Introduction
The Hellenic Public Properties Co S.A. (the “Company”) is a société anonyme whose purpose is the utilization, by any appropriate means, of the real estate assets included in its ownership, the management of such assets, and the operation of tourism business units assigned to it by the State, by legal entities governed by public law, by legal entities governed by private law that belong to the wider public sector, as well as by other sociétés anonymes whose share capital is directly or indirectly owned by the Hellenic State (hereinafter “HPPC S.A.” or the “Company”).
We would like to assure you that HPPC S.A., in the management of the Achilleion Palace (the “Museum”), sets as its primary objective the protection of the personal data of its customers–visitors, as well as of other persons, such as, for example, its partners and staff. For this reason, we take appropriate measures to protect the personal data we process and to ensure that the processing of personal data is always carried out in accordance with the obligations imposed by the legal framework, both by the business unit itself and by third parties that process personal data on its behalf.
Data Controller – Data Protection Officer (DPO)
HPPC S.A., headquartered in Athens (7 Voulis Str., P.C. 10562), VAT No. 094537454, tel.: +30 210-3339416, website: http://www.hppc.gr, e-mail: info@hppc.gr and fax: 210-3339507, in the management of the Museum, located in Corfu, in the mountain village of Gastouri, 10 km southwest of the city of Corfu (tel.: +30 26610-56245, fax: 26610 56284, e-mail: msachil@hppc.gr, website: www.achillion-corfu.gr), informs you that, for the purposes of conducting its business activities, it processes personal data in accordance with applicable national legislation and Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “Regulation”), as in force. For any matter relating to the processing of personal data, please contact the Data Protection Officer (DPO), Ms. Marilena Bellou, e-mail: dpo@hppc.gr.
What personal data do we process?
The personal data you provide to us, such as, for example, your full name, address, telephone number, e-mail address, as well as other additional information on a case-by-case basis, such as, indicatively, bank account or bank card details, VAT number and tax office, which may be required in the context of financial transactions with our partners and/or customers, or even—under certain conditions—photographs from activities carried out at our Museum, are processed only when we have a lawful basis to do so.
What are the lawful bases for processing your personal data?
Lawful bases for processing your personal data include: (a) actions we take to provide you with the services you expect and wish to receive from us (e.g., tourism services, guided tour services, etc.). (b) the consent you provide to us, under the specific conditions set by the legal framework, for example in the case of posting photographs (depicting natural persons) on the Museum’s website for the presentation and promotion of our services. We assure you that on this legal basis we process your personal data exclusively for the purpose for which you provide your consent. (c) the processing of personal data carried out in order to comply with a legal obligation, such as, for example, compliance with the applicable legal framework as defined by the Ministry of Tourism (Greek National Tourism Organisation) for the operation of museums, as well as compliance with specific environmental provisions, as specified by the Ministry of Environment. (d) safeguarding and protecting legitimate interests, primarily yours as well as the Museum’s. Thus, in order to be able to protect the security of natural persons, property and facilities, premises and exhibits of the Museum, we use security cameras.
How and why do we use your personal data?
- To offer quality services, provide you with the best possible service, and ensure the proper performance of contractual relationships with our partners. From our contractual relationship we derive and process the information required for the smooth course of cooperation with our customers and the best possible provision of our services to you. We also use your personal data to respond to questions and requests you submit to us in writing or orally.
- To present and promote the services offered at our Museum.
Provided that you have consented to this, photographic material from the Museum premises will be hosted on our website, under the conditions set by the applicable legal framework of the Regulation, in order to showcase our Museum’s premises through our website, with the aim of attracting tourist interest. - To comply with a legal obligation. We are required to comply with statutory provisions issued by the Ministry of Tourism (in particular the Greek National Tourism Organisation) and the Ministry of Culture and its competent Services regarding the operation of Museums, the health regulations of the Ministry of Health, as well as environmental provisions of the Ministry of Environment, which collectively define the framework of our lawful and proper operation. • To safeguard our legitimate interests and protect persons and property. We process our customers’ personal data for the technical support of our website and for the optimization of our services. In addition, the use of closed-circuit television (CCTV) and security cameras ensures the protection of natural persons (i.e., our visitors and staff), as well as the security of the Museum’s buildings and exhibits.
Where are your data disclosed?
In relation to the operation of the Museum, HPPC S.A. may transfer your personal data to the following categories of recipients:
• State authorities, law enforcement agencies. When necessary, e.g., in the case of a tax audit and in accordance with the prescribed procedures, as well as in cases where we must provide information to a police and/or judicial authority, if any legal dispute arises, and in any case in order to safeguard our business interests and the reputation of our branch. • Partners of our Company (suppliers, agencies, advertising companies, etc.). HPPC S.A. maintains partners to whom it assigns the processing of personal data on its behalf (e.g., equipment suppliers, accounting partners, marketing companies). In these cases, our business remains responsible for the processing of your personal data and determines the specific elements of the processing, and signs a special agreement with the partners to whom it assigns processing activities, in order to ensure that processing is carried out in accordance with the applicable legal framework and that any natural person can freely and without hindrance exercise the rights granted by the legal framework.
Retention Period
The retention period for data is determined based on the following specific criteria, depending on the case: When processing is required as an obligation under provisions of the applicable legal framework and for the protection of the public interest, your personal data will be stored for as long as the relevant provisions require. When processing is carried out on the basis of contract performance and/or taking steps prior to entering into a contract, your personal data are stored for the period defined by the governing contract, as well as for as long as necessary for the establishment, exercise, support or defense of legal claims arising from the contract and until their lawful limitation period expires. The above personal data may also be retained for as long as determined by other tax or more specific legislative provisions. For the purposes of promoting our products and services, and to the extent that the provision of your personal data is based on your consent, your personal data are retained until you withdraw your consent. You may do so at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
What are your rights in relation to your personal data
Any natural person whose data are processed by HPPC S.A. in relation to the Museum enjoys the following rights:
Right of access
You have the right to be aware of and to verify the lawfulness of processing. Therefore, you have the right to access your data and to receive additional information regarding their processing.
Right to rectification
You have the right to review, correct, update, or modify your personal data, following a written request to the Data Protection Officer (DPO).
Right to erasure
You have the right to submit a written request for the erasure of your personal data when we process them on the basis of your consent or in the context of protecting our legitimate interests. In all other cases (such as indicatively where there is a contract, a legal obligation to process personal data, or public interest), this right is subject to specific restrictions or may not apply, depending on the case.
Right to restriction of processing
You have the right to request restriction of the processing of your personal data in the following cases: (a) when you contest the accuracy of the personal data and until verification is carried out, (b) when you object to the erasure of personal data and request restriction of their use instead of erasure, (c) when the personal data are not needed for processing purposes, but are necessary for the establishment, exercise or defense of legal claims, and (d) when you object to processing and until it is verified whether there are legitimate grounds concerning us that override the grounds for which you object.
Right to object to processing
You have the right to object at any time to the processing of your personal data in cases where, as described above, it is necessary for the purposes of legitimate interests pursued by us as the data controller.
Right to data portability
You have the right to receive your personal data free of charge in a format that allows you to access, use, and process them using commonly used processing methods. You also have the right to request that we transmit the data directly to another controller, where technically feasible. This right applies to data you have provided to us and whose processing is carried out by automated means based on your consent or in performance of a relevant contract.
Right to withdraw consent
Where processing is based on your consent, you have the right to withdraw it freely, without affecting the lawfulness of processing based on your consent before its withdrawal. To exercise any of the above rights, you may contact the Data Protection Officer (DPO) at: dpo@hppc.gr.
Right to lodge a complaint with the Hellenic DPA
You have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr): Call Center: +30 210 6475600, Fax: +30 210 6475628, E-mail: complaints@dpa.gr
Personal Data Security
HPPC S.A. implements appropriate technical and organizational measures with the aim of secure processing of personal data and preventing accidental loss or destruction, and unauthorized and/or unlawful access to, use, alteration or disclosure of such data. In any case, the way the internet operates and the fact that it is freely accessible to anyone does not allow guarantees that unauthorized third parties will never be able to breach the applied technical and organizational measures, gaining access and potentially using personal data for unauthorized and/or unlawful purposes.
Links to other websites
Our website may contain links to third-party websites. HPPC S.A. and the Museum bear no responsibility for the privacy practices or the content of other websites that do not belong to our Company. Consequently, we recommend that you carefully read the privacy statements posted on the respective third-party website.
Changes to the Privacy Policy
Information regarding our Company’s privacy policy reflects the current status of data processing on our website. In the event of changes in data processing, this data protection information will be updated accordingly. Our website will always contain the most recent version of this data protection information so that you are informed about the scope of data processing on our website. We recommend that you always stay informed about how we process and protect your personal information. All future changes regarding this Privacy Statement will be communicated in a timely manner before such changes take effect.