CUSTOMER NOTIFICATION OF PERSONAL DATA PROCESSING
THEOFILOS CHALKIADAKIS Societe Anonyme (CACTUS HOTELS)
Regarding the Processing of Personal Data
THEOFILOS CHALKIADAKIS SA (operating under the trade name CACTUS HOTELS), located in Malia (Stalida Mochou, P.C. 70007, tel. 2897031319, email: info@cactushotels.gr ), (hereinafter referred to as the "Company"), hereby informs you, as the data subject, in its capacity as the data controller, in accordance with Regulation (EU) 2016/679 (hereinafter referred to as the "GDPR") and relevant Greek data protection laws, about the types of personal data collected, their source, the purpose and legal basis for their processing, any recipients of the data, the retention period, the possible transfer of data outside the EU, as well as your rights in relation to your personal data as customers of the Company and how you can exercise them.
The Company collects and processes personal data relating to its customers, both adults and minors. The types of personal data collected and processed are as follows:
The personal data under points 1-4 are provided directly to the Company by our customers (you) as data subjects. The provision of your data is a requirement for the conclusion and performance of the contract between us, and refusal to provide them would make it impossible to enter such a contract. Information regarding your payments and debts arises during your transactional relationship with the Company and is retained by the Company. The provision of data under point 5 above is optional, and any refusal to provide such data will result in the non-provision of specialized services (e.g., special dietary requirements).
The Company collects and processes the personal data that concern you for the following purposes and legal bases:
The above-mentioned personal data are processed for the purpose of providing hospitality services to you, including your identification, communication with you, etc. The legal basis for processing identification, communication, and reservation data is the performance of our contract with you, according to Article 6(1)(b) of the GDPR. If you provide us with special categories of data, such as health data (e.g., allergies, disabilities, dietary preferences, etc.), the legal basis for processing such data is your consent, according to Article 9(2)(a) of the GDPR.
The data under points 1, 2, and 3 mentioned above in Section B, which relate to your payments, are additionally processed for the purpose of invoicing the Company's services. The legal basis for processing these data is the fulfillment of the Company's legal obligations arising from tax legislation, according to Article 6(1)(c) of the GDPR.
Your electronic communication details are used for the purpose of promoting similar services of ours through electronic means (email/sms), based on our legitimate commercial interest in direct marketing of our services (Article 6(1)(f) of the GDPR and Article 11(3) of Law 3471/2006).
For the Company to fulfill the aforementioned functions and its related obligations, it discloses the personal data of its customers to categories of individuals or entities (recipients). The recipients have access only to the Personal Data that are absolutely necessary for the performance of their duties or the provision of services they have undertaken for the Company. These categories are as follows:
while maintaining the confidentiality of your data.
Ε. Data retention time
Your data is kept by the Company throughout the period of provision of its services to you and until the completion of the service provided by each of the above mentioned providers.
If by the end of the above periods there are ongoing legal proceedings in which the Company is involved and which concern you directly or indirectly, the retention time for your data will be extended until the issuance of an irrevocable court decision.
After the expiration of the time periods above, as the case may be, your personal data will be deleted/destroyed based on the Company's destruction policy.
The Company does not transmit your personal data to third countries outside the EU.
As customers of the Company, you have a series of rights, in accordance with the provisions of articles 15-22 of the GDPR, regarding your personal data, which are processed by the Company.
The table below lists your rights by processing purpose and corresponding legal basis. In this table you will find detailed information (meaning, method and deadlines for exercising) and a form for exercising each right. General information on exercising your rights is available here. If you wish to exercise any of your rights, please fill out the corresponding form and send it to the email address dpo@cactushotels.gr or in writing [Stalida Mochou, P.O. 70007, Malia / Attention Data Protection Officer]. We note that in case there are reasonable doubts about the identity of the data subject we may request the provision of additional information to confirm the identity.
|
RIGHTS |
||||||||
Access (Article 15 GDPR) |
Correction (16) |
Delete (17) |
Restriction (18) |
Portability (20) |
Opposition (21) |
Automated Decision (22) |
Withdrawal of consent (7.3) |
||
PURPOSE |
LEGAL BASIS |
i 2 |
i 2 |
i 2 |
i 2 |
i 2 |
i 2 |
i 2 |
|
Provision of hotel and tourism services to customers in general (in terms of simple data, such as identification and contact details) |
Execution of contract (Article 6.1b GDPR) |
Χ |
Χ |
Χ |
Χ |
Χ |
|
|
|
Provision of hotel and tourist services (regarding any health data, e.g. food and accommodation preferences, etc.) |
Consent (9.2α) |
Χ |
Χ |
Χ |
Χ |
Χ |
|
|
Χ |
Invoicing of products / services |
Compliance with legal obligation (6.1c) + tax legislation |
Χ |
Χ |
|
Χ |
|
|
|
|
Promotion of products/services to customers by electronic means |
Overriding legal interest (6.1f + Law 3471/2006 art. 11.3) |
Χ |
Χ |
Χ |
Χ |
|
Χ |
Χ |
|
It is pointed out that the Company has in any case the right to partially or fully refuse to satisfy your request for restriction of processing or deletion of your data, if the processing or keeping of the personal data concerning you is necessary for the establishment, exercise or support of its legal rights or the fulfillment of its legal obligations.
The Company must respond to your request within one month of receiving it. The aforementioned deadline may be extended by two more months, if required at the discretion of the Company taking into account the complexity of the request and the number of requests and in this case the Company will inform you within one month of receipt of said extension, as well as the reasons for the delay.
If the Company does not act on your request when exercising the above rights or after its response you consider that your above mentioned rights are being violated, you have the option of submitting a complaint to the Personal Data Protection Authority, Kifissias Street 1-3, 115 23, Athens, https://www.dpa.gr/ , tel. 2106475600.
For any issue regarding the protection of your personal data, you can contact our Company's Data Protection Officer, at: tel. 6936988100 and/or e-mail: dpo@cactushotels.gr
Εγγραφείτε στο Ενημερωτικό Δελτίο μας για να είστε οι πρώτοι που θα μαθαίνετε τα νέα μας, τις ανακοινώσεις και τις πληροφορίες για τις υπηρεσίες μας.
ΤΚ 70007 Σταλίδα,
Κρήτη - Ελλάδα
T: +30 28973 05150
E: info@cactus-mare.gr