PRIVACY POLICY
1. General information
1.1. Purpose and Contents
1. This privacy statement informs you about the nature, scope, and purpose of personal data processing in relation to our online offer and the associated websites, functions and content (hereinafter collectively referred to as "Online Offer" or "We bite") . Details of these processing activities can be found in Section 2.
2. Details of the processing of personal data in our physical stores are described in section 3.
3. Details of the processing of personal data for the purposes of carrying out our business processes are described in Section 4.
4. HOLMES PLACE EAST MED BV (Agiou Konstantinou 40, "ETHRIO"Shopping Center, 15124 Maroussi - hereinafter referred to as "We" or"Us" - is responsible under data protection legislation.
5. You can contact our data protection officer atDataprotection_GR@holmesplace.gr.
6. The term "user" includes all customers and visitors of the online offer.
1.2. Legal Basis
We collect and process personal data based on the following legal bases:
1. Consent in accordance with Article 6(1)(a) of the General Data Protection Regulation (GDPR). Consent is any voluntary, informed and unambiguous expression of will in the specific case in the form of a declaration or other unambiguous affirmative act by which the data subject indicates that they consent to the processing of their personal data.
2. Necessity for the performance of a contract or the implementation of preparatory measures pursuant to Article 6(1)(b) GDPR, i.e. the data is necessary to be able to fulfill our contractual obligations towards you or we need the data to prepare for the conclusion of a contract with you.
3. Processing for the compliance with a legal obligation pursuant to Article 6(1)(c) GDPR, i.e. that the processing of the data is required by law or other regulations.
4. Processing for the protection of our legitimate interests in accordance with Article 6(1)(f) GDPR, i.e. processing is necessary for the protection of legitimate interests on our part or on behalf of third parties,unless your interests are overridden by the interests or fundamental rights and freedoms, which require the protection of personal data.
1.3. Data subject rights
You have the following rights regarding the processing of your personal data by us:
1. Right to lodge a complaint with a supervisory authority pursuant to Article 13(2)(d) GDPR and Article 14(2)(e) GDPR
1. Right to information pursuant to Article 15 GDPR
2. Right to rectification pursuant to Article 16 GDPR
3. Right to erasure ("right to be forgotten") pursuant to Article 17 GDPR
4. Right to restriction of processing pursuant to Article 18 GDPR
5. Right to data portability pursuant to Article 20 GDPR
6. Right to object pursuant to Article 21 GDPR
Note: Users can object to the processing of their personal data at anytime, with effect for the future. This objection can be made in particular against the processing of personal data for the purposes of direct advertising.
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, your place of work or the place of the alleged infringement, if you if you consider that the processing of personal data relating to you infringes the GDPR.
1.4. Data Erasure and Retention Period
The user's personal data will be deleted or restricted as soon as the purpose of the processing ceases to apply. The processing may also take place if this is provided for by other legal provisions to which the controller is subject (e.g. Tax). The data will also be limited or deleted if the retention period defined by the aforementioned standards expires, unless there is a need to further store the data for the conclusion or performance of a contract.
1.5. Processing Security
1. We have implemented appropriate and state-of-the-art technical and organizational security measures (TOMs). This protects the data we process against accidental or intentional manipulation, loss, destruction and unauthorized access.
2. Security measures include, in particular, encrypted data transmission between your browser and our server.
1.6. Transfer of data to third parties, subcontractors and third-party providers
1. Transmission of personal data to third parties takes place only in the context of legal requirements. We only transmit user data to third parties if this is necessary, for example for billing purposes or for other purposes,if the transmission is necessary to fulfill contractual obligations towards the user.
2. If we use subcontractors for our online offer, we have taken appropriate contractual precautions and appropriate technical and organizational measures with these companies.
3. If we use content, tools or other means from other companies(hereinafter collectively referred to as "third-party providers") and whose registered offices are located in a third country, we can assume that the data will be transferred to the countries where the third-party providers have their registered offices. We only transfer personal data to third countries if there is an appropriate level of data protection, user consent or other legal permission.
2. Processing within the scope of our online offer
2.1. Webflow
1. We host our Website with Webflow. The provider is Webflow, Inc., 39811th Street, 2nd Floor, San Francisco, CA 94103, USA (hereinafter Webflow). When you visit our Website, Webflow collects various log files including your IP addresses.
2. Webflow is a website builder and hosting tool. Webflow stores cookies or other identification technologies required to display the Website, provide certain Website functions and ensure security (necessary cookies).
3. Details can be found in Webflow's privacy policy:
https://webflow.com/legal/eu-privacy-policy
4. The use of Webflow is based on Article 6(1)(f) GDPR. We have a legitimate interest in ensuring that our website is presented as reliably as possible. If a corresponding consent has been requested, the processing is done exclusively on the basis of art. 6(1)(A) GDPR and 25(1), insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g., device fingerprint) . Consent can be withdrawn at any time.
5. Data transfer to the US is based on the European Commission's Standard Contractual Clauses. Details can be found here:
https://webflow.com/legal/eu-privacy-policy
6. We have concluded an order processing agreement (AVV) with the above-mentioned provider. This is a contract required by data protection law,which ensures that this provider only processes the personal data of our website visitors in accordance with our instructions and in compliance with the DPR.
2.2. Amazon Cloud Front CDN
1. We use the Cloud front Content Delivery Network (CDN). The provider is Amazon Web Services EMEA SARL, 38 avenue John F. Kennedy, L-1855, Luxembourg(hereinafter "Amazon"). Amazon acts as a subcontractor for Webflow.
2. Amazon Cloud Front CDN is a globally distributed content delivery network. Technically, the transfer of information between your browser and our Website is routed through the content delivery network. This enables us to increase the global accessibility and performance of our Website.
3. The use of Amazon Cloud Front CDN is based on our legitimate interest in providing our Website as secure and error-free as possible (Article 6 (1)(f)GDPR).
4. The transfer of data to the US is based on the European Commission's Standard Contractual Clauses. Details can be found here:
https://aws.amazon.com/en/blogs/security/aws-gdpr-data-processing-addendum/
2.3. Fastly
1. Our website uses the Fastly Content Delivery Network (CDN) to deliver content. CDN Fastly is operated by Fastly Inc., General Counsel 475 Brannan St,Suite 300 San Francisco, CA 94107. Fastly acts as a subcontractor for Webflow.
2. Fastly CDN makes content from our Website available on various servers distributed around the world. This shortens the loading time of the webpage, achieves greater reliability and increased protection against data loss.Content embedded on this Website, such as images and videos, is retrieved from the Fastly CDN when the page is accessed. Through this retrieval, information about your use of our Website (such as your IP address) is transmitted toFastly servers in other EU countries and stored there. This already happens when you use the Website with this content.
3. Fastly Web services and Fastly CDN are used for reasons of greater reliability, increased protection against data loss and better loading speed of he Website. This constitutes our legitimate interest within the meaning of Article 6(1)(f) GDPR.
4. Fastly's current data protection statement can be found here: https://www.fastly.com/privacy
2.4. Information on Google services
1. We use various services from Google Ireland Limited("Google"), Gordon House, Barrow Street, Dublin 4, Ireland on our Website.
You will find more detailed information about the individual specific Google services we use on this Website in the further data protection statement.
2. By integrating Google services, Google may collect information(including personal data) and process it. It cannot be ruled out that Google will also transfer the information to a third-country server. Transfer to the US depends on the function by which the personal data is transferred. As the controller, we may transfer data to Google in the USA for further use.
There is currently no adequacy decision under Art. 45 GDPR. However, the transfer may be based on standard contractual clauses. Google is committed to complying with standard contractual clauses for the transfer of personal data to third countries in accordance with Directive 95/46/EC (Standard Contractual Clauses - SCCs).
For more information on Standard Contractual Clauses, visit
https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractuals-clauses-scc_en
as well as below
https://policies.google.com/privacy/frameworks?hl=gr
3. We ourselves cannot influence which data Google actually collects and processes. However, Google states that, in principle, the following information(including personal data) may be processed:
· log data (in particular the IP address)
· Location-based information
· Unique application numbers
· Cookies and similar technologies
Information about the types of cookies used by Google can be found at https://policies.google.com/technologies/types
4. If you are logged in to your Google account, depending on your account settings, Google may add the processed information to your account and treat it as personal data depending on your account settings.
5. Google states, among other things:
"If you are not signed in to a Google Account, we store the data we collect with unique identifiers associated with the browser, application or device you use. This allows us, for example, to ensure that your language settings are retained across all your browsing sessions.
If you are signed in to a Google Account, we also collect data that we store in your Google Account and consider personal data." (https://privacy.google.com/take-control.html )
6. You can prevent this data from being added directly by logging out of your Google account or by making the appropriate account settings in your Google account. You can also change your cookie settings (e.g. delete cookies,block them, etc.).
7. For more information, see Google's privacy policy, which can be accessed here: https://www.google.com/policies/privacy/
8. Information on Google's privacy settings can be found at https://privacy.google.com/take-control.html
2.5. Google Analytics
1. Based on your consent for the analysis, optimization and economic operation of our online offer in accordance with Article 6 (1)(a) GDPR, we use Google Analytics, a web analysis service provided by Google Ireland Limited(Gordon House, Barrow Street, Dublin 4, Ireland) - hereinafter"Google"). Google uses cookies and other technologies. The information generated by the service about the users' use of the Online Offer is transmitted to a Google server in the USA and processed there.
2. Google acts on our behalf in the context of data processing in accordance with Article 28 GDPR. We have concluded a data protection agreement with Google which contains the EU standard data protection clauses.
3. In addition, we have we have concluded a shared responsibility agreement with Google in accordance with Article 26 GDPR for the use of Google's measurement services (see https://support.google.com/analytics/answer/9012600). Within this framework, we have agreed with Google to be responsible for the fulfilment of information obligations and for ensuring the rights of data subjects in accordance with Chapter 3 GDPR, as well as for the security of processing and reporting and notification obligations. (Articles 32 to 34 GDPR). Google will use the information to evaluate the use of our online offer by users, to compile reports on the activities of this online offer and to provide us with other services related to the use of this online offer and the use of the Internet. Pseudonymous user profiles can be created from the processed data.
4. We use Google Analytics to display the advertisements placed on the advertising services of Google and its partners only to those users who have also shown an interest in our Online Offer or who have certain characteristics(e.g. interests in certain topics or products based on the websites they visit), which we transmit to Google ("Google Analytics Audience"). With the help of personalized marketing, we also want to ensure that our ads are relevant to users' potential interests and are not intrusive.
5. We use Google Analytics with IP anonymization enabled.
6. Google Analytics stores cookies in your browser for a period of two years from your last visit. These cookies contain a randomly generated user ID by which you can identify yourself on future visits to the Website. Users may refuse to the storage of cookies by setting their browser software accordingly.In addition, users can prevent the collection and processing of the data generated by the cookie and related to the use of the Online Offer by Google by downloading and installing the browser plug-in available at the following link:https://tools.google.com/dlpage/gaoptout?hl=gr
7. The recorded data is stored together with the randomly generated user ID, which enables the evaluation of pseudonymous user profiles. This user-related data is automatically deleted after 26 months. Other data is stored in aggregate form indefinitely.
8. More information about Google's use of data, settings and revocation options can be found on Google's websites:
https://policies.google.com/technologies/partner-sites?hl=gr ("Use of data by Google when you use our partner sites or apps")
https://policies.google.com/technologies/ads ("Use of data for advertising purposes")
https://adssettings.google.com/authenticated ("Manage information Google uses to show you ads").
2.6. Google Tag Manager
1. We use Google Tag Manager on our Website. Google Tag Manager is a service provided by Google Ireland Limited ("Google"), Gordon House,Barrow Street, Dublin 4, Ireland.
2. Google Tag Manager enables us to integrate various codes and services on our Website in an orderly and simplified manner. Google Tag Manager implements the tags or "triggers" the embedded tags. When a tag is triggered,Google may process information (including personal data) and process it. It cannot be ruled out that Google will also transfer the information to a third-party server.
3. Information about the standard contractual clauses and the transmission by us to Google in the USA and other relevant data for data processing by Google as part of the use of Google services can be found in this data protection statement in section 2.4 "Information about Google Services".
4. In particular, the following personal data is processed by the Google Tag Manager:
· Online identifiers (including cookie identifiers)
· IP address
5. You can also find more detailed information about Google Tag Manager at https://www.google.com/tagmanager/use-policy.html
as well as below
https://www.google.com/intl/en/policies/privacy/index.html (section "Data we receive based on your use of our services").
6. In addition, we have concluded a data processing agreement with Google for the use of the Google Tag Manager (Article 28 GDPR). Google processes the data on our behalf in order to trigger the stored tags and display the services on our Website. Google may transfer this information to third parties where required by law or when these third parties process the information on Google's behalf.
7. If you have disabled individual tracking services (e.g. by setting a nopt-out cookie), the deactivation remains for all affected tracking tags integrated by Google Tag Manager.
8. By integrating Google Tag Manager, we aim to be able to integrate various services in a simplified and clear way. In addition, the integration of Google Tag Manager optimizes the loading times of the various services. The legal basis for the processing of personal data described here in the context of the measurement process is your express consent pursuant to Art. 6 (1) (a)GDPR. The legal basis for processing those data that are processed in the context of obtaining consent is our legitimate interest pursuant to 6(1)(f)GDPR.
2.7. Facebook Pixel
1. We use the Facebook Pixel, from Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, a subsidiary of Facebook Inc.1601, Willow Road Menlo Park, CA 94025, USA on our Website, to monitor the success of our own Facebook advertising campaigns and to optimize the delivery of Facebook advertising campaigns to interested target groups.
2. After you click on an ad on Facebook or visit our Website, a cookie s stored on your end device using the Pixel on our Website. The cookie processes data about whether you arrived to our Website through a Facebook ad and enables the analysis of user behavior until the purchase is completed. This allows us to track the success rate of our Facebook advertising campaigns. In addition,the Pixel processes data that you have visited on our Website and allows the advertisements displayed on Facebook to be tailored to your interests.
3. When you visit our Website, a direct connection to the Facebook servers is established via the Facebook pixel embedded in our Website. The information generated by the cookie about your use of this Website (including your IP address) is transmitted to Facebook in the USA.
4. There is no adequacy decision by the EU Commission for data transfers to the US. Facebook ensures an adequate level of data protection through EU standard contractual clauses. You can access a copy of the contractual clauses here: https://www.facebook.com/legal/EU_data_transfer_addendum
5. The data collected is anonymous to us and does not allow us to draw any conclusions about the user. If you are registered with Facebook, Facebook can assign the collected information to your account. Even if you do not have a Facebook account or are not logged in when you visit our Website, it is possible for Facebook to process and store your IP address and other identification data.
6. The legal basis for data processing is your consent in accordance with Art. 6(1)(a) GDPR.
7. You can revoke your consent to data processing by the Facebook Pixel for our web domain at any time with effect for the future by adjusting your preferences in the cookie settings. You can also prevent the setting of cookies by adjusting the relevant settings in your Facebook account at https://www.facebook.com/settings?tab=ads
2.8. Consent Management
1. This Website uses Cookies-Script's cookie consent technology to obtain your consent to store certain cookies on your end device to ensure compliance with personal data protection legislation. The provider of this technology is Object is Ltd (Laisves st. 60 LT-05120 Vilnius, Lithuania,website: https://cookie-script.com/ ) - hereinafter "Cookie-Script".
2. When you enter our Website, the following personal data is transferred to the Cookie-Script:
· Your consent or withdrawal of consent
· Your IP address
· Information about your browser
· Information about your device
· the time of your visit to the Website;
3. In addition, Cookie-Script stores a cookie in your browser to be able to allocate the given consent or its withdrawal by you. The data collected in this way is stored until you request us to delete it, delete the Cookie-Script cookie yourself, or the purpose for storing the data no longer applies.Mandatory statutory retention requirements remain unaffected.
4. Cookie-Script is used to obtain the legally required consent for th euse of cookies. The legal basis for this is Article 6(1)(c) GDPR.
2.9. Links to other websites
1. While using some of our services, you will be automatically redirected to other websites.
2. Please note that this data protection statement does not apply there.The data protection statement of the linked site may differ significantly from this one.
2.10. Bootstrap
Bootstrap is a widely used styling framework. We only use the Bootstrap library to style the Website. This poses no security risk as it is only used for the front end and only for style elements on the page.
2.11. jQuery
jQuery is a widely used java script library that helps us with some effects. Just like Bootstrap, we only use jQuery for styling/front end UX.
3. Entry Process
3.1. Access Control
Below you will find our data protection notice within the meaning of Articles 12 to 14 GDPR regarding the processing of personal data in the context of access control.
1. As a participant you will receive a STORM oscilloscope at the Holmes Place reception.
2. As part of the access control, the following data - hereinafter"Access Data" - are recorded: Date and time of access and the club visited.
3. The legal basis for the processing is our legitimate interest in accordance with Article 6(1)(F) GDPR.
4. Our legal interest lies in particular in:
a) conduct of our house rights,
b) asserting or exercising legal claims or defending against legal claims,
c) safeguarding members' interests (avoiding waiting time at the reception desk)
d) to ensure complete evacuation of the club in case of emergency
e) to detect / prevent misuse of the oscilloscope
5. Profiling (profiling) in accordance with Article 4(4) GDPR, based on access data is not carried out by us.
4. Processing for the purpose of carrying out our business processes
4.1. Contact form and contact by e-mail
1. When contacting us (via an electronic form or e-mail), the data provided by the user will only be used to process and handle the request.
2. Any other use of the data is only based on the consent of the user.
3. User data is stored in the Customer Relationship Management System("CRM System").
4.2. Direct Marketing
1. If you have given us your consent, we will inform you regularly bye-mail, phone or SMS / push notification about us, our clubs and current topics and offers. We use your name, email address and phone number for this purpose.The legal basis for data processing is Art. 6 (1) (a) GDPR. You can withdraw your consent at any time with effect for the future.
2. If you withdraw your consent, your email address will no longer be used for our email newsletter.
3. By subscribing to the newsletter, you also agree to our newsletter tracking for the purposes of personalized advertising and market research. With the help of tracking pixels or web beacons and links, each of which is linked to an individual ID, we collect the following personal tracking information in connection with the use of our newsletter:
· Opening the newsletter, clicking on the links contained therein,submitting a form on our Website after clicking on a link contained in thenews letter (including the time of such actions);
· Type of terminal device used when you call up images in the newsletter or click on links
· Behavior on our Website if you access it via a link from our newsletter (including the time of such actions);
· Location if you access images in the newsletter or click on links (by assigning your IP address, which we do not store)
We store this data for your user profile, which is assigned to the data you entered when subscribing to the newsletter. We use this data to evaluate and optimize email marketing and for personalized advertising and market research purposes. This enables us to send you personalized products, services and offer information of particular interest to you as part of our newsletter.You can withdraw your consent to this data processing at any time with effect for the future by unsubscribing from the newsletter. We delete tracking data when you unsubscribe from our newsletter. Data stored by us for other purposes remains unaffected.
4.3. Advertising to existing customers
1. If you have a contractual relationship with us, we may inform you from time to time by e-mail, telephone, SMS or letter about similar services provided that you have not objected to this.
2. The legal basis for data processing is Art. 6 (1) (f) GDPR. Our legitimate interest lies in direct advertising (recital 47 GDPR). You can object to the use of your e-mail address, telephone number and postal address for advertising purposes at any time and with effect for the future at no additional cost.
5. Cookie policy
5.1. General information
1. Cookies are pieces of information transferred from our web server or third-party web servers to the user's web browser and stored there for future retrieval. Cookies can be small files or other types of information storage.
2. If users do not wish cookies to be stored on their computer, they are asked to disable the corresponding option in the system settings of their browser. Stored cookies can be deleted in the browser's system settings.Exclusion of cookies may lead to functional restrictions of this online offer.
5.2 Overview and management of cookies
1. You can find an up-to-date overview of the cookies used on this Website in the consent management platform "cookie-Script" (see section 2.8 "Consent Management").
2. You can also manage your individual consents or preferences there.
6. Changes to the Privacy Policy
1. We reserve the right to change this Privacy Policy in order to adapt it to changes in legislation or changes in the way we process data.
2. If the user's consent is required or parts of the Privacy Policy contain provisions of the contractual relationship with the user, changes will only be made with the user's consent.
3. Users are requested to regularly inform themselves about the content of this Privacy Policy.
Update: July 2022
