Data Controller
The company with the name "K. Mavrochoridis - A. Glaroudis O.E." and distinctive title "SEA WORLD SCUBA DIVING CENTER", with VAT number 084149935 and General Commercial Registry no. 032111357000 based in Kassandra Halkidiki, in a leased property within the SANI hotel complex with email address seaworld@seaworld.gr and contact address for privacy data protection issues privacy@seaworld.gr.
Our priority is the legal processing of your data and your full and transparent information about it. For any question do not hesitate to contact us.
Joint data controllers
- In the event that you receive diving training and certification services, we will process certain categories of your data jointly with the PADI EMEA Ltd Organization, based on our contractual relationship. PADI EMEA Ltd is the Certification Body that provides us with our diving training program, certifies our company as a dive center and provides us with the ability to certify divers/scuba divers.
- In addition, if you receive services from the company SANI ANONYMOS ETAIREIA ANAPTYXEOS KAI TOURISMOU, A.F.M.: 094027165, we will process some specific categories of your data jointly with this company, due to the cooperation between us.
First Section
General Information
1. What is personal data?
The term "personal data" (hereinafter referred to as "data") refers to any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one whose identity can be identified, directly or indirectly, in particular by reference to an identifying element of identity, such as a name, an identity number, an address, a telephone number but also by reference to one or more factors that characterize the physical, physiological, genetic, psychological, economic, cultural or social identity of the person concerned due to a natural person.
In short, personal data is any information that relates to and concerns a natural person, whether it immediately reveals his identity or may reveal it.
2. What is the Processing of Personal Data
Any act or series of acts carried out with or without the use of automated means, on personal data or sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Almost any action, from the moment a data is created to the moment it is destroyed (or completely anonymized), constitutes a processing act.
The processing of personal data is a legal act, as long as it is carried out within the framework defined by the relevant legislation, i.e. the national law 4624/2019 but also the European General Data Protection Regulation (GDPR) 679/2016/EU.
3. Is the processing of your personal data mandatory?
Providing certain data about you to our business is necessary when you transact, receive our services or communicate with us.
With this policy we inform you about the processing rules we follow.
If you do not provide us with some of the data listed below, we will not be able to complete the transactions you request and generally provide you with our products and services or respond to your contact request or any other request you submit to us.
4. When and how we collect your data
We collect your data at the following times:
- A.When you receive services and conduct transactions with our business
- B.When you contact us
- C.When you enter or are in our store (via our surveillance camera system)
- D.When you request to receive electronic updates about our news, offers and events, i.e. by registering on the newsletter recipient list
- E.When you visit, browse or use our website
- F.When you interact on our official business social media pages
5. What principles do we follow when processing data
When processing your data, we accept, adopt and apply the processing principles according to article 5 GDPR, in other words your data are:
- (a)processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);
- (b)collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes;
- (c)adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (‘data minimisation’);
- (d)accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (‘accuracy’);
- (e)kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed;
- (f)processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).
Second Section
Analysis of the processing
A. Categories of personal data, purpose, legal basis of processing
Data Controller
The company with the name "K. Mavrochoridis - A. Glaroudis O.E." and distinctive title "SEA WORLD SCUBA DIVING CENTER"
| Data Categories | Purpose of processing | Legal basis of processing |
|---|---|---|
| 1. Name, home address/area, telephone number (landline/mobile), email address |
|
processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (article 6 par.1 case b GDPR) |
| 2. Data related to the payment method, data from the transactions you carry out with our company as well as invoicing data (goods/services, value, quantity), transaction history |
|
processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (article 6 par.1 case b GDPR) |
| 3. Date, time, depth and duration of dive | Compliance with diving legislation (article 4 par. 4 of Ministerial Decision 2131.7/76069/2022 (Government Gazette B 5617/02.11.2022)) | processing is necessary for compliance with a legal obligation to which the controller is subject; (article 6 par.1 case c GDPR) |
| 4. Name, surname, father's name, year of birth, nationality for training certificates of scuba diving instructors and amateur scuba divers | Compliance with the diving legislation (article 5 par. 1 section c. law 3409/2005) | processing is necessary for compliance with a legal obligation to which the controller is subject; (article 6 par.1 case c GDPR) |
| 5. Data you provide us when you subscribe to our newsletter (name, email address) | Promotion of our business services | Consent (article 11 par. 3 of Law 3471/2006) |
| 6. Your image via the surveillance camera system when you are in our store (occasionally and not systematically), if you are in their range | Protection of persons and goods | Protection of legitimate interests of our business (article 6 par.1 case f GDPR) |
| 7. Your image and movement through photos/videos published on our business website or social media pages | Promotion of our business services | Consent (article 6 par.1 case a GDPR) |
| 8. Your data when visiting and browsing our site (see also Cookies Policy) | Improving our services (see also Cookies Policy) | Consent (article 4 par.5 law 3471/2006) |
| 9. Your name and your profile photo, any comments or messages you have on our social media pages (as long as you interact with them by taking actions such as like, follow, sending comments or messages, etc.) | Promotion of our business services (see Social Media Privacy Policy) | Consent (article 6 par.1 case a GDPR) |
Joint Data Controllers
"K. Mavrochoridis - A. Glaroudis O.E."
PADI EMEA Ltd
| Data Categories | Purpose of processing | Legal basis of processing |
|---|---|---|
| 10. Name, date of birth, photo, instructor name, type of diving training, course dates, comments, exam results, certification date |
|
|
|
11. Liability release form, medical questionnaire, medical statement (We are obliged to ask you for a doctor's certificate regarding your ability to participate in diving training, if you answer some questions positively in the health questionnaire, i.e. if you declare the existence of some medical problems.) |
|
|
We process this data together with PADI EMEA, either exclusively in electronic form (if you follow the e-learning process), or partially in physical form (if you do not follow e-learning process).
Joint Data Controllers
"K. Mavrochoridis - A. Glaroudis O.E."
SANI ANONYMOS ETAIREIA ANAPTYXEOS KAI TOURISMOU
| Data Categories | Purpose of processing | Legal basis of processing |
|---|---|---|
| 12. Name, date and type of diving service | Fulfillment of contractual obligations between our company and the SANI ANONYMOS ETAIREIA ANAPTYXEOS KAI TOURISMOU | processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; (article 6 par.1 case b GDPR) |
| 13. Information about your evaluation of our services | Monitoring and improving the quality of services of both companies | Protection of legitimate interests of our business (article 6 par.1 case f GDPR) |
We would like to clarify that not all of the above categories are requested from you each time, but only those that are each time necessary for the specific need.
Newsletter
Regarding newsletter, we inform you that this takes place only if:
- a)there has been a provision of products/services between us before and you have not objected or
- b)if you have voluntarily subscribed to our company's newsletter mailing list, i.e. with your consent.
In every newsletter message you receive, we provide you with the possibility to unsubscribe at any time you wish.
The newsletter is sent only for the promotion of similar and related products or services of our company. Your email address is not shared with third parties.
Camera Rental Service
In case you requested to rent a camera from our company to film you during the dives our company adheres to the following rules:
- We film only you and no other person using our equipment.
- After the completion of our diving services to you, we provide you the material taken in digital form.
- We erase any kind of material (photos/videos) of our device and we do not retain any backups.
No data processing takes place in this case.
B. Time – Place of Retention, Recipients, Processors
| Data categories | Retention period | Data location | Recipients | Processors |
|---|---|---|---|---|
| 1. Name, home address/area, telephone number (landline/mobile), email address | 20 years after the provision of the service | Our facilities and our digital business archive | - | - |
| 2. Data related to the payment method, data from the transactions you carry out with our company as well as invoicing data (goods/services, value, quantity), transaction history | 10 years after the provision of the service | Our facilities and our digital business archive | General Secretariat of Information Systems | - |
| 3. Date, time, depth and duration of dive | 5 years after the provision of the service | Digital business archive | Port Police (in case these data are requested) | - |
| 4. Name, surname, father's name, year of birth, nationality for training certificates of scuba diving instructors and amateur scuba divers | Forever | Digital business archive | Directorate of Port Police (Ministry of Shipping) | - |
| 5. Data you provide us when you subscribe to our newsletter (name, email address) | Until you withdraw your consent, otherwise 5 years after the start of the shipment |
|
- | - |
| 6. Your image via the surveillance camera system when you are in our store (occasionally and not systematically), if you are in their range |
5 days See our CCTV Policy |
CCTV archive | - | HANGZHOU HIKVISION DIGITAL TECHNOLOGY CO. LTD (HIKVISION) |
| 7. Your image and movement through photos/videos published on our business website or social media pages | Until you withdraw your consent, otherwise 5 years from their publication |
|
- | - |
| 8. Your data when visiting and browsing our site (see also Cookies Policy) | See Cookies Policy | See Cookies Policy | See Cookies Policy | See Cookies Policy |
| 9. Your name and your profile photo, any comments or messages you have on our social media pages (as long as you interact with them by taking actions such as like, follow, sending comments or messages, etc.) | Until you withdraw your consent, (see Social media Policy) | see Social media Policy | see Social media Policy | see Social media Policy |
| 10. Name, date of birth, photo, instructor name, type of diving training, course dates, comments, exam results, certification date | Forever | Web server PADI EMEA Ltd | - | - |
|
11. Liability release form, medical questionnaire, medical statement (We are obliged to ask you for a doctor's certificate regarding your ability to participate in diving training, if you answer some questions positively in the health questionnaire, i.e. if you declare the existence of some medical problems.) |
Forever | Web server PADI EMEA Ltd | - | - |
| 12. Name, date and type of diving service | 5 years after the provision of the service | Digital archive SANI ANONYMOS ETAIREIA ANAPTYXEOS KAI TOURISMOU | - | - |
| 13. Information about your evaluation of our services | 5 years after the provision of the service | Digital archive SANI ANONYMOS ETAIREIA ANAPTYXEOS KAI TOURISMOU | - | - |
In the case of using a credit/debit card, we do not store relevant data (card number-cvv number), while in the case of a telephone transaction we delete it immediately after its completion.
C. Your Data Rights
We process the above data in accordance with the above policy and of course we support and ensure the exercise of your rights with a corresponding procedure.
Our response to your requests (whether related to the exercise of rights or complaints) is free of charge without delay, and in any case within (1) one month of receiving your request and confirming your identity.
However, if your request is complex or a large number of requests are submitted to our business at the same time, we will inform you within this month whether we need to obtain an extension of another (2) two months, within which we will respond to you. The stated times of one (1) plus two (2) months (if required) are the legal and provided for in the GDPR.
If your requests are manifestly unfounded or excessive, our company may impose a reasonable fee, taking into account the administrative costs of providing the information or performing the requested action, or finally refuse to respond to your abusively repeated request.
You can exercise your rights here: info@seaworld.gr
In particular you have the following rights:
- Right to be informed about all the above issues and any other related to the processing of your data.
- Right of access, i.e. right to receive a copy of the data you have provided to us.
- Right to update/correction, in case some data is or becomes inaccurate so that we can correct it. The update will be made within 7 working days from the date of submitting your written request and confirming your identity.
- Right to erasure. This right may be subject to relevant restrictions due to the need to retain some data due to legal obligations.
- Right to restriction of processing when:
- a)the accuracy of the personal data is contested by you and for a period of time that allows us to verify the accuracy of the personal data,
- b)the processing is illegal and you object to the deletion of the personal data and request, instead, the limitation of their use,
- c)we no longer need the personal data for the aforementioned processing purposes, but this data is required by you to establish, exercise or support legal claims and in related cases.
- Right to portability i.e. the right to receive the personal data concerning you, and which you have provided to us, in a structured, commonly used and machine-readable format, as well as the right to transmit said data to another data controller without objection from us.
- Right to withdraw your consent to specific processing for which you have provided it and to withdraw consent to newsletter sending, i.e. the right to ask not to receive future newsletter messages from our company by e-mail, through the unsubscribe option in any such email you have received.
- Right to file a complaint with the Personal Data Protection Authority (dpa.gr) in case you believe that we are violating the relevant protection legislation, e.g. regarding your data.
Third Section
Further information
- A.Our business uses modern and up-to-date organizational and technical measures to prevent illegal intrusion, access or dissemination of your personal data.
- B.We inform you that we do not carry out automated individual decision-making or profiling.
- C.Our website uses cookies to facilitate your connection to it, to collect statistical traffic data or for marketing purposes. For more see Cookies Policy. In addition, we maintain active hyperlinks to our social media pages (Facebook, YouTube, Instagram). For more information see Social Media Policy.
- D.Sending Newsletters
To sign up for our company's newsletter recipient list, we only ask for your name and email address. Your email will be used exclusively to send you informational material about our news, services and any special offers. We do not sell or share your email. You have the right to withdraw your consent at any time with the "unsubscribe" option in the emails you receive or by email at info@seaworld.gr. - E.We regularly use Omena Dive, a dedicated platform for bookings, dive and digital dive briefing acceptance, signing PADI documents and other related operational need. Please advise our dedicated Privacy Policy for this processing here: https://dive.omena.pro/privacy-policy/seaworld
Other information
Our company reserves the right to periodically modify or revise this Privacy Policy, at its sole discretion. If changes are made, our business will record the date of amendment or revision in the new Privacy Policy and the updated Policy will apply to you from that date. We encourage you to periodically review this Privacy Policy to review any changes to the way we manage your personal data.
If you have questions, comments or complaints about the management or protection of your personal data or if you wish to exercise any of your rights, please contact us at the contact details above.
To submit a complaint regarding a breach of your personal data, you can contact the Personal Data Protection Authority (Kifisias 1-3, 115 23 Athens, Telephone Center: 210 6475600, Fax: 210 6475628, e-mail for notification of a personal data breach incident: databreach@dpa.gr, general e-mail: contact@dpa.gr).