INTRODUCTION
E-shop www.paragliding-crete.gr belongs to the company PARAGLIDING CRETE POWER FLY LIMITED PARTNERSHIP, with registered offices in the Municipality of Chania Crete Greece, 20 Nikiforou Foka St., P.C. 73100, taxpayer identification number (TIN) & VAT number EL 800984846, tel. No: (0030) 6975937593, e-mail: info@paragliding-crete.gr.
The Company has taken the appropriate measures which ensure that processing of your personal data complies with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the applicable Greek Laws (Law 4624/2019). Especially, Paragliding-crete.gr adopts internal policies and implement measures which meet the principles of data protection by design and data protection by default.
We collect your personal data either directly from you, or through affiliated companies. We collect your data through this Website and / or in other ways (social media, contests, cookies, analytics tools, e-mails etc.).
By using this Website, you agree to be bound by this Privacy Policy.
This Privacy Policy applies to Visitors / Users / Customers of Paragliding-crete.gr. Therefore, the words “you”, “your” and generally the use of the second plural form refers to Visitors / Users / Customers. Throughout the Privacy Policy, the terms “we”, “us” and “our”, refer to the Company.
SCOPE AND AIM
While you are browsing through different webpages of the Website, we may ask you to disclose some personal data in order to provide you with our Products and Services. The present Privacy Policy (hereafter Privacy Policy) describes the type of your personal data which are subject to the processing, the way and the context in which your personal data are collected, the purposes and means of the processing of your personal data, the lawfulness of processing, the entities to which your personal data may be disclosed, the purpose limitations, the storage period and measures we take to ensure lawful and fair processing and the principles relating to processing of personal data. It also includes information about your rights and data protection. The Privacy Policy applies only to processing of personal data for purposes of the Website’s services and operation. We also collect personal data through our pages on social media, cookies, analytics tools etc. In this case data processing may be subject also to another privacy policy (e.g. Google privacy policy).
DEFINITIONS
For the purposes of this Privacy Policy:
(1) ‘personal data’ or ‘data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
(2) ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
(3) ‘data controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the Controller or the specific criteria for its nomination may be provided for by Union or Member State law;
(4) ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller;
(5) ‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;
(6) ‘recipient’ means a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing;
(7) ‘third party’ means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data;
(8) ‘supervisory authority’ means an independent public authority which is established by a Member State pursuant to Article 51 G.D.P.R.
(9) ‘restriction of processing’ means the marking of stored personal data with the aim of limiting their processing in the future;
(10) ‘profiling’ means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location or movements;
For any other term please read the Terms of use .
OUR PRINCIPLES RELATING TO PROCESSING OF YOUR PERSONAL DATA
On this Website we process your personal data lawfully, fairly and in a transparent manner (‘lawfulness, fairness and transparency’). We collect your personal data for specified, explicit and legitimate purposes. Your data are not further processed in a manner that is incompatible with those purposes (‘purpose limitation’). Furthermore, your personal data that we process are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’). Your personal data are also accurate and, where necessary, kept up to date. We take every reasonable step to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’). Your personal data are kept in a form which permits identification of you for no longer than is necessary for the purposes for which the personal data are processed (‘storage limitation’). Your personal data are processed in a manner that ensures appropriate security of them, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
DATA CONTROLLER
For any processing of personal data for the following purposes and means, PARAGLIDING CRETE POWER FLY LIMITED PARTNERSHIP is the Data Controller (e-mail: info@paragliding-crete.gr). The Data Controller determines the purposes and means of the processing of your personal data.
PERSONAL DATA WE COLLECT AND PROCESS – LAWFULNESS OF PROCESSING – PURPOSES – RETENTION PERIOD
If you wish to order Products / Services, we will ask you to provide us with personal information such as: your first name, your last name, your (billing / delivery) address (street, city, region, apartment, postal code), phone number, your e-mail address and company name (optional). These data are collected electronically through the relevant data entry form. You may choose to create an account based on the data you fill in during the checkout process. We will also collect/process your order payment information. We do not process your credit / debit card details that you enter in the electronic environment of collaborating payment service providers. Processing of your data is necessary for the performance of our contract to which you are party (invoicing, shipping, activities’ booking and scheduling etc.). We will disclose your data to collaborating courier companies. We will store your personal data for as long as the law stipulates from your last purchase from Paragliding-crete.gr. In the same context, we may also process your personal data in order to take steps at your request, prior to entering into a contract. We may as well use your e-mail address to send you information about your orders, the delivery of the Products or the provision of the Services.
We will process your e-mail address to create a personal account for you. If you retain an account, we also process your previous orders for your convenience. We will store these data for as long as you retain your account (legal basis: consent). If your account remains inactive and there is no other legal basis for the processing of your personal data, or any obligation to retain them, they will be deleted two years after your last login on the Website. You can ask Paragliding-crete.gr to keep your data indefinitely so that it is not deleted in case of inactivity. In case of deletion of your account by the Company, your personal data will be kept for one month after the deletion of the account (unless there is another legal reason or obligation to maintain them) and you will be notified so that you can ask the Company to provide you with a copy of your data, then they will be permanently deleted. If you request the deletion of your account, your data will be deleted immediately. We may as well use your e-mail address to send you improvements and / or updates of our Products’ / Services’ specifications.
We process your personal data when you contact us in any way, in order to answer your questions/requests. When you seek for information about our Products / Services, we process your Personal Data in order to take steps at your request, prior to entering into a contract. We may also process these data for the performance of our contract. Unless you are already a customer of Paragliding-crete.gr, we will store your personal data for one year from the last time you have contacted us.
Where Paragliding-crete.gr obtains from its customers their e-mail address, in the context of Product sales and Service contracts, we may use these e-mail address for direct marketing of our similar Products or Services. We give you the opportunity to object, free of charge and in an easy way, to such use of your e-mail address, on each message, in case you have not initially refused such use (soft-opt in).
Furthermore, Paragliding-crete.gr may process your e-mail to send you Newsletters on the basis of your consent. In this case, we will store your personal data (e-mail) for as long as you wish to receive Newsletters from us. Newsletters are free of charge e-mails with advertising content, promotions, events, discounts, special offers, contests etc. You may unsubscribe from our mail list at any time. In this case, if there is another legal basis for keeping your e-mail, we will also store it to an unsubscribe list to fulfil our legal obligation, otherwise we will completely erase it.
We also, collect your Personal Data (profile name, comments, reviews, contact details, messages) that you share with us when visiting our pages / profiles / channels on social media platforms (Facebook / Instagram / YouTube / Google Maps etc.). This information is processed when you contact us, make a request or interact in another way with us, through our social media pages, so as to respond or communicate with you in any way. Your personal data will be retained for as long as you remain a fan / follower / member / subscriber of our pages / profiles or for as long as your activity (posts, comments, reactions etc.) remains on our social media pages. By using the above-mentioned services (social media) you acknowledge that your interaction (like, comment, message) with our pages / profiles / channels etc. gives us the right to process your personal data on the basis of your consent. We may also use this information for marketing purposes (e.g. send you information about a contest or Products / Services) or in order to take steps at your request, prior to entering into a contract.
We collect your personal data (name, contact details), when you participate in contests, on the basis of your consent. We may collect information (profile name, likes/shares/comments) from your social media profile. We will process this information to run the contest and communicate with the winners (winners’ name, address, phone number, e-mail will be also collected). Then we will erase your data.
We may also process your personal data, if processing is necessary for the purposes of the legitimate interests pursued by the Controller (statistical analysis, market research, security reasons), or for direct marketing. Any processing of your Personal Data in this context will be carried out in accordance with the GDPR and the applicable Greek Law.
We will collect and process your declaration of withdrawal. The withdrawal forms will be retained for as long as the law stipulates, in order to check whether you are abusively exercising your right to withdraw from a contract with our Company (legal basis: contract, legitimate interest).
Paragliding-crete.gr and third parties may store Cookies on your device and process information collected through Cookies’ use (IP included). We store your IP collected through Google Analytics for two years. For more information (e.g. purposes, lawfulness, retention period etc.) read the Cookies Policy[SA2] .
The Company cooperates with advertising / promotional companies, statistical analysis companies, suppliers and service providers who process personal data on our behalf. We disclose to our partners your personal data, solely for the processing purposes referred to in this Policy.
We collect and process your personal data only for legal purposes, as the above mentioned. We may process your personal data for purposes other than those for which your personal data were initially collected, only where the processing is compatible with the purposes for which your personal data were initially collected. E.g. we may contact you via e-mail to inform you about the Website’ s function. We may also process your personal data, if processing is necessary for compliance with a legal obligation to which the Company is subject.
The time that your Personal Data may be retained by the Company is also determined by our legal obligations in the applicable Legislation (tax etc.). If you have not fulfilled any payment obligations, or if there is a dispute, pursuant to our contract, we may keep your personal data for as long as Greek laws stipulate.
PROCESSING OF SPECIAL CATEGORIES OF PERSONAL DATA – CHILDREN’ S DATA
We will not collect or process special categories of Data. You shall refrain from sending to us special categories of Personal Data, unless necessary. The Company shall not be liable for any damage incurred to you or a third party due to an illegal act or omission performed by you, regarding special categories of Data. In case you send us Special Categories of Personal Data you consent to the processing of your personal data in accordance with our Company’s statutory purposes.
Only adults shall use the Website’ s services. Therefore, we do not collect or process children’s Data. The Company will erase any children’s Data that you disclose to us through the Website. The Company shall not be liable for any and all damages arising from any use of the Website by a child.
CONSENT
We may ask you to give your consent to the processing of personal data relating to you. This may include ticking a box while browsing through different webpages of the Website. Ticking that box, is a clear affirmative action, which is considered as a freely given, specific, informed and unambiguous indication of your agreement to the processing of your personal data for the above-mentioned purposes, when we process your data based on your consent. You may withdraw your consent at any time, without affecting the lawfulness of processing based on your consent before your withdrawal.
We will provide you all the information you need to express your prior agreement (consent) to the processing of personal data relating to you, if processing is based on your consent.
If you refuse to disclose your Personal Data to the Company, we will not be able to provide you with some of our Products / Services.
RECIPIENTS & PROCESSORS
We may need to disclose your Personal Data to authorized recipients for (i) the maintenance / repair of our equipment (PCs, servers, hardware) that support the operation of the Website, and (ii) the development of the Website.
Where processing is to be carried out on behalf of the Company, we use only processors providing sufficient guarantees to implement appropriate technical and organizational measures in such a manner that processing will meet the requirements of the GDPR and ensure the protection of your rights. Some of the recipients and/or processors: i) WooCommerce, ii) Attica Bank, iii) Google Inc.
Woocommerce Privacy Policy: https://automattic.com/privacy/.
Google Privacy Policy: https://www.google.com/intl/en/policies/privacy/.
The Company uses Google Analytics. The Company and Google Inc. are joint controllers for some of the processing operations, while for other processing operations Google Inc. and the Company are sole Controllers.
Google Inc. determines some of the purposes and means of the processing of personal data collected through its technology. For any processing of personal data for the purposes and means determined by Google Inc., it is the data controller. Google Inc. may use your personal data for its own purposes, such as for profiling or combined with other data from user accounts in other services. The processing of your Data under the Google Analytics service, either by the Company or by Google Inc., is carried out on the basis of your consent.
TRANSFER OF PERSONAL DATA TO A THIRD COUNTRY
A transfer of personal data to a third country (outside European Economic Area (EEA)) may take place where the Commission has decided that the third country ensures an adequate level of protection. In the absence of a decision we may transfer personal data to a third country only if the processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available. Otherwise, we will transfer your data to a third country only under GDPR conditions (data subject’ s consent, contract, vital interests etc.).
YOUR RIGHTS
The Company protects your personal data and respects your rights and freedoms.
As Data Subject you have the right to be informed on the processing of your personal data, the right of access to your personal data and to information relevant to processing, the right of rectification of your personal data , the right to erasure of your personal data, the right to restriction of processing, the right to data portability, the right to object to the processing of your personal data, the right not to be subject to a decision based solely on automated processing, including profiling and the right to withdraw your consent at any time.
To be informed about or exercise the above rights, you need to apply in writing to the Company PARAGLIDING CRETE POWER FLY LIMITED PARTNERSHIP, with registered offices in the Municipality of Chania Crete Greece, 20 Nikiforou Foka St., P.C. 73100, or via e-mail: info@paragliding-crete.gr. You may also use the Website’s services to rectify/complete your data. We are ready to handle your request with respect to your rights and privacy. Otherwise, you could lodge a complaint to a supervisory authority (www.dpa.gr – tel: 0030 210 6475600, contact@dpa.gr), if the Data Controller does not take action on your request.
We take all efforts to facilitate the exercise of Data Subjects’ rights. We will not refuse to act on any request of yours for exercising your rights, which are described above, unless we are not in a position to identify the Data Subject.
We will respond in writing to such requests from you, without undue delay and in any event within one month of receipt of your request. In this case we will provide you with information on action taken on behalf of your request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests. We will inform you of any such extension within one month of receipt of the request, together with the reasons for the delay.
We will communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.
Otherwise, if we do not intend to act on your request, we will inform you without delay and at the latest within one month of receipt of the request, of the reasons for not taking action.
Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the Company may either: (a) charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or (b) refuse to act on the request.
STORAGE & SECURITY OF PERSONAL DATA
Personal data collected through Paragliding-crete.gr, are stored at the Company’s computer systems and at the Website’s server in European Union or at other collaborating companies’ data centers.
Your Personal data are generally kept in electronic form or in a physical archive, when necessary (tax information, invoices, original forms of withdrawal, etc.). Paragliding-crete.gr uses SSL certificate.
All payments by credit/debit/prepaid card are processed through the secure electronic environment of Attica Bank. During the payment process all your information and personal data are encrypted with strong encryption protocol.
The Company shall not be liable for any damage caused by risks appearing in online systems of Banks, entities advertised in this website or collaborating courier companies etc., even if users are referred to said websites by hyperlinks, banners etc. placed on Paragliding-crete.gr. Liability for the content, information, visitors’ safety and protection of their personal data, as well as the quality of services provided is born solely by owners, managers and administrators of said websites, which users visit at their own risk.
DISPUTE RESOLUTION
For any dispute you may have with the Company, regarding this Privacy Policy, the use of the Website and the Services, we are willing to resolve the issue with respect of your rights.
In case of controversy or claim of any nature regarding the process of your personal data and the context of this Privacy Policy, applicable law is the law of the Greek state, the GDPR and the instructions, decisions, guidelines and opinions of the Hellenic Data Protection Authority. Any dispute between The Company, Users and third parties will be resolved through friendly negotiations between them and through Alternative Dispute Resolution (Mediation). Otherwise, for all actions or legal procedures, the Greek Courts will be in charge.
UPDATES TO OUR PRIVACY POLICY
The Company reserves the right to amend this Privacy policy. Any changes will be post on this web page. You should periodically check whether changes have been made. In case you disagree with the Privacy Policy, you must refrain from any action, interaction, access and use of this Website. Last update: 30/05/2022.
