PRIVACY POLICY

In this Privacy and Cookie Policy you will find all relevant information that applies to our use of the personal data of our users and customers, regardless of the channel or medium (online or in person) you use to engage with us.

If you would like information about how we use cookies and similar devices that may be installed on the terminals of our customers and users, we encourage you to refer to our Cookies Policy.

When we talk about our company, we generally refer to any of the channels or media, digital or in-person, that you may have used to interact with us. The main ones are:

• Our website.
• In person, at our company's head office.

A. Details of the Data Controller

The company under the name "OKTANA Single Member P.C." (hereinafter referred to as the "Company"), which has its registered office in Glyfada, Attica, (83, Poseidonos Ave. Postal code: 16675 Glyfada, VAT No. 801565428, General Commercial Registry No. 159234103000)/ D.O.Y KEFODE Attikis) hereby informs you, as the controller, in accordance with Regulation (EU) 2016/679 (hereinafter referred to as the "GDPR") and the relevant provisions of the Greek legislation on the protection of personal data, as applicable, of the type of personal data it collects, the source of collection, the reason for their collection and processing, any recipients, the time of their retention, any transfer outside the E.U. as well as your rights in relation to your data and how you can exercise them.

Β. Type of Data and Sources,

The information you provide may vary depending on the services you request or the actions you expressly authorize us to perform, we will process the data strictly necessary to complete the provision of the services.

The personal data collected and processed by the Company depending on the type of service you have requested are:

• title
• your full name,
• your mobile and/or landline telephone number,
• your full postal address details,
• your first name/surname of co-hosts,
• your VAT number,
• your date of birth,
• your identity card or passport number, yours and co-hosts
• your IP address,
• your payment details,
• additional data that the Data Controller may receive in the course of its activity,
• In case you request the issuance of a Company Invoice, you will be asked for your Company's details such as the Company Name, Tax ID, Tx Office, Activity, Headquarters Address and Contact Telephone Numbers (fixed and mobile).
• economic data where applicable

Data Source:

• Directly from you or via the contact form online from http://octana.gr/ or both,
• by the travel agent, or through a shipping agent based in European Union countries as well as in countries outside the European Union
• from our call centre, and/or,
• from the Company's offices; and/or,
• through the online service channels of the companies with which the Company cooperates online from their websites. In this service case, both companies will act as separate Data Controllers of your data. To find out how they manage your personal data please refer to the respective privacy and cookie policies of their websites from the platform you are logging into.

Marketing:

Depending on the action, we only process personal data that is absolutely necessary. For example, when you configure your mobile device, when you configure it in relation to your device's privacy settings, when you consent through your cookie settings or when you accept the legal terms and conditions for participating in a promotion or for publishing your photos on the Company or on our social media channels.

• If and when you subscribe to our Newsletter, we will process your personal data to manage your subscription, including sending you personalized information about our products or services through various means (such as email or SMS or Whatsapp app). We may also provide you with this information through push notifications if you have enabled them on your device.

Remember that you can unsubscribe from the newsletter at any time and without cost, by writing to the Company's Data Controller by physical or electronic mail using the following details: 83, Poseidonos Ave. Postal code: 16675 Glyfada, Attica, Greece, e-mail: info@octana.gr, as well as through the instructions provided in each update. If you do not want to receive push notifications, you can disable this option on your device.

Display internet advertisements that you may see when you visit websites and applications, for example, on social media. The ads you see may be random, but in other cases they may be ads related to your preferences or your shopping and browsing history.

• If you use social media, we may provide the companies we work with, with certain information so that they can show you our ads and, in general, offer you and users like you ads that take into account your profile on those social media sites. If you would like information about how we use your data and how our social media ads work, we encourage you to refer to the privacy policies of the social media sites on which you have a profile.
• We also use your data to perform metrics and segment analysis on the ads we serve to users on some of our partner platforms. To do this, we work with third parties that provide us with the necessary technology (for example, cookies, pixels, SDKs) to use these services. Please be aware that although we do not provide personally identifiable information to these partners, we do provide them with some form of identification each time (for example, the advertising ID associated with the device, an identifier associated with a cookie, etc.) If you would like more information about this, please see our Cookies Policy. Similarly, you can reset the ad ID or turn off personalized ads on your device by setting your preferences in the settings section of your device.
• Data enrichment: when we collect your personal data from various sources, we may collect it in certain circumstances in order to improve our understanding of your needs and preferences regarding our products and services (including for the purposes of analytics, user profiling, marketing studies, quality surveys and improving our interactions with our customers). This refers, for example, to how we may combine your information if you have a registered account and, using the same email associated with your account, make a purchase or service as a visitor, or to information collected automatically (such as IP and MAC addresses or metadata) that we may link to information you have provided to us directly through your activity on the Site (for example, information related to a purchase or service, in the course of your activity on the Site).
• Conduct promotions and competitions. By participating in any promotion, you authorize us to process the personal data you have shared with us in accordance with the promotion and to be able to share them through various means such as social networks or the Company itself. In each promotion in which you participate, you will be provided with terms and conditions where we will provide you with more detailed information about the processing of your data.
• Release photos or images that you have shared publicly with the Company or through our social media channels, provided that you have given us your express consent for this purpose.

The above personal data is provided to the Company by you.

Usability and quality analysis to improve our services

If you access our website, we will inform you that we will manage your browsing data for analytical and statistical purposes, i.e. to understand how users interact with our website so that we can improve our services.

In addition, we sometimes conduct quality surveys and activities to know the level of satisfaction of our customers and users and to identify those areas where we can improve.

Provision of third party data

If you provide us with third party personal data, you confirm that you have informed that third party of the purposes and manner in which we are to process their personal data.

If a third party has provided your data to us or if you have provided it to us as a result of a function or service requested by one of our users, we will use it to administer that function or service, in each case within the limits of the purposes set out in this Privacy Policy and Cookies Policy.

SOCIAL MEDIA

If you choose to contact us using social media in order to respond to your requests or to receive information about our services or products, none of the data you provide will be stored by this Website or transferred/processed by any of the third party data processors. Instead, the data will be collated into a message simply to respond to you. To exercise your rights as described in the article "What rights you have in relation to your data and how you can exercise them", do not use social networks and their platforms. To exercise the above rights or for issues related to the processing of your personal data, please submit your request to the Company's Data Controller by physical or electronic mail using the following details:
83, Poseidonos Ave. Postal code: 16675 Glyfada, Attica, Greece, e-mail: info@octana.gr. Some of our social media pages allow users to submit their own content. Remember that any content submitted to one of our social media pages may be viewed by the public and you should be careful about providing certain personal information (e.g. financial information or address details) through these platforms. We are not responsible for any actions taken if you post personal information on one of our social media platforms (e.g. Facebook or Instagram). Please also refer to the respective privacy and cookie policies of the relevant social media platforms you use.

C. Purpose and Legal Basis of Processing

D. Transmission of Data - Recipients

In order for the Company to meet the above mentioned functions and its relevant obligations, the Company communicates the personal data of its customers to categories of persons or entities (recipients). Recipients have access only to as much of your Personal Data as is strictly necessary for the fulfilment of the tasks or the provision of the services they have undertaken vis-à-vis the Company. These categories are as follows:

1. Processors: the Company cooperates with the following processors on its behalf in order to assist it in fulfilling its legal or contractual obligations, which are:

   • accounting service providers
   • providers of computer systems support services
   • hosting and cloud providers
   • providers of product and service promotion services
   • providers of physical security services
   • providers of insurance companies
   • providers related to the transport and delivery of the vessels/services you require
   • travel agents, shipbrokers

   provided that your data is kept confidential.

2. Financial institutions, to the extent necessary for the execution of the transaction
3. Tax, port, and governmental authorities, in accordance with applicable tax or other legislation
4. Lawyers, to the extent necessary to exercise the Company's rights and defend its legal interests
5. Bailiffs, notaries, judicial, prosecutorial and police authorities, as well as auditing authorities, if required by legal provisions or court decisions or upon their legitimate requests in the exercise of their duties.

E. Data Retention Period

In the context of the sending of marketing messages to you by electronic means by the Company, your data are kept for as long as your consent to receive such messages is valid and until its revocation or until the exercise of your right to object.

Your data as a customer of the Company are kept for the entire duration of the respective contract and after its termination or expiration in any way for the period of time defined by the respective legal, tax, accounting framework as required by the applicable legislation and regulations.

If until the expiry of the above time periods, legal proceedings are in progress in which the Company is involved and which concern you directly or indirectly, the time of keeping your data is extended until the issuance of an irrevocable court decision. After the end of the above-mentioned periods, your personal data will be deleted/destroyed.

F. Transfer of Data Outside the E.U.

The Company does not transfer your personal data to third parties outside the European Union unless the conditions of Articles 44-49 GDPR are met and an appropriate check has taken place prior to the transfer. This also applies where our suppliers or service providers to us using equipment or resources located outside the EU process your personal data on our behalf.

Where personal data is transferred to third countries, it will continue to be subject to appropriate safeguards and will be protected in the same way as it would be within the EEA.

The safeguards and assurances we obtain to protect your personal data during transfers to third countries include, inter alia, the adoption of standard contractual clauses of the European Commission in our contracts with data recipients.

G. What Rights You Have Regarding Your Data and How You Can Exercise them

As data subjects, you have a number of rights, in accordance with the provisions of Articles 15-22 of the GDPR, in relation to your personal data processed by the Company.

We are committed to respecting the confidentiality of your personal data and to ensuring that you can exercise your rights at no cost by making a request to the Company's Data Controller managment@octana.gr. Where we consider it necessary to confirm your identity, we may request a copy of a document proving your identity.

The table below sets out your rights by purpose of processing. In this table you will find detailed information (meaning, method) on how to exercise each right.

If you wish to exercise a right, do not use social networks and their platforms. To exercise your rights below or for issues related to the processing of your personal data, please submit your request, using our specially designed forms, at any of our stores or you can address your request in writing to the Company's Data Controller by physical or electronic mail using the following details: 83, Poseidonos Ave. Post code: 16675 Glyfada, Attica, Greece, e-mail: info@octana.gr. Please note that in case of reasonable doubt as to the identity of the data subject, we may request additional information to confirm the identity.

Please note that the Company has the right in any event to partially or fully refuse to comply with your request to restrict the processing or erasure of your data, if the processing or retention of your personal data is necessary for the establishment, exercise or support of its legitimate rights or the fulfilment of its legal obligations.

The Company must reply to your request within one month of receipt. This time limit may be extended by a further two months, if necessary at the discretion of the Company, taking into account the complexity of the request and the number of requests, in which case the Company will inform you within one month of receipt of the extension in question and of the reasons for the delay.

If the Company does not act on your request in the exercise of the above rights or following its reply, you consider that the aforementioned rights have been infringed, you have the possibility to file a complaint to the Hellenic Data Protection Authority, 1-3 Kifissias Avenue, 115 23, Athens, https://www.dpa.gr/, tel. 2106475600.

For any matter relating to the protection of your personal data, please contact the Company's Data Controller by physical or electronic mail using the following details: 83, Poseidonos Ave. Postal code: 16675, Glyfada, Attica, Greece, e-mail: info@octana.gr.

H. CHANGES IN PRIVACY AND COOKIE POLICY

We may modify the information contained in this Privacy and Cookies Policy when we deem it necessary or when required by changes in the legal framework. In any case, we suggest that you check this Privacy and Cookies Policy from time to time in case we make changes or introduce an interactive improvement, taking advantage of the possibility that you will always find it as a permanent information point on the Website so that you can check the changes, evaluate them and, where applicable, oppose or unsubscribe from a service or function.

This Privacy Policy has been drafted in accordance with the provisions of the General Data Protection Regulation (EU GDPR) No. 2016/679/EU. In any case, the Company reserves the right to change the Privacy Policy, in accordance with the relevant legal framework in force at the time. Accordingly, these privacy terms may be revised and updated at any time and without notice. Users of our website and our customers are kindly requested to check these terms periodically for any changes, as their continued use of the website implies their acceptance of all possible amendments thereto.