PRIVACY POLICY

«HELLENIC ENTERTAINMENT PARK S.A»
PRIVACY POLICY
(«www.allou.gr»)

The present document constitutes the Privacy Policy, according to which, Hellenic Entertainment Park S.A. (ALLOU), which is a company established in Agios Ioannis Rentis in Athens, Kanapitseri – Myrivili – Il.Venezi str. P.C 18233, phone number +302108092800, email: info@allou.gr, acting as data controller, under the EU Regulation 697/2016 – General Data Protection Regulation (GDPR) collects, storages, uses and in general processes your Personal Data during specific online activities.

Furthermore, the present Privacy Policy describes the method of use, disclosure and protection of your Personal Data, your right concerning your Personal Data and how you can contact with us. For any question concerning the present Privacy Policy or any matter relating to the processing of your Personal Data and the exercise of your rights, you can communicate with Hellenic Entertainment Park S.A. in the above-mentioned details.

1. What is Personal Data?
Personal Data is any information that relates to an identified or identifiable living individual, such as name and surname, home address, email address, phone number etc., hereafter called «Personal Data or Data».

2. What is the Processing of Personal Data?
Any operation or set of operations which is performed by automated means or not on Personal Data or sets of Personal Data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

3. What Personal Data do we collect?
We collect only the absolutely necessary Personal Data, which are adequate and relevant in relation to the purposes for which they have been asked, as the following.

i. As to the communication via the contact form or via the email address info@allou.gr:
a) your name and surname,
b) your email address,
c) any other Personal Data included in your message.

ii. As to the organization of party in Allou and Kidom via our website:
a) your name and surname,
b) your email address,
c) any other Personal Data included in your message.

iii. As to the organization of school visits via our website:
a) your name and surname,
b) your email address,
c) any other Personal Data included in your message.

iv. As to the organization of corporate events via our website:
a) your name and surname,
b) your email address,
c) any other Personal Data included in your message.

v. As to the submission of your job application via our website:
a) your name and surname,
b) your father’s name,
c) your mother’s name,
d) your birthday,
e) your place of birth,
f) your address,
g) your P.C,
h) your telephone numbers,
i) your family situation,
j) information about your military service,
k) your studies,
l) your foreign languages,
m) your qualifications,
n) your previous professional experience,
o) the reason for leaving your previous job.

vi. As to the creation of a user account for additional services:
a) your name and surname,
b) your email address,
c) your password.

vii. As to the promotion of activities in Allou and Kidom via our website:
a) your photos.

viii. As to the e - shop:
a) your name and surname,
b) the type of ticket you bought,
c) your address,
d) your city,
e) your P.C,
f) your telephone number,
g) your email address.

It should be noted that in case of credit card payment, Personal Data which are filled in on our website, namely credit card holder’s name, card number, CVV card and expiry date, are collected directly from VIVA Payments, as the payment takes place via Viva Payments. ALLOU does not receive any knowledge of the above-mentioned Personal Data. Data Controller for these Personal Data is VIVA, the Privacy Policy of which is available here.

ix. As to the sending of newsletter to users of our website:

a) your email address,
b) your registration date,
c) your IP address.

x. As to the competitions via social media, namely on Facebook or/and Instagram:
a) your Facebook or/and Instagram name, as it is stated on social media,
b) Facebook or/and Instagram name of a friend of yours, whom you refer on your comment, only if it is required for your participation in the competition,
c) the relationship that connects you to the above-mentioned one according to your statement in your comment, only if it is required for your participation in the competition,
d) your status as winner,
e) your name and surname, only if you are the winner.

xi. As to the promotion via social media, namely on Facebook or/and Instagram or/and YouTube:
a) your photos,
b) your videos,
c) any other Personal Data included in your message.

xii. As to the sending of press releases via email address to online media:
a) name, surname and the email address of each journalist.

Furthermore, our website uses cookies, which collect only the necessary Personal Data for the better operation of it, only with your consent and in accordance with the Cookies Policy, which is also available in our website. You can read the Cookies Policy here.

4. For what purposes do we collect your Personal Data?

i. As to the communication via the contact form or via the email address info@allou.gr:
We collect Personal Data directly from you, as you fill them in the contact form, in order to communicate with you.

ii. As to the organization of party in Allou and Kidom via our website:
We collect Personal Data from yourself, as you fill them in the relevant form, in order to organize a party in Allou and Kidom.

iii. As to the organization of school visits via our website:
We collect Personal Data from you, as you fill them in the relevant form, in order to organize the school visit.

iv. As to the organization of corporate events via our website:
We collect Personal Data from you, as you fill them in the relevant form, in order to organize the corporate event.

v. As to the submission of your job application via our website:
We collect Personal Data from you, as you fill them in the relevant form, in order to examine your hiring to the company.

vi. As to the creation of a user account for additional services:
We collect Personal Data from you, as you fill them in the relevant form, in order to create your user account on our website and provide you with personalized services.

vii. As to the promotion of activities in Allou and Kidom via our website:

We collect Personal Data from you, in order to promote the activities of Allou and Kidom in our website.

viii. As to the e-shop:
We collect Personal Data from you, as you provide them via our e – shop in order you to buy your ticket for Allou and Kidom.

ix. As to the sending of newsletter to users of our website:
We collect Personal Data from you, as you provide them via our website, in order to send you newsletter.

x. As to the competitions via social media, namely on Facebook or/and Instagram:
We collect Personal Data from you or your friends which provide them during their participation by comments, in order to carry out competitions on Facebook or/and Instagram.

xi. As to the promotion via social media, namely on Facebook or/and Instagram or/and YouTube:
We collect Personal Data from you, in order to promote Allou and Kidom activities on social media.

xii. As to the sending of press release via email address to online media:
We collect Personal Data from yourself or the media in which you work, in order to send you press releases concerning our activities.

5. Which is the legal basis for the Processing of your Personal Data by ALLOU?
We collect your Personal Data only under one of the legal basis of EU Regulation.

i. As to the communication via the contact form or via the email address info@allou.gr:
In any case the processing will be based on your clearly given consent, which is provided by sending your message. You can withdraw your consent at any time.

ii. As to the organization of party in Allou and Kidom via our website:
In any case the processing will be based on the fact that it is necessary for the performance of a contract to which the data subject will become a party, namely for the organization of your party in Allou and Kidom.

iii. As to the organization of school visits via our website:
In any case the processing will be based on the fact that it is necessary for the performance of a contract to which the data subject will become a party, namely for the organization of the school visit.

iv. As to the organization of corporate events via our website:
In any case the processing will be based on the fact that it is necessary for the performance of a contract to which the data subject will become a party, namely for the organization of the corporate event.

v. As to the submission of your job application via our website:
In any case the processing will be based on the fact that it is necessary for the performance of a contract to which the data subject will become a party, namely for your hiring in our company.

vi. As to the creation of a user account for additional services:
In any case the processing will be based on your clearly given consent. You can withdraw you consent at any time.
It is underlined that if you are below the age of 16 years, the consent has to be given or authorised by the holder of the parental responsibility over you.

vii. As to the promotion of activities in Allou and Kidom via our website:
In any case the processing will be based on your clearly given consent, which is given in written, or for the performance of the contract to which you are a party. As to your consent, you can withdraw it at any time.

viii. As to the e-shop:
In any case the processing will be based on the fact that it is necessary for the performance of the contract to which you are a party, namely the sale of entrance ticket.

ix. As to the sending of newsletter to users of the website:
In any case the processing will be based on your clearly given consent, which is given by filling your email address in the relevant form of our website. You can withdraw your consent at any time.
It is underlined that if you are below the age of 16 years, the consent has to be given or authorised by the holder of the parental responsibility over you.

x. As to the competitions via social media, namely on Facebook or/and Instagram:
In any case the processing will be based on one of the following legal basis:
a) your consent, which is given by your participation in the competition and which you can withdraw at any time,
b) your consent, which is given by sending your name as the winner of the competition and which you can withdraw at any time,
c) the purposes of the legitimate interests pursued by ALLOU, namely the proper conduction of the competition for the benefit of the participants and third parties associated with the participants.
It is underlined that if you are below the age of 16 years, the consent has to be given or authorised by the holder of the parental responsibility over you.

xi. As to the promotion via social media, namely on Facebook or/and on Instagram or/and Youtube:
In any case the processing will be based on your clearly given consent, which is given in written or electronically, among others by tagging a photo, sending a message and by performing the contract to which you are a party. As to your consent, you can withdraw it at any time.

xii .As to the sending of press releases via email address to online media:
In any case the processing will be based on the purposes of our overriding legitimate interests, namely the public information about our activities via the media, in the context of freedom of expression and information during our operation.

6. Who have access to your Personal Data and / or are the recipients of your Personal Data?


i. As to the communication via the contact form or via the email address info@allou.gr:
Access to your Personal Data has only the absolutely necessary staff of ALLOU and only if it is necessary.
Furthermore, recipient of your Personal Data is Microsoft, which provides us web and email hosting services via its servers, which are located in the EU.

ii. As to the organization of party in Allou and Kidom via our website:
Access to your Personal Data has only the absolutely necessary staff of ALLOU and only if it is necessary.
Furthermore, recipient of your Personal Data is Microsoft, which provides us web and email hosting services via its servers, which are located in the EU.

iii. As to the organization of school visits via our website:
Access to your Personal Data has only the absolutely necessary staff of ALLOU and only if it is necessary.
Furthermore, recipient of your Personal Data is Microsoft, which provides us web and email hosting services via its servers, which are located in the EU.

iv. As to the organization of corporate events via our website:
Access to your Personal Data has only the absolutely necessary staff of ALLOU and only if it is necessary.
Furthermore, recipient of your Personal Data is Microsoft, which provides us web and email hosting services with servers which are located in the EU.

v. As to the submission of your job application via our website:
Access to your Personal Data has only the absolutely necessary staff of ALLOU and only if it is necessary.
Furthermore, recipient of your Personal Data is Microsoft, which provides us email hosting services via its servers, which are located in the EU.

vi. As to the creation of a user account for additional services:
Access to your Personal Data has only the absolutely necessary staff of ALLOU and only if it is necessary.
Furthermore, recipient of your Personal Data is Microsoft, which provides us web and email hosting services via its servers, which are located in the EU.

vii. As to the promotion of activities in Allou and Kidom via our website:
Access to your Personal Data has only the absolutely necessary staff of ALLOU and only if it is necessary. Access to your Personal Data have also visitors of the website.
Furthermore, recipient of your Personal Data is Microsoft, which provides us web hosting services via its servers, which are located in the EU.

viii. As to the e-shop:
Access to your Personal Data has only the absolutely necessary staff of ALLOU and only if it is necessary.
Furthermore, recipient of your Personal Data is Microsoft, which provides us web and email hosting services via its servers, which are located in the EU.

ix. As to the sending of newsletter to users of our website:
Access to your Personal Data has only the absolutely necessary staff of ALLOU and only if it is necessary.
Furthermore, recipient of your Personal Data is Microsoft, which provides us web and email hosting services via its servers, which are located in the EU. Moreover, Mailchimp, which belongs to The Rocket Science Group LLC company, is a platform of sending newsletter and provides us with newsletter services. Mailchimp’s servers are located in the USA.

x. As to the competitions via social media, namely on Facebook or/and Instagram:
Access to your Personal Data has only the absolutely necessary staff of ALLOU and only if it is necessary.
Recipients concerning your Personal Data, which are published on comments, are the relevant social media company (Facebook or/and Instagram) and visitors of Facebook or/and Instagram accounts of ALLOU.

xi. As to the promotion via social media, namely on Facebook or/and Instagram or/and YouTube:
Access to your Personal Data has only the absolutely necessary staff of ALLOU and only if it is necessary.
Recipients are also the social media company (Facebook or/and Instagram or/and Youtube) and visitors of Facebook or/and Instagram or/and Youtube accounts of ALLOU.

xii. As to the sending of press release via email address to online media:
Access to your Personal Data has only the absolutely necessary staff of ALLOU and only if it is necessary.
Recipient is also Mailchimp, which belongs to The Rocket Science Group LLC company, is a platform of sending newsletter and provides us with newsletter services. Mailchimp’s servers are located in the USA.

7. How do we ensure that our associates respect your Personal Data?
Our associates have agreed:
  • to maintain confidentiality,
  • not to send your Personal Data to third parties without ALLOU's permission,
  • to take the appropriate technical and organizational security measures,
  • to comply with the legal framework for the protection of Personal Data, in particular Regulation 679/2016 (GDPR).

8. Do we transmit your Personal Data outside the E.U.?
Normally, we do not transmit your Personal Data outside the E.U.

As to sending of newsletter:
Mailchimp, which belongs to The Rocket Science Group LLC company, is a platform of sending newsletter and provides us with newsletter services. Mailchimp’s servers are located in the USA.

9. Period of keeping the Personal Data
Your Personal Data are being kept only as long as it is necessary for the fulfillment of the purpose for which you have disclosed them to us, unless if the extension of this time period is necessary due to legal claims or legal obligation.

i. As to the communication via the contact form or via the email address info@allou.gr:
Your Personal Data are typically deleted within one year after our last contact.

ii. As to the organization of party in Allou and Kidom via our website:
Particularly, concerning those who receive an offer but do not conclude a contract, your Personal Data are typically deleted within one year after the submission of our offer.

iii. As to the organization of school visits via our website:
Particularly, concerning those who receive an offer but do not conclude a contract, your Personal Data are typically deleted within one year after the submission of our offer.

iv. As to the organization of corporate events via our website:
Particularly, concerning those who receive an offer but do not conclude a contract, your Personal Data are typically deleted within one year after the submission of our offer.

v. As to the submission of your job application via our website:
Particularly, concerning those who are interested in working with us but finally do not get hired, your Personal Data are typically deleted within one year after the submission of your job application.

vi. As to the creation of a user account for additional services:
Your Personal Data are typically deleted within a year after your last log in.

vii. As to the promotion of activities in Allou and Kidom via our website:
Your Personal Data are typically deleted after the end of each promotional campaign.

ix. As to the sending of newsletter to users of our website:

Your Personal Data are typically deleted after a lapse of six months without sending you our newsletter.
Your Personal Data collected during our communication via Facebook Μessenger and Instagram Direct are typically deleted within three months after our last contact.

x. As to the sending of press releases via email address to online media:
Your Personal Data are deleted when you leave from the respective online media.

10. Are your Personal Data safe?
Recognizing the importance of the security of your Personal Data, we have taken all appropriate organizational and technical measures to secure and protect your Personal Data from any unauthorized access, misuse, alteration, forbidden dissemination, disclosure, loss or accidental / unlawful destruction and any other form of illicit processing. These measures shall be reviewed and amended as necessary.

11. What are your rights?
  • Right of access
That means that you have the right to receive information from us concerning how and which of your Personal Data we process. You can also be informed for the purpose of these processing, the type of Personal Data that we store, which are the recipients of your Personal Data, the time of keeping them and whether we take decisions based solely on automated means or not.
  • Right to rectification
If you find that there is an inaccuracy concerning your Personal Data, you may ask from us the correction of any inaccuracies and the completion of any incomplete Personal Data (e.g. rectification of name), in order to be complete and accurate.
  • Right to erasure
You have the right to request from us the erasure of your Personal Data, if they are no longer necessary in relation to the purposes for which they were collected or otherwise processed.
  • Right to data portability
You have the right to ask to receive your Personal Data in a structured, commonly used and machine readable format or to request their transmission to another data controller.
  • Right to restriction of processing
You have the right to request from us the restriction of the processing of your Personal Data while the examination of your objections is pending.
  • Right to withdraw consent/object
You have the right to object to the processing of your Personal Data at any time or to withdraw your consent which was asked by us, and we are going to stop the processing of your Personal Data, if there are not other compelling and legitimate reasons that override your right or are no longer necessary for the above mentioned processing purposes.

12. How can you exercise your rights?
In order to exercise your rights you have to contact us and express your request as follows:
-Address: Agios Ioannis Rentis in Athens, Kanapitseri – Myrivili – Il.Venezi str. P.C 18233
-Telephone: 2108092800
-email: info@allou.gr

As soon as we get your request, we are going to send you a special form in order to proceed with its execution.
In any case, concerning the processing of your Personal Data, you can communicate with the company’s Data Protection Officer (DPO), sending your message as follows: dpo@allou.gr and Hellenic Entertainment Park SA, 16th Kanapitseri, 18233 Ag. Ioannis Rentis, Greece, Attn:DPO

13. When do we reply to your requests?
We reply to your request free of charge, without delay, in any case within (1) one month from the receipt of your request. Nevertheless, if your request is complicated or there is a great number of requests, we will inform you within one month if we need an extension of two (2) more months, within which we will answer you.
If your requests are manifestly unfounded or excessive in particular because of their repetitive character, we may impose the payment of a reasonable fee, taking into consideration the administrative expenses for the provision of the information or for the execution of the requested action, or may refuse to execute your request, by providing you with a justified answer.
In case you do not receive our answer within the aforementioned period or the answer that you received is not satisfactory or your issue has not been resolved, you have the right to communicate with the Hellenic Data Protection Authority (www.dpa.gr).

14. Do we take decisions based solely on automated means/ including the profiling during the processing of your Personal Data?

We do not take decisions based solely on automated means/ including the profiling during the processing of your Personal Data.

15. What is the applicable law for the processing of your Personal Data?
Applicable Law is the Greek Law as formulated in accordance with the General Regulation on the Protection of Personal Data 679/2016 and in general the current national and European legislative and regulatory framework for the protection of Personal Data. The Courts of Athens are competent for any disputes raised concerning your Personal Data.

16. How will you be informed about any changes to this Privacy Policy?
We update this Privacy Policy whenever it is necessary. If there are any significant changes to the Privacy Policy or the way we use your Personal Data, we will post on our site the update of this and we will notify you in any appropriate manner.
We encourage you to read this Policy at regular intervals to know how your Personal Data are protected.

The present Privacy Policy was updated on 27.06.2019.