Last updated December 01, 2025
This Privacy Policy (hereinafter referred to as the “Policy”) defines the procedure and conditions for the processing of personal data when using the informational website https://cor-e95.cor-int.com, as well as related online services, including COR-Energy / COR ID mobile applications (if this Policy applies to them) (hereinafter collectively referred to as the “Services”).
This Policy describes how, on what legal grounds, and for what purpose we may access, collect, record, store, use, and/or transfer (“process”) your personal data when you use the Services, including when you:
The owner (controller) of personal data is “COR-E95” LIMITED LIABILITY COMPANY (hereinafter – “COR-E95”, “we”, “us”, “our”), which determines the purposes, categories, and scope of personal data processed through the Services, and bears primary responsibility for their processing in accordance with the Law of Ukraine “On Personal Data Protection” and, where applicable, EU data protection legislation (GDPR).
Technical implementation and publishing of the software (including the COR-Energy / COR ID mobile application and related backend/frontend program code, APIs, integrations with payment services, CRM/ERP, and analytics) is carried out by “COR-SOFTWARE” LIMITED LIABILITY COMPANY (hereinafter – “COR-SOFTWARE”), which acts as the processor (processor) of personal data and processes users’ personal data exclusively on behalf of and under the documented instructions of “COR-E95” LLC, without independently determining the purposes and categories of processing.
COR-Energy is a mobile application for purchasing fuel, food, drinks, and other goods, providing users with a convenient self-service experience at filling stations by interacting with our server infrastructure, payment gateways, and internal accounting systems.
Reading this Policy will help you understand exactly what data we process, why we process it, what rights you have as a personal data subject, and how to exercise them. “COR-E95” LLC is responsible for making decisions regarding how your personal information is processed.
By using the Services, you confirm that you have read this Policy, understand which company is the owner (controller) of your personal data and what role “COR-SOFTWARE” LLC plays as the processor (processor), and agree to the conditions of their processing described in the Policy. If you do not agree with our policies and practices regarding personal data protection, please refrain from using the Services. If you still have questions or concerns, you can contact us through the communication channels specified in the “Contacts” section of this Policy.
Have questions? Reading this Privacy Notice will help you understand your rights and options regarding the protection of personal data. We are responsible for making decisions about how your personal information is processed. If you do not agree with our policy and practice, please do not use our Services. If you still have questions or concerns, please contact us at the contact email address.
This summary presents the key points from our Privacy Notice, but you can learn more about any of these topics by clicking the link after each key point or by using the table of contents below to find the relevant section.
Personal Information You Provide to Us
In Short: We process personal data that you voluntarily provide to us through our websites and/or mobile applications, as well as during registration and use of COR-Energy / COR ID.
We collect personal information (personal data) that you voluntarily provide to us when you:
Personal data you provide. The scope of data depends on the specific context of your interaction with us and the Services. In particular, we may process the following categories of data:
We do not require and knowingly do not ask you to provide special (sensitive) categories of personal data (e.g., health data, racial/ethnic origin, political opinions, religious or philosophical beliefs, sexual orientation, etc.) and ask you to refrain from entering such information in forms, resumes, or “comment” fields.
Payment data. If you make a payment through COR-Energy, third-party payment services may be involved in processing the payment (such as a bank payment gateway, Apple Pay, Google Pay, or another provider specified in the payment interface).
In doing so:
The privacy policy of the respective payment service is provided by the provider and is available in the payment form interface.
Login data. We provide the ability to register and log in to COR-Energy using:
We do not support authentication via third-party social media accounts (Facebook, Google, X, etc.) and, accordingly, do not receive any information about you from social media providers.
COR ID. Upon registration in COR-Energy, a unique identifier—COR ID—is automatically created for you. It serves as your digital “passport” for authentication and access to the COR ecosystem’s services (a set of interconnected digital services and information systems under the COR brand, including the COR-Energy mobile application, the COR ID authentication system, the COR Admin administrative panel, websites, and related APIs). These services operate on a shared technical infrastructure, are integrated with payment, analytical, and marketing platforms, and are used by “COR-E95” LLC to provide services to Users and by “COR-SOFTWARE” LLC to develop, support, and maintain them technically as a personal data processor.
The COR ID stores basic account data, including:
The specific set of COR ID fields may change as the COR ecosystem develops, while we strictly adhere to the principle of data minimization.
Application data. If you use our mobile applications, we may process additional information related to the app’s functionality, provided that you have granted the appropriate permissions in your device settings.
In particular, this may include:
Geolocation information. We may request access to your device’s geolocation (precise or approximate) to:
You can change geolocation access at any time in your device settings (“always”, “only while using the app”, “denied”).
Access to device features. Depending on the specific version of the application, we may request access to individual device features (e.g., camera for scanning QR codes/barcodes, Bluetooth to interact with filling station equipment, storage for data caching).
If certain permissions are not needed or you do not wish to grant them, you can restrict or revoke access in your device settings.
We do not request access to your social media accounts for authentication, nor do we import your personal data from them.
Push notifications. We may send push notifications (service-related and, with your consent, marketing), including:
You can manage push notifications in the application or operating system settings.
This information is used, among other things, to maintain the security and proper functioning of the applications, troubleshoot technical issues (debugging), and for internal analytics and reporting (usage monitoring, crash reports).
Duty to keep data up to date.
All personal information you provide to us must be true, complete, and accurate. You are responsible for updating such data in a timely manner if it changes (e.g., a change in email or phone number).
Automatically Collected Information
In Short: Certain technical data (e.g., IP address, browser type, device characteristics, event logs) is collected automatically when using the Services—for security, technical support, and analytics.
When you visit, use, or browse our Services, we automatically collect certain information. Generally, this information does not contain direct identifiers (full name, email, phone number) but may constitute personal data under applicable law as it is linked to a specific device/session.
Such information may include:
Like many companies, we use cookies and similar technologies (such as pixels, local storage, and analytics SDKs) to collect this information. You can learn more about our use of cookies and similar technologies in our Cookie Policy.
The information we automatically collect includes, in particular:
Log data and usage data. Our servers (backend) automatically record technical events related to the operation of the Services in log files:
Device data. We may obtain information about the device type, operating system, model, application version, application/device identifiers (e.g., advertising IDs), browser type, internet service provider or mobile operator, screen settings, and system configuration. This data allows us to optimize the interface for different devices and monitor technical stability.
Location data. Part of the location information may be determined automatically (e.g., approximate location based on IP address). With your separate consent and device settings, we may receive more precise geolocation data (see the “Application data” block above). You can restrict or disable the collection of geolocation data by changing your browser or mobile device settings. However, in this case, certain features of the Services may not work properly or may be unavailable.
All automatically collected information is primarily used for:
In Short: We process your personal data to provide and support the operation of the Services, process your requests and orders, ensure security, perform analytics and marketing, and comply with legal obligations. Certain types of processing are carried out only with your consent.
We process your information depending on how exactly you interact with the Services, including:
Account creation, authentication, and administration. We process your data (COR ID, email, password hash, profile settings) to:
Provision and support of services. We process your data to:
User support and feedback. We use your contact data and the content of your communications to:
Administrative notifications. We may send you service (non-marketing) notifications, including:
Order and payment fulfillment and management. We process data regarding your orders and transactions to:
Analytics, product improvement, and UX. We analyze aggregated and technical data (logs, analytical events, crash reports) to:
Fulfillment of legal obligations and protection of rights. We may process your data to:
Marketing and informational newsletters. We may use your contact details (including email, push tokens) to:
You can always opt out of marketing emails / push notifications by using the appropriate unsubscribe mechanism or by changing your notification settings.
Targeted advertising (Google, Meta, etc.). We may process information about your interaction with the Services (cookies, device identifiers, analytics events) to:
For more details on the use of cookies and similar technologies, see Section 4 of this Policy.
We may process your personal and technical data to:
For this purpose, server log files, security logs, and system events at the backend and mobile SDK levels are used, among others.
COR-Energy uses COR ID as a single point of authentication and storage for user credentials.
The password is stored in the COR ID in an encrypted/hashed form.
The COR-Energy mobile application does not store your password in plain text; instead, it uses token-based authorization (access/refresh tokens) and requests to COR ID via a secure protocol (HTTPS/TLS).
COR-Energy only “knows” that COR ID has confirmed your authentication and receives technical identifiers from COR ID (user ID, tokens, basic profile attributes).
Business data (fuel prices, promotions, news, filling station settings, product catalogs, etc.) is stored in a separate administrative information system, “COR Admin”—an internal back-office web panel for managing content and configurations of the COR ecosystem. Authorized employees of “COR-E95” LLC use it to manage business parameters, while “COR-SOFTWARE” LLC provides its hosting, technical support, and integration with COR-Energy and COR ID via secure APIs. This business data:
Thus:
Access to your personal data within “COR-E95” LLC is restricted to those employees for whom it is objectively necessary to perform their official duties, including:
All such individuals are bound by a duty of confidentiality and use the data exclusively within the framework of approved processes.
We may transfer your data to third parties that provide services to “COR-E95” LLC (IT infrastructure, payments, marketing, loyalty programs, etc.) and require access to the data solely to perform their contractual obligations. Such counterparties:
Such third parties may include:
“COR-SOFTWARE” LLC – the primary technical processor, developer, and publisher of the COR-Energy/COR ID mobile application on the App Store and Google Play. It ensures:
Sub-processors of “COR-SOFTWARE” LLC – contractors engaged by it (e.g., cloud platforms, logging and monitoring providers, SMS/email gateways) that provide:
“COR-SOFTWARE” LLC engages them based on contracts that include restrictions on personal data processing.
Payment providers – Apple Pay, Google Pay, banking acquiring services, and other certified payment organizations through which payments are processed.
Loyalty program partners – in the event that you use bonuses (e.g., Cor-Coins or another virtual currency) to obtain goods or services from partners:
Marketing and analytical platforms – Google, Meta, and other services that receive data via integrated scripts and SDKs (cookies, pixels, app events) solely to the extent necessary for analytics and targeting, in accordance with Section 4 of this Policy.
All such third parties are prohibited from using the data received for purposes not agreed with “COR-E95” LLC and are obliged to ensure an appropriate level of personal data protection.
We may transfer your personal data to:
In certain cases, we may transfer your data as part of corporate transactions and group structure:
Business transfer. In the event of a merger, division, reorganization, sale of assets, the attraction of an investor, or the transfer of the business (in whole or in part) to other companies, your data may be transferred to the successor. In such a case, we will ensure that the new entity assumes all obligations regarding personal data protection set forth in this Policy.
Affiliated persons. We may share data with our affiliates (parent company, subsidiaries, joint ventures) to the extent necessary for:
All affiliated entities are required to act in accordance with rules compatible with this Policy.
Business partners. We may share a limited amount of data with business partners if necessary for:
In such cases, the partner may act as an independent personal data controller and bear sole responsibility for the further processing of your data in accordance with its own privacy policies.
We do not sell your personal data to third parties in the sense of direct commercial transfer of data as a standalone commodity.
Data transfer occurs exclusively:
In Short: We may use cookies and other tracking technologies to collect and store your information.
We may use cookies and similar tracking technologies (like web beacons and pixels) to collect information when you interact with our Services. Some online tracking technologies help us maintain the security of our Services and your account, prevent crashes, fix errors, save your preferences, and assist with essential site functionality.
We also allow third parties and service providers to use online tracking technologies on our Services for analytics and advertising, including managing and displaying advertisements, tailoring ads to your interests, or sending abandoned cart reminders (depending on your communication preferences). Third parties and service providers use their technologies to deliver advertising for products and services relevant to your interests, which may appear on both our Services and other websites.
Specific information on how we use such technologies and how you can opt out of certain cookies is set forth in our Cookie Policy.
In Short: You can register and log in to COR-Energy using a COR ID or an email with a password. Sign-in data is used exclusively for authentication and securing access to your account.
Our Services provide the ability to register and log in exclusively via:
We do not support authentication via third-party social media accounts (Facebook, Google, X, etc.) and, accordingly, do not receive personal data from social media providers for login purposes in COR-Energy.
The password you create is stored in the COR ID infrastructure as a cryptographic hash, not in plain text. COR-Energy:
The information you provide for sign-in (email, password, COR ID, tokens, sign-in logs) is processed exclusively for:
We do not use sign-in data (login, password, tokens) as an independent basis for marketing profiling or transfer to third parties, except in cases explicitly specified in this Policy (technical processors, security, fulfillment of legal obligations).
If you follow links from the Services to third-party websites or applications (including social networks), the processing of your personal data on such external resources is carried out in accordance with their privacy policies. We do not control such sites/applications and are not responsible for how they collect, use, or disclose your information. We recommend that you independently familiarize yourself with the privacy policies of such third parties.
In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice, unless otherwise required by law.
We will retain your personal information only for as long as necessary for the purposes set forth in this Privacy Policy, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). None of the purposes specified in this notice require us to retain your personal information for longer than the period during which you hold an account with us.
If we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.
In Short: We aim to protect your personal information through a system of organizational and technical security measures.
We have implemented appropriate and reasonable technical and organizational security measures designed to protect the security of any personal information we process. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Although we do our best to protect your personal information, transmission of personal information to and from our Services is at your own risk. You should only access the Services within a secure environment.
In Short: We do not knowingly collect data from children under 18 years of age or sell it to children.
We do not knowingly solicit data from or market to children under 18 years of age, nor do we sell such personal information. By using the Services, you represent that you are at least 18 years of age or that you are the parent or guardian of such a minor and consent to such minor dependent’s use of the Services. If we learn that personal information from users under 18 has been collected, we will deactivate the account and take reasonable measures to promptly delete such data from our records. If you become aware of any data we may have collected from children under 18, please contact us at info@cor-energy.com.
In Short: In cases provided by law, you may request access to, rectification, erasure, or restriction of the processing of your personal data; object to processing (including for marketing purposes); withdraw your consent; and request account closure.
Depending on the applicable law (primarily the legislation of Ukraine and, in certain cases, EU law), you have the following rights, among others:
If we rely on your consent as the legal basis for processing:
If at any time you wish to review or change your account information or close your account, you can:
Upon your request to terminate the account, we will:
Most browsers are set to accept cookies by default. You can:
If you choose to delete or block cookies, this may affect the performance of certain features of our Services (authentication, saving preferences, operational stability). For more details on the use of cookies and other tracking technologies, see Section 4 of this Policy.
To exercise any of the aforementioned rights or to obtain additional clarifications regarding the processing of your personal data, you can:
We will review your request and provide a response within the timeframes established by applicable law.
Most web browsers, as well as some mobile operating systems and mobile applications, include a Do-Not-Track (“DNT”) feature or setting that you can activate to signal your privacy preference that your online browsing activity not be monitored or collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.
In Short: Yes, we will update this notice as necessary to stay compliant with applicable laws.
We may update this Privacy Policy from time to time. The updated version will be indicated by an updated “Revised” date at the top of this Privacy Notice. If we make material changes to this Privacy Policy, we may notify you either by prominently posting a notice of such changes or by sending you a notification directly. We encourage you to review this Privacy Policy frequently to stay informed about how we protect your information.
If you have questions or comments about this Privacy Policy or the processing of your personal data, you can contact:
Regarding personal data protection issues (Controller):
Regarding issues related to application publishing and technical support (Publisher/Processor):
Note: We recommend using email as the primary channel of communication.
Data Protection Officer (DPO)
To ensure an appropriate level of information security and compliance with data protection laws, “COR-E95” LLC engages “COR-SOFTWARE” LLC as its technical partner, which, in particular, performs the functions of:
For matters concerning the functions of the Data Protection Officer (DPO) in the technical processing phase, you can contact “COR-SOFTWARE” LLC at the email address specified in Section 12 of this Policy (or through another officially published communication channel).
In any case:
Under applicable laws in your country, you may have the right to request access to the personal data we collect from you, details about how we process it, to correct inaccuracies, or to delete your personal data. You may also have the right to withdraw your consent to our processing of your personal information. Under certain circumstances, these rights may be limited by applicable law. To request a review, update, or delete your personal information, please visit https://azk-cor-energy.com