Privacy Policy & GDPR Compliance

IN GENERAL

The use of our web pages and the services provided to the visitor on the site kastrinos-thassos.gr owned by Kastrinos Maisonette hereafter «the company», requires your agreement with the Privacy Policy of this site. Therefore, the visitor must carefully read the contents of this page before using the services of our website. If he does not agree, he must leave this website and NEVER make use any of its services or content.
This privacy policy may change from time to time according the relevant legislation. We will not explicitly notify our customers or our site’s users about these changes. Instead, we recommend you to occasionally visit this page for any changes to this privacy policy. The continued use of the kastrinos-thassos.gr website even after any changes to the Privacy Policy implies the unconditional acceptance of these terms by you.

Privacy and Protection of personal data

We collect and process your personal data only when it is absolutely necessary.
We will never sell, rent, distribute, or publicize in any way your personal data.
If you are under 16, you MUST have your parents’ consent before using the services of this site.

Relevant legislation

Along with our company’s internal IT systems, this site is designed to comply with the following laws/regulations regarding the protection of user’s personal data:

1. EU Data Protection Directive (DPD of year 1995)
2. Regulation on general EU data protection (GDPR of year 2018)

Personal information collected by this site and why we collect it

This site collects and uses personal information for the following reasons:

Website traffic monitoring

Like most sites, this site uses Google Analytics (GA) to track user activity. We use this data to determine the number of our site visitors to better understand how they find and use our web pages. Although GA records data such as your geographic location, your device, your web browser, and your operating system, none of this information identify you to us. GA also records your computer’s IP address, which could be used to identify you, but Google does not provide access to it. We believe that Google is a third data processor that is compliant with the requirements of European legislation.

Contact forms and e-mail links

If you choose to contact us using a contact form or an email link, none of the data you provide will be stored to our site or transferred or processed by any third party data processor as defined below in the section «Our third-party data processors». Instead, these data will be sent to us via an SMTP protocol (Simple Mail Transfer Protocol). Our SMTP servers are protected by a TLS security protocol (also known as SSL), meaning that email content is encrypted before being sent over the Internet. The content of the email is decrypted by our local computers and devices.

Newsletters

If you choose to subscribe in our newsletter, the email address you submit will be forwarded to MailChimp which manages our e-mail marketing services. MailChimp is a third-party data processor (see «Our third-party data processors» below). Your e-mail address will not be stored in any of our databases. Your e-mail address will remain in the MailChimp database for as long as we continue to use our e-mail marketing services or until you explicitly request to be removed from the mailing list. You can do, using the delete link contained in all the email newsletters we send you.
As long as your e-mail address remains in the MailChimp database, you will receive periodic (approximately once a month) e-mail newsletters from us.

About this site’s web server

All web traffic (file transfer) between this site and your browser is encrypted and transferred via the HTTPS protocol using Secure Sockets Layer (SSL).

Third-party personal data processors

We use a number of third parties to process personal data for us. These Third-party personal data processors have been carefully selected to comply with the legislation mentioned in this document.

Data breaches

For any of your personal information stored in our database, all necessary action will be taken to be secure as possible.
We will report any unlawful violation of our database or any third party data processing database to all relevant stakeholders as well as authorities within 72 hours of the violation, if it is obvious that the personal data stored in recognizable form, have been stolen.