Data Protection Notice
Contents
Data Protection Notice
This website is owned, operated, and provided by Aluma Greece P.C., a company established under the laws of Greece with registered company number 150272701000 and registered tax number 801151140, having its registered address at 28 Geraniou St., 10552, Athens, Attica, Greece (hereinafter the “Company”, “we”, “us”, “our”) who is also responsible for operating and managing it.
The use of the website www.alumahotels.com (hereinafter the “Website”) is subject to the “Terms & Conditions” (hereinafter the “Terms & Conditions”), the present Data Protection Notice (hereinafter the “Notice”), which describes how we, under our capacity as data controller (within the meaning of the GDPR), process your Personal Data when you visit the website (the “Website”) or use one of our services, and the Notice regarding the processing of personal data via the use of trackers (hereinafter the “Notice on the use of trackers”).
References in this Notice to “you” or “your” are references to individuals whose Personal Data we process, i.e. if you are a User (natural persons accessing, browsing or using the Website).
In this Notice, “Personal Data” means any information that enables you to be identified, directly or indirectly, as an individual, in particular by reference to an identifier, such as your name, location data, an online identifier (e.g., your IP address), etc.
We comply with applicable regulations on personal data protection, including with the General Data Protection Regulation EU 2016/679 (the “GDPR”), Law 4624/2019, Law 3471/2006, as well as with directives and guidelines of the Hellenic Data Protection Authority (the “HDPA”) and the European Data Protection Board.
The Website uses cookies or other tracking technologies to provide you with a safe and enhanced navigation experience, also in order for you to be able to use the functions of the Website and the services provided. The processing of personal data in this context is subject to the Notice on the use of trackers, where you may be informed on how the Website uses cookies or other tracking technologies.
We may update this Notice from time to time (e.g., to reflect a change in the applicable legal framework or a change in our practices) and will revise the date at the top of this document to reflect the date when such update occurred. You should check frequently for updates. By accessing the Website after the effective date of the Notice, you are deemed to have reviewed and accepted to our then-current Notice.
What Personal Data we process
When you visit and use the Website, we collect and further process certain Personal Data, to be able to offer access to the Website and its functionalities.
The types of Personal Data that we collect and further process, are collected directly from you and depend on the context of your interaction with us and the Website.
As applicable and depending on the specific purpose for which we process your Personal Data, we will collect the following categories of Personal Data:
(a) IP address;
(b) Name, phone number, email address, subject of the request, content of request, the hotel the request concerns;
(c) Information collected using cookies or other tracking technologies (for further details please see our Notice on the use of trackers,); and
(d) Preference regarding your stay in the hotel (e.g., dates of stay, destination, number of guests, promo code).
Why and how we process Personal Data
We process your Personal Data when we have a legal basis for such processing, only if and to the extent that at least one of the following applies:
- processing is necessary for the performance of a contract to which you a party or in order to take steps at your request prior to entering into such contract (i.e., to enable you to access the Website, to enable you to redirect to simplebooking.com in order to make a reservation) (Contract);
- processing is necessary for compliance with a legal obligation which we are subject to (i.e., for tax compliance purposes in the framework of your contract with us) (Legal obligation);
- processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data; for instance, such legitimate interests include (a) ensuring the efficient and secure operation of the Website, also for reasons of fraud and misuse detection and prevention; and (b) the improvement of our services (Legitimate interests);
- processing is necessary in order to respond to your request (Legitimate interests);
- where you have provided your consent for the processing of your Personal Data. This mainly applies when we use certain cookies and tracking technologies, and when you have provided your email address to receive marketing communications (Consent).
Where we have a statutory duty to collect your Personal Data (for instance, for purposes of compliance with applicable legislation) or under the terms of a contract that we have with you and you fail to provide the Personal Data when requested, we may not be able to perform the contract and offer you access to the Website functionalities and our services.
Recipients of Personal Data
We engage external parties who provide certain services to us, such as IT and system administration services, data hosting services, marketing communications services, providers of reservation services. We may share Personal Data with law enforcement authorities, government authorities, competent independent regulatory/supervising authorities, competent courts and other judicial authorities, our professional external advisers, counsels or consultants, including lawyers, auditors, accountants and insurers providing relevant services to us. In case of a merger or acquisition or funding, to the extent permitted by applicable law, your Personal Data may be shared with third parties being involved.
If you wish to request the updated list of these parties, please contact us at [email protected].
International transfers of Personal Data
In the framework of cooperation with the aforesaid recipients, , due to sharing of personal data with them, will be based on an adequacy decision issued by the European Commission or subject to suitable and appropriate safeguards and conditions to ensure an adequate level of data protection, e.g., data transfer agreements based on standard contractual clauses approved by the European Commission. For further information on how we protect personal data when transferred outside the EU/EEA or in order to obtain a copy of the safeguards we implement to protect personal data when transferred outside the EU/EEA, please contact us at [email protected].
Retention period
Your Personal Data processed for the aforementioned purposes will generally be retained for as long as it is necessary to fulfil the purposes we collected it for, e.g., for as long as you keep your account open or as needed to provide you with Website functionalities and our services. Once the data processing purpose is completed, we will either delete or anonymize your Personal Data, unless statutory retention requirements apply (e.g., to comply with regulatory and accounting requirements, or for the establishment or defense of legal claims).
With regard to the retention of information collected via cookies and other trackers, please read our Notice on the use of trackers.
Your rights
Under the conditions provided in the relevant legislation, you have the following rights regarding the protection of your Personal Data:
Right of access: You may contact us in order to be informed and receive explanations as to whether we process Personal Data that concern you, the categories of such data, as well as how we process them. You can also request a copy of your Personal Data which we process.
Right to rectification: If you believe that your data are inaccurate or are missing, you have the right to request the rectification or the completion thereof.
Right to erasure: Under appropriate circumstances, such as, when the data are no longer necessary or if you have withdrawn your consent, you can request us to proceed with erasure of the data.
Right to restriction of processing: If you believe that your data are inaccurate or that processing is unlawful or that we no longer need the data or you have objections to the automated processing (if applicable), you have the right to request the restriction of processing.
Right to object: You may object to the processing of your personal data by the Company on grounds that concern you and relate to your particular situation, unless, inter alia, there are compelling legitimate grounds for the processing which override your interests, rights and freedoms. You also have the right to object when a decision concerning you is based solely on automated processing, including profiling, and this decision produces legal effects concerning you or significantly affects you (exceptions provided by law).
Right to data portability: You may request to receive the data concerning you in a structured, commonly used and machine-readable format, as well as to transfer those data to another organization (controller), which you will indicate to us.
Right to withdraw your consent: You may withdraw your consent at any time, without your withdrawal affecting the lawfulness of the processing based on your consent before its withdrawal.
Right to lodge a complaint with the HDPA: You have the right to lodge a complaint with the HDPA with regard to matters that concern the processing of your Personal Data by the Company. The HDPA is based in Athens (1-3, Kifisias Avenue, GR-11523). More information on the competence of the HDPA and how to lodge a complaint, you can find at www.dpa.gr.
How to contact us
If you have concerns or questions regarding this Notice or if you want to exercise any of your rights mentioned in the “Your rights” section, please contact us at [email protected].
Greece
