Personal data protection policy

PERSONAL DATA PROTECTION POLICY

In Marketing Greece we respect your privacy and undertake to protect your personal data. The present privacy statement aspires to inform you about the personal data we collect and process in the course of the provision of our services and our communication with you.

Our full particulars are:
Marketing Greece Société Anonyme for the Promotion and Development of Tourism (Marketing Greece S.A.)

Εmail address: admin@marketinggreece.com

Postal Address: 20 Voukourestiou Street, 10671 Athens, Greece

Telephone: +30 210 3649080

Scope and objectives of the personal data protection policy

The scope of the present Policy is to determine the basic rules and principles according to which Marketing Greece collects, processes and stores personal data, as defined by the applicable national and EU legislation in force and, in particular, Regulation (EU) 2016/679 (hereinafter “the Regulation”) and Law 4624/2019.

Personal Data Concepts/Definitions

For the purposes of the present Policy, the following concepts shall be construed as follows:

“Personal data”: any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Special categories of personal data”: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

“Processing”: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Anonymization”: the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject.

“Pseudonymization”: the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

“Controller”: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

“Processor”: a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

“Consent” of the data subject: any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

“Personal data breach”: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

“Data concerning health”: personal data related to the physical or mental health of a natural person, including the provision of health care services, which reveal information about his or her health status.

“Applicable law”: The provisions of the Greek, EU or other law to which Marketing Greece is subject and which prescribe personal data protection issues, such as:

Law 3471/2006 on the protection of personal data and privacy in the electronic communications sector and the amendment of Law 2472/1997;
Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on the protection of privacy in electronic communications) as amended (Directive 2009/136);
Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) and any implementation laws thereof;
Law 4624/2019: Personal Data Protection Authority, measures for the implementation of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and the incorporation into national legislation of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 and other provisions.

General Principles of Personal Data Processing

When Marketing Greece processes personal data, it ensures that:

It collects and processes such data lawfully, in accordance with the provisions of the applicable laws and the conditions thereby prescribed.
It processes personal data only for defined, express and lawful purposes.
It implements appropriate technical and organizational measures to ensure that personal data are processed in such manner as to warrant the appropriate level of security for personal data, including, inter alia, their protection with regard to unauthorized or illegal processing and accidental loss, destruction or damage. Moreover, it periodically reviews the adequacy and efficacy of such measures.
It makes the required effort so that the personal data it keeps and processes are always accurate and updated.
It does not keep the personal data it collects for a longer time than necessary for the purposes for which they were collected and processed. However, it may keep such data for a longer time, if their processing is required:

for complying with the legal obligation which imposes such processing pursuant to the provisions of a law (especially in the context of its obligations as beneficiary in the realization of co-financed National Strategic Reference Framework/NSRF programmes, etc.);
for fulfilling a duty discharged in the public interest;
for archiving purposes in the public interest or for scientific or historical research purposes or for statistical purposes, after appropriate technical and organizational measures are taken, including their pseudonymization, and only to the extent that such purposes may not be served through the anonymization of data;
for substantiating, exercising or supporting legal claims.

Purposes for processing:

Marketing Greece collects and processes personal data for the following purposes:

In order to meet its obligations as imposed by the law and by the provisions of its charter for its objectives and actions. For example:

To develop and carry out programmes intended to promote and publicize the country in general and to advertise the Greek tourism product, both worldwide and within Greece, and to carry out programmes intended to promote individual tourism regions and tourism products.
To study and research the international and domestic tourism markets.
To provide consultancy services pertaining to the creation, development and realization of a branding system for Greek tourism at a national, regional and local level and on a category basis.
To catalogue and highlight historic, cultural, folklore, geographical, dietary, entertainment, environmental and other features and aspects of the country and of its individual regions.
To provide support towards promoting and publicizing programmes, events and actions within the context of the national and regional tourism policy and the relevant strategic planning of Greek tourism.
To design campaigns, programmes and actions intended to promote and advertise tourism, in collaboration with the competent state bodies and to supplement their actions.
To undertake communication strategy studies on the tourism promotion of the country and of its individual tourism regions or products.
To produce or support the production of material and products in general whose further distribution would contribute towards the tourism promotion of the country and of its individual tourism regions or products.
To support public and private bodies which deal in tourism in Greece.
To engage in any other related activity.

In order to meet its obligations as imposed by the law and in particular by the social security and taxation laws in force with regard to its employees and suppliers.
In order to be able to recruit staff or to contract with independent partners.
In order to ensure its smooth operation in line with the objectives set out in its Charter and with the applicable laws.
In order to ensure the safety of its staff, facilities and equipment.
In order to lawfully execute contracts and meet the legal obligations therein prescribed.
In order to undertake research and studies for statistical purposes.
In order to undertake actions and organize seminars, conferences, presentations, etc.
In order to organize media/press trips for journalists and bloggers from other countries.
In order to undertake campaigns and the production of pertinent audiovisual material.
In order to facilitate the promotion of tourism services and visitor information providers through the www.discovergreece.com online platform.

Legal basis for personal data processing

Marketing Greece shall process your personal data with transparency in accordance with the principles of lawfulness, proportionality, confidentiality and integrity, the limitation with regard to the purpose and accuracy, the specific time that data are kept and the minimization of data.

The legal basis for the processing of your personal data may consist in any of the following, as the case may be:

(a) your consent;

(b) the requirement to process your data in the context of our contractual obligations;

(d) the requirement to process your data in the context of safeguarding our lawful interests;

(e) the requirement to extract statistical data.

What data are processed

With regard to the aforesaid objectives, Marketing Greece may collect and process personal data which may include, without being limited to, the following:

Personal Data Categories

Employees and/or independent partners: full name, father’s name, mother’s name, year of birth, place of birth, gender, citizenship, postal address, email address, contact telephones, identity card number, VAT number (Greek AFM), social security number (Greek AMKA) and other social security fund numbers, bank account number (IBAN), particulars about family status, education and training of employee, previous experience, curriculum vitae, references from previous employers.
Purposes – Legal basis for processing:
- The management of the employment relationship. The processing of data is essential for the execution of the employment contract.
- The fulfilment by Marketing Greece of its obligations as employer. The processing of data is essential for Marketing Greece’s compliance with legal obligations.
Candidate employees/partners: Marketing Greece collects and processes data of candidate employees & partners upon a candidate’s submission of a pertinent application for a vacant post. In such cases, Marketing Greece collects and processes only the personal data that are required for the assessment of the candidate’s appropriateness for the specific post/partnership (e.g. name, surname, contact details, education, previous experience, etc.). Such data shall be collected on submission of an application in any manner (e.g. by dispatch of an email message to Marketing Greece’s email address provided with the relevant announcement/invitation) and from the curriculum vitae which the candidate attaches to his/her application. Moreover, for the assessment of applications for a post/partnership, Marketing Greece may use additional questionnaires which disclose information about candidates in order to facilitate the further assessment of the candidate’s appropriateness for a specific post. Should the application for a post cite contact information for previous employers and provided a candidate declares his/her express consent to that effect, Marketing Greece shall be entitled to contact them in order to request information exclusively pertaining to the post and the candidate’s capacity/ability to match the post.
Purposes – Legal basis for processing:
- Candidates’ data are collected for the purpose of:
  - Assessing a candidate’s appropriateness for a specific post. The legal basis for processing is Marketing Greece’s lawful interest.
  - Keeping on file a candidate’s application for potential post vacancies. The legal basis for processing is Marketing Greece’s lawful interest.
  - Contacting previous employers, whose particulars have been provided by candidates for this purpose. The legal basis for processing is the candidate’s prior express consent, if provided.
- Participants and speakers in seminars, conferences and/or educational/vocational activities: full name, postal address, email address, contact telephone, profession, etc. Marketing Greece may also request additional data pertaining to the curriculum vitae of speakers, lecturers, etc.
  Purposes – Legal basis for processing:

Candidates’ data are collected for the purpose of:

– Organizing conferences, seminars and other educational/vocational activities. The legal basis for processing is Marketing Greece’s lawful interest.

Visual data: In the context of the organization of conferences, presentations and other such activities and events of Marketing Greece, such events may be recorded in photographs and/or videos and such material may be uploaded in Marketing Greece’s website or social media accounts.
Purposes – Legal basis for processing:

Visual data are collected for the purpose of:

– The management of events. The processing of data is essential for the management of events and of their purposes. The legal basis for processing is Marketing Greece’s lawful interest.

Contact data (email address, full name, telephone, etc.): of persons who are in regular contact with Marketing Greece with regard to its objectives and activities, contact data of journalists for the communication of Press Releases and updates about Marketing Greece’s actions, campaigns and events, and contact data of persons who have declared their wish and have provided their consent to receive updates from Marketing Greece (full name, email address, post office box, capacity, profession, contact telephone numbers).
Purposes – Legal basis for processing:

Data are collected for the purpose of:

– Sending updates on the actions, campaigns and events of Marketing Greece. The legal basis for processing is the consent of persons who wish to receive updates from Marketing Greece about its events and actions and about developments in the tourism sector or Marketing Greece’s lawful interest, provided such data have been legally obtained in the context of the company’s previous cooperation with the subject.

Contact data and personal data of journalists and bloggers who cooperate with the company, in the context of the organization and actualization of media/press trips: full name, capacity, ID or passport particulars, email address, etc.

Purposes – Legal basis for processing:

Data are collected for the purpose of:

Organizing and carrying out media/press trips for a journalist or blogger from abroad to Greece.

The legal basis for processing is Marketing Greece’s lawful interest.

In order for the company to organize and carry out the trip, it is essential that the data which visitors have filled in in the special form as requested by the company be transmitted to airline companies and/or tourist accommodation facilities in order that the relevant travel and accommodation reservations be made for visitors in Greece.

Visitors are specifically informed by means of the special form (media trip request form) about the aforesaid processing and transmitting of their personal data.

Contact data (full name and email address) of persons receiving/using audiovisual material from the company’s content library.

Purposes – Legal basis for processing:

Data are collected for the purpose of:

The concession of audiovisual material to persons with a view to the promotion of the Greek tourism product.

The legal basis for processing is Marketing Greece’s lawful interest for the identification of persons acquiring rights to use such audiovisual material.

Data of users of Marketing Greece’s websites.

For information regarding the processing of data of users of Marketing Greece’s corporate website (www.marketinggreece.com), please refer to the relevant cookies policy here ……………..

For information regarding the processing of data of users of the company’s online platform www.discovergreece.com, please refer to the relevant privacy policy of the website

Special categories of personal data

Marketing Greece may collect and process data which belong to special categories of personal data (“sensitive data”), such as data concerning health, in order to meet its social security obligations. Such data may at times not pertain to parties directly transacting with Marketing Greece but to third parties (e.g. members of an employee’s family, offspring, etc.).

Purposes – Legal basis for processing:
Data are collected for the purpose of:

– Marketing Greece’s meeting its obligations as imposed by the law and in particular by the social security laws in force.

Transmission of Data

Marketing Greece may transmit data to the Greek Tourism Confederation-SETE, which exercises decisive control/dominant influence on Marketing Greece, as well as to the civil non-profit company under the name “INSETE” (Institute of the Greek Tourism Confederation), on which SETE also exercises decisive control/dominant influence, both for internal administrative purposes, including the processing of personal data of partners and/or employees, and for the purpose of informing subjects about the activities and actions of the said three “affiliated” legal persons.

Marketing Greece may also transmit data to third parties (legal or natural persons) acting as processors, in support of its operation (e.g. accounting support, payroll purposes, technical support) and in support of its actions (e.g. production of audiovisual material, support of its websites, etc.).

Marketing Greece may also transmit such data to third parties either on account of its obligation when this is prescribed by the applicable laws or, alternatively, in accordance with the guarantees prescribed by the applicable laws. In such cases, it should adequately inform the data subjects before proceeding to such transmission.

In the event that such transmission should involve a country outside the European Union (EU) or the European Economic Area (EEA), Marketing Greece should check whether:

the Commission has issued a pertinent adequacy decision for the third country to which data shall be transmitted;
appropriate guarantees are in place in accordance with the Regulation about the transmission of such data.

If not, transmission to a third country is prohibited and Marketing Greece may not transmit personal data to such country, unless one of the special derogations prescribed in the Regulation should apply (e.g. express consent of the subject and information of same about the risks the transmission entails, the transmission is necessary for the execution of a contract upon the subject’s request, there are reasons of public interest, it is required to support legal claims and vital interests of the data subjects, etc.).

Data retention period

Marketing Greece shall retain your personal data for a limited time period depending on the purpose of their processing and upon expiry of such period personal data shall be deleted from our files, unless a different retention period is prescribed or allowed by the applicable laws (social security, labour legislation, etc.).

The curricula vitae and/or any filled in questionnaires of applicants for a post/partnership are kept by Marketing Greece for a period of one year and are subsequently destroyed, unless compliance with the pertinent laws prescribes that the relevant folder be kept for a longer period.

In cases when personal data are provided directly by subjects in order for subjects to receive newsletters and other updates from Marketing Greece, such data are kept until subjects should revoke their consent, which may occur at any time, without this affecting the lawfulness of any processing carried out prior to the time when the consent was revoked.

In cases when media/press trips are organized, Marketing Greece keeps the personal date directly provided by subjects until the trip is completed.

Rights of Personal Data Subjects

Marketing Greece shall ensure that data subjects are able to exercise the rights provided for same by the law with regard to the collection and processing of personal data. Said rights are:

The right of accessto data.
The right of rectificationof data.
The right of erasureof data (“right to be forgotten”).
The right of restriction of processingof data.
The right of portabilityof data.
The right to object to the processing of data.

In the event that any of the above rights should be exercised, we shall take all possible steps to satisfy your request within a reasonable time and in any event within one (1) month from submission of your request and its/your identification. That period may be extended by two further months where necessary, in the event that your request is complex or if there is a great number of requests. In such case, Marketing Greece is obliged, within one month of identifying the request, to notify you about the delay and the reasons for such delay. Within the said time, Marketing Greece is obliged to inform you of any refusal on its part to satisfy, in whole or in part, the request you submitted and about the reasons of such refusal.

Marketing Greece may refuse to satisfy, in whole or in part, a request received by the data subject only when this option is provided for under the General Data Protection Regulation (EU 2016/679).

If Marketing Greece is processing personal data as processor, it shall transmit such requests to the controller, who is responsible for examining and satisfying such requests.

To exercise any of the above rights, you may use the following email address privacy@marketinggreece.com and the following telephone number: +30 210 3649080.

Right to Appeal to the Personal Data Protection Authority

If you believe that there is a breach of any of your rights with regard to the protection of Personal Data, you may file a complaint with the competent supervising authority, viz. the Hellenic Data Protection Authority. For more information, please visit the website http://www.dpa.gr.