1. Subject matter of the Personal Data Protection Policy.
For the purposes of this Policy, the following terms have the following meaning:
"Applicable legislation": The respective national and EU legislation on personal data protection and specifically the General Data Protection Regulation (EU) 2016/679 (hereinafter "GDPR"), Law 4624/2019 as well as its Decisions, Instructions and Opinions of the Personal Data Protection Authority (hereinafter "PDPA").
"Personal Data": any information relating to an identifiable natural person ("data subject"); , ID number, location data, online ID or one or more factors that characterize the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.
"Specific categories of personal data": personal data disclosing racial or ethnic origin, political beliefs, religious or philosophical beliefs or trade union affiliation, and the processing of genetic, biometric data relating to health or the sexual life or the sexual orientation of a natural person.
"Processing": any operation or sequence of operations performed with or without the use of automated means, on personal data or on personal data sets, such as collection, registration, organization, structuring, storage, adaptation or alteration, retrieval, search, use, disclosure, dissemination or any other form of disposal, association or combination, restriction, deletion or destruction.
"Processor": a natural or legal person, public authority, department or other body which, individually or jointly with others, determines the purposes and manner of processing personal data. When the purposes and the method of processing are determined by Union law or the law of a Member State, the controller or the specific criteria for his appointment may be laid down by Union law or the law of a Member State. In this case, our Company acts as the Controller.
"Executor": the natural or legal person, public authority, department or other body that processes personal data on behalf of the controller.
"Subject of Processing": the natural person whose personal data are being processed. In this case, every user of our Website is considered as the subject of the processing.
"Consent" of the data subject: any indication of will, free, specific, explicit and fully aware, by which the data subject expresses his or her consent, by declaration or clear positive action, to the processing of personal data concern it.
"Personal data breach": a breach of security that results in accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access to personal data transmitted, stored or otherwise processed.
3.Personal data we collect from the users and we process.
3.1 Personal data we collect through a contact form.
The purpose of the collection and processing of such personal data is your immediate and optimal possible response and service. The legal basis for the processing of personal data is the legal interest of the Company to provide high quality services to the users of our website.
The purpose of collecting and processing this data is to improve the functionality of our website, the services provided to you, as well as the analysis of its traffic. Legal basis for the processing of personal data, is your free explicit consent which you grant by accepting these cookies, with the exception of the only necessary cookies which are permanently installed and are absolutely necessary for the operation of our website, for which legal processing basis is the legal interest of the Company.
3.3 Personal Data we collect through the "User Registration"
The purpose of collecting and processing this data is your registration as a registered user of our website so that you can purchase tickets so we can contact you. The legal basis for the processing of personal data is the legal interest of the Company to provide high quality services to the users of our website.
3.4 Personal Data we collect through the "Work with us" form
The purpose of the collection and processing of this data is your evaluation as a prospective employee / partner, while the legal basis for the processing of your personal data is your free explicit consent, which you grant when completing and submitting the relevant form.
3.5 Personal data we collect when placing an advertisement
The purpose of collecting and processing this data is to register and post your advertisement in order the tickets to be sold and ultimately manage to sell the item you have chosen. The legal basis for the processing of your personal data is the fulfillment of the contractual obligation we have undertaken towards you.
3.6 Personal data we collect when purchasing a ticket
The purpose of collecting and processing this data is your participation in the lottery and in case you win, the transmission of your contact details (ie phone and email) to the seller, in order to arrange the delivery of your prize. The legal basis for the processing of your personal data is the fulfillment of the contractual obligation we have undertaken towards you.
3.7 Personal data that we process when announcing the winner.
In case you become the winner of the Competition, you will be sent a relevant informative email which will notify you about a) announcement of you as the winner of the Competition, b) the transmission of your details, ie full name and email, to the seller in order to contact you and hand over your prize, c) after your explicit and free consent, the name and the prize you won will be posted on our website. In case you do not give us this consent, only the ticket code will be posted on our website as the winner of the Competition, without your identification being possible.
The purpose of collecting and processing this data is the completion of the Competition, the delivery of your prize and the announcement of the winner on our website. The legal basis for the processing of your personal data is the fulfillment of the contractual obligation we have undertaken towards you and your explicit and free consent.
4. Personal Data of Minors
Our website is not intended for minors and does not wish to collect and process personal data of minors (ie persons under 18 years of age). However, as it is impossible to cross-check and verify the age of the users, we ask the parents / guardians of the minors, in case they find any unauthorized disclosure / provision of data by the minors, to immediately notify the Company, so that we can take the necessary measures (eg deletion of such data). In the event that we become aware that we have collected personal data of a minor, we undertake to delete it immediately and to take all necessary measures to protect such data.
5. Time period of keeping your personal data
Your personal data is kept for a predetermined and limited period of time, depending on the purpose of the processing, after which the data is deleted from our files. When processing is required by law or a specific retention period is provided, your personal data will be retained for as long as the relevant provisions require.
6. Safety of your personal data
Taking into account the latest developments, implementation costs and nature, scope and purposes of processing, as well as the risks of different occurrence and severity of the rights and freedoms of users from processing, we obtain the necessary technical and organizational measures to protect your personal data. Although no internet transfer method or electronic storage method is completely secure, we take all the necessary digital security measures for your data etc.
7. Transfer of your personal data to third parties
Our Company may transmit your personal data to third parties, to whom it has entrusted the processing of personal data on its behalf (such as random.org, service companies, etc.). In any case, the third parties to whom the data of the users may be transmitted are contractually bound to us in order to ensure the obligation of confidentiality as well as all the obligations provided by the Applicable Legislation. At the same time, your personal data may be transferred to public authorities, independent authorities, etc. (eg Police Departments, Prosecution, Tax, Customs, PDPA, etc.) in the exercise of their duties automatically or at the request of a third party interest and in accordance with legal procedures.
8. Transfer of Personal Data outside the EU
Your personal data collected through our website is transmitted to the United Kingdom where our Company is headquartered, that is in a country outside the European Union (EU) or the European Economic Area (EEA) as this transmission is necessary for the conclusion and the execution of the contract between us (article 49 par. 1 'b and ΄c of the GDPR).
Otherwise, the transfer to a third country is prohibited and the Company will not transfer your personal data to it, unless one of the special derogations provided by the GDPR applies (eg the explicit consent of the user and informing him about the risks involved in the transfer or if the transmission is necessary for the execution of a contract at the request of the subject, or there are reasons of public interest, or it is necessary to support legal claims and vital interests of the user and so on).
9. Your rights
Our Company ensures that it is able to respond immediately to the requests of users, in order to exercise their rights in accordance with the applicable law.
In particular, as a user of our website you have the following rights:
1. Request information about the processing of your personal data by the Company.
2. Request access to your personal data held by the Company. More specifically, you can request a copy of your personal data that is kept in order to check the legality of the processing.
3. Request the correction of your personal data in case of incorrect or incomplete registration by the Company.
4. Request the deletion of your personal data if their retention is not based on any legal basis or legal interest.
5. Request a restriction on the processing of your personal data, under certain conditions.
6. Request the portability / transfer of your personal data either to you or to third parties.
7. To revoke at any time the consent you have given for the processing of your personal data, without this revocation affecting the legality of the processing until then.
8. Oppose the processing of your personal data by the Company.
9. Oppose a decision that concerns you and is made solely on the basis of automated processing, including profiling.
To exercise your rights, you can contact us via the contact form on our website or email us at email@example.com. In case of exercise of any of the above rights, we undertake to respond immediately and in any case within one (1) month of receipt of the request and your identification. This deadline may be extended by another two (2) months, if required, if the request is complex or there is a large number of requests. For any complaints regarding this Policy or personal data protection issues, or if we do not satisfy your request, you can contact the DPA at www.dpa.gr.
10. Disclaimer for Third Party websites
In the event that there are links on our website that redirect you to third party websites, we inform you that our Company does not control or it is responsible for the content of these websites, nor for the way in which your personal data are processed.
Last Review: March 2020