Privacy Notice

We, “ARIONA HELLAS CULTURAL, TECHNICAL AND CONSTRUCTIONAL SOCIETE ANONYME” and distinctive title “ARIONA S.A.” (G.E.MI. no: 1220017010000) with registered seat in Athens, Greece (2 Galaxia Str. & Evridamantos Str.) acting as representative in Greece of Onassis Foundation (hereinafter “we” or “the Company”), are the Data Controller of your personal data, during your visit to our website and use of other services. We are committed to respecting and protecting the privacy of our website visitors and users of our services and we are obligated to inform you in a transparent way of the respective processing of your data.

We reserve the right to amend and update this Notice whenever necessary. If there are any changes to this Notice, we will upload the new document on the website. Therefore, we recommend that you carefully read this Privacy Notice and check our webpage periodically.

The protection of your personal data is subject to the relevant provisions of the applicable European legislation (mainly EU General Data Protection Regulation 2016/679) and respective Greek law for the protection of the individuals from the processing of personal data, as supplemented by decisions of the competent supervisory authorities.

1. Does this apply to me?

The information provided in the following paragraphs refers to the processing of personal data with respect to services and features provided through our website Onassis.org, as well as with respect to purchasing tickets for the Onassis Stegi cultural events, online through tickets.onassis.org or via phone at +302130178000 (hereinafter the “Services”).

For more specific information on other occasions where your personal data is processed by the Company or by other Onassis Group companies, please refer to the respective privacy notices, as available along with each specific announcement.

Please do not use our Services if you are younger than 15 years old.

2. What personal data we process

In the context of the Services, we collect and further process the following categories of personal data:

A. When booking a ticket for Onassis Stegi events or creating an account

• Basic information (such as name, surname, account password)
• Contact details (such as postal address, mobile and landline phone number, email address, preferred means of contact, preferred language of contact)
• Other information relating to ticket purchasing through our website (such as order history, ticket type, location of ticket purchase)
• Payment details regarding ticket purchase (such as credit/debit card details)
• Voice recording of the transaction concluded, when purchasing tickets via phone

B. When receiving newsletters

• Contact details (email address, preferred language of contact)
• Optional information for receiving personalized communications (such as date of birth, sex, profession, preferences of art in relation to our events e.g. as dance, theater, movies)

C. When using other features and services through Onassis.org

• Contact details and other information that may be provided by you -regarding a scholarship, grant, job offering, expression of interest for educational/cultural activities, or any other request and query- via any Company’s email addresses indicated at Onassis.org for such communication.
• In certain cases, we also collect automatically technical information that does not directly identify you, such as browser type, PC operation system, domain name of the webpage from which the connection was made, location and other information arising from the use of website cookies (such as IP address, web content viewed etc.). For more detailed information on the use of cookies on our website, please refer to our Cookie Policy.

D. When recognized as an art creator, prize winner, member of the Board of Directors or other, at the Onassis.org website or our digital media channels

• Identification information (such as name, surname, position/field of expertise)
• Basic biographical information and professional footprint
• Picture
• Any prizes, recognitions received or productions participated

3. How and why we process your personal data?

We will process the personal information that you provide us with in the context of the Services and depending on the case, under the following lawful grounds and purposes:

1. Contract

To provide our services to you and specifically in order to enable you to register as an account holder or as an Onassis Friend or to book a ticket for an event online or via phone. In this case, we act because of our contractual relationship by which you will be granted access to and use our offered services and we will accommodate any related request you may have. Moreover, based on any contractual agreement for collaboration we have with you (such as in cultural productions, scholarships, grants, prizes etc.), we will process your personal data in order to fulfill such a contract, including by publicizing limited details on you at Onassis.org or our other digital media channels.

In cases where you submit us your CV and related professional information about yourself, we will process such information to evaluate your application and apply our hiring policy. Should you be selected for a job opening, we will maintain this information in the context of our employment relationship as we do for our personnel.

1. Legitimate interest

It is in our legitimate interests to process personal data of ticket purchasers or other closely related contacts of the Company (including journalists), for notifying them on relevant news and events they may be interested in. Moreover, we process personal data in order to ensure website and transactional security and proper operation, to back-up data and to safeguard business continuity. It is also in our legitimate interests to process your personal data to develop and optimize our services, by contacting you to conduct surveys on your feedback for our events and performances.

1. Consent

In case you need to disclose to us some health condition such as allergy, disability etc., as necessary in the context of your participation in a cultural/educational activity, we will request your explicit consent (Art. 9.2.a GDPR) for doing so. You may withdraw such consent by contacting us.

Following your specific consent as a plain website visitor by clicking at the respective option on the website or as a social media follower by enabling the respective functionality, we can enlist you in our newsletter subscribers list, should you wish so. We will maintain your basic contact details (email address, social media profile) in order to send you information on our coming events and actions to which you are interested. You may withdraw such consent at any time by clicking “unsubscribe” at the bottom of each communication received or by disabling the relevant social media feature.

Following your specific consent and in accordance with your selection of choices while entering our website, we will process your personal data collected through cookies and similar technologies, in order to improve your experience on our website, to analyze website use and to pursue advertisement activities. You may withdraw such consent and find more detailed information on the use of cookies on our website, in our Cookie Policy.

4. How long will we keep your information?

We will keep the information that you provide us with only for the time necessary for us to achieve the above purposes or for as long as we are required by law. Such time may differ depending on the particular use e.g. your email that you gave in order to receive newsletters for us will be kept until you submit an opt out or consent withdrawal request and provided that we are not required to keep it for any other purpose (e.g. in order to administer your website account).

5. Who has access to your data and how is this access secured?

Any information processed in the context of the Services will be kept by our authorized personnel.

Moreover, in order to ensure optimum provision of services and operations and in accordance with the applicable legislation on the protection of personal data, the recipients of your personal data may be the following:

• Website technical operators and social media management companies
• Promoters of our Services, survey conducting companies, marketing communications platform providers such as SendGrid, Campaign Monitor, WuFoo, και JotForm. Your personal data will be transferred outside the EU/EEA by these companies and specifically to the USA. International data transfer measures are in place, including Standard Contractual Clauses.
• The Onassis Stegi back-office tickets provider
• Educational/cultural program co-organizers
• External consultants or other industry experts
• other Onassis Group companies
• any social media or digital platform provider, including Google, Facebook, Twitter, when you use their forms or embedded services. Your personal data will be transferred outside the EU/EEA by these companies and specifically to the USA. International data transfer measures are in place, including Standard Contractual Clauses.
• as well as any other administrative, judicial or public authority or generally any legal or natural person to whom, by law or court decision, the Company may be obliged or has a right to disclose such data.

Please refer to our Cookie Policy (hyperlink) for a complete list of all companies that may have access to data collected through cookies while browsing the website.

The safety of your information is of utmost importance to us. We try to be always up-to-date in respect of digital transformations and adopt technical and organizational measures that ensure, to the extent possible, the smooth operation of our website and the protection of the integrity, confidentiality and availability of any information transmitted through this channel. Nonetheless, we encourage you to review the website Terms and Conditions referring to the matters over which we do not have control and cannot guarantee, such as, the way you enter and use the website.

6. What rights do you have?

You are entitled to the following rights in relation to your personal data:

• The right to request access to your data that we keep and receive a copy of your data
• The right to request rectification of inaccurate or incomplete data that we maintain related to you
• The right to request the erasure of your data that we are no longer entitled to keep
• The right to object to the processing of your data that is based on our legitimate interest
• The right to request the restriction of processing
• The right to data portability, i.e. to request that we provide you or another controller with your personal data in a structured, easily readable format (e.g. USB)
• The right to revoke your previously given consent, where the processing is based on your consent

If you exercise any such right, we will undertake all necessary measures to address the request within 1 month or up to 2 additional months if the perplexity of request or total number of requests received so requires. We will notify you in writing of the satisfaction of the request, or alternatively of the reasons that prevent us from satisfying such request. Please keep in mind that exercise of the above rights is subject to certain requirements and limitations set by law e.g. we may not be able to address a request if we don’t receive identification details necessary to protect your data and confirm that it’s you who makes a request, or delete information that we may be obligated to keep in order to comply with an obligation or to pursue our legitimate interest.

7. Contact

To exercise your above-mentioned rights regarding the processing of your data in the context of the Services, please send an e-mail to the ARIONA S.A. Data Protection Officer at the following email address: gdpr@onassis.org .

Lastly, in case you feel your personal data protection has been violated in any way, you are entitled to file a complaint with the Greek Data Protection Authority, by using the following contact details: www.dpa.gr | 1-3 Kifissias Ave., Athens 115 23 | +30 210 6475600 | Fax: +30 210 6475628 | complaints@dpa.gr