1. Introduction
This privacy policy sets out the ways in which geoshop.gr processes information that can be used to directly or indirectly identify an individual (“Personal Data”) collected through the use of the geoshop.gr website and its contact form or its order form. In any case, geoshop reserves the right to change the terms of protection of personal data after informing visitors/users and within the existing or potential legal framework. If a visitor/user does not agree with the terms of protection of personal data provided in this section, he/she must not use the services of geoshop.gr.
You can browse our online store without providing any personal information. Your personal information will only be requested when you want to contact geoshop or place an order.
Our website is in compliance with the General Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data (“GDPR Regulation”), which is a directly binding legislative act. The GDPR Regulation creates some new rights for individuals and enhances some of the rights that already existed under Directive 95/46/EC. Directive 95/46/EC will be repealed on 25 May 2018, when the GDPR Regulation comes into force.
In the text of this policy, “User” means the person who uses the services of the geoshop website, “Visitor” means the person who visits our website, “Customer” means the persons who contract with geoshop to purchase its products.
Any processing of personal data carried out by geoshop is carried out in such a way as to ensure its confidentiality. All information is stored securely and only authorised personnel are allowed access to it. Geoshop implements and develops the necessary technical and organizational measures to protect the Personal Data of Users, Visitors and Customers (all of them understood as “Subjects” of personal data) from unauthorized or unlawful processing and use, as well as against possible loss, destruction, damage, theft or unauthorized access.
2. Collection and Use of Personal Data
2.1. The legitimate basis for the use of your personal data
Geoshop collects only those personal data that are necessary in order to meet your requests. Whenever additional, optional information is sought, you will be informed at the time of collection of such data, and your prior consent to the processing will be required.
The current legal framework allows us to process personal data only if we have a legitimate basis to do so. Therefore, when we process your personal data, we rely on one of the following processing situations:
Providing consent: we may occasionally ask for your consent in order to process some of your personal data. Your data will only be processed in this way if you expressly agree to this (Article 6(1a) of the GDPR).
Contract performance: Where the processing of your personal data is necessary for the performance of our obligations arising from the contract concluded between us (Article 6(1b) of the GDPR Regulation).
Legal obligation: This is where we are required to process your personal data in order to comply with a legal obligation, such as, but not limited to: a) to keep records for tax purposes, b) to provide information to a public body, c) to comply with the requirements of a legislative or regulatory provision or a judicial decision (Article 6(1c) of the GDPR Regulation).
Protection of your vital interests: this is where the processing of your personal data is necessary to protect your vital interests (Article 6(1d) of the GDPR).
Performance of a task carried out in the public interest or in the exercise of official authority: This is where the processing of your personal data is necessary for the performance of a task carried out in the public interest (Article 6(1e) of the GDPR).
Legitimate interest: we may process your personal data in cases where such processing is in the legitimate interest of our company in the performance of a lawful activity, in order to ensure the continuity of that activity. This processing will, of course, not go beyond your interests, freedoms and fundamental rights (Article 6(1f) of the GDPR).
Geoshop does not process your personal data, such as personal data concerning a person’s race, nationality, political opinions, trade union membership, religious beliefs, philosophical beliefs, physical or mental health, sexual life and orientation, data concerning criminal convictions and criminal acts.
The following sections cover the specifics of each of the aforementioned groups from which personal data are collected.
2.2. Collection of Subject Data
Geoshop collects the personal data of the Subjects through the Customer Service Call Centre, its External Partners, and through its website.
The following sections cover the Subjects whose personal data are collected.
Geoshop may collect and process personal data about Users through the contact form, Website Visitors, Customers through the order form and External Partners.
Where required by the applicable legal framework, we will request your explicit consent for the processing of your personal data as collected by geoshop.
Your personal data processed by geoshop are the following:
Personal Data of Users: Full name, landline phone number, mobile phone number, home address, IP address, email address.
Visitor Personal Data: IP address, cookies
Customer Personal Data: Full name, home address, shipping address, passport number, passport number, landline phone number, mobile phone number and email address
3. Data transmission
Geoshop does not disclose your personal data to third parties outside the European Union in countries where there is no appropriate data protection regime. However, should such a data transfer be necessary, geoshop will take all possible measures to ensure that your data is treated securely as it would be within the EU/EEA and in accordance with this Policy and applicable law. In addition, geoshop will update the current Policy in order to cover the cross-border transfer of data and related privacy safeguards for Users of its platform.
4. Data retention period
Geoshop will not retain the Data Subjects’ data beyond the time necessary to fulfil the purposes for which they have been collected or as required by the applicable legal framework.
In the event of a sales contract with geoshop, the latter shall keep the customer’s personal data until the expiry of the statutory general limitation period for claims, i.e. for a period of up to twenty (20) years from the termination of the relevant contracts in any way.
If until the expiry of the above period, legal actions are in progress with geoshop that directly or indirectly concern the Customer, the above data retention period will be extended until the issuance of an irrevocable court decision. In certain cases, specific personal information may be retained beyond this period of time due to possible legal obligations, legitimate interests of geoshop, etc. Such cases include, but are not limited to, those related to any branch of law (tax, civil, criminal, etc.). In the event that the transactional relationship is not established, the User’s or Customer’s personal data will be kept for a period of up to five (5) years from the date of collection.
In the event that a shorter or longer data retention period is provided for by law, the above data retention period will be reduced or increased accordingly.
geoshop may collect, record and process the data of the Visitors of its website. We may record your IP address and use cookies.
5. Use of the Website
In accordance with the specific provisions of Article 8 of the Regulation, minors under the age of fifteen (15) years old are prohibited from disclosing to geoshop through its website their personal data without the prior consent of their guardian. We ask these persons not to submit information to us. In the event that the Users of the website fall into the above category and continue to disclose their personal data to us through our website, geoshop will assume that these persons have received the prior consent of their guardian.
6. The Rights of Subjects
The new GDPR Regulation gives you the following rights, regarding the processing of your personal data:
Right of Access: you can request access to your personal data. This enables you to receive a copy of your personal data held by geoshop
Right to rectification: you can request the rectification of your personal data. In this way, you are given the opportunity to correct any incomplete or inaccurate data that geoshop has about you. In this case, we will need to verify the accuracy of the new data you provide us with.
Right of Deletion: You may request the deletion of your personal data. This enables you to request that we delete or remove personal data in the event that there is no reason for us to continue processing it.
Right to restriction of processing: You may request restriction of the processing of your personal data.
Right to object: you may object to the processing of your personal data at any time, in cases where the processing of your data is based on the performance of a task carried out in the public interest or in the exercise of official authority (case e) of Article 6(1) of the Regulation), or if the processing is carried out for the purposes of the legitimate interests of geoshop or a third party (case f) of Article 6(1) of the Regulation).
Right of Portability: You can request the transfer of your personal data to you or to third parties. We will provide you or your chosen third party with your personal data in a commonly used, electronically readable format. Please note that this right only applies to automated information that you originally provided us with your consent to use or whenever we have used that information to perform a contract with you.
Right to withdraw consent: you can withdraw your consent at any time, in cases where you have already given your consent to the processing of your personal data. However, this will not affect the lawfulness of any processing that took place before your consent was withdrawn. If you withdraw your consent, geoshop may not be able to offer you certain of its products or services. You will be informed of this at the time of submitting your request.
Manual decision making: automatic decision making occurs when an electronic system uses personal data to make a decision without human intervention. In this case, you have the right not to submit to decisions taken solely through automated processing, including profiling, which produces legal effects concerning you or which significantly affect you in a similar way, unless you provide us with your consent, or it is necessary for the conclusion or performance of a contract between you or otherwise permitted by law. You also have the right to challenge decisions taken about you through the above procedure.
Geoshop respects your rights to your personal data and facilitates the exercise of these rights. In any case, if you feel that the protection of your personal data has been violated in any way, you have the right to submit a written complaint to the Hellenic Data Protection Authority (1-3 Kifissias Street, P.O. Box 11523, Athens) or online (www.dpa.gr).