May 2020 GrCycling, Travel Agency, 16, Tzaferi Street, 11854, Greece is the owner and, therefore, responsible for the projects indicated below, including any of their subdomains or sections (hereinafter, “Website” as corresponds): www.GrCycling.combooking.GrCycling.com This legal text applies to the information we collect from you when you visit our Website, as in the following cases: user registration, using any of our services, collaboration, subscription to our newsletters or personal information provided when filling in online forms. The present Privacy Policy regulates the processing of personal data belonging to the Website’s users (hereinafter, “User” or “Users”, as applicable) performed by GrCycling Travel Agency, 16, Tzaferi Street, 11854, Greece (hereinafter, “GrCycling Company”), collected through the use of the services offered on the Website (hereinafter, “Services”). By using and accessing our Website, the User acknowledges that they have read this Privacy Policy and that they fully agree with it. The latest update of this Privacy Policy is indicated at the top of this text and it will become effective immediately upon being posted. GrCycling Company, thus, recommends reviewing this Privacy Policy from time to time.Some of the Services offered on the Website may be subject to specific privacy policies that will supplement this general Privacy Policy or, in case they differ from the terms of this Privacy Policy, they will substitute the present Privacy Policy. These additional privacy policies must be accepted by the User before initiating the corresponding Service. Additionally, the access and use of the Website and the accompanying Services are governed by the Terms of Use of the Website. PERSONAL DATA PROCESSING The following sections address the collection and processing of Users’ personal information through any of the projects run by GrCycling Company, including any of their subdomains and sections. DATA CONTROLLER GrCycling Company as data controller, is responsible for the processing of Users’ personal information on the Website:GrCycling, Travel Agency16, Tzaferi Street11854, Athens GreeceTax ID No. EL102717017Email: info@GrCycling.com or support@GrCycling.com. DATA WE COLLECT According to the EU General Data Protection Regulation (GDPR, 679/2016/UE), personal data refers to any information relating to an identified or identifiable natural person (User), that is, any information which can identify a natural person. Therefore, it is not applicable to anonymous data.GrCycling Company collects different types of personal data, which include:Profile Data: username and password, profile settings (bookmarks, follows, saved routes, bicycles rental, etc.), comments, responses to surveys and additional or optional information such as links to social networks, profession, city and website. Identity Data: first name and last name and government-issued identification number.Contact Data: email address, telephone number and postal address.Payment Data: payment and billing information, depending on the payment method selected by the User, as well as other details related to information about the purchased services or subscriptions. No credit or debit card information is collected or stored in our serversTechnical Data: login information, language, Internet Protocol (IP) address, browser type and version, time zone settings, operating system, browser plug-in types and versions and other technical data used by the User when visiting the Website.Usage Data: information about how the User uses the Website, products and services.Marketing and Communications Data: User’s preferences regarding marketing communications from GrCycling Company and information about enabling and disabling notifications.Bicycle Usage Data: height, shoe sizes, helmet size and cycling preferences (road cycling, ebike etc) GrCycling Company does not collect any personal data related to sensitive categories (racial or ethnic origin, political opinion, religious or philosophic beliefs, membership in a union, health information or genetic data).In case the User is asked to provide personal data, by law or by contract terms, and chooses not to provide them, we may not be able to carry out the contract nor provide them with the service. If this is the case, the User will be notified in advance. GrCycling Company does not collect the age nor the date of birth of their Users. Consequently, a specific data treatment for minors has not been established. GrCycling Company is exclusively targeted to users of legal age. HOW WE COLLECT DATA GrCycling Company collects data through different interactions, which include: Browsing and using the Website:Generally, Users navigate our Website anonymously without revealing any personal data to GrCycling Company.When a User visits and uses our Website, it stores and collects information automatically using technologies or automatic tools. In general, this collected information is related to technical information about the device, browsing activity and usage patterns. We collect this data through the use of cookies and similar technologies. If you want to learn more about it, you can consult our Cookies Policy.Moreover, we also store information about the number of downloads, bookings and searches run by the User. This information is collected in order to control the number of downloads and bookings by the User in compliance with the Terms of Use of this Website and to detect fraudulent and illegitimate usages of the Website, if any. In addition, we use personal information to perform analyses that help us to improve the quality of our Website, offer new products and ensure our Users’ satisfaction.User booking / registration, or subscription to newsletters:User Registration:When a User registers on our Website or subscribes to our informative newsletter, GrCycling Company stores data to develop the Website, provide the service and offer certain features and options related to the service itself. We also use this data to send information, offers, promotional communications and news about the Services offered by GrCycling Company, sponsors or third-parties, which provide services and products within the cycling sector through newsletters or any other communication method (including e-mail and phone number). The User can choose not to receive this information at any moment through the user account or by sending an email to info@GrCycling.com.Payment and billing data, which depend on the payment method selected by the User, will be sent directly to the corresponding external payment service provider which is in charge of processing the payment.Requests for information about products, services or publications, and requests for Website’s support services:“Contact” and “Support” Forms: Any information received by GrCycling Company will be stored in a file of GrCycling Company and will be used merely to respond to inquiries, suggestions or complaints sent by the Website’s Users. This information includes data collected from Contact forms, from the section ‘Can we help you?’, from satisfaction surveys as well as other information received via these two email addresses: info@GrCycling.com or support@GrCycling.com.Information provided through job and collaboration offers:“Jobs” and “Join Us” Forms: Any information provided to GrCycling Company through the ‘Jobs” or “Join Us” forms available on the Website, will be stored in a file belonging to GrCycling Company and it will be only used to manage internal recruitment processes.Furthermore, if the individual enters our internal recruitment process further to their application being accepted, we will request and collect all the necessary information as it is established by the Greek labor and tax legislation.“We’re Hiring” Form: Any information provided to GrCycling Company requesting for collaboration with any of their projects, will be stored in a file belonging to GrCycling Company and it will be only used to manage recruitment processes of external collaborators.Furthermore, if the individual enters our internal recruitment process further to their application being accepted, we will request and collect all the necessary information as it is established by the Greek labor and tax legislation. OUR PURPOSE AND LEGAL BASIS OF DATA WE COLLECT We mainly use personal data of our Website’s Users in the following cases: To manage and implement the Terms of Use of the WebsiteTo create and manage User accountsWhen the User agrees that their personal data can be collectedTo enter into a collaboration contractWhenever it is required in compliance with legal obligationsWhenever it is necessary to ensure the legitimate interest of GrCycling Company or third parties The User can withdraw their consent at any time in writing to info@grcycling.com Promotional Communications: we will send communications if: The User is registered or has accessed any of the Services of the Website (booking a rental bike is also included)The User requests for information through any of the forms available on the WebsiteThe User has not explicitly opted-out of receiving promotional communications HOW WE KEEP DATA We store personal information for as long as is needed to fulfill the purposes outlined in this privacy policy and, then, as long as it is permitted by applicable law. DISCLOSURE OF DATA GrCycling Company does not transfer nor share collected personal data with third parties external to the company. The information provided will only be used for identifying the User and managing the account on the Website. Our Website includes plugins which allow the User to carry out actions on social networks of third parties such as Facebook, Twitter, Pinterest or Google+, like, for instance, sending a publication or showing support to the Website. These plugins are indicated with the corresponding social network logotype. If these plugins are accepted, the content will be transferred to the corresponding social network. The User can find information regarding plugins and how they process personal data in the privacy statements of these social networks. If the User does not want their data to be collected by these social networks, they must not accept plugins and must sign out of their account before navigating the Website. We may disclose personal information of our Users to third parties only in cases when it is strictly necessary for GrCycling Company to perform their functions and to comply with the Terms of Use. We may also share personal information with other third parties to ensure compliance with applicable laws, including: Service providers, to manage systems and information technology.Payment platforms, banks and companies involved in the transaction process, to ensure the fulfillment of the necessary transactions.Other possible third parties with which GrCycling Company is compelled to share personal data, as permitted or required by law. These include professional advisers such as lawyers, auditors, legal and accounting consultancy services and financial institutions.Services provided by third parties are necessary for the development of GrCycling Company’s business activity. The processing of personal data is at all times subject to a contract which establishes the duties of the data processor towards the data controller. Under no circumstances will personal information be used for other purposes and it will be managed in compliance with GrCycling Company policy guidelines, their privacy policy and the applicable data protection regulation.GrCycling Company, in compliance with User privacy and data protection of Users, will only rely on service providers which adopt enough and proper technical and organizational measures to ensure that data processing complies with the applicable law regarding data protection and guarantee the protection of Users rights. RIGHTS OF THE USER GrCycling guarantees the exercise of rights established in the General Data Protection Regulation 2016/679 (hereinafter, GDPR), that will start to be applicable on 25th of May, 2018. The User can exercise the rights by emailing us at info@GrCycling.com.Please note that GrCycling Company may require the User to verify their identity before taking action on the request for the exercise of rights.The User has the following rights: Right to Access: The User has the right to obtain from GrCycling Company confirmation about whether or not personal data concerning them are being processed and, if that is the case, receive information about it.Right to Rectification: The User has the right to request us to correct personal data where it is inaccurate or incorrect. When requesting for rectification, the User must indicate the data to be rectified and provide the correct information. In addition, where necessary, the request must be sent together with supplementary documentation that accounts for the incomplete or inaccurate data.Right to Erasure: The User has the right to request the erasure of personal data concerning their personal account. Therefore, individuals can close their User Account at any moment in an easy and straightforward way within the booking / account webpage.When requesting for terminating the account and, therefore, erasing all personal information, the User must note the following:GrCycling Company may keep and use personal information where it is necessary in compliance with the legal obligations enforced by fiscal obligations and connected to judicial information and auditing.If the User sends an erasure request, the personal data will be erased from the safety back-up systems at GrCycling when the next back-up is done.Right to Object: The User has the right to object to the processing of their personal data by GrCycling Company at any time. In some cases, we may continue processing personal information because of legitimate grounds or for the exercise or defense of possible legal claims.Right to Restrict Processing: The User has the right to request the restriction of personal data where they have particular reason for wanting the restrictions.This right entitles the User to request the restriction of personal data in the following circumstances:The accuracy of the personal data is contested by the User, while GrCycling Company verifies the accuracy of the personal data.The User has objected to processing their data, pending the verification whether the legitimate grounds of the controller override those of the User.Furthermore, the User has the right to request us to retain their personal data when:The processing is unlawful and the User opposes the erasure of the personal data and requests the restriction of their use insteadGrCycling Company no longer needs the personal data for the purposes of the processing, but they are required by the User for the establishment, exercise or defense of legal claims.Right to Data Portability: The User has the right to request us a copy of the personal information provided to GrCycling Company in a structured form and of common and legible use. The user is also entitled to request that this information be sent to another service provider (where technically possible).Right to Withdraw Consent: In the cases in which the User has authorized their data processing, the User has the right to withdraw their consent at any time. Please note that revocation of consent does not affect the lawfulness of processing based on consent before its withdrawal.The User can access and update their personal information in the settings of the User Account.The User is responsible for updating their personal information. DATA SECURITY GrCycling Company implements strong security controls to safeguard User’s personal information against loss, misuse, unauthorized access, disclosure or alteration. INTERNATIONAL DATA TRANSFERS Some external service providers of GrCycling Company are outside the European Economic Area (EEA), which implies that the User’s personal information may be transferred to countries outside the European Union.In order to offer assistance when providing services, GrCycling Company works with subprocessors, subcontractors and other content delivery networks. A sub-processor is an external data processor contracted by GrCycling Company, who has been granted access to information (which may be personal) about clients and collaborators and who can process it.In any case, and concerning international data transfers, GrCycling Company commits to ensure that transfers of personal information outside the EEA comply with this Privacy Policy and meet any applicable law regarding data protection regulations of the European Union. COMPLAINT SUBMISSION If you, the User, do not agree with the way GrCycling Company processes your personal data, you can contact us by sending an email to info@GrCycling.com
