PRIVACY POLICY

PERSONAL DATA

Personal Data refer to any information relating to the data subject, i.e. any natural person to whom the data refer and whose identity is known or can be verified. Such data may include, indicatively, name, surname, address, date of birth, gender, telephone number, email address, as well as any data related to the use of this website.

CATEGORIES OF DATA

The following categories of data are collected for processing:

a) Identification data, such as full name, patronymic, ID card, passport, nationality, gender, date of birth.

b) Contact details, including landline and mobile phone numbers, residential or work address, email address, fax.

c) Payment details.

d) History, such as number of visits, frequency of visits, preferences, participation in invitations, questionnaire responses.

DATA COLLECTED

During your visit to the website, data are collected in order to:

a) Enable you to register and create an account.

b) Assist you in subscribing to our newsletter.

c) Ensure communication with you, which will facilitate exchange of information regarding your reservation.

d) Establish communication with you to provide updates on any exceptional circumstances that may affect your reservation (e.g. strikes, marathons, cycling races, demonstrations, etc.).

e) Respond to your inquiries.

More specifically, the following information, which you voluntarily provide to us, is collected for the purpose of registering as a member and creating a personal account:

• Full name
• Mailing address
• Occupation
• ID card or passport number
• Mobile phone number
• Email address
• Password (the username and password are always chosen by you as soon as the availability check is conducted

Furthermore, voluntary information such as mobile phone number and email address is requested to enable us to communicate directly with you about the confirmation of your reservation and to provide updates on its course. Your email address is also needed should you choose to receive our newsletter.

PURPOSES OF PROCESSING PERSONAL DATA

Personal data provided on our website and its online services are intended exclusively for our communication with you, improvement of the services provided, ensuring the proper functioning of the relevant service your data are granted for, as well as for statistical purposes. They may not be used by any third party, except in cases expressly provided for in this Privacy Policy and always in accordance with the Law.

DATA RECIPIENTS AND PURPOSE OF TRANSFER

Your data shall be transferred for the exclusive purpose of fulfilling a specific task assigned to the data processor, solely within the context of proper execution of your order. Your consent shall not be obtained for the transfer of your data to the competent authorities, only in the context of complying with the Law. The maintained data may be disclosed to the competent judicial, police, and other administrative authorities upon their request and in accordance with the applicable legislative provisions.

NEWSLETTER SUBSCRIPTION

Having requested your explicit consent, we collect and process your email address, voluntarily provided to us. We only use your email address and name, and also retain your IP address, in order to send newsletters to you. Our sole purpose of processing is to send informative newsletters and offers from our company, which processes the specific data until you notify us that you no longer wish to receive newsletters and request to be removed from the mailing list by emailing the company. The option to unsubscribe from the list is also provided to the user with a corresponding indication in each newsletter sent.

DATA RETENTION PERIOD

Under current Greek and European legislation, we take all appropriate technical and organizational measures to securely retain your personal data for as long as you are registered to a service. Your data is deleted after the ending, in any way, of the transaction relationship. More specifically, your account is retained for a period of two (2) years. After expiry of the two-year period, your account is automatically deleted. We only retain your email for a maximum period of five (5) years in order to send you newsletters regarding new products and offers from our company, provided that we have obtained your consent beforehand (you are entitled to withdraw your consent for this purpose at any time).

Υour data as described above shall not be deleted in the following cases where:

1. There is an unresolved issue related to your account, an outstanding claim, or dispute. In this case, we will retain the necessary personal data until the issue is resolved.
2. We are obliged to retain your personal data for legal, tax, auditing, and accounting purposes, always in accordance with applicable law. In such case, we will retain only the necessary personal data for the period required by the current legislation.
3. It is necessary for our legitimate business interests, such as fraud prevention or other risks, and for maintaining the security of our users.

COOKIES

This website uses cookies. You can learn more about the cookies we use, their purpose, and the way to manage them by reading our Cookies Policy.

We reserve the right to modify this Policy, either in whole or in part, at our sole discretion. Any modification to this Policy will take effect immediately upon the posting of the revised Policy on the Website. There will also be an indication on our homepage highlighting the change. In any event, your continued use of or access to the website following the posting of any changes constitutes acceptance of those changes.

CUSTOMER RIGHTS

You have the right to:

a) Request access to your personal data. This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.

b) Request rectification of your personal data. This enables you to correct incomplete or inaccurate personal data or although we reserve the right to ask you to verify the accuracy of the new data provided.

c) Request erasure of your personal data, subject to the time period limitations described above.

d) Oppose our processing your personal data when you deem that your fundamental rights and freedoms have been violated. You also have the right to object to our processing your personal data for direct marketing purposes without having obtained the consent needed.

e) Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following cases: (1) if you want us to establish the accuracy of the data, (2) where our use of the data is unlawful but you do not want us to erase it, (3) where you want us to hold the data even if we no longer require it, as you need it to establish, exercise, or defend legal claims, or (4) if you have objected to our use of your data but need to verify whether we have overriding legitimate grounds to use them.

f) Request the transfer of your personal data to you or to a third party. We will provide you, or the third party you designate, with your personal data in a structured, commonly used, machine-readable format. This specific right pertains only to information we have received with your consent on conclusion of the agreement or later, up to the time the request has been submitted

g) Withdraw your consent should you find and substantiate that it has ceased to be lawful. However, this cannot affect the lawfulness of any processing carried out before withdrawing your consent. If you withdraw your consent, we may not be able to provide certain services to you.

There shall be no obligation to comply with a Client's request regarding restriction, objection to processing, or erasure of their data whenever processing of data is necessary for the establishment, exercise, or defense of the Company’s legal claims or for the compliance with the Company’s legal obligations.

A response to any legitimate request shall be provided within thirty (30) days from its receipt, unless a longer period is required due to specific circumstances, in which case prior notice will be given.

The Client has the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr), which is the competent supervisory authority, if they consider that their rights have been infringed in any way by the processing of their data. However, before lodging your complaint, you may contact us directly and give us the opportunity to address your concerns and answer your questions, making every effort to serve you promptly, based on what is stipulated in this Policy, in accordance with the interpretation of European Regulation (EU) 2016/679 and the relevant provisions of the current Greek legislation on personal data protection.

EXERCISE OF RIGHTS

You can  exercise your rights by sending a request to the e-mail address gdpr@blackleaderathens.com.

CONTACT

If you have any questions related to this Policy, please submit your query in writing to the email address gdpr@blackleaderathens.com

PRIVACY POLICY CHANGES

We reserve the right to modify the present Policy and effect any changes in the information provided previously, within the constraints of the law. If there are any substantial changes to the Policy or the way we process your personal data, we will post the update on our website in order to keep you informed of the changes.

It is clarified that these changes will  come into force from the day of their publication in our Privacy Policy, on the official website of our company www.blackleaderathens.com We encourage you to regularly read this Policy so that you are aware of how your data are protected

Last updated JUNE 25, 2023 in accordance to the new European Data Protection Regulation (GDPR) (EU) 2016/679.