Privacy Policy

“Coca-Cola HBC Brand Opener 2021” Privacy Policy

This Privacy Policy specifies the manner of processing the personal data of participants of the “Coca-Cola HBC Brand Opener 2021” competition (hereinafter the “Participants”) organised by Coca-Cola HBC Polska Sp. z o.o. and, together with the “Coca-Cola HBC Brand Opener 2021” Fanpage Privacy Policy (available on www.facebook.com/CocaColaBrandOpener), it lays down the rules applicable to the processing of the personal data collected by Coca-Cola HBC Polska Sp. z o.o. in connection with the organisation of the aforementioned competition.

Data controller

The data controller of the personal data of the Participants of the “Coca-Cola HBC Brand Opener 2021” competition, including the participants of Mini Challenges (hereinafter the “Personal Data”) is Coca-Cola HBC Polska Sp. z o.o. with its registered office in Warsaw at ul. Żwirki i Wigury 26, 02-092 Warszawa (hereinafter: “CCHBC” or “we”, “us”, etc.). The Personal Data will be processed in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR”. The detailed principles of processing the Personal Data are presented below.

Purpose and legal basis for data processing

The Personal Data will be processed by CCHBC for the purpose of pursuing legitimate interests of CCHBC (legal basis: Article 6(1)(f) of GDPR), such as:

  1. organisation of the “Coca-Cola HBC Brand Opener 2021” competition (hereinafter the “Competition”), including for the purpose of handing over the prizes and considering appeals lodged by the Participants, if any,
  2. evidential purposes to enable defence in matters concerning claims related to the Competition, including claims resulting from the provisions of the Act of 4 February 1994 on Copyright and Neighbouring Rights.

The data of the Participants will also be processed for the purposes of meeting the tax obligations in connection with the prizes awarded to the Participants in the Competition (legal basis: Article 6(1)(c) of GDPR).

The data, in the form of anonymised summaries, may also be processed for analytical and statistical purposes. The anonymisation means that the Participants’ data is modified in such a way that the Participants to whom the data relates can no longer be identified. The statistical summaries, therefore, will not contain the Personal Data of the Competition Participants. We may provide third parties with summary information on the use of our website, but it will not include information that may be used to identify a particular person.

The Participant may freely consent for the Organiser to send information on further editions of the Competition and traineeships offered by the Organiser to the Participant’s email address. Giving such a consent is voluntary. If such a consent is given, the Organiser will process the first name, the surname and the email address of the Participant in pursuit of its legitimate interest of providing the Participant with the requested information (legal basis: Article 6(1)(f) of GDPR). The consent to receiving the aforementioned information to the email address may be withdrawn by the Participant at any time, which, however, will not affect the lawfulness of activities undertaken by the Organiser based on the consent before its withdrawal. Failure to give such a consent or its withdrawal at a later time does not affect participation in the Competition.

Passive collection of Personal Data

When the Participant browses the website http://www.brandopener.eu, data on his/her activity is collected automatically and stored in cookies (so-called passive data collection). This data may include e.g. the IP address, the domain name, the version of the browser and the operating system, activity data, localisation data, web log data. The Participant may choose whether to accept cookies or not at any time using the web browser settings. In particular, these settings may be changed so as to block automatic support for cookies in the web browser settings or display a notification in the website user’s device any time a cookie is created. Withdrawal of the cookie consent will not affect the lawfulness of activities undertaken by us based on the consent before its withdrawal. Detailed information on cookie support and the methods of handling cookies are available in the software (web browser) settings. When collecting data from cookies we act on the basis of a legitimate interest (e.g. when it is necessary to process the registration form) or with the Participant’s consent (legal basis: Article 6(1)(a) or (f) of GDPR). For detailed information on the principles of passive data collection and the use of such data please consult the “Cookies” section of this Policy.

Personal Data recipients

The Personal Data of the Participants will be available to authorised CCHBC employees, postal operators (to the extent required to deliver correspondence, e.g. related to a participant’s appeal), banks (to the extent required to pay out the prize to the winners) and our service providers contracted by us to process the data for the purpose of performing the services provided for CCHBC, in particular the Competition Contractor, i.e. LUCKYYOU INTERACTIVE SP. Z O.O. (with its registered office in Poznań at ul. Zakręt 8, 60-352 Poznań) and providers of IT systems and tools, including electronic mail, used to process the Personal Data. The Personal Data will be stored in the data centre hosted in Crawley in the United Kingdom by the company Rackspace, which has another location in Ireland. However, the Personal Data of the Participants will always be made available only to those recipients who have a justified need for such access due to the tasks performed and services provided. We ensure that our employees complete relevant training on personal data protection by familiarising them with internal data protection policies and procedures or through dedicated training programs. All persons authorised to process the Personal Data are obliged to keep the data confidential and protect it against disclosure to unauthorised persons.

At the same time, we reserve the right to disclose the Personal Data in accordance with legal requirements or if we believe that the disclosure is necessary to protect our rights and/or to comply with court proceedings, a court order, a request from a regulatory authority or other legal proceedings to which we are a party.

Unless required by law, we will not in any way make available, sell or distribute any Personal Data of the Participants without their consent.

Furthermore, to the extent permitted by law, if our company enters into a joint venture, is sold to or merges with another business, the Personal Data will be disclosed to our new business partners or owners.

Transfer of data to third parties

CCHBC is a global company. In pursuit of the aforementioned processing purposes, the Personal Data of a Participant may be accessed by CCHBC employees, representatives or contractors from a country outside the European Economic Area (EEA). Legal regulations applicable in such a country may ensure a standard lower than the one applicable in the EEA. In such a situation, CCHBC will ensure that suitable safeguards are used with respect to the Participant’s information available outside the EEA.

Some non-EEA countries, such as Canada and Switzerland, have been approved by the European Commission as ensuring protection that is substantially equivalent to the personal data protection regulations applicable in the EEA and, consequently, no additional legal safeguards are required (the full list of such countries is available at http://ec.europa.eu/justice/data-protection/international-transfers/adequacy/index_en.htm). In the case of countries that have not been approved as mentioned above, such as e.g. Russia, the Participant’s data will be transferred based on standard contractual clauses approved by the European Commission, which impose equivalent personal data protection obligations on the recipient, unless the applicable data protection regulations make it possible to transfer the data without such formalities. Information on the safeguards used in case of transfer of data outside the EEA can be obtained by contacting CCHBC through the contact points indicated below.

All non-EU recipients to whom the Personal Data is transferred will process such data on behalf of CCHBC in order to deliver specific services or orders to us.

Personal Data storage period

The Personal Data of the Participants will be stored for the period required to organise the Competition, including to consider the Participants’ appeals, and after the end of the Competition – until the claims are time-barred, including claims related to copyrights and neighbouring rights. The Personal Data of the winners that is processed by the Organiser to meet its obligations arising under tax regulations will be processed for the period provided for in the legal regulations concerning the storage of accounting and tax documentation in order to document compliance with its regulatory liabilities.

If a Participant requests CCHBC to send him/her information on further editions of the Competition and traineeships by email, the Personal Data processed for this purpose will be stored until the Participant withdraws his/her consent to such form of contact.

CCHBC applies strict physical, administrative and electronic security measures in order to protect the processed Personal Data against unauthorised access and unlawful processing, accidental loss, destruction and damage if the data is online, which includes in particular justified protection measures against viruses and other harmful content. Due to the nature of the Internet, however, it is impossible to ensure that access to the website http://www.brandopener.eu will be uninterrupted and error-free, because of the website user’s responsibility for the level of security of his/her own access point (PC / laptop and mobile devices) and the Internet connection. We strongly recommend accessing the aforementioned website from a trusted, familiar access point and through an Internet connection protected with an anti-malware / anti-virus solution.

Rights and obligations of Participants related to the processing of Personal Data

The website is intended for adults only. Persons below the age of 18 must not provide Personal Data to us. Provision of Personal Data indicated by the Organiser as required data is necessary to enter the Competition or lodge an appeal against the Jury decision due to the fact that such data is required by the Organiser for correct organisation of the Competition or consideration of the Participant’s appeal. In the case of winners, the obligation to provide the Personal Data for the purposes of deducting and paying the relevant tax on the prize in the Competition arises from tax regulations. If a Participant refuses to provide data, the Organiser will have the right to exclude him/her from the Competition and refuse to issue the prize to him/her. The Participants are obliged to inform he Organiser about any changes in their Personal Data.

Each Participant may exercise the following rights at any time:

a. the right to request access to his/her Personal Data and obtain information on the processing of such data, and if such data should be incorrect he/she has the right to request its rectification (in accordance with Articles 15 and 16 of GDPR),

b. the right to request restriction of processing of his/her data in the situations and on the terms indicated in Article 18 of GDPR (the Participant may request restriction of processing of his/her Personal Data during the verification of the data correctness or until his/her objection to processing of the data is considered. This right can also be exercised if the Participant believes that the processing of the Personal Data is unlawful but he/she does not want the data to be erased immediately, and also when such data is required by the Participant for a time longer than the processing period adopted by us, due to establishment or defence of claims),

c. the right to request erasure of the data in accordance with Article 17 of GDPR (“right to be forgotten”),

d. the right to object, at any time, to the processing of his/her Personal Data if such data is processed by CCHBC in the pursuit of its legitimate interests (in accordance with Article 21 of GDPR).

CCHBC contact points

In matters related to the processing of Personal Data and exercise of the aforementioned rights, CCHBC can be contacted directly by sending correspondence to the address of our registered office or through the Data Protection Officer designated by CCHBC (contact to the DPO: DataProtectionOffice@cchellenic.com). A person who submits a request or demand concerning the processing of his/her Personal Data, including by exercising the rights vested in such a person, may be asked by CCHBC to answer a few questions related to his/her Personal Data to verify his/her identity.

CCHBC is committed to protecting the Participants’ Personal Data in accordance with the provisions of GDPR. However, if a Participant believes that we have breached these provisions, he/she may lodge a complaint regarding the processing of his/her Personal Data by CCHBC to the competent personal data protection authority. The personal data protection authority in Poland is the President of the Personal Data Protection Office (address: ul. Stawki 2, 00-193 Warszawa). The list of all data protection authorities operating in individual EU countries is available at: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080.

Links to other websites

The website http://www.brandopener.eu contains links to other websites, which are not controlled by us and which are not subject to this Privacy Policy. If a Participant navigates to other websites using the links, the operators of these websites may obtain information from him/her, which will be used in accordance with their respective privacy policies. Neither Coca-Cola HBC Polska Sp. z o.o. with its registered office in Warsaw nor any other company from the Coca-Cola HBC Group is in any way responsible for the principles implemented by the operators of such websites or for such operators’ processing the personal data of the users of their websites. Coca-Cola HBC Polska Sp. z o.o. encourages the Participant to read the privacy policies and cookie policies, as well as the terms of use of the websites to which such links, references or interfaces visited by the Participant relate, before he/she provides his/her personal data through such a third-party website.


This website uses cookies to distinguish the Participant from other participants of the website, helping ensure good user experience to the Participant while browsing the website and enabling us to optimise the website http://www.brandopener.eu.

Cookie is a small file containing letters and numbers, which is stored in the Participant’s browser or on the hard drive of his/her computer. Cookies contain information that are transferred to the hard drive of the Participant’s computer. Analytical cookies, on the other hand, are cookies that collect information allowing us to improve our website.

Type   Source     Validity period Purpose
_ga   Google Analyctics       2 years Used to distinguish website users.
_gid     Google Analyctics       24 hours Used to distinguish website users.
_dc_gtm_<property-id>     Google Analyctics     1 minute Used to limit the speed of sending the request.
_gac_<property-id>     Google Analyctics     90 days Collects campaign related information concerning the user.
_fbp          Facebook     2 months This cookie is set by Facebook to deliver advertisement when the user is on Facebook or a digital platform powered by Facebook advertising after visiting this website. 
fr     Facebook     2 months The cookie is set by Facebook to show relevant advertisements to the users and measure and improve the advertisements. The cookie also tracks the behaviour of the user across the web on sites that have Facebook pixel or Facebook social plugin.
zabVisitID   Zoho PageSense   1 year Used for identifying every visit made by the user on the web page.
zabSplit         Zoho PageSense         5 seconds Used for sending the experiment and visitor information to the server upon redirection.
zabBucket       Zoho PageSense       1 year Used to consistently serve visitors the same variation of the test they’ve seen before.
zabHMBucket   Zoho PageSense   1 year Used for identifying the exact heatmap experiment to be tracked on the web page.
{ exp_key }     Zoho PageSense     1 month     Used for deriving the path taken by the visitor and the number of visitors that dropped off while traversing through the funnel.
{ exp_key }   Zoho PageSense   1 hour Used for tracking actual user conversions.
zsr { expkey }   Zoho PageSense   2 hours Used for mapping all the user actions performed within a session.
{ sessionId }    Zoho PageSense   2 hours Used for identifying the start time, last interacted time, and number of pages visited for a session.
zabme   Zoho PageSense   1 year Used for serving the same experiment within a mutually exclusive group, the user has seen this before.
ps_payloadSeqId:   Zoho PageSense   2 hours Used to keep track of duplicate payloads (session data).
zabPZBucket   Zoho PageSense   1 year Used to consistently serve visitors the same experience they have seen before.
zPersonalization   Zoho PageSense   1 year Used for sending the experiment and visitor information to the server upon redirection.
zia_ { projectkey }   Zoho PageSense   1 year Used to avoid sending the same visitor data multiple times to the server.
zpc< projectkey>    Zoho PageSense   1 year Used to ensure that the banner does not reappear to the same visitor on your website.

The website user may accept or refuse to accept a cookie. Refusal to accept a cookie may in some cases preclude the user from using the website, negatively affect the display or operation of our website or some of its elements or functions.

There are various ways to manage cookies. Additional information on such functions can be found in the browser manual or in the help screen. For example, in the Internet Explorer browser the user can go to the tab Tools / Internet Options / Security and Privacy to adjust the browser to his/her expectations. If the website user uses different computers at different locations, he/she must make sure that each browser is configured in the way reflecting his/her preferences concerning cookies.

Some modern browsers offer a function of analysing the terms of privacy policies of websites, enabling the user to control his/her privacy protection needs. Such functions are known as “P3P” (Privacy Preferences Platform).

Cookies that were installed in the Cookies folder of the user’s browser can be easily deleted. For example, if a user of the website http://www.brandopener.eu uses the Microsoft Windows Explorer browser, he/she should:

•    Open Windows Explorer.

•    Click “Search” on the toolbar.

•    Enter “cookie” in the “Folders and files” search field.

•    Select “My computer” in the “Browse” field.

•    Click “Search now”. Double click on the folders in the search results.

•    “Choose” any cookie.

•    Press “Delete” on your keyboard.

In the case of other browsers, to find information about the folder with cookies select “cookies” in the “Help” function.

Introducing changes to this Privacy Policy

We encourage you to check this Privacy Policy regularly to keep up to date with any changes. This Privacy Policy may be changed or supplemented, and the Participant will be notified of such changes or additions by email. Furthermore, information on main changes to this website will be posted on this website for at least 30 days after the change.