Hotel Brain S.A. Applicant Privacy Policy

Privacy Policy – Privacy Statement – Privacy Notice for the protection of Personal Data

1. Update on the Processing of Personal Data

We would like to assure you that for “HOTEL BRAIN ACADEMY K.D.V.M” (hereinafter “the Company”), the protection of the personal data of our students and partners is of primary importance. For this reason, we take appropriate measures to protect the personal data we process and to ensure that the processing is always carried out in accordance with the obligations set by the legal framework, both by the company itself and by third parties that process personal data on its behalf.

We would also like to assure you that at the Company we do not collect data about minors under the age of 16.

2. What is GDPR

The General Data Protection Regulation (GDPR) is the new regulatory framework of the European Union (EU) in the field under consideration. The object of the law is to establish the conditions for the processing of personal data, to protect the rights and freedoms of natural persons and in particular the right to the protection of personal data.

3. Personal Data

Personal data is any information that concerns and identifies a subject (natural person), on the basis of which it is arranged / identified such as name, age, residence, profession, marital status, physical characteristics, education, work, financial situation, interests, activities , habits.

4. What are the legitimate grounds for processing your personal data?

Lawful grounds for processing your personal data include:
(a) the provision of the services you entrust to us and wish to receive from us, such as for example the information about our activities and consequently the fulfillment of our contractual obligations in this context, specifically:

– updating the financial offer – discount for immediate contract repayment.
– informing students and guardians about the operation of the School (e.g. new building, new annex, operation of new programs, new collaborations with other educational institutions, etc.).
– the notification of a change in the curriculum.
– the notification of non-attendance of a teacher – lesson cancellation.
– the information when the school is closed.
– information on educational visits.
– information about free seminars within the course.
– information on the receipt of educational material.
– information on absences, examinations,.
– the information about the Internship.
– information about events and competitions of the school.

The information collected and processed for this purpose is as follows:

– Name and surname
– Date of birth
– Phone number (fixed and mobile)
– Email address (email)
– Address of residence (city – region of residence and postal code)
– VAT number
– D.O.Y.
– AM.
– A.M.C.A.
– Status (student, employee, parent/guardian)
– Level of study
– Passport – residence permit (in case of foreigners)

(b) safeguarding and protecting our legitimate interests, both yours and ours. Thus, we use closed circuit television (CCTV) and security cameras in order to be able to protect the safety of natural persons, materials, facilities as well as special security software aimed at detecting and preventing malicious actions: specifically during your visit to the natural premises of our company but also on our online pages we use information, such as for example IP address, location information, devices of coke users in order to detect or prevent fraud or abuse of our website.

(c) compliance with an obligation imposed by law, such as regulatory compliance for tax purposes

(d) the consent you provide under the specific conditions set by the legal framework, in order to receive updates on the activity, products, services or third-party collaborating companies, which process personal data in accordance with the applicable framework

• The above information actions take place via email, sms, standard mail, newsletter brochures, telephone and other means (e.g. social media if available).

5. Principles governing the processing of Personal Data

Personal Data: They are processed lawfully and legitimately in a transparent manner in relation to the subject of the data. The processing of personal data will be non-automated by keeping a physical file, as well as an electronic one. They are collected for specified, explicit and legitimate purposes and are not further processed in a manner incompatible with these purposes. They are appropriate, relevant and limited to what is necessary for the purposes for which they are processed. They are accurate and, when necessary, updated. All reasonable steps must be taken to immediately delete or correct personal data that is inaccurate in relation to the purposes of the processing. They are kept in a form that allows the identification of the data subjects for the period required for the purposes of processing the personal data. They are processed in a way that guarantees the appropriate security of personal data, including their protection against unauthorized or illegal processing and accidental loss, destruction or deterioration, using appropriate technical or organizational measures.

6. Security of personal data

The security of your personal data is a high priority for the Company. Therefore, we protect your data, which is stored with us, through technical and organizational measures to effectively prevent its loss or misuse by third parties. Specifically, those in charge, who process personal data, are committed to maintaining confidentiality. To protect your personal data, data is transmitted in encrypted form. In order to ensure the long-term protection of your data, the technical security measures are regularly monitored and, if necessary, adapted to the respective prevailing technology standards.

7. CATEGORIES OF RECIPIENTS of Personal Data / Transmission of data by the COMPANY.

The COMPANY transfers Personal Data to third parties, as long as this is required for us to fulfill our contractual obligations to the data subject, or is clearly required by the respective legislative, regulatory and regulatory framework or court decision, or we act as processors and it is required that sending personal information.

Recipients of personal data, based on the above, may be:

Official state agencies and Public Organizations involved in the respective training and education programs. (e.g. Ministry of Labour, OAED, EOPPEP, SEPE. )

Especially some partners to serve the needs of the COMPANY and refer to IT services and/or support of all kinds of information and electronic systems, networks, applications, including online systems and platforms.

Collaborating companies, external partners, subcontractors, employees to whom we have assigned on the basis of a contract the execution of specific tasks (e.g. Knowledge Certification Companies, accountants, law firms).

to technology service providers

When transmitting absolutely necessary data, for the performance of services by third parties, we constantly ensure the highest possible level of security. Therefore, your data is only transmitted to partners, employees and companies, which have been carefully selected & bound by statements of confidentiality and confidentiality in advance.

SECURITY of Personal Data by the COMPANY

The COMPANY implements appropriate technical and organizational measures in order to ensure on a permanent basis the required level of security of your personal information and its protection from accidental or unlawful destruction, accidental loss, alteration, prohibited dissemination or access and any other form of unlawful processing.

The external partners or employees of the COMPANY who either collect or process personal data are bound by confidentiality.

In order to ensure the long-term protection of your data, technical security measures are regularly monitored and, if necessary, adapted to the respective prevailing technology standards.

8. Storage time interval

The Personal Data submitted for the above processing purposes will be kept by our company for the period deemed absolutely necessary for the fulfillment of these purposes and in accordance with the legislative provisions. With respect to Personal Data processed for the provision of the contractual service, our company may continue to store such Data for a longer period of time, as may be necessary to protect our company’s legitimate interests in relation to potential liability related to the provision of the Service.

9. What are your rights in relation to your personal data?

Every natural person whose data is processed by the Company enjoys the following rights:

Right of access: you have the right to be aware of and verify the lawfulness of processing. Therefore, you have the right to access the data and to receive additional information about their processing.

Right to rectification: you have the right to review, correct, update or modify your personal data

Right to erasure: You have the right to request the erasure of your personal data when we process it based on your consent or in order to protect our legitimate interests. In all other cases (such as indicatively when there is a contract, an obligation to process personal data imposed by law, public interest), the right in question is subject to specific limitations or does not exist as the case may be.

Right to restriction of processing: You have the right to request the suspension of processing when you have a legitimate interest.

Right to object to processing: You have the right to object at any time to the processing of your personal data in cases where, as described above, this is necessary for the purposes of legitimate interests pursued by us as controllers, as well as processing for direct marketing purposes.

Right to portability: You have the right to receive your personal data free of charge in a form that will allow you to access it, use it and process it by commonly used processing methods. You also have the right to ask us, if technically feasible, to transfer the data directly to another controller. This right exists for the data you have provided us with and the processing is carried out by automated means on the basis of your consent or in execution of a relevant contract.

Right to withdraw consent: The company informs you that where processing is based on your consent, you have the right to freely withdraw it, without affecting the lawfulness of the processing based on your consent, before you withdraw it. To withdraw your consent you can contact us at the following address
info@hotelbrainacademy.com
 as well as contact the DPO.

Right to lodge a complaint with the DPAA: You have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr): telephone: +30 210 6475600, fax: +30 210 6475628, e-mail: contact@dpa.gr.

The Company handles your requests with due care in order to ensure the security of your data and the protection of your rights. For this reason, in case of doubt as to the person requesting the disclosure of Personal Data, we may ask you for additional information necessary to confirm your identity.

In the event of a breach of your data and if such a breach may put your rights and freedoms at high risk and provided that it does not fall within one of the exceptions expressly provided by law, the Company undertakes to inform you without undue delay.

In principle, the Company is obliged to respond to your request immediately and within one month at the latest. If necessary, taking into account the complexity of the request and the number of requests, this period may be extended by a further two months. In any case, the Company will inform you as soon as possible and, in any case, within one month from the submission of your request, about the development of the request and the reason for any delay in its satisfaction.

If your requests are manifestly unfounded or excessive, in particular because of their repetitive nature, the Company may either impose a reasonable fee, taking into account the administrative costs of providing the information or the communication or execution of the requested action, or refuse to follow up on your request.

10. Hyperlinks to third party websites

With the help of appropriate hyperlinks within our Website, it is possible to access third party websites. The placement of these links has been done with the sole purpose of facilitating visitors during their browsing on the internet. It is in no way an indication of acceptance or approval of the content of the websites listed with a link from our Company.

Accessing the website using the links provided is entirely at your own risk and we encourage you to carefully read the data protection policy of each website you visit.

11. Conversions

This Privacy Notice may be amended from time to time. We reserve the right to change or modify this Privacy Notice at any time. The effective date of this Privacy Notice is indicated at the beginning of the text. Please check regularly and especially before providing any new personal data.

12. Contact

Finally, you can contact the Company at any time for Personal Data issues, to exercise your rights, to submit a query or a complaint at the following e-mail address:
info@hotelbrainacademy.com

13. Information on the processing of personal data through a video surveillance system

  1. Processing manager

HOTEL BRAIN ACADEMY, 123 Patision Avenue, P.K 11251 tel. 210 3000565

  1. Purpose of processing and legal basis

We use a surveillance system for the purpose of protecting persons and property. The processing is necessary for the purposes of legitimate interests pursued by us as controller (Article 6(1)(f) GDPR).

  1. Analysis of legitimate interests

Our legal interest consists in the need to protect our site and the goods located in it from illegal acts, such as theft. The same applies to the safety of life, physical integrity, health and property of our staff and third parties who are legally present in the supervised area. We only collect image data and limit downloads to areas we have assessed as having an increased likelihood of illegal acts being committed e.g. theft, such as at our checkouts and at the entrance, without focusing on areas where the privacy of the persons whose image is taken may be unduly restricted, including their right to respect for personal data.

  1. Recipients

The material kept is accessible only by our competent/authorized personnel who are in charge of the security of the site. This material is not transmitted to third parties, with the exception of the following cases: a) to the competent judicial, prosecutorial and police authorities when it includes elements necessary for the investigation of a criminal act, which concerns persons or goods of the data controller, b) to the competent judicial, prosecutorial and police authorities when they request data, legally, in the exercise of their duties, and c) to the victim or the perpetrator of a criminal act, when it comes to data which may constitute evidence of the act.

  1. Time of observance

We keep the data for seven (7) days, after which it is automatically deleted. In the event that we discover an incident during this period, we isolate part of the video and keep it for up to one (1) month, with the aim of investigating the incident and initiating legal proceedings to defend our legal interests, while if the incident concerns third we will keep the video for up to three (3) more months.

  1. Rights of data subjects

Data subjects have the following rights:

  • Right of access: you have the right to know whether we are processing your image and, if so, to receive a copy of it.
  • Right to restriction: you have the right to ask us to restrict processing, such as not deleting data that you consider necessary for the establishment, exercise or maintenance of legal claims.
  • Right to object: you have the right to object to processing.
  • Right to erasure: you have the right to request that we delete your data.

You can exercise your rights by sending an e-mail to
info@hotelbrainacademy.com
 or by sending a letter to our postal address or by submitting the request in person, at the address of the shop. In order to consider a request related to your image, you will need to tell us approximately when you came into range of the cameras and provide us with an image of you to help us identify your own data and mask the data of third-party imagers . Alternatively, we give you the opportunity to visit our premises to show you the images you appear in. We also point out that the exercise of the right to object or deletion does not imply the immediate deletion of data or the modification of processing. In any case, we will reply in detail as soon as possible, within the deadlines set by the GDPR.

  1. Right to lodge a complaint

If you believe that the processing of your data is in breach of Regulation (EU) 2016/679, you have the right to lodge a complaint with a supervisory authority.

The competent supervisory authority for Greece is the Data Protection Authority, Kifissia 1-3, 115 23, Athens, Greece, https://www.dpa.gr/, tel. 2106475600