Last updated: 26 October 2026 · Version 2026.2
This policy explains what personal data METRO Foods Trading Ltd (“METRO”, “we”) collects about customers and visitors to our stores and our website, why we collect it, how long we keep it and what rights you have.
1. Who we are and how to contact us
The data controller is METRO Foods Trading Ltd, Nicodemou Mylona 1, 6050 Larnaca, Cyprus.
We have appointed a Data Protection Officer (DPO). For any question about your personal data or to exercise your rights, write to [email protected] or to the address above, marked “For the attention of the DPO”. You can also ask at any METRO store.
2. What we collect and why
METROcard
When you join METROcard we collect your name, address, email, phone number and date of birth. When you shop with your card we record your purchases and points, so that you earn and redeem points and receive the benefits of the programme.
Legal basis: performance of the METROcard programme you joined. Retention: while your card is active. If a card is not used for 3 years, the account is closed and its data deleted.
Offers and messages
If you have agreed to receive them, we send METROcard members offers and coupons by SMS or email. To make them relevant, we may select offers based on what you buy. You can stop these messages at any time by calling the free NO-SMS number shown at the bottom of every SMS, by writing to [email protected] or by asking at any store; we then add your number to our opt-out list. You can also object to offers being based on your purchases.
Legal basis: your consent. Retention: until you withdraw your consent or your METROcard data is deleted.
Our website
When you visit www.metro.com.cy our web server records technical data such as your IP address, browser and the pages requested. We use this to run the site and protect it from attacks; these logs are kept for up to 14 days. Statistics and advertising cookies (Google Analytics, Google Ads, Meta Pixel) are used only if you accept them. See our Cookies Policy, and change your choice at any time with “Cookie Settings” at the bottom of every page.
Legal basis: our legitimate interest in running a secure website; your consent for statistics and advertising cookies.
The METRO app and notifications
The METRO app (www.metro.com.cy/app) shows our offers and our stores. It does not ask for your name or contact details and uses no tracking cookies. If you turn on notifications with the bell button, your phone gives us a technical address for your device (a “push subscription”, issued by Google, Apple or Microsoft depending on your phone) and we keep it with the language you chose, so that we can tell you about new offers and important store news. We cannot identify you from it. You can turn notifications off at any time with the bell button or in your phone’s settings, and we then delete it.
Legal basis: your consent. Retention: until you turn notifications off, or until the push service tells us the address is no longer valid.
Contact forms and enquiries
When you use a form on our website, email us or call us, we use the details you give us (such as your name, contact details and message) to reply to you. Our contact form is protected by Google reCAPTCHA, which checks that it is used by a person and not an automated program; Google processes data such as your IP address for this purpose.
Legal basis: our legitimate interest in answering you, or steps you ask us to take. Retention: up to 2 years after we close your enquiry.
Tell METRO: comments and satisfaction surveys
If you send us a comment or take part in our customer satisfaction survey, we collect your answers and, if you give them, your email or phone number, so that we can improve our service and contact you if you asked us to. Some answers (such as age group or household size) are optional. The survey is run for us by a specialist research provider.
Legal basis: your consent. Retention: up to 2 years.
Complaints and incidents
If you make a complaint or are involved in an incident in a store, we record your contact details, the details of the complaint and any receipt or photos you provide, so that we can deal with it and keep the records we need.
Legal basis: our legitimate interest in handling complaints and our legal obligations. Retention: as long as needed to resolve the matter and for any legal claims.
CCTV in our stores
Our stores and car parks are monitored by CCTV (images only, no sound) to protect customers, staff and property and to prevent crime. Signs mark the monitored areas. Footage is kept for 3 weeks and then overwritten, unless it is needed to investigate a specific incident or is requested by the police.
Legal basis: our legitimate interest in security.
Job applications
If you apply for a job with us, we use your application to assess it. If you are not hired, we keep it for up to 3 years only if you agree, so that we can contact you about future positions.
Orders through Wolt and Bolt Food
When you order METRO products through Wolt or Bolt Food, the delivery platform is responsible for your account, payment and delivery data under its own privacy policy. We receive only what we need to prepare your order.
3. Who we share your data with
We do not sell your personal data. We share it only with:
- service providers who work for us under contract and only on our instructions: IT, hosting and back-up providers, our business software provider, SMS and email providers, our survey provider and the security companies that operate our CCTV;
- Google Ireland Ltd and Meta Platforms Ireland Ltd, only for the cookies you accept (see the Cookies Policy);
- Google, Apple or Microsoft (depending on your phone), only to deliver the app notifications you turned on;
- public authorities, such as the police or courts, where the law requires it.
4. Transfers outside the EU
We keep your data in the European Union. Where a provider such as Google or Meta transfers data outside the European Economic Area, the transfer is protected by an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework) or by the Commission’s standard contractual clauses.
5. How we protect your data
Access to personal data is limited to authorised staff who need it for their work. We use technical and organisational measures such as access controls, encrypted connections, firewalls and back-ups to protect it.
6. Your rights
You have the right to:
- know whether we hold data about you and get a copy of it;
- have inaccurate data corrected;
- have your data deleted when we no longer need it or you withdraw your consent;
- restrict how we use your data;
- object to processing based on our legitimate interest, and at any time to marketing and to offers based on your purchases;
- receive the data you gave us in a common electronic format (portability);
- withdraw your consent at any time, without affecting what we did before.
To use any of these rights, contact [email protected] or ask at any store. It is free. We will reply within one month; if your request is complex we may extend this by up to two more months, and we will tell you why. We may ask you to confirm your identity.
7. Complaints
If you are not satisfied with our answer, you can complain to the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, www.dataprotection.gov.cy, [email protected].
8. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows the latest version.
