing activities we carry out as data controller. This Privacy Policy does not cover processing activities carried out by parties other than the Company which process personal data for independent processing purposes. We do not assume responsibility for the processing of your personal data by these third parties. For example, please note that this Privacy Policy does not cover the processing activities conducted by our partners or by other independent business owners that may have entered into partnerships with us (e.g., for the operation of any of our loyalty programs such as Club Avolta, if you are a member). Please refer to their own privacy practices for information on how they collect and use their own customers’ personal data. 

Please also note that you may receive more specific privacy notices, covering other processing activities that we may undertake with respect to your personal data.

11. Changes to our Privacy Policy 

We may update this Privacy Policy from time to time to reflect changes in our global practices or legal requirements. Any changes will be effective when posted on our Websites or Apps. We encourage you to review this Privacy Policy periodically. In the event of substantial changes, we will notify you of such changes, as required by applicable law. If you do not agree with any changes, you should refrain from continuing to use our services or access our websites or Apps. 

Last updated: 15 October 2025

Country Specific Information

TURKEY

To the extent the processing of your personal data falls within the scope of the data protection laws of Türkiye, Turkish Data Protection Law numbered 6698 (“TDPL”) will be applicable to the data processing activities described in this Privacy Policy. 

Sensitive Personal Data

If the processing activities described in this Privacy Policy involve the collection of personal data that qualifies as Sensitive Personal Data under TDPL is collected, we will only be able to lawfully process such data upon your explicit consent for the purposes mentioned in Section 3 above (“How and why we use your personal data?”), unless another legal basis applies. In such cases and where so required by the TDPL, we will take the necessary steps to seek your consent.

Data Subjects’ Rights  

Under TDPL, if your request is to be responded to in writing, you may be charged per page over ten pages. In cases where the request is responded to by means of a recording medium like a CD or a flash memory, you may be charged at the cost of the recording medium.

CHINA

To the extent the processing of your personal data falls within the scope of data protection laws in China, the Personal Information Protection Law of the People’s Republic of China (“PIPL”) as well as other relevant Chinese data protection laws, regulations, guidelines and standards will be applicable to the data processing activities described in this Privacy Policy. 

Sensitive Personal Data 

Some of the personal data we collect for the purposes described in this Privacy Policy may be classified as Sensitive Personal Data under PIPL. Where this is the case, where the processing is not specifically mandated by or conducted in connection with a legal obligation to which we are subject and where none of the other legal bases provided by PIPL is applicable, we may need to collect your consent in order to lawfully process such Sensitive Personal Data for the purposes mentioned under Section 3 above (“Why and how we use your personal data?”). In such cases and where so required by the PIPL, we will take the necessary steps to seek your consent. 

Transfer of Personal Data 

As mentioned in Section 7 above (“Do we transfer your personal data outside your country/region?”), as a global company operating in the food & beverage and travel retail sectors worldwide, we may need to transfer your personal data to countries or regions outside China. In such cases and where so required by the PIPL, we will take the necessary steps to seek your consent to such transfer and adopt other mandatory measures. 

Legal Basis 

Since legitimate interest is not recognised as a valid legal ground for the processing of your personal data under the PIPL, in order to carry out some of the activities described in Section 3 above (“Why and how we use your personal data?”), we may need to collect your prior consent. In such cases and where so required by the PIPL, we will take the necessary steps to seek your consent. 

Data sharing with Avolta Group entities

As explained in Section 5, we may share your personal data with Avolta Group entities that are located outside of the People’s Republic China for the same purposes within the same retention period as described in this Privacy Policy. 

The overseas entities that may receive your personal data will be communicated to you upon your request via the contact e-mail address or the postal address in Section 9. For the processing of your personal data by these entities, you may also contact us via the contact e-mail address or the postal address in Section 9 to exercise your statutory rights under Chinese law in respect of your personal data. 

MEXICO

To the extent the processing of your personal data falls within the scope of the data protection laws of Mexico, Federal Law on the Protection of Personal Data Held by Private Parties (“LFPDPPP”) will be applicable to the data processing activities described in this Privacy Policy.

Sensitive Personal Data 

If the processing activities described in this Privacy Policy involve the collection of personal data that qualifies as Sensitive Personal Data under LFPDPPP, we will only be able to lawfully process such personal data upon your consent for the purposes mentioned under Section 3 above (“Why and how we use your personal data?”), unless the processing is specifically mandated by or conducted in connection with a legal obligation to which we are subject. In such cases and where so required by the LFPDPPP, we will take the necessary steps to seek your consent. 

Transfer of Personal Data 

As mentioned in Section 7 above (“Do we transfer your personal data outside the country/region?”), as a global company operating in the food & beverage and travel retail sectors worldwide, we may need to transfer your personal data to countries or regions outside Mexico. Unless a statutory exception applies and where so required by LFPDPPP, we will take the necessary steps to seek your consent to such transfer and adopt other mandatory measures. 

US – California  

To the extent the processing of your personal data falls within the scope of the California Consumer Privacy Act (“CCPA”) this section applies and supplements the information provided in the general Privacy Policy. As used in this section, Personal Information and Sensitive Personal Information are used as defined in the CCPA. For example, under the CCPA, Sensitive Personal Information is defined to include data such as social security or state identification card number, immigration status, genetic data, and account log-in in combination with any required security or access code. 

Below, we identify (1) the categories of Personal Information and, where applicable, Sensitive Personal Information that we plan to collect and use, and have collected and used within the preceding twelve months; (2) the categories of recipients to which we have disclosed each category of Personal Information or, where applicable, Sensitive Personal Information for our operational business purposes within the preceding twelve months; and (3) the categories of Personal Information and, where applicable, Sensitive Personal Information, we have sold or shared within the preceding twelve months, as “sale” and “sharing” are defined in the CCPA.

We do not sell Personal Information in the traditional sense of the word, for monetary consideration. However, because the definitions of “Sale” and “Sharing” under the CCPA are broad enough to potentially include the disclosure of your information to certain types of advertising and marketing partners, we provide consumers with the right to opt-out of any such Sale or Sharing of their Personal Information. We do not knowingly Sell or Share the Personal Information of anyone under 16 years old.

 

Category of Personal Information Collected	Disclosed to Which Categories of Recipients for Operational Business Purposes	Sold and/or shared? If so, to Which Categories of Third Parties
Identifiers, such as name, postal address, email address, online identifiers, or other similar identifiers.	Our corporate affiliates	Third-party service providers that provide marketing and advertising services to us
	Third-party service providers that provide services to us, such as  marketing and advertising
	Enforcement authorities or other parties pursuant to law
Characteristics of protected classifications under California or federal law, such as age or gender.	Our corporate affiliates	Third-party service providers that provide marketing and advertising services to us
	Third-party service providers that provide services to us, such as marketing and advertising
	Enforcement authorities or other parties pursuant to law
Commercial information, such as history of products or services purchased, obtained or considered, or other purchasing or consuming histories or tendencies.	Our corporate affiliates	Third-party service providers that provide marketing and advertising services to us
	Third-party service providers that provide services to us, such as [IT support, marketing and advertising, and payment processing
	Enforcement authorities or other parties pursuant to law
Internet or other similar network activity, such as browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.	Our corporate affiliates	Third-party service providers that provide marketing and advertising services to us
	Third-party service providers that provide services to us, such as marketing and advertising
	Enforcement authorities or other parties pursuant to law
Inferences drawn from other Personal Information to create a consumer’s profile reflecting, such as personal preferences or characteristics, behavior and attitudes.	Our corporate affiliates	Third-party service providers that provide marketing and advertising services to us
	Third-party service providers that provide services to us, such as marketing and advertising
	Government authorities or other parties pursuant to law

Data Subject’s Rights

California residents have the following additional rights:

- Requests to Opt-Out of Sale and Sharing

You may opt out of our “sale” of Personal Information or “sharing” of Personal Information. 

To opt-out of Sale or Sharing, please visit our “Your Privacy Choices” page or by contacting privacy@avolta.net. We also recognize opt-out preference signals as required by the CCPA.

- Nondiscrimination 

You have the right to be free from unlawful discriminatory treatment for exercising any of your CCPA rights.

- Financial Incentives

From time to time, we may offer a program, benefit, or other offering in exchange for the collection, retention, sale, or sharing of Personal Information to us (collectively, “Financial Incentive”), such as your contact information. Any discount we provide will be based upon our reasonable but sole determination of the estimated value of your Personal Information, taking into consideration, without limitation, estimates regarding anticipated revenue generated from such information, the anticipated expenses which might be incurred in the collection, storage, and use of such information in the operation of our business, and other relevant factors related to the estimated value of such information to our business, as permitted under applicable law. We may provide additional notice of the details of the particular Financial Incentive as required, and participation in any Financial Incentive programs is on an opt-in basis. If you later wish to opt-out of a Financial Incentive program on a going-forward basis, you may submit a request to us via the contact e-mail address or the postal address in Section 9.

 

ARGENTINA

To the extent the processing of your personal data falls within the scope of the data protection laws of Argentina, the Personal Data Protection Law No. 25,326 (“DPL”) will be applicable to the data processing activities described in this Privacy Policy.

Sensitive Personal Data

Some of the personal data we collect for the purposes described in this Privacy Policy may be classified as Sensitive Personal Data under the DPL. Where this is the case, by consenting to this Privacy Policy you provide your express, prior and informed consent to the processing of your Sensitive Personal Data by us. 

International Data Transfers

As mentioned in Section 7 above (“Do we transfer your personal data outside your country/region?”), as a global company operating in the food & beverage and travel retail sectors worldwide, we may need to transfer your personal data to countries outside Argentina. This may occur, for example, when the entities of the Avolta Group or its service providers are located in other countries that may have different data protection laws than your country of residence.

Where necessary for the purposes described in this Privacy Policy, we may transfer your personal data outside of Argentina, including to jurisdictions that may not provide the same level of protection of that existing in Argentina. By consenting to this Privacy Policy, you expressly acknowledge and agree to such international transfers. In such cases, we will implement the necessary safeguards to ensure that your personal data is transferred in compliance with applicable international data transfer requirements.

Data Subject Rights

Following what is set out in Section 8 ("What are your rights"), under the DPL you are entitled to the following rights: (i) access, (ii) rectification, (iii) erasure, and (iv) withdrawal of consent. Please note that the DPL does not recognize the rights to restriction, data portability, or objection.

In accordance with the DPL, we will respond to your request for access to your personal data within ten calendar days of receiving the request. Requests for rectification or suppression of your personal data will be responded to within five business days of receipt.

You may access the information you provided to us, free of charge, at intervals of no less than six months, unless you can prove a legitimate interest to that effect, as provided for in the DPL.

Please be informed that the Agency of Access to Public Information, in its capacity as the Control Agency of Law No. 25.326, is responsible for dealing with complaints and claims filed by data subjects whose rights are affected by non-compliance with the regulations in force regarding the protection of personal data.

Legal basis

Since legitimate interest is not recognized under the DPL as a lawful basis for the processing of personal data, the processing activities described in this Privacy Policy require your express consent. Therefore, by consenting to this Privacy Policy, you authorize the processing of your personal data as outlined herein.

In this regard, by consenting to this Privacy Policy, you confirm that you have read and understood this Privacy Policy and, where applicable, you expressly, voluntarily, informedly, and unequivocally consent to the processing of your personal data by us, including the transfer of your personal data and the processing of your Sensitive Personal Data, in accordance with the terms of this Privacy Policy.

Cookie Policy – Avolta

This Cookie Policy explains how Avolta Group and its affiliated companies (collectively, "Avolta Group" or "Avolta," "we," "us") use cookies and similar tracking technologies on our websites and online services related to recruitment.

This Cookie Policy aims to provide you with clear and comprehensive information about the cookies we use and your choices regarding them, in accordance with applicable data protection law.    

This Cookie Policy should be read in conjunction with our Privacy Policy. For additional information about the entity responsible for processing your personal data (the data controller) and the rights you can exercise, please consult the Privacy Policy. If you have any additional questions, please contact us at: privacy@avolta.net or to the following postal address: Dufry International AG Brunngässlein 12 Basel, 4052 Switzerland Attention: Global Data Protection Officer.

1. What are cookies and similar tracking technologies?

When you visit our website, we use “cookie” technology to make your experience simple, personalised and meaningful. These cookies are not edible, but small pieces of information which are issued to your computer or any similar device you use to access the internet (e.g., smart phone, tablet or other mobile device). They are generally used to make our website work, to let us know how you’re using the website, to remember your login details, your preferences, and interests. Cookies may also be used to allow tracking of your browsing activities within a website, for statistical or advertising purposes.

We may also use other similar tracking technologies, such as:

- Pixel tags (web beacons): Small graphic images (or code) embedded in web pages and emails that track your interaction with our content.

- Browser and device identifiers: Unique strings that can be used to identify your browser or device.

- Local storage: Technology that allows websites to store data locally on your device.

- Software Development Kits (SDKs): These are sets of tools and code that are embedded in our mobile applications. SDKs allow us and our partners to collect information about how you use our apps, similar to how cookies and other technologies are used on websites. They can be used for analytics, functionality, and advertising purposes within the app environment. For additional information see section “Tracking Technologies in Our Mobile Applications”.

For the purposes of this Cookie Policy, the cookies or other tracking technologies used in our website will collectively be referred to as “cookies”. 

There are different types of cookies, and they can be differentiated by their origin, function and lifespan.

Some cookies are set by us and some are set by third parties who we work with. “First-party cookies” are cookies that are placed by us, while “third-party cookies” are placed by a website other than the one you are visiting. It’s important to know that we do not control the collection or further use of data by third parties.

Depending on their lifespan, cookies may also be distinguished between “browsing / session cookies” and “persistent cookies”. Session cookies are temporary cookies that are erased once you close your browser while persistent or permanent cookies stay on your device until you manually delete them or until your browser deletes them based on the duration period specified in the persistent cookie file.

Depending on their functions, cookies can be further divided in different categories. Please find below the list of cookies used by Avolta:

- Essential Cookies: These cookies are required for the operation of this website and cannot be turned off. They are essential for you to navigate the site and use its basic features.

- Analytical Cookies: (first party and third party): These cookies allow us and our third-party analytics providers to collect information about how you use our website. This data helps us understand and improve your browsing experience, measure website effectiveness, and optimize performance. You can choose to enable or disable these cookies in the Cookie Consent manager.

- Functional Cookies (first party): These cookies enable our website to remember choices you make, enhancing your experience with personalized features and convenience. You can choose to enable or disable these cookies in the Cookie Consent manager.

- Advertising Cookies (first party and third party): These cookies, including social media cookies, are used by us and our third-party advertising partners to track your browsing activity to show you relevant advertisements on our website and other sites. They also help us measure the effectiveness of our advertising campaigns. You can choose to enable or disable these cookies in the Cookie Consent manager.

2. Specific cookies we use

For a detailed list of the specific cookies we use within each category, please refer to the Cookie Consent manager accessible in the footer page or Settings section of the app. The Cookie Consent manager provides up-to-date information on the names, providers, purposes, and duration of each cookie.

3. Tracking technologies in our mobile applications

When you use our mobile applications, we and our partners may collect information through the use of Software Development Kits (SDKs) and other similar technologies. These technologies function similarly to cookies on websites, allowing us to understand how you interact with our apps, personalize your experience, and provide relevant content and advertising.

We may use SDKs and similar technologies in our apps for the following purposes, which align with the cookie categories described above:

- Essential Functionality: Some SDKs are essential for the basic operation of our apps, enabling core features and security. These may be necessary for the app to function correctly.

- Analytics: We use analytics SDKs (both our own and third-party) to collect data about your app usage, such as how often you use the app, which features you interact with, and any errors you encounter. This helps us to understand user behavior, improve the app's performance, and enhance the user experience.

- Functionality: SDKs may enable us to remember your preferences within the app, such as language settings or personalized display options, providing a more tailored experience.

- Advertising: We and our advertising partners may use SDKs to track your activity within our apps and potentially across other apps to show you relevant advertisements for Avolta job openings or related content that may be of interest to you. These SDKs may also help us measure the effectiveness of our advertising campaigns.

Managing Your Tracking Technology Preferences in Our Apps

Our mobile applications may provide specific controls within their settings menus to manage your preferences regarding the use of certain tracking technologies, particularly those used for analytics and advertising. We encourage you to review the privacy settings within each of our apps for information on how to control your preferences. In some cases, your device operating system may also provide settings that limit certain types of tracking.

For more detailed information about the specific SDKs and other tracking technologies used in our mobile applications, please refer to the specific privacy notices or consent mechanisms provided within those apps.

4. Managing your cookie preferences

Upon your first visit to the website, by interacting with the cookie banner displayed on your first visit, you can (i) accept all cookies by clicking the “Accept All Cookies” button, (ii) proceed without giving consent and continue with the default settings, which only use essential cookies as necessary for the functioning of the website, by clicking "Reject Non-Essential Cookies”/”X” button, or (iii) selectively choose specific categories of cookies by clicking “Manage Cookie Preferences”.

On any subsequent visit to the website, you can select which cookies to authorize through the “Cookie Consent” manager section available in the footer of the website.

Please note that you may also be able to authorize, block, or delete (in whole or in part) cookies through the specific functions of your browser. For more information on how to customize your browser settings to enable or disable cookies, you may consult the following link: https://allaboutcookies.org/how-to-manage-cookies. 

Note: Please note that disabling essential or certain functional cookies may impact your browsing experience on our website. 

5. Changes to our Cookie Policy and additional information

We may update this Cookie Policy from time to time to reflect changes in our global practices or legal requirements. Any changes will be effective when posted on our website. We encourage you to review this Cookie Notice periodically. In the event of substantial changes, we will notify you of such changes or request that you update your cookie preferences in light of such changes, as required by applicable law. If you do not agree with any changes, you should refrain from continuing to use our services or access our websites.

Last updated: 15 October 2025

Privacy Notice

 

1. Introduction

 

(a) Valuing your privacy and safeguarding your personal data

 This Privacy Notice describes the way Dufry International, AG and its global affiliates (collectively “Avolta” “us”, or “we”) treat all the personal data you provide or that we have obtained through our websites, mobile applications and in our retail and food and beverage stores.

 

At Avolta, we respect your privacy and adhere to applicable data protection and privacy laws and relevant e- commerce laws globally. We strive to consistently exceed our clients’ expectations regarding the products and services that we offer to our travel retail customers. We create experiences that our customers value by responsibly using information with which you entrusted us.

  

(b) Applicability and links to other third-party applications and/or websites

 This Privacy Notice applies to all visitors and anyone who accesses or uses our products and services of Avolta store locations (“Stores”) and the global Avolta.com websites and any local country websites of Avolta or our mobile applications for the Avolta loyalty program, and any other mobile application or websites (as amended from time to time) of Avolta (collectively “Avolta Websites and Applications”). “Personal data” means any information relating to an individual who is identified or identifiable, such as name, address, email, phone number and information relating thereto.

 

Avolta Websites and Applications may contain links to and from the applications and/or websites of our partner networks, advertisers, third parties and affiliates. They are merely for informational purposes. If you follow a link to any of these applications and/or websites, please bear in mind that they have their own privacy policies and that we assume no responsibility or liability arising whatsoever nor endorse any practices from their policies.

 

BY ACCESSING AVOLTA WEBSITES AND APPLICATIONS AND ACCEPTING THE STATEMENT WITH THE LINK “YES, I AGREE” OR YOU ENTER AND PURCHASE PRODUCTS IN OUR STORES, YOU ACCEPT THE TERMS AND THE PROCESSING OF PERSONAL DATA DESCRIBED IN THE PRIVACY NOTICE. IF YOU DO NOT AGREE, PLEASE REFRAIN FROM ACCESSING AVOLTA WEBSITES AND APPLICATIONS OR OUR STORES.

 

YOU MAY WITHDRAW YOUR CONSENT AT ANY TIME. WE WILL THEN REFRAIN FROM FURTHER PROCESSING YOUR PERSONAL DATA, EXCEPT TO THE EXTENT THE PROCESSING OF YOUR PERSONAL DATA IS LAWFUL FOR OTHER REASONS EVEN WITHOUT YOUR CONSENT, SUCH AS LAWFUL PURPOSES AS FULFILLING THE CONTRACTUAL OBLIGATIONS OR COMPLIANCE WITH LAW OR TO PROTECT OUR OR THIRD PARTIES LEGITIMATE INTERESTS (SUCH AS THE UNINTERRUPTED AVAILABILITY OF OUR WEBSITE OR ENFORCEMENT OF VIOLATIONS OF LAW).

 

(c ) Summary of provisions:

 

• Sources of Personal Data and What Personal information about Customers do Avolta Websites and Applications collect?
• Lawful Purposes for Processing and collecting Personal Data
• Sharing your Personal Data
• Storing your Personal Data
• Security of Personal Data
• Transfer of Data Outside of your Country
• Retention of Personal Data
• Minors
• What Are Your Rights?
• What Are My Choices?
• Changes to Our Privacy Statement
• Where to make a Data Protection complaint?

 

2. Sources of Personal Data and What Personal Information about customers do Avolta Websites and Applications collect?

• Controller and Processors of Personal Data

 Avolta and the owner of the local website (as set out in the terms) which you are currently visiting or the local Avolta entity which owns the local Store that you are visiting or from whom you are purchasing goods are joint controllers of the personal data that you (as data subject) provide us or we received in our Stores and Avolta Websites and Applications.

 

• Types of Personal Data collected and Sources of Personal Data

 We collect personal data directly from our customers through Avolta Websites and Applications and our Stores.

 

We obtain, use, disclose and otherwise process personal data about customers to (i) process transactions they request, including e-commerce Reserve and Collect selection and mobile transactions, (ii) improve Avolta Websites and Applications, Stores, quality of service and customers shopping experience, (iii) send communications about our products, services, campaigns, promotions, competitions, sweepstakes and customer satisfaction surveys, (iv) prevent and detect fraud and abuse, (v) process information or claims in connection with incidents at Stores, (vi) enable service providers to perform certain activities on Avolta’s behalf, (vii) protect the log in details of the subscribers and system integrity of the Avolta Websites and Applications, (viii) comply with legal obligations, policies and procedures and for internal administrative and analytics purposes,(ix) allow valid Avolta loyalty program members to access their accounts  and accumulate, redeem, or receive, or utilise their member benefits and (x) to commence, protect or defend Avolta in actual or threatened legal proceedings.

 

We collect the following types of personal data about you from the following sources:

 

Information that you provide to us: We receive and store any information you enter on Avolta Websites and Applications and Stores or give us in any other way such as during registration, accessing your account or profile, submitting queries or as part of a survey or competition or utilising gift coupons or customer support or communicate with us or purchasing in Stores or using our products or services.

 

Due to such actions, you may supply us with your (i) name, postal address, email address, phone numbers, (ii) data necessary to process your payment (including the credit card/payment instrument information and personal security code associated with your credit card) for Store purchases or on line purchase of gift vouchers, to reserve purchases (under the Avolta Reserve & Collect Application), to apply for a refund, or to communicate with customer services regarding a refund to the credit card/payment instrument, (iii) flight number, destination, flight date and delivery address for the subscriber and airport location to collect any pre ordered reserve & collect products or make purchases of our products and services in Stores. Demographical data such as your age, gender, country, preferred language, passport number and citizenship, date of birth and country of residence are also collected. You must hold a valid flight ticket to be able to make duty free or duty paid purchases from Avolta at certain Avolta locations. Such information is collected to meet our contractual obligations to our landlord and airport authorities and legal obligations towards customs and other regulatory authorities.

 

When you register for membership, subscribe for services or the newsletter or other marketing communications including blogs or customer comments or use the Avolta Websites and Applications or purchase in our Stores, we collect log in details, passwords, any password questions and hints, similar security information used for authentication and account access is also collected for the access into your personal account and profile and to utilise the Reserve and Collect elements or customer loyalty elements of Avolta Websites and Applications or in our Stores.

 

You can choose not to provide certain information, but then you might not be able to utilise many of the features of the Avolta Websites and Applications. See What Are My Choices section below.

 

Information collected automatically through interaction with us:

We receive and store information when you visit or use the Avolta Websites and Applications or when you access other API service(s) provided by Avolta.

 

This information includes (but is not limited to) any combination (or all) of the following:

a) IP (Internet Protocol) address(es) of your devices;

b) Logs of URLs (with accompanying timestamps) that your devices have accessed;

c) Version, type and operating system information that your devices automatically send to us;

d) Details of searches that you undertake;

e) Details of products or services that you visit, browse, or are recommended to you;

f) Details of products that you reserve or purchase with us (your purchasing history);

g) Information about the performance of our services on your device, including crashes of mobile applications (“Crashlytics”, a conjunction of crash dumps and analytics) and the loading speed of website content assets.

If you have contacted us by other means, we may additionally collect:

a) Your phone number if you contacted our Customer Contact Centre teams

b) Your username on social media or social messaging services such as (but not limited to) WhatsApp, Apple Business Messenger, Facebook Messenger.

 

We also utilise third-party analytics services to help us understand and improve the services that Avolta provides to you. These may include but are not limited to Google Analytics, Hotjar, Adobe Launch (and associated Adobe Experience Cloud services) and New Relic.  These services may use Cookies and Local Storage services offered by your web browser to temporarily or persistently store information that may identify your access session, your activity while browsing (including clicks, scrolling activity, the amount of time you spend) and to track your usage of our services over multiple visits.

 

For more information, see What are My Choices section below.

 

Mobile or Avolta Applications: When you choose to use or download Avolta Websites and Applications we receive information about your location and mobile device, including a unique identifier for your personalised device and subject to your choices about location services provided by your mobile device, your location.  Location data is neither stored nor transmitted to third parties. If you agree with the localisation functions, we can provide you with location-based services including advertising, search results and personalised content. Once you are near one of our Stores, then we can use mobile device push notifications or email communications to you if you have provided your consent to receive such communications and advertising. Most mobile devices allow you to turn off location services and push notifications services. For more information, see What are My Choices section below.

 

E-Mail Communications: To provide more personalised and interesting email communications, we may receive a confirmation when you open email from Avolta Websites and Applications or your device is near one of our Stores, if your computer or device supports this capability and you have provided us the appropriate consents to do so.

 

If you do not wish to receive any Emails from us, please adjust your customer communication preferences in your account profile.

 

Information from other Sources: We receive information about you from other sources and add it to our account information. The third-party sources include:

 

(i) Updated delivery and contact address data from third parties which are used to update our records and deliver your next purchase more easily;

(ii) Social networks when you grant permission to Avolta Websites and Applications to access your data on one or more networks;

(iii) Service providers that help us determine a location based on your IP address to allow customisation of certain products to your location;

(iv) Our partners which we offer co-branded services or conduct joint marketing activities;

(v) Publicly-available sources from open government databases or other data in the public domain; and

(vi) Credit history information from credit bureaus, which we use to help prevent and detect

 

3. Lawful basis and purposes for processing and using your personal data

 

(a)     Lawful purposes

 

Your personal data is processed by the Avolta on the basis of a lawful “justification” for such processing, to the extent required by or permissible under applicable law. The processing of special categories of personal data (including data relating to health, sexual preferences racial or ethnic origin, religious beliefs) is always justified on an additional basis as set out below.

 

In the majority of cases, the processing of your personal data will be justified on one of the following bases:

 

(i) It is provided for in your contract of providing products and services requested by you to be provided by us;

(ii) It is necessary for us to comply with a legal obligation;

(iii) It is with your freely provided unequivocal and informed consent for specified processing purposes: or

(iv) It is in our legitimate interests as a business and as your supplier of contractually requested goods, and our interests are not overridden by your interests, fundamental rights or freedoms including legitimate interests as set out

 

The processing of special categories of personal data will be justified by one of the above conditions and normally by one of the following special conditions:

 

(i) It is necessary for the purposes of carrying out legal obligations:

(ii) It is carried out subject to your explicit consent:

(iii) It is necessary for the establishment, exercise or defence of legal claims: or

(iv) In exceptional circumstances, it is necessary to protect your vital interests and you are incapable of giving consent.

 

(b) Purposes of processing personal data

 

We obtain, use, disclose and otherwise process personal data about customers to:

 

(i) process transactions they request, including e-commerce Reserve and Collect selection and mobile transactions,

(ii) process information for and from the Avolta loyalty programme and to ensure that the collection redemption, receipt, and utilization of Avolta loyalty programme benefits and confirm the status of a customer to allow for the correct discount to be applied to the sales of goods purchased in Stores or goods reserved for collection under the Reserve & Collect application and purchased in person in Stores;

This information will enable us to provide access to all areas of the loyalty programmes, the Reserve and Collect and Avolta loyalty programme applications contained in Avolta Websites and Applications.

(iii) review and collect data from the boarding pass, nationality, destination and holder of the valid boarding pass to ensure that the passenger is part of the travelling public to allow Avolta to provide duty free goods under the terms of the contractual agreement with our landlords or airport authorities;

(iv) provide payment services including credit cards for online purchases and in Stores purchases;

(v) provide goods and services to the customers that they have requested (i.e., provided an email address to allow the regularly communication to be provided to the customer)

(vi) to maintain our business relationship, where you are a user or subscriber of our Avolta Websites and Applications,

(vii) to maintain our business relationship and communicate with you where you are a Avolta loyalty programme member;

(viii) to answer your enquiries;

(ix) improve Avolta Websites and Applications, Stores, quality of service and customers shopping experience,

(x) send communications about our products, services, campaigns, promotions, competitions, sweepstakes and customer satisfaction surveys,

(xi) prevent and detect fraud and abuse,

(xii) process information or claims in connection with incidents at Stores,

(xiii) enable service providers to perform certain activities on Avolta’s behalf,

(xiv) protect the log in details of the subscribers and system integrity of the Avolta Websites and Applications,

(xv) comply with legal obligations, policies and procedures and for internal administrative and analytics purposes,

(xvi) to communicate with you and personalize our communications with you. i.e., respond to your queries or accommodate your preferences and registration for program membership. We communicate with you by email or phone or SMS to inform you about our services, how to keep your subscription or account active, to communicate regarding a refund or customer inquiry or assisting with web site or Avolta Websites and Applications access or technical queries or to participate in a customer survey or a competition or to receive a promotional coupon or discount rebate or to invite you to attend an event sponsored by the Avolta Websites and Applications or in Stores, and

(xvii) to commence, protect or defend Avolta in actual or threatened legal proceedings.

 

We use personal data to carry out your contractual transactions with us and to provide our products (including but not limited to) reserve of products listed in the Reserve and Collect application for collection at the requested Store) to you as requested by you. This includes using your personal information to register or subscribe to any services provided through Avolta Websites and Applications.

For certain transactions where we have contractual obligations to our landlord pursuant to concession agreement(s) and/or to allow the calculation of VAT or similar tax allowances for customs authorities, we collect personal data, including boarding pass information (which includes your name, next flight and final destination) to ensure that you are a valid traveler.

 

Where we process your personal data on the basis of our legitimate interests, those will be our interests in:

(i) The conclusion of the specific processes listed above;

(ii) Providing and improving the products we offer and perform essential business operations. This includes operating the products, maintaining and improving the performance of the products, developing new features, conducting research and providing customer support.

(iii) Protecting the security and safety of our products and our customers, to detect and prevent fraud to confirm the validity of the subscriber logging into Avolta Websites and Applications;

(iv) Using personal data for statistical and analytical purposes. Whenever reasonably possible we will anonymize such information before using it for statistical or analytical purposes. Such information is processed in the legitimate interests of Avolta to maintain the efficiency, relevancy and availability of the Avolta Websites and Applications;

(v) Effective management and operation of Avolta;

(vi) Our engagement with and communications with our customers;

(vii) Developing our business and the business of the Avolta as a whole;

(viii) Increasing the efficiency of our processes and practices:

(ix) Striving to ensure compliance with the Avolta’s policies and procedures and applicable laws and business norms:

(x) Ensuring the on-going stability and availability of the Avolta Websites and Applications or in our Stores;

(xi) Avoiding or mitigating harm to you, to our customer, to us and the Avolta and to third parties.

(xii) Advertising: Sending you newsletters, notifying you of special offers or promotions or asking you to participate in customer surveys or to provide invitations to attend events or provide advertising based on your interests, if you have provided us with the consent to do so.

 

 

4. Sharing your Personal Data

 

We will not transfer or disclose your personal information outside our Avolta of, other than as set out below:

 

(a) in connection with a joint venture or business combination where Avolta holds less than 50% ownership or does not have effective management control of such joint venture or business combination;

(b) sending or making promotional offers to selected customers of Avolta Websites and Applications or Stores on behalf of other companies (but if we do this, then we do not give that business your name and address). If you do not want to receive these emails, please advise us by notifying us at privacy@avolta.net or updating your preferences in your account profile;

(c) to third-party service providers (companies or individuals) that we employ to perform functions on our behalf such as fulfilling orders, delivering to retail locations or Stores, sending postal mail and email, removing repetitive information from customer lists, analysing data, providing marketing assistance, providing search results and links, processing credit card payments and providing customer service. These providers have access to personal information needed to perform their functions, but may not use it for other purposes and include the following categories of data recipients:

 

(i) advertising and media consultants,

(ii) market research consultants;

(iii) providers of technical services;

(iv) website designers and developers;

(v) cloud computing service providers;

(vi) electronic storage providers;

(vii) customer services;

(viii) recruitment agencies;

 

(d) in connection with the proposed merger, acquisition or sale or as a result of the actual sale of all or part of the assets of, or shares in Dufry International, AG or a business transfer of business activities of Dufry International, AG occurs other than without a sale or acquisition;

(e) in releasing account and other personal data to comply with the law, undertaking litigation or other proceedings or to enforce or comply with or apply our terms of use and other agreements, or protect the rights, property or safety of Avolta Websites and Applications or Stores. This includes exchanging information with other companies for fraud prevention and credit risk reduction;

(f) to comply with legal or regulatory requirements or obligations in accordance with applicable law, a court order or a subpoena,

(g) with regulatory authorities, airport authorities and Avolta landlords and concession partners and customs and tax authorities to show the calculation of such tax exemptions; or

(h) to data analytical firms you have provided us with consent to use;

(i) in an emergency, such as to safeguard the life, health, or property of an individual; or

(j) with your consent to proceed to share your personal information with third parties where required by applicable law.

Nevertheless, within our corporate group of Avolta, certain services are centralised to provide one or more affiliates for the entire group or a part of it.

 

5. Storing your Personal Data

 

Your personal information you have provided to either or both joint controllers be located in a  Dufry International, AG cloud based customer management database software tool located within data centres maintained in the territories of the EEA, unless the local data protection laws require that the local Avolta entity will be included in a file owned by the local Avolta entity, the purpose of which is to manage the business relationship with you, in accordance with the provisions of the local data protection laws.

 

Avolta and the local Avolta entity will manage the customer relationship with you and any marketing materials can be provided, in accordance with your preferences, by Avolta as Controller or by the local Avolta entity as a joint controller.

 

6. Security of personal data

 

Your personal data will be secured by taking security measures that are commensurate with the sensitivity of the personal data processed. To this end, Avolta and all Avolta entities maintain appropriate physical, technical, and administrative security measures with a view to protecting personal data against theft; accidental loss; unauthorised alteration; unauthorised or accidental access, processing, erasure, use, disclosure or copying; and/or accidental or unlawful destruction.

 

When we have provided (or you have chosen) a password allowing access to certain benefits of the Avolta Websites and Applications, you are responsible for safeguarding it and keeping it confidential and you undertake not to allow it to be used by third parties. Unfortunately, the transmission of information through the internet is not completely secure. Although we will take all reasonable commercial measures to protect your personal data, we cannot guarantee the security of any personal information or data you disclose online. You accept the inherent security implications of using the internet and to the extent permitted by law, we will not be responsible for any breach of security, unless we have been acting with gross negligence and only within the limitations as set out in the terms and conditions of use for Avolta Websites and Applications.

 

7. Transfers of Data Outside of Your Country

 

Your personal data (as described above) may be transferred to other Avolta entities with the corporate group or to third parties described above, only to the extent required for Avolta companies to perform their obligations to you, or for you to access your Avolta Websites and Applications, or for the purposes described above in this Notice, provided such purposes are in accordance with applicable laws. In particular:

 

1. Your profile and contact information contained in systems such as corporate communications systems, customer relationship management databases or directories will be accessible to all marketing, sales and customer support or customer care employees of Avolta companies worldwide.
   
   
2.  Your personal data may be transferred to or accessed by Avolta employees located inside or outside your country, and/or a person or company that is not part of Avolta located in or outside your country, on a need-to-know basis. Transfers outside the EU may be made pursuant to the European Commission's Standard Contractual Clauses ("SCC"), the EU-U.S. Privacy Shield certification or other legally acceptable mechanisms which ensure an adequate level of protection. As permitted by law, you may be entitled, upon request to the Global Data Protection Co-Ordinator, to receive a copy of any contractual documentation showing that appropriate safeguards have been taken to protect your Personal Data for transfer outside the EU.
   
   
3.  Avolta may process your personal data as a controller in order to administer and provide you with products and services that you requested, to administer global sales and customer programs, promotional and marketing activities and surveys, competitions and coupon and gift promotions, communications with customers, advertising campaigns with us, to manage sales and customer relationships and to prepare sales and customer relationship management and customer support reporting, consistent with the terms of this Notice. Dufry International, AG is located in Switzerland, a country that benefits from an adequacy decision of the European Commission that has found Swiss law to afford adequate protection to personal data.
   
   
4.  Transfers may be made to respond to law enforcement requests or discovery procedures, or where required or permitted by applicable laws, court orders, government regulations, or government authorities (including tax and employment). Such transfers may entail access by courts or governmental authorities outside your country, after having ensured that only your minimal necessary data is disclosed and transferred, or that such data is de-identified or that, where possible, appropriate stipulative court orders have been issued.

A list of the countries located outside the EU to which your Personal Data may be transferred, and an indication of whether they have been determined by the European Commission to grant adequate protection to Personal Data, can be found at International Data Transfers (“Data transfers on the basis of an adequacy decision”)

 

Transfers of Personal Data in accordance with this Section 7 are based on the same legal bases as applicable for the respective purposes of processing as set out above.

 

8. Retention of personal data

 

Avolta data retention policy requires that personal data be retained for no longer than required to fulfil the purposes for which it was collected. Avolta can provide a copy of the Avolta Data Retention Policy upon request to the email address privacy@avolta.net: In general, personal data, or records containing personal data, will be retained for periods of time required in accordance with applicable legal, tax, or accounting obligations. In specific circumstances, and in accordance with applicable law, Avolta may retain your personal data for longer periods of time (such as for the duration of the relevant statute of limitation) so that we have an accurate record of our dealings with you or to protect the legitimate interests of Avolta. In all cases, where your information is no longer required, Avolta will ensure it is disposed of in a secure manner.

 

9. Minors

 

Avolta Websites and Applications do not provide products and services to children. Whilst we may sell toys and confectionary which may appeal to children, any reservation for our products and services can only be provided to adults over the age of 18 years old. We do not knowingly collect personal information from children under the age of 18 years without the consent of the child’s parent or guardian. Accordingly, the parent will need to complete and submit a fully completed and signed Parental Personal Data Consent Form along with evidence of the person’s identity, to the email address: privacy@avolta.net.

 

10. What are your rights?

 

You have the right under applicable law to access, obtain a copy and correct personal data concerning you, subject to limited exceptions that may be prescribed by applicable laws. Where justified and mandated by applicable law, you may also require that your personal data be deleted or blocked, or you may be entitled to obtain information about the processing of your data, or object to further processing of your data.

 

In the event your personal data is processed on the basis of your consent, you have the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. You can do this by:

(i) In some cases deleting the relevant Personal Data from the relevant IT system (although note that in this case it may remain in back-ups and linked systems until it is deleted in accordance with our data retention policy), or

(ii) Contacting our Global Data Protection Co-Ordinator.

 

As permitted by law, you also have the following additional rights:

a) Data portability - where we are relying upon your consent or the fact that the processing is necessary for the performance of a contract to which you are party as the legal basis for processing, and that personal data is processed by automatic means, you have the right to receive all such personal data which you have provided to Avolta in a structured, commonly used and machine-readable format, and also to require us to transmit it to another controller where this is technically feasible.

b) Right to restriction of processing - you have the right to restrict our processing of your personal data where:

(i) you contest the accuracy of the personal data until we have taken sufficient steps to correct or verify its accuracy;

(ii) where the processing is unlawful but you do not want us to erase the personal data:

(iii) where we no longer need your personal data for the purposes of the processing, but you require such personal data for the establishment, exercise or defence of legal claims;

(iv) where you have objected to processing justified on legitimate interest grounds (see below) pending verification as to whether Avolta has compelling legitimate grounds to continue processing; or

(v) where your personal data is subject to restriction in this way, we will only process it with your consent or for the establishment, exercise or defense of legal claims.

c) Right to object to processing justified on legitimate interest grounds - where we are relying upon legitimate interest to process personal data, then you have the right to object to that processing. If you object, we must stop that processing unless we can either demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or where we need to process the personal data for the establishment, exercise or defence of legal claims. Where we rely upon legitimate interest as a basis for processing we believe that we can demonstrate such compelling legitimate grounds, but we will consider each case on an individual basis.

 d) Right to object to processing for marketing purposes – you have the right to object to any processing of your data for marketing purposes (including profiling). Additionally, see What are My Choices?

 

Please contact us by submitting a Data Subject Access Request Form (available upon request) in writing or by email to the address listed below.

 

Avolta has appointed a Global Data Protection Co-Ordinator who may be contacted securely and confidentially at the following email address: privacy@avolta.net

 

Alternatively, you can send your Data Subject Access Request Form, written comments, questions or concerns to:

 

Avolta AG

Attn: Global Data Protection Co-Ordinator

Brunngaesslein 12

4052 Basel

Switzerland

Copy to; Avolta Legal Department

 

11. What are My Choices?

 

Avolta Websites and Applications provide you with access to a range of information about your account and your interactions with us. To ensure that your personal data is accurate and up to date, we encourage you to regularly review and update your information as appropriate, if your communication preferences change or your contact details or address has changed. If you have subscribed to Avolta Websites and Applications, especially the Club Avolta application or the Reserve and Collect Application, then you can either access your account and make the changes or request the changes are made by sending an email request along with evidence of your identity to privacy@avolta.net.

 

We like to inform you about our products and services and those of our partners and to also send you surveys, promotional materials and invitations to events, to participate in competitions or receive coupons or gift certificates as well as communications on your birthday or other special events. If you choose not to receive such communications or wish to modify what method of communications such as SMS, email, letter or phone we use to contact you, all electronic communications channels provide an “Unsubscribe” or “STOP” mechanism, or for modifications, a Preferences Centre to make more granular changes. For all other non-electronic communications, you may submit an objection email or letter to specify your preferences to privacy@avolta.net

 

When you visit our Websites and Applications from either a desktop or mobile device, we also may collect and use cookies or other identifiers to serve you with personal advertisements; to measure how you interact with our Websites and Applications; and to maintain your preferences. We do this primarily through cookies, which are pieces of data stored directly on the computer or mobile device that you are using.

 

Avolta uses third-party services such as UserCentrics to gather, store and manage the consent(s) (if any) that are provided by you when accessing our Websites and Applications. These consents ordinarily govern the ability of our platform and of third-party services we use to create, modify and delete cookies and other technologies provided by your web browser. The UserCentrics consent screens provide detailed information to you on:

 

a. The logical groupings of the consents we seek from you, including (but not limited to):

(i) “Essential” – These cookies are necessary to enable the basic features of our Websites and Apps, such as providing a secure log-in or booking a stay.

(ii) “Functional” – These cookies allow our Websites and Apps to remember your site preferences and choices you make on the site. We also use functional cookies to facilitate navigation, to display content more effectively, and/ or to personalize your experience.

(iii) “Marketing” – Marketing cookies allow us to select which advertisements or offers are most likely to appeal to you. We also use them to track responses to online advertisements and marketing, and we may use them to better understand your interests so we can present you with relevant messages and offers. These cookies may also allow you to share certain pages with social network.

b. The inventory of cookies and other technologies that are relevant to the Website or Application you are accessing, and their purpose.

There are several ways to manage cookies: 

(i) You can opt out of cookies on your browser. Every browser is different, please check the instructions provided by your browser.

(ii)All our websites that collect your consent via the UserCentrics control panel contain a link in the footer entitled “Cookie Consent” that, when clicked, will permit you to make an alternative selection or to withdraw your consent.

For more information on how to manage cookies in your web browser or device: How to manage cookies

 

12. Changes to our Privacy Notice

 

Changes and amendment to the terms of this Privacy Notice can be made at any time and shall apply as soon as they are published on any Avolta Websites and Applications (“Privacy Notice Changes”). You are responsible for reading and understanding this Privacy Notice and any Privacy Notice Changes. Should you not agree to any section of this Privacy Notice or changes or amendments, then you should refrain from continuing to use our services or products or access Avolta Websites and Applications or our Stores.

 

13. Where to make a Data Protection complaint?

 

You have the right to lodge complaints pertaining to the processing of your personal data with the relevant data protection supervisory authority.