PROTECTION OF PERSONAL DATA AND PRIVACY POLICY
OF THE HONDOSCENTER ESHOP
1. Who is the Data Controller?
2. What personal data do we collect?
3. How do we collect your personal data?
4. What are the principles and legal bases of collection and processing?
5. What is the purpose and legal basis of each processing?
6. What is the legal framework of our Marketing Communication?
7. How long is your data retained?
8. How can you update and manage your own information?
9. What are your rights and how can you exercise them?
10. What are the procedures for exercising your rights?
11. What about the use of bank cards?
12. What are the third recipients of your data?
13. How is your data secure?
14. What about Cookies?
15. Changes to this Policy

Our Company gives priority to respecting your personal data and takes reasonable measures in order to comply with the applicable laws on the protection of your personal data. The following terms of processing of personal data by Hondos Center S.A., apply to the customers of our eshop and to the users of our website (www.hondoscenter.com) (which consist an integral part of the terms of use that govern the eshop as a whole).

1. Who is the Data Controller?
1.1. The company under the name "HONDOS CENTER DEPARTMENT STORES COMMERCIAL S.A." with headquarters in Athens, 10 Stadiou and 4 Omirou str., with tax registration number 099879258, Tax Office for S.A. of Athens, with registration number (GENERAL COMMERCIAL REGISTRY) 4104501000, telephone no. 2144169060, no. fax 2103231895 and email address info@hondoscenter.gr (hereinafter referred to as the "Company") is the Data Controller.
1.2. Data Protection Officer (DPO) details: Telecom Expert ,www.telecomexperts.eu, 24 Derigni str.,10434, Athens
1.3. Contact details: For any matter concerning this privacy policy and the processing of your personal data, you can contact us in the following ways:
A) By telephone at 2103233304, Monday to Friday 09:00 am-4:30 pm
B) By e-mail to dataprotection@hondoscenter.gr
C) By post at Hondos Center Headquarters, 10 Stadiou and 4 Omirou str., 10564, Athens

2. What personal data do we collect?
Your personal data includes any information that allows, by itself or in combination with other, your unique identification in accordance with the provisions of the General Data Protection Regulation (GDPR 2016/679), the applicable Greek legislation and the decisions of the Hellenic Data Protection Authority (HDPA).
This is information that you register electronically when you sign up and create and manage an account at the e-shop, for instance, your full name and email address, information regarding the issuance of an invoice, for instance, VAT number and public tax authority, information you enter when submitting an order, for instance, delivery address and mobile phone number, as well as information regarding the operation of the eshop, for instance information that the Company collects automatically (such as your ip address when entering and navigating our webpages) or by using cookies. We also collect information regarding any request for your service, as well as information we collect automatically about you, such as your purchase data from your account statement and your transactions. Please note that we collect data that you communicate to us or that that are requested in any interaction or communication with us, e.g. details included in contests or other programs. In addition, it is possible to collect data as aggregated and only statistical data, taking all the necessary safeguards so that your identification is not possible.
This information is registered in electronic media, such as your equipment or terminal identifiers, computer, smartphone, tablet, web browse history, log files, cookies, etc.

3. How do we collect your personal data?
The Company collects and processes your personal data to conduct business transactions with you, with your consent and acceptance of the terms of use of each of our services, including, but not limited to:
• when you contact our offices or our customer service staff, by recording the content of your calls and your communication with our call center, including your comments, your shopping preferences and your feedback, having been notified about this recording.
• when filling in your order submission details and completing the sale and giving us your email address in order to contact you on issues of conclusiuon of our contractual relationship, issuance or dispatch of invoice or services sales receipt, as well as invoicing and delivery details regarding your order.
• When filling in application or form, in order to check your age and confirm if it is permitted by law to properly conclude a contract with us or if your parents / guardians' consent or signature is required.

• when you sign up voluntarily to printed or electronic directories to receive printed, electronic or by SMS informational material or other marketing materials, or to update your preferences or when participating in contests, questionnaires and surveys
• when you sign up voluntarily on our eshop to create an Account to make your purchases more easily and to keep your shopping history.
• when you visit our webpages through which we collect information from your terminal device such as your IP address, your operating system, your browser type and version, etc. by using cookies.
• when we enter into commercial partnerships with third parties, data that is strictly necessary to monitor the status of the transactional relationship in order to fulfil our commercial partnership.
• When we receive documents, requests, orders, court applications, warrants, etc. of third parties, such as supervisory, prosecutional, judicial, tax authorities, for investigating crimes and your protection against fraud or for combating all forms of crime and Infringements of rights.

4. What are the principles and legal bases of collection and processing?
The Company and its trained staff apply all Processing Principles set in GDPR 2016/679  (lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability). The Company protects and safeguards all your Rights regarding the use of your Personal Data (information, access, rectification, erasure, restriction of processing, portability, objection and non-automated individual decision-making, including profiling, as specified in Greek law). The above apply without any limitation and to all processes performed by and to all services provided by HONDOS CENTER department stores.
The legal bases of collection and processing are the following:
a) your consent
i) to sign up and create an account at the e-shop
ii) to receive communication from the Company for customer service purposes (e.g. when you ask the Company to contact you or to manage your matter)
 iii) to receive direct marketing communication from the Company (on your mobile phone or email or multimedia)
When you give us your consent to any of the above, you may withdraw it at any time for the future by contacting the Company, as well as by unsubscribing at the corresponding hyperlink in the contact email or SMS or multimedia messages (e.g. viber) or by accessing your e-shop account (if available).
b) our legitimate interest

(i) for the security of your Account and your identification where necessary, and to your advantage for the avoidance of fraud or security breach,
(ii) to develop our business activity and to manage and optimize our technical systems, our commercial growth, as well as to effect commercial programs and collaborations,
iii) to adopt tools / means of customer service, before and after sale, as well as to manage any of your issues in the best possible way based on your needs for your benefit as is reasonably expected from a commercial company.
(iv) for direct marketing communication with you, if you are our customer (i.e., make a purchase or transaction with us)
v) for statistical analysis and processing of aggregated data to improve our products and services, without identifying a particular subject and without prejudice to the rights and freedoms of the data subjects.

When the legal basis is the legitimate interest, you have the right to object to the above processing on a case-by-case process. It should be noted, however, that the Company is entitled to invoke compelling and legitimate reasons for continuing such processing (e.g. tax obligations, resolution of disputes, etc.).

c) the performance of a contract that the Company undertakes to fulfill towards you, within the context of the eshop purchase and sale agreement.
d) Compliance with the company's legal obligation to comply with tax obligations and provisions as well as other legal requirements during the performance of the contract (eg information about your order details, delivery of products, etc.)

5. What is the purpose and legal basis of each processing?
Purpose of Processing








    Legal Basis of Processing




Signing up - Creation and Management of an Account at the online store www.hondoscenter.com (hereinafter referred to as the "e-shop")

    a) your consent regarding your signing up and the creation of an Account at the e-shop.
b) Our legitimate interest in the security of your account and your identification where appropriate

To execute your e-shop or telephone order and in particular:

- submission of an order by the customer
- order entry
- product pricing
- delivery of products to the customer
- withdrawing or returning of a product for another reason
- order tracking
- notification regarding your order and order status update
- processing and overall order management
    a) performance of the contract
b) Compliance with our legal obligations

Eshop operation including:
- technical excellence and safety
- Optimization of commercial processes and technical systems
- adoption of commercial and business models, programs and partnerships
    a) The legitimate interest of our company in the operation of our eshop technically well enough and safely
b) The legitimate interest of our company in the development of our business activity and in the management and optimization of the technical systems.

Customer service including:
- Communication by the customer in the Company's communication media (conventional media, email or call center, or communication multimedia such as viber or other media, social media)
- Communication by the Company at customer's request to the customer's contact details
- Service in general on issues related to the company, the eshop, the products, the services, the contests that run at any time, the guarantees that it provides, the social media of the company etc.
- overall management and optimization of user experience and service at the eshop
    a) compliance with the Company's legal obligation to adopt before / after-sale customer service tools / means
b) the legitimate interest of the company in optimizing its customer service
c) your consent to receive communication by the Company for customer service

Statistical analysis including:
- Evaluation and improvement of business processes in order to respond and manage the e-shop better
- Research and / or analysis for better understanding of the needs of e-shop customers
- Assessment for the launch of new programs, offers, etc.
    The legitimate interest of the Company in the further processing of aggregated data to improve its products and services

The optional information you fill in for the following purposes
1. Execution of the contract for the sale of products through the e-shop
2. Statistical analysis
3. Marketing Communication (if there is a corresponding legal basis of communication)    Your prior consent to us by filling in these details.

6. What is the legal framework of our marketing communication?
It’s the framework laid down by consumer protection legislation (law 2251/1994) and by privacy legislation (GDPR 2016/679), as well as the protection of personal data and privacy in the electronic telecommunications sector and amendment of law 2472/1997 (law 3471/2006), as applicable.
6.1. Purpose of Processing and legal basis
Purpose of Processing
    Legal Basis of Processing

Direct Marketing Communication:
It consists of general information about:
- Promotional acts, gifts, promotions
- our products and services in general
-your voluntary participation in contests.
    Your prior consent.

You can withdraw it at any time by communicating at the Company's details, as well as by unsubscribing at the corresponding hyperlink in the contact email or sms or multimedia messages (e.g. viber) or by accessing your privacy dashboard if you have an account at the e-shop

Direct Marketing Communication to CUSTOMERS of the Company    The Company's legitimate interest in the processing of its customer data (that is, persons whose contact information we have legally acquired in the context of selling our products) for purposes of direct marketing.

You can request for an opt-out by pressing your unsubscribe button at your e-mail or message on your mobile phone or by communicating at any of our Company's contact details.

6.2. Where consent is required for marketing communication, you may choose to receive marketing communication from us at an email address that you provide to us. In case that you give us consent to contact you, without stating a specific e-mail address, we will use the contact email that you provided to us when you signed up.
6.3. We want you to enjoy reading our emails and in order to continuously improve their content, we count and store the opening rates and clicks, i.e., if you open our emails, what is the content of the emails that you open, as well as if and why our emails may not have been delivered. We may also use this data for statistical purposes. These processing operations are based on our legitimate interest in optimizing our communication with you.

7. How long is your data retained?
7.1. We will retain your personal data for as long as you continue to interact with us and it is necessary to fulfill the processing purposes described above (for example, if you maintain an account, if you are signed up to receive marketing communication from us, if you make a purchase from our online store, if you take part in a contest, for tax purposes etc.). The data remains at the eshop base until you request its deletion (e.g. in the case of an application for deletion of your account), unless their retention is imposed on the basis of a statutory obligation (e.g. tax purposes). In any case, the data is deleted immediately after the purposes for which it is retained are fulfilled, while some data (e.g., any order data) is retained anonymized  or  pseudonymized for statistical analysis purposes.
7.2. a) Your contact data and your personal choice data for purposes of marketing communication with you will be retained for five (5) years from your last contact with us (e.g. making a purchase, contacting the call center, participating in a contest) or
(b) until your consent has been withdrawn for each of the above processing purposes, in which case the Company will delete your personal data and will no longer use it (with the exception of data that  is required to retain for the performance of a contract and / or to fulfill its statutory obligations (e.g. tax obligations).
7.3. In addition,  calls made to the call center are recorded and retained for three (3) months.
8. How can you update and manage your own information?
8.1. By contacting us at dataprotection@hondoscenter.gr
8.2. Through your eshop account, once you have created an Account when signing up in the e-shop.
8.2.1. You access the Account by entering your e-mail as your username and the password you create (which you should always keep secret and notify the Company in case of loss or unauthorized use). The password is encrypted and can not be retrieved.
9. What are your rights and how can you exercise them?
Your rights can be exercised at the Company's contact details
For your convenience, we provide a detailed table below with your rights and the relevant explanation (the reference to articles below refers to the General Data Protection Regulation 679/2016):

Right
    Explanation

Access (Article 15)
    You can request to:
• Confirm that we process your personal data.
• give you access to whatever data you do not have at your disposal
• provide you with other information about your personal data, such as what data we have, why we use it, to whom we notify it, whether we transfer it abroad, how we protect it, how long we retain it, what rights you have, how you can submit a complaint, from where we took your data (as long as no relevant information has been given in this Policy).

Rectification (Article 16)
    You can request to rectify inaccurate personal data.
We can try to verify the accuracy of the data before we rectify it.

Erasure (Article 17)
    You can request to erase your personal data:
• at any time when they are no longer needed for the purposes for which they were collected or
• if they have been illegally processed

We can retain your data if processing of your personal data is necessary:
- to comply with a legal obligation
- to fulfill another legitimate purpose or other legal basis; or
- for the establishment, exercise or defense of legal requirements of our Company.
- Double opt in procedure will not be available in case of re –registration of a deleted newsletter subscriber

Restriction of processing (Article 18)
    You may request to restrict (i.e. keep but not use) your personal data when:
• their accuracy is being questioned (see rectification) so that we can verify their accuracy or
• processing is illegal, but you do not want it to be deleted or
• it is no longer necessary for the purposes for which it was collected, but we still need it for the establishment, exercise or defense of legal requirements, or there is another legitimate processing purpose or other legal basis.

Portability (Article 20)
    When processing is based on your consent or the performance of a contract and done by automated means, you may request to provide your personal data in a structured, commonly used and machine-readable format, or you may request to be transferred directly to another controller. However, this right, according to the law, concerns only the data provided by the subject and not that data obtained by the controller based on the data provided to the controller by the subject

To Object (Article 21)
    You may at any time object to any processing of your personal data, which has as its legal basis the legitimate interest of the Company or performance of a task carried out for reasons of public interest.
If you exercise your right to object, the Company has the right to demonstrate  compelling legitimate grounds for the processing which override the rights and freedoms of the data subject.

Human intervention in automated individual decision-making, including profiling (Article 22)
    You have the right not to be subject  at any time to automated individual decision-making, including profiling, to intervene, to express your opinion and to doubt the decision taken on the basis of automated processing.

Opt-out    You are entitled to withdraw your consent, where consent is provided for as a basis of processing. The withdrawal is valid for the future.


10. What are the procedures for exercising your rights?
Identification
    We take full account of the confidentiality of all files that contain personal data and we reserve the right to ask you for proof of your identity, if you are applying for the exercise of your rights with respect to those files.

Costs
    We will not charge you for the exercise of your rights in relation to your personal data unless, as provided by law, your request for access to information is unfounded or excessive, so we have the right to charge a reasonable fee under the specific circumstances. In any case, we will notify you of any charges before completing your request.

Timetables    Our goal is to respond to any valid requests within one (1) month of their receipt, unless it is very complex or you have made a number of requests. We'll let you know if we'll need more than one (1) month for the reasons outlined above. We may ask you if you can tell us exactly what you want to receive or what exactly is your concern. This will help us to act faster on your request. In any case, you should give specific and true details and / or facts in order to be able to reply to and / or satisfy your request accurately, otherwise we reserve the right to make any errors that are beyond our control. In addition, our Company may refute requests that are unjustified or excessive or abusive or inaccurate or generally illegal in the context of the provisions of the law.

Complaint to the Supervisory Authority: You also have the right to file a complaint to the local Supervisory Authority regarding the processing of your personal data after contacting us to find a solution to any of your problems. In Greece, the supervisory authority for data protection is the Hellenic Data Protection Authority - HDPA (www.dpa.gr).

11. What about the use of bank cards?
11.1. Collection and / or redemption of loyalty points in our eshop: In the context of our cooperation with banking loyalty programs for collecting points and / or redeeming them in our eshop, we only gain access to what data is absolutely necessary for your collection and / or redemption of your points in the eshop for any transactions made between the cardholder and the Company.
11.2. The legal basis for processing is the performance of the contractual obligation to perform the loyalty program by using your banking card in your purchases at our eshop to collect and / or redeem points. Following your purchase via card, you will receive informative electronic communication from the bank at the email address that you have given to us while making each transaction with us.

12. What are the third recipients of your data?
12.1. For the operation of e-shop and the fulfillment of its contractual obligations, our Company cooperates with third-party companies that gain access only to data that is  absolutely necessary for your signing up at the e-shop, for managing your account, for the performance of the contract between us and the general provision of our services to you, the operational and mechanical organization of our website, as well as the optimization of our products and services.
When transmitting your personal data, we always ensure the highest possible level of security. As a result, your data will only be transmitted to service providers and co-operating companies, which are carefully selected and bound by a contract in advance. Indicatively, such affiliated companies are: the company that supports and hosts technically the eshop, the shipping / postal company  in charge of product deliveries, the payment service providers (e.g. banks, payment agencies, PayPal).
Please note that during the payment process, we do not record or store payment information during this transaction, e.g. credit card numbers, etc. You only provide this information directly to the respective payment service provider. Also, if you are accessing websites of third parties, affiliates or no-affiliates of our Company through our website, our Company has no involvement in the collection and processing of your data, which is effected  by the third-party webmasters of the websites you enter. Therefore, you are invited to consult the respective privacy policy on the website you are visiting.
12.2. The Company generally maintains your personal data within the European Economic Area (EEA). Where data is to be transmitted to third countries outside the European Economic Area for which no European Commission’s adequacy decision is available or to International Organizations, all the appropriate safeguards provided for in the applicable data protection legislation regarding transfers to third countries are taken and the relevant information will be posted on the company's website www.hondoscenter.com

13. How is your data secure?
The Company takes all necessary technical and organizational security measures to protect and safeguard the privacy of your personal data (for instance, Firewalls, Access Rights Control, Domain Controller, Lan Segmentation, Antivirus, Partially Encrypted Information).
The data you submit to the Company are managed exclusively by specifically authorized personnel of the Company acting under its control and according to its orders, or those of the recipients, where appropriate. In order to conduct the processing, the Company selects persons with corresponding professional qualifications that provide sufficient guarantees in terms of technical knowledge and personal integrity to maintain confidentiality. The Company, through its respective contractual commitments and its partners, takes all necessary security measures to protect and ensure the privacy, confidentiality and integrity of personal data. In any case, their security in the platform’s environment is subject to reasons beyond the company’s sphere of influence, as well as reasons resulting from technical or other failure of the network that is not controlled by the Company, or reasons of force majeure or events of chance.
You should not disclose your Account details / password and, in particular, you should protect it from any unauthorized access to it from third parties.

14. What about Cookies?
i. We use cookies on our website to be operational or more efficient in its operation, to improve your navigation, to provide you with the full potential of the website and to ensure the correct display of the content.
ii. Cookies are small text files stored on your computer when you visit a digital platform, which are used as a means of identifying your computer. The cookies placed by the owner of the digital platform are called "first party cookies". Cookies placed by others are called "third party cookies". Third-party cookies allow third-party features (such as analytics, ads, and videos) to be provided on or through the digital platform. Parties installing third party cookies can recognize your device both when visiting our digital platform and when visiting some other digital platforms.
iii. Cookies are only installed if you accept their installation when you visit our website. By accepting cookies when entering our site, you expressly state that you have read and understood the specific terms and conditions regarding the installation, function and purpose of the cookies and you provide your consent for their use.
iv. Alternatively, you may not accept cookies. In this case, only cookies that are technically and functionally necessary for the operation of eshop will be installed.
v. You can manage the use and installation of cookies at any time through a panel, where you can choose which category of cookies you want to accept and which ones not (or request to install only the technically necessary cookies).
vi. In particular, the cookies used by the website are the following:
Absolutely necessary Cookies
    The absolutely necessary cookies are essential for the proper operation of the website. These cookies allow you to browse and use website features such as access to secure areas or use of the shopping cart. These cookies do not recognize your individual identity and without them, the smooth operation of the website is not possible.
    •    VisitorGUID
Visitor cookie. Used to personalize the visitor through the navigation to the site.
•    VisitorState
Visitor state cookie. Used to save the visitor's preferences such as language, country, currency etc...
•    ForceClearCartLocalStorage
Used to store/clear visitor's cartin broswer and improve the user experience.
•    ROUTEID.XXXX (LNB)
Used to distribute traffic by load ballancer to improve the user experience.
•    SpPlList_XXXX
Used to index the products shown to user to improve the user experience.
•    __cfduid (Cloudflare CDN)
Used by Cloudflare CDN to improve site's speed.
•    Logglytrackingsession
Used to track errors during visitor's session and report them.
•    Vendd:UserAndVisitorShoppingCartJoin
Used to retrieve older cart products of user and merge them with new ones.
•    ConsentChecked
Used to check if visitor has given consents for site cookies.
•    ASP.NET Session
Session cookie sent to the web browser. This cookie is deleted when you close your browser.
•    CurrentWishlistModel
Used to store visitor's wish list in browser and improve the user experience.
•    CurrentCartModel
Used to store visitor's cart in browser and improve the user experience.

Functionality Cookies / Preferences
    The functionality cookies allow the website to remember your choices such as language, currency, etc. so as to provide improved and personalized features. They can also be used to provide services that have been requested by the user, such as video viewing or use of  social media. These cookies can not track the browsing activity on other sites. If you reject these cookies, our site's performance and functionality may be affected and your access to its content restricted. For example, every click you make on the page will prompt you again and again for your username and password
    •    PreviousCountryCode
Used to remember the visitor's previous country selection improve the user experience.
•    LastViewedProducts
Used to store and show the last viewed products of visitor.

Statistics Cookies
    These are cookies that evaluate the way visitors use the website (for example, which pages are visited more often and whether they receive error messages from webpages). These cookies are used for statistical purposes and to improve the performance of a website.
    •    _gtm
Google tag manager cookies. Used by Google to initialize the google tag manager and google analytics.
•    _ga
Google analytics cookie. Used by Google to collect information about how visitors use our website to help us improve the site. It collects information in an anonymous form, including the number of visitors to the site.

Marketing Cookies    Targeting and advertising cookies collect information about your actions on the website. The goal is to collect information such as the number of visitors, the number of pages viewed, etc., to improve the services provided to you, according to your preferences. As for ads, although our website does not host ads, when you visit a third-party site or a social networking site that uses ads, you may see an ad related to our website and a product you saw during your navigation in our website.    •    __atuvc
AddThis cookie. Used to enable easy interaction with social media.
•    fr
Facebook cookie. Used by Facebook to track user activity and improve advertising.


15. Changes to this Policy
We reserve the right to amend this Policy, for example to comply with the new requirements imposed by applicable laws, directives, or technical requirements or in the event of revision of our procedures or practices. We will notify you of any revision of our Privacy Policy by posting it on www.hondoscenter.gr. We also encourage you to periodically review this page.

Last update 15/04/2019