Définitions

General Data Protection Regulation (GDPR)” – European Union Regulation aimed at harmonizing European legislation on the protection of personal data. It has been applied since May 25, 2018, and any reference thereto should be interpreted to include national implementing legislation.

Personal data” means any information relating to an identified or identifiable natural person ( data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Sensitive personal data” means any personal data which contain information on racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, physical and mental health, genetic and biometric data, data on sexual life or sexual orientation, and information on criminal convictions and offences. Because of the nature of sensitive personal data, the legislation is much more rigorous about how these data should be processed. The Company processes sensitive personal data only in accordance with the law.

Personal data breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

Restriction of processing” means the marking of stored personal data with the aim of limiting their processing in the future Collaborators” means natural persons with whom the Company might keep any kind of business or contractual relationship or partnership.

Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

1. Scope

This Privacy Statement describes our procedures regarding the processing of personal data, namely the collection, registration, organizing, structuring, storing, adaptation or alteration, retrieval, search, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of your personal data.

CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA” reserves the right to modify and adjust this statement whenever deemed necessary, and the changes will take effect in the moment you are notified of them, either via e-mail or by posting them on the Internet or by any other way the Company deems appropriate.

If the terms of your cooperation with CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA” are defined by more specific terms regarding the protection of personal data, these terms shall apply in conjunction with the present ones. In the event of incompatibility, the specific terms of use of each service shall prevail.

2. Collected data

• Personal/corporate name
• Email address, Postal address.
• Other contact information, such as our customers ’phone number or the phone number of our customers ’contact persons.
• Invoicing details, namely the TIN and the Tax Office.
• Personal data is also collected and processed in the case of telephone services.

3. Processing Purposes

The company CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA” collects and processes your personal data mentioned above for the following purposes:

• CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA” if it gets prior consent from you, might process your personal data in order to inform you of new services or promotions, either its own or from sponsors and collaborators, that might be of interest to you. For this purpose, it processes your data to present to you new services and promotions, its own or from sponsor and collaborators, that best serve your needs.

• CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA” may use personal data to improve its products and services.
• CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA” may use personal data to communicate for market research purposes.

• In any case, you are entitled to object to the processing of your personal data for the above purpose by addressing your request to……

• CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA” collects and processes the users of its website s personaldata solely forthe purposes mentioned above and only to the extent strictly necessary to effectively serve those purposes.

4. Legal Basis

In order to be able to fulfil the contractual obligations of the company CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA” towards you and to monitor the fulfilment of the contractual obligations of the company CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA” s collaborators, the legal basis according to which the Company legally processes the data of its members is Article 6, par. 1 (b) of the GDPR, where it is stipulated that CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBEREDSA”” may process data if processing is necessary for the performance of a contract in which the data subject is a contracting party”.

Apart from CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA”” s contractual obligations, it also has to comply with several obligations stemming from the current legislative framework. According to Article 6, par. 1 (c) of the GDPR, CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA” might process personal data when processing is necessary to comply with its legal obligation”.

According to the provisions of Article 6 par. 1 (f) of the GDPR, CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA” may process personal data when such processing is necessary for the purposes of the legitimate interests pursued by CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA”, unless the interests or the fundamental rights and freedoms of data subjects that impose the personal data protection prevail over such interests .

The following cases are a non-exhaustive report of the legitimate interests pursued in order to
successfully achieve the corporate objectives:
• safeguarding your safety and protection.
• protecting the property of CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA”, as well as documenting, securing and enforcing claims from the Company against third parties for damages to its property.

In extremely limited cases, we might seek your consent through means of positive action (opt-in) before we proceed in specific processing of your data. For example, we might ask for your consent to send you informative or promotional material or to publish your data on corporate printed material or other means for promotional purposes.

5. Retention period

CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA” will retain the personal data as stipulated in the applicable provisions of the law and only for as long as it is required to fulfil the purposes stated in the preceding sections or for the time required by law or to defend CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA” against possible judicial actions to pursue claims. In addition, we shall retain the personal data of the persons who subscribed to the newsletters until those persons inform us that they no longer wish to receive newsletters from us.

6. Information Security

The actions followed by CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA” for processing personal data are carried out in a way that ensures its confidentiality. In particular, they are carried out exclusively by the personnel of CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA” instructed for that purpose. Moreover, all appropriate organizational and technical measures are taken to ensure data security and protection against accidental or illegal destruction, accidental loss, alteration, prohibited dissemination or access, and any other form of illegal processing.

7. Transmission to Third Parties

CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA” shall not in any way transmit the personal data of its members, nor interconnect its archive in exchange for financial or other compensation with any third private companies, natural and legal persons, public authorities or services or other organizations.

8. About Your Rights

One of the basic principles of the GDPR is the protection of the rights of natural persons regarding the processing of their personal data. In this context, you have a set of rights related with your personal data that happen to be processed by CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA”,
namely:

• Right to object: this right allows you to object to the processing of your personal data, especially when the processing is done for purposes of a legitimate interest of the CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA”. If the processing is done for the purpose of serving its legitimate interests, CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA” will comply with your objection and terminate such processing unless CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA” can demonstrate absolute and legal reasons for processing, that prevail over your interests, rights and freedoms or such processing is done to establish, exercise or support legal claims of CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA”.

• Right to withdraw consent: If your personal data processing is based on prior consent, you have the right to withdraw your consent at any time and CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA” will cease the specific activity you previously consented to, unless there is an alternative legal basis justifying the continuation of your data processing for that purpose, in which case you will be informed.

• Rights to access and rectification and erasure: You can request at any time to be informed about your personal data that CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA” holds about you and request the editing, rectification, updating or erasure of that information. We might ask you additional information so as to process your request. However, since we give you access to the information we hold about you, this will be done without financial costs for you, unless your claim is clearly unfounded or illegitimate”. Since we have the legal right to deny your request, in the event of such denial, we will inform you on the specific reasons for such denial.

• Right to restriction of processing: In some cases, you have the right to block” or withdraw further use of your personal data. In practice this means that we can store your data, but we will not be able to process it further, unless such processing happens with your consent, or such processing is necessary either to establish, exercise or support legal claims of CRETAN INVESTMENT GROUP OF HELLAS SINGLE MEMBERED SA”, or for the protection of the rights of another person or also for reasons of public interest. We keep lists of people who have requested to block” the further use of their personal data to make sure that the restriction will be respected in the future.

• Right to portability: You have the right to transfer your personal data to other controllers. In practice this means that you have the ability to transfer the information we hold about you to any third party. In order to implement this right, we will provide you the data in a structured, commonly used and machine readable format so that you can transfer your data to another person responsible for processing. Alternatively, we can also send the data directly in your name. The right to portability applies to (a) data we process automatically (i.e. without human intervention), (b) for personal data provided by you (c) for personal data which is processed based on your consent, or whose processing is necessary for the execution of a contract.

• Right to lodge a complaint with competent authorities: You have the right to file a complaint to the competent supervisory authority, which for Greece is the Personal Data Protection Authority.

You can contact the Personal Data Protection Authority through the following ways:

Postal Address: Personal Data Protection Authority, Headquarters: 1-3 Kifissias Ave., P.C. 115 23,
Athens
Call Centre: +30-210 6475600
E-mail: contact@dpa.gr

9. Company s Details

CRETAN INVESTMENTS GROUP OF HELLAS SINGLE MEMBER S.A.
HOTELIER & TOURISM ENTERPRISES
HEADQUARTERS: INDUSTRIAL AREA OF HERAKLION STR A’
PO GR 71601 HERAKLION CRETE GREECE
VAT No EL 801289325 TAX OF HERAKLION

Do you have any questions? Contact us!
If you have any questions about this Statement, please contact us by e-mail to info@elioshill.gr