PRIVACY POLICY

Purchasing Products via the website

By purchasing a product from the company, the user expresses her/his wish to have the company process a set of personal information in order to complete the transaction. This data is objectively and legally essential to the function of the provided service.

When the user is in the process of ordering a product from the website, she/he will be required to fill necessary fields in the order form. The data will then be processed by the company for the purpose of fulfilling the order. In doing so the company will perform a series of actions which might can include gathering, organizing, rectifying, storing, adjusting, searching the data.

For the purposes of completing the order, we collect data which include the name, surname, billing and shipping address, member ‘s date of birth, telephone number, e-mail address, member’s name, member’s code of each user. Finally, communications’ data such as for e.g., IP address that are technically necessary for your navigation on our website or/and for making purchases that are maintained for as long as the law provides for businesses like ours.

The company shall hold on to the user’s data for however long the contractual relation is maintained between them. For those users that have registered to the website, the data will be held for as long as these users have an active account. Some of the data provided by the user will be stored for longer for tax purposes. These data include the user’s name, billing address and product order.

The user shall rest assured that the company is absolutely committed to implementing modern and suitable means of technological processing (e.g., encryption, anonymity) as well as organizational measures in order to achieve data security.

Reserving a table in Peskesi Restaurant or expressing an interest to book an experience at Peskesi Organic Farm

When the user is in the process of expressing her/his interest in booking an experience at Peskesi Organic farm or reserving a table in Peskesi Restaurant she/he will be required to fill necessary fields in the website. The data will then be processed by the company for the purpose of fulfilling the order. In doing so the company will perform a series of actions which might can include gathering, organizing, rectifying, storing, adjusting, searching the data.

For the purposes of completing the order, we collect data which include the name, surname, telephone number, e-mail address, allergies that they might have, finally communications’ data such as for e.g., IP address that are technically necessary for your navigation on our website or/and for making purchases that are maintained for as long as the law provides for businesses like ours.

The company shall hold on to the user’s data for however long the contractual relation is maintained between them and will proceed to deleting them after 1 week following the reservation, 1 week following a visit to Peskesi Organic Farm or 3 weeks following an expression of interest to book a visit to Peskesi Organic Farm which did not result in a booking. For those users that have registered to the website, the data will be held for as long as these users have an active account.

The user shall rest assured that the company is absolutely committed to implementing modern and suitable means of technological processing (e.g., encryption, anonymity) as well as organizational measures in order to achieve data security.

User’s Rights

The User, may, as appropriate, exercise the following rights:

• The right of access (learning which data of theirs the Company is processing, for what reasons and its recipients)
• The right of amendment (rectifying any inaccuracies or lack of data)
• The right of deletion / right of oblivion (purge from Company files, should their presence, however, no longer be necessary)
• The right of restricting processing (In case of doubt being presented so as to the accuracy of data etc.)
• The right of portability (for the Customer to receive their data at a structured and commonly used format)

Such rights are exercised sans cost for the user, with the sending of relevant postage or email to the Data Protection Officer (DPO), unless they are repeated often and due to volume, they possess administrative weight for the Company, hence the user shall be burdened with the relevant cost.

Should the user exercise any of those rights, the Company shall undertake any possible means for the satisfactory conclusion of such a request within thirty (30) days from receiving the relevant request, after the Company notifies such either for its execution, or the subjective reasons which prevent it.

Third party data processing

It is the responsibility of the company, as the controller, to use processors that have put in place appropriate technical and organizational measures to ensure that the processing meets the requirements of EU Regulation 2016/679 and any other applicable European and national legislation.

Processing by the processor, a partner of the Company, is governed by a contract or other legal act under the law of the Union or the Member State which binds the processor in relation to the Company and determines the subject matter and duration of processing, the nature and purpose of the processing, the type of personal data and the categories of data subjects and the controller’s obligations and rights. This Convention or other legal act provides in particular that the processor:

1. processes personal data only on the basis of documented Company’s instructions as a controller, including with regard to transfers of personal data to a third country or international organization, unless it is required to do so under Union law or the law of the Member State to which the processor is a subject. In this case, the processor shall inform the controller of this legal claim in question prior to processing, unless that law prohibits such information on important grounds of public interest;
2. ensures that persons authorized to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
3. takes all necessary measures pursuant to Article 32 of (EU) Regulation No 2016/679,
4. complies with the conditions set out above for the recruitment of another processor,
5. taking into account the nature of the processing, assists the controller with the appropriate technical and organizational measures, to the extent possible, for the fulfilment of the controller’s obligation to respond to requests for exercising the data subject’s rights laid down in EU Regulation 2016/679;
6. assists the controller in ensuring compliance with the obligations pursuant to EU Regulation 2016/679 Articles 32 to 36, taking into account the nature of processing and the information available to the processor;
7. at the choice of the controller, deletes or returns all the personal data to the controller after the end of the provision of services relating to processing, and deletes existing copies unless Union or Member State law requires storage of the personal data;
8. makes available to the controller all information necessary to demonstrate compliance with the obligations laid down in this Article and allow for and contribute to audits, including inspections, conducted by the controller or another auditor mandated by the controller.

As regards point (h) of the first subparagraph, the processor shall immediately inform the controller if, in his opinion, an instruction infringes this Regulation or other Union or Member State data protection provisions. Where a processor engages another processor for carrying out specific processing activities on behalf of the Company as a controller, the same data protection obligations as set out in the contract or other legal act between the Company as the controller and the processor, as provided for in paragraph 3, shall be imposed on the other processor by a contract or other legal act in accordance with the law of the Union or of the Member State, especially to provide sufficient assurances to implement appropriate technical and organizational measures in order processing meets the requirements of this Regulation. When the other processor fails to meet data protection obligations, the initial processor remains fully accountable to the Company as the controller for the fulfilment of the obligations of the other processor.

Submission of a complaint by the user

The user can contact the Data Protection Officer (DPO) for whichever issue might involve the processing of her/his data. The details of the DPO are as follows:

ΜΙΧΑΛΙΤΣΗ ΜΑΡΙΑ ΤΟΥ ΒΑΣΙΛΕΙΟΥ

ΚΑΠΕΤΑΝ ΧΑΡΑΛΑΜΠΗ 6-8,

Heraklion, P.C. 71202

Crete, Greece

2810288887

[email protected]

COOKIES

A cookie is a small text file that a website stores on your computer or mobile device when you visit the site.

• First party cookies are cookies set by the website you’re visiting. Only that website can read them. In addition, a website might potentially use external services, which also set their own cookies, known as third-party cookies.
• Persistent cookies are cookies saved on your computer and that are not deleted automatically when you quit your browser, unlike a session cookie, which is deleted when you quit your browser. Every time a user visits the website he will be asked to accept or reject the cookies.

By storing a user’s cookies, the website memorizes her/his preferences so as it is possible to make suggestions to the user for new products that she/he may be interested in or display ads on social media. Thus, the user is given the opportunity to choose from a new range of products that he may not have known, to be informed about offers, etc.

Cookies can also be used to establish anonymized statistics about the browsing experience on our website.

The 3 types of first-party cookie we use are to:

1. store visitor preferences
2. make our websites operational
3. gather analytics data (about user behavior)

Visitor preferences

These are set by us and only we can read them. They remember:

• if you have agreed to (or refused) this site’s cookie policy
• if you have already replied to our survey pop-up (about how helpful the site content was) – so you won’t be asked again

Operational cookies

There are some cookies that we have to include in order for certain web pages to function. For this reason, they do not require your consent. In particular:

• authentication cookies
• technical cookies required by certain IT systems

Authentication cookies

These are stored when you log in to our website, using our authentication service. When you do this, you accept the associated privacy policy.

Analytics cookies

We use these purely for internal research on how we can improve the service we provide for all our users. The cookies simply assess how you interact with our website – as an anonymous user (the data gathered does not identify you personally). Also, this data is not shared with any third parties or used for any other purpose. The anonymized statistics could be shared with contractors working on marketing projects or on developers of new products. However, you are free to refuse these types of cookies – via the cookie banner you’ll see on the first page you visit.

Promotional – Marketing cookies (targeting or advertising cookies):

These cookies are used to deliver adverts that are more appealing to each user and more relevant to their interests. They are also used for targeted advertising with the purpose of limiting irrelevant and repetitive ads.

Third-party cookies

Some of our page’s display content from external providers, e.g., YouTube, Facebook and Twitter. To view this third-party content, you first have to accept their specific terms and conditions. This includes their cookie policies, which we have no control over. But if you do not view this content, no third-party cookies are installed on your device.

These third-party services are outside of the control of the company. Providers may, at any time, change their terms of service, purpose and use of cookies, etc.

Our website uses the following cookies: