Part 1 · IDC
Sea World CDC Privacy Policy
Introduction
This text explains in simple terms how we process the personal data we collect from you in the context of our business relationships and the provision of our services during our IDCs.
Data Controller
The company with the name "K. Mavrochoridis - A. Glaroudis O.E." and distinctive title "SEA WORLD SCUBA DIVING CENTER", with VAT number 084149935 and General Commercial Registry no. 032111357000 based in Kassandra Halkidiki, in a leased property within the SANI hotel complex with email address cdc@seaworld.gr and contact address for privacy data protection issues privacy@seaworld.gr, a recognized PADI CDC.
Our priority is the legal processing of your data and your full and transparent information about it. For any question do not hesitate to contact us.
Joint data controllers
- In the context of your IDC, we will process certain categories of your data jointly with the PADI EMEA Ltd Organization, based on our contractual relationship. PADI EMEA Ltd is the Certification Body that provides us with our diving training program, certifies our company as a CDC and provides us with the ability to certify scuba instructors.
- In addition, if you receive services from the company SANI ANONYMOS ETAIREIA ANAPTYXEOS KAI TOURISMOU, A.F.M.: 094027165, we will process some specific categories of your data jointly with this company, due to the cooperation between us.
First Section: General Information
1. What is personal data?
The term "personal data" (hereinafter referred to as "data") refers to any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one whose identity can be identified, directly or indirectly, in particular by reference to an identifying element of identity, such as a name, an identity number, an address, a telephone number but also by reference to one or more factors that characterize the physical, physiological, genetic, psychological, economic, cultural or social identity of the person concerned due to a natural person.
In short, personal data is any information that relates to and concerns a natural person, whether it immediately reveals his identity or may reveal it.
2. What is the Processing of Personal Data
Any act or series of acts carried out with or without the use of automated means, on personal data or sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Almost any action, from the moment a data is created to the moment it is destroyed (or completely anonymized), constitutes a processing act.
The processing of personal data is a legal act, as long as it is carried out within the framework defined by the relevant legislation, i.e. the national law 4624/2019 but also the European General Data Protection Regulation (GDPR) 679/2016/EU.
3. Is the processing of your personal data mandatory?
Providing certain data about you to our business is necessary when you transact, receive our services or communicate with us.
With this policy we inform you about the processing rules we follow.
If you do not provide us with some of the data listed below, we will not be able to complete the transactions you request and generally provide you with our products and services or respond to your contact request or any other request you submit to us.
4. When and how we collect your data
We collect your data at the following times:
- A.When you receive services and conduct transactions with our business
- B.When you contact us
- C.When you enter or are in our store (via our surveillance camera system)
- D.When you request to receive electronic updates about our news, offers and events, i.e. by registering on the recipient newsletter list
- E.When you interact on our official business social media pages
When you visit, browse or use our website you are kindly requested to advise our website (cdc) Privacy Policy.
5. What principles do we follow when processing data
When processing your data, we accept, adopt and apply the processing principles according to article 5 GDPR, in other words your data are:
- (a)processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
- (b)collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
- (c)adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
- (d)accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
- (e)kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed;
- (f)processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
Second Section: Analysis of the processing
A. Categories of personal data, purpose, legal basis of processing
Data Controller
The company with the name "K. Mavrochoridis - A. Glaroudis O.E." and distinctive title "SEA WORLD SCUBA DIVING CENTER"
| Data Categories | Purpose of processing | Legal basis of processing |
|---|---|---|
| 1. Name, home address/area, telephone number (landline/mobile), email address |
|
processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (article 6 par.1 case b GDPR) |
| 2. Data related to the payment method, data from the transactions you carry out with our company as well as invoicing data (goods/services, value, quantity), transaction history |
|
processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (article 6 par.1 case b GDPR) |
| 3. Date, time, depth and duration of dive | Compliance with diving legislation (article 4 par. 4 of Ministerial Decision 2131.7/76069/2022 (Government Gazette B 5617/02.11.2022)) | processing is necessary for compliance with a legal obligation to which the controller is subject; (article 6 par.1 case c GDPR) |
| 4. Name, surname, father's name, year of birth, nationality for training certificates of scuba diving instructors | Compliance with the diving legislation (article 5 par. 1 section c. law 3409/2005) | processing is necessary for compliance with a legal obligation to which the controller is subject; (article 6 par.1 case c GDPR) |
| 5. Data you provide us when you subscribe to our newsletter (name, email address) | Promotion of our business services | Consent (article 11 par. 3 of Law 3471/2006) |
| 6. Your image via the surveillance camera system when you are in our store (occasionally and not systematically), if you are in their range | Protection of persons and goods | Protection of legitimate interests of our business (article 6 par.1 case f GDPR) |
| 7. Your image and movement through photos/videos published on our business website or social media pages | Promotion of our business services | Consent (article 6 par.1 case a GDPR) |
| 8. Your name and your profile photo, any comments or messages you have on our social media pages (as long as you interact with them by taking actions such as like, follow, sending comments or messages, etc.) | Promotion of our business services (see Social Media Privacy Policy) | Consent (article 6 par.1 case a GDPR) |
Joint Data Controllers
"K. Mavrochoridis - A. Glaroudis O.E."
PADI EMEA Ltd
| Data Categories | Purpose of processing | Legal basis of processing |
|---|---|---|
| 9. Name, date of birth, photo, instructor name, training course dates, comments, exam results, certification date, other data related to exams |
|
|
| 10. Liability release form, medical questionnaire, medical statement (We are obliged to ask you for a doctor's certificate regarding your ability to participate in diving training, if you answer some questions positively in the health questionnaire, i.e. if you declare the existence of some medical problems.) |
|
|
We process this data together with PADI EMEA, either exclusively in electronic form (if you follow the e-learning process), or partially in physical form (if you do not follow e-learning process).
Joint Data Controllers
"K. Mavrochoridis - A. Glaroudis O.E."
SANI ANONYMOS ETAIREIA ANAPTYXEOS KAI TOURISMOU
| Data Categories | Purpose of processing | Legal basis of processing |
|---|---|---|
| 11. Name, date and type of diving service | Fulfillment of contractual obligations between our company and the SANI ANONYMOS ETAIREIA ANAPTYXEOS KAI TOURISMOU | processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (article 6 par.1 case b GDPR) |
We would like to clarify that not all of the above categories are requested from you each time, but only those that are each time necessary for the specific need.
Newsletter
Regarding newsletter, we inform you that this takes place only if:
- a)there has been a provision of products/services between us before and you have not objected or
- b)if you have voluntarily subscribed to our company's newsletter mailing list, i.e. with your consent.
In every newsletter message you receive, we provide you with the possibility to unsubscribe at any time you wish.
The newsletter is sent only for the promotion of similar and related products or services of our company. Your email address is not shared with third parties.
B. Time – Place of Retention, Recipients, Processors
| Data categories | Retention period | Data location | Recipients | Processors |
|---|---|---|---|---|
| 1. Name, home address/area, telephone number (landline/mobile), email address | 20 years after the provision of the service | Our facilities and our digital business archive | - | - |
| 2. Data related to the payment method, data from the transactions you carry out with our company as well as invoicing data (goods/services, value, quantity), transaction history | 10 years after the provision of the service | Our facilities and our digital business archive | General Secretariat of Information Systems | - |
| 3. Date, time, depth and duration of dive | 5 years after the provision of the service | Digital business archive | Port Police (in case these data are requested) | - |
| 4. Name, surname, father's name, year of birth, nationality for training certificates of scuba diving instructors and amateur scuba divers | Forever | Digital business archive | Directorate of Port Police (Ministry of Shipping) | - |
| 5. Data you provide us when you subscribe to our newsletter (name, email address) | Until you withdraw your consent, otherwise 5 years after the start of the shipment |
|
- | - |
| 6. Your image via the surveillance camera system when you are in our store (occasionally and not systematically), if you are in their range | 5 days See our CCTV Policy |
CCTV archive | - | HANGZHOU HIKVISION DIGITAL TECHNOLOGY CO. LTD (HIKVISION) |
| 7. Your image and movement through photos/videos published on our business website or social media pages | Until you withdraw your consent, otherwise 5 years from their publication |
|
- | - |
| 8. Your name and your profile photo, any comments or messages you have on our social media pages (as long as you interact with them by taking actions such as like, follow, sending comments or messages, etc.) | Until you withdraw your consent, (see Social media Policy) | see Social media Policy | see Social media Policy | see Social media Policy |
| 9. Name, date of birth, photo, instructor name, type of diving training, course dates, comments, exam results, certification date | Forever | Web server PADI EMEA Ltd | - | - |
| 10. Liability release form, medical questionnaire, medical statement (We are obliged to ask you for a doctor's certificate regarding your ability to participate in diving training, if you answer some questions positively in the health questionnaire, i.e. if you declare the existence of some medical problems.) |
Forever | Web server PADI EMEA Ltd | - | - |
| 11. Name, date and type of diving service | 5 years after the provision of the service | Digital archive SANI ANONYMOS ETAIREIA ANAPTYXEOS KAI TOURISMOU | - | - |
In the case of using a credit/debit card, we do not store relevant data (card number-cvv number), while in the case of a telephone transaction we delete it immediately after its completion.
C. Your Data Rights
We process the above data in accordance with the above policy and of course we support and ensure the exercise of your rights with a corresponding procedure.
Our response to your requests (whether related to the exercise of rights or complaints) is free of charge without delay, and in any case within (1) one month of receiving your request and confirming your identity.
However, if your request is complex or a large number of requests are submitted to our business at the same time, we will inform you within this month whether we need to obtain an extension of another (2) two months, within which we will respond to you. The stated times of one (1) plus two (2) months (if required) are the legal and provided for in the GDPR.
If your requests are manifestly unfounded or excessive, our company may impose a reasonable fee, taking into account the administrative costs of providing the information or performing the requested action, or finally refuse to respond to your abusively repeated request.
You can exercise your rights here: cdc@seaworld.gr
In particular you have the following rights:
- Right to be informed about all the above issues and any other related to the processing of your data.
- Right of access, i.e. right to receive a copy of the data you have provided to us.
- Right to update/correction, in case some data is or becomes inaccurate so that we can correct it. The update will be made within 7 working days from the date of submitting your written request and confirming your identity.
- Right to erasure. This right may be subject to relevant restrictions due to the need to retain some data due to legal obligations.
- Right to restriction of processing when:
- a)the accuracy of the personal data is contested by you and for a period of time that allows us to verify the accuracy of the personal data,
- b)the processing is illegal and you object to the deletion of the personal data and request, instead, the limitation of their use,
- c)we no longer need the personal data for the aforementioned processing purposes, but this data is required by you to establish, exercise or support legal claims and in related cases.
- Right to portability i.e. the right to receive the personal data concerning you, and which you have provided to us, in a structured, commonly used and machine-readable format, as well as the right to transmit said data to another data controller without objection from us.
- Right to withdraw your consent to specific processing for which you have provided it and to withdraw consent to newsletter sending, i.e. the right to ask not to receive future newsletter messages from our company by e-mail, through the unsubscribe option in any such email you have received.
- Right to file a complaint with the Personal Data Protection Authority (dpa.gr) in case you believe that we are violating the relevant protection legislation, e.g. regarding your data.
Third Section: Further information
- A.Our business uses modern and up-to-date organizational and technical measures to prevent illegal intrusion, access or dissemination of your personal data.
- B.We inform you that we do not carry out automated individual decision-making or profiling.
- C.Our website uses cookies to facilitate your connection to it, to collect statistical traffic data or for marketing purposes. For more see Cookies Policy. In addition, we maintain active hyperlinks to our social media pages (Facebook, YouTube, Instagram). For more information see Social Media Policy.
- D.Sending Newsletters
To sign up for our company's newsletter recipient list, we only ask for your name and email address. Your email will be used exclusively to send you informational material about our news, services and any special offers. We do not sell or share your email. You have the right to withdraw your consent at any time with the "unsubscribe" option in the emails you receive or by email at cdc@seaworld.gr.
Other information
Our company reserves the right to periodically modify or revise this Privacy Policy, at its sole discretion. If changes are made, our business will record the date of amendment or revision in the new Privacy Policy and the updated Policy will apply to you from that date. We encourage you to periodically review this Privacy Policy to review any changes to the way we manage your personal data.
If you have questions, comments or complaints about the management or protection of your personal data or if you wish to exercise any of your rights, please contact us at the contact details above.
To submit a complaint regarding a breach of your personal data, you can contact the Personal Data Protection Authority (Kifisias 1-3, 115 23 Athens, Telephone Center: 210 6475600, Fax: 210 6475628, e-mail for notification of a personal data breach incident: databreach@dpa.gr, general e-mail: contact@dpa.gr).
Part 2 · Website
Sea World Sani CDC Website Privacy Policy
1. Data controller
The controller for this microsite is Κ. Μαυροχωρίδης – Α. Γλαρούδης Ο.Ε. (Greek General Partnership), trading as Sea World Scuba Diving Center / Kentro Katadyseon Thalassios Kosmos.
- Registered address: Sani Kassandreias 0, 63077 Kassandreia, Halkidiki, Greece
- VAT No.: 084149935
- Competent tax office: Nea Moudania
- G.E.MI. No.: 032111357000
- Business commencement: 19 July 1996
- Email: cdc@seaworld.gr
- Phone: +30 698 364 5088
This policy covers the data processing while you use seaworld.gr/cdc/, contact-form submissions and related communications. It does not govern third-party websites reached through external links.
2. Data we collect
Data you provide
Your full name, email address, optional phone number, interested contact topic, message.
Technical data
- IP address, device and browser type, request date and time, requested pages and technical server logs.
- Security-verification data required by Cloudflare Turnstile to prevent automated abuse.
- Your choice about optional Google Maps and the time it was saved in the
swcdc_consentcookie. The page address determines its language.
Your name, email and message are needed to handle and respond to your enquiry; your phone number is optional. We do not ask for special-category personal data, payment details or medical information through the contact form. Please do not include such information in an initial enquiry.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Answer enquiries, provide information and arrange courses or services. | Performance of a contract or steps taken at your request before entering into a contract (article 6 par.1 case b GDPR). |
| Secure the website, prevent spam or abuse and diagnose technical problems. | Our legitimate interest in operating a safe and reliable service. (article 6 par.1 case f GDPR) |
| Meet duties imposed by applicable law. | Compliance with a legal obligation. (article 6 par.1 case c GDPR) |
| Load optional Google Maps on the Contact page. | Prior consent, which you may withdraw through Cookie settings. (article 6 par.1 case a GDPR) |
We do not use solely automated decision-making or profiling that produces legal or similarly significant effects concerning you.
4. Service providers and recipients
Only authorised members of our team and providers needed to run the site and communications may access relevant data:
- Hostinger: website hosting and server infrastructure.
- Email providers: delivery and storage of correspondence.
- Cloudflare Turnstile: a security check on the contact form to prevent bots and malicious use. It may process your IP address, browser and device information, and interaction data. This security function is independent of your map choice. See the Turnstile Privacy Addendum and Cloudflare's Privacy Policy.
- Google Maps: the embedded map on the Contact page loads only if you allow it. Google may then receive your IP address, browser information and information about your map use, and may use its own cookies or similar technologies. If you are signed in to Google, your account settings also affect this processing. See Google's Privacy Policy.
We do not sell or rent personal data. Links to WhatsApp and social networks take you to third-party services that process data under their own policies.
5. Cookies and similar technologies
swcdc_consent: a necessary cookie that records the preference version, whether you allowed the map, and the time of your choice for 180 days. Acceptance and rejection are remembered for the same period.swcdc-popup-…: an entry in your browser's local storage that remembers when you closed an announcement window, so it is not shown again too soon. We count announcement views and clicks only as daily totals per language, without IP addresses or identifiers.- WordPress may use strictly necessary session or login cookies for authorised administrators.
- Google Maps remains inactive until you allow it. The necessary Cloudflare Turnstile security check runs separately on the contact form.
We do not use Google Analytics or other advertising-tracking tools on this microsite. Fonts are served from our own website. You can change or withdraw your map choice at any time through “Cookie settings” in the footer. Withdrawal prevents further loading of the embedded map; use your browser settings to remove cookies Google has already placed.
6. Retention
We retain messages and contact details only for 1 year to answer, manage your request and support any resulting course participation or business relationship. They are then deleted unless a longer period is required by contractual or other legal obligations.
Technical and security logs are retained for a limited operational period under the settings of our hosting and security providers, then deleted or aggregated.
7. International transfers
Some technology providers may process data outside the European Economic Area. Where applicable, transfers rely on an adequacy decision, Standard Contractual Clauses or another safeguard recognised by the GDPR. Contact cdc@seaworld.gr for information about these safeguards and how to obtain a copy.
8. Your rights
We process the above data in accordance with the above policy and of course we support and ensure the exercise of your rights with a corresponding procedure.
Our response to your requests (whether related to the exercise of rights or complaints) is free of charge without delay, and in any case within (1) one month of receiving your request and confirming your identity.
However, if your request is complex or a large number of requests are submitted to our business at the same time, we will inform you within this month whether we need to obtain an extension of another (2) two months, within which we will respond to you. The stated times of one (1) plus two (2) months (if required) are the legal and provided for in the GDPR.
If your requests are manifestly unfounded or excessive, our company may impose a reasonable fee, taking into account the administrative costs of providing the information or performing the requested action, or finally refuse to respond to your abusively repeated request.
You can exercise your rights here: info@seaworld.gr
In particular you have the following rights:
- Right to be informed about all the above issues and any other related to the processing of your data.
- Right of access, i.e. right to receive a copy of the data you have provided to us.
- Right to update/correction, in case some data is or becomes inaccurate so that we can correct it. The update will be made within 7 working days from the date of submitting your written request and confirming your identity.
- Right to erasure. This right may be subject to relevant restrictions due to the need to retain some data due to legal obligations.
- Right to restriction of processing when:
- a)the accuracy of the personal data is contested by you and for a period of time that allows us to verify the accuracy of the personal data,
- b)the processing is illegal and you object to the deletion of the personal data and request, instead, the limitation of their use,
- c)we no longer need the personal data for the aforementioned processing purposes, but this data is required by you to establish, exercise or support legal claims and in related cases.
- Right to portability i.e. the right to receive the personal data concerning you, and which you have provided to us, in a structured, commonly used and machine-readable format, as well as the right to transmit said data to another data controller without objection from us.
- Right to withdraw your consent to specific processing for which you have provided it and to withdraw consent to newsletter sending, i.e. the right to ask not to receive future newsletter messages from our company by e-mail, through the unsubscribe option in any such email you have received.
- Right to file a complaint with the Personal Data Protection Authority (Hellenic Data Protection Authority) in case you believe that we are violating the relevant protection legislation, e.g. regarding your data.
To exercise a right, email cdc@seaworld.gr. We may reasonably request information to verify your identity. We will respond without undue delay, normally within one month. If an extension is needed because of the complexity or number of requests, we will inform you within the first month in accordance with the GDPR.
9. Security
We use reasonable technical and organisational safeguards, including HTTPS encryption, access controls, software updates and automated-abuse protection. No method of internet transmission or storage can guarantee absolute security.
10. Children
The website is not intended to collect data from children without the involvement of a parent or guardian. For an enquiry about a course involving a minor, the first contact should be made by a parent or legal guardian.
11. Changes to this policy
We may update this policy when services, technologies or legal requirements change. The newest version will always appear on this page with its updated date.
Your cookie choices
You can change your Google Maps choice at any time.