image
in Greek
in Greek

Privacy Policy



Personal Data Protection Policy

State Theatre of Northern Greece



The following information relates to the protection of your Personal Data and explains the means and ways in which the NTNG processes your personal information (data) when you communicate with it, when you use any of the Theatre's services (e.g. browsing) including the use of electronic means (internet services), as well as when you contract or transact (also by electronic means) with it. The purposes for which your personal data is processed, and the security measures taken to protect such data, are also listed. In addition, this document can inform you of your rights and who you can contact to exercise them.




 





1.- The NTNG as a Data Controller

The NTNG is a non-profit Legal Entity governed by Private Law which operates in the public interest and seeks to develop, promote and disseminate the art of theatre as a cultural, educational and recreational element in the social life of Northern Greece and the country as a whole. The NTNG is obliged to comply with the requirements of the General Data Protection Regulation (GDPR) (EU) 2016/679 as well as with national provisions, such as those laid down in Law 4624/2019, but also with the decisions and instructions of the Personal Data Protection Authority, with a view to keeping your personal data secure and limiting the processing of your data to what is legally necessary, respecting the principles of data confidentiality, integrity and availability.

When any processing of your personal data occurs, including such processing as occurs when you simply browse the NTNG websites (ntng.gr, on.ntng.gr), the Data Controller is: the "National Theatre of Northern Greece", Ethnikis Amynis 2, 546 21, Thessaloniki, tel. 2315 200200 Email: [email protected]


2.- The processing of personal data by the NTNG

According to Article 4(1) of the GDPR, 'personal data' is defined as any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one whose identity can be established, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to physical, physiological, genetic, psychological, economic, cultural or social identity;

Article 4(2) of the GDPR defines 'processing' as any operation or set of operations which is performed, whether or not by automated means, on personal data or on sets of personal data. Such operations include collection, recording, organizing, structuring, storing, adapting or altering, retrieving, consulting, using and disclosing—by transmission, dissemination or otherwise making available—, aligning or combining, restricting, erasing or destroying,

The NTNG ensures that it processes only such personal data as is strictly necessary, which is appropriate, accurate and relevant to the legitimate purpose for which it is intended, following the principles governing the processing of personal data laid out in Article 5 of the GDPR. Depending on the activity being performed, the NTNG processes the necessary personal data in an appropriate way (by automated or non-automated means) for the following legitimate reasons:
 
1) To fulfil a contractual obligation: The NTNG processes your personal data in order to undertake and fulfil all kinds of contractual obligations, such as those arising from employment contracts, procurement, the booking and purchase of tickets and/or other services, such as audience service. Related to this purpose is the obligation to comply with statutory obligations (e.g. notifying the public authorities of contracts concluded, fulfilling social security obligations, issuing tax documents, or providing discounts as these are provided for by law), but also at times the need to respond, file or support legal claims related to these obligations.

2) To communicate/submit a request or complaint: The NTNG processes your personal data in order to respond to the requests/queries, and/or any complaints, you submit. This is either to fulfil contractual obligations or to comply with legal obligations, in particular to respond to requests you submit to us.

3) To send you a newsletter, if you have requested it: With your consent, which you can revoke at any time without prejudice and without justification, the NTNG e-mails out informative content about its current activities, such as its performance schedule and latest news.

4) To provide you with access to the NTNG's online services, to ensure that you are safe when using and browsing its website, to prevent accidental or malicious actions or other online attacks/incidents.

5) To establish, exercise or support any legal claims made by the NTNG.

6) For archiving in the public interest or for academic or historical research or statistical purposes, in line with the terms laid down by law and subject to appropriate safeguards being in place to ensure the fundamental rights of the data subjects.

7) To subscribe to electronic services other than newsletters via the website (e.g. participation in a competition) with your consent, which you can withdraw at any time without prejudice and without justification.

8) To register online/electronically for events or seminars or, generally, for public presentations (apart from those for employees, students, etc.), given that you have requested it. In this case, too, you can withdraw your consent at any time without prejudice and without justification.

9) To record telephone calls for telecommunications security purposes. The NTNG uses caller ID.

10) To receive biographical data via email for an (artistic) personnel selection procedure.

11) To register journalists/sponsors by email on a list of recipients of press releases relating to the activities of the NTNG.



3.- Personal data collected in accordance with the stated purpose

1) To conclude employment, project, service and supply contracts: identification and contact details, professional status, tax and social security details, bank details, family status and health details, where required by law.

2) To conclude a contract for the sale/reservation of tickets: full name, contact details (email address, telephone number), only through until the performance, in case of cancellation. This data, along with bank details required to make the payment (debit, credit or prepaid card) or tax data for the issuing of an invoice, if requested, are collected by the company "VIVA Electronic Services SA", which the Theatre has contracted, with special terms relating to the protection of personal data for the purpose of buying/reserving tickets.

3) To subscribe to the newsletter/participate in a contest/events/press releases/communication-requested correspondence: full name, contact details (e-mail address).

4) Data you provide when you register with the Supporters of the NTNG VIP CLUB: full name, contact details. Bank details for executing the payment are collected by the company "VIVA Electronic Services S.A.", with which the National Theatre of Greece has contracted with special terms for the protection of personal data for this purpose.

5) NTNG website traffic data: such as, for instance, the IP address of the user/visitor. The data is recorded in a log file for each request on the NTNG website server.

6) For archiving purposes in the public interest and for maintaining historical records, audiovisual, image and sound archives of artistic performances, including photographs, posters and images in general, as well as biographical data on the artists, which may contain personal data, are kept under the terms of the GDPR and the law, with a view to preserving and disseminating cultural heritage.



4.- Legal basis for the processing of personal data

The processing of your personal data by the NTNG is based on one of the following legal bases:
 
1) On your consent (Article 6(1a) of the GDPR), where required for the specific purposes mentioned above (e.g. sending a newsletter/responding to a requested communication/correspondence).

2) In order to fulfil the obligations arising for the NTNG from the performance of a contract to which you as the data subject are party, or to take measures prior to the conclusion of a contract with you (Article 6(1b) of the GDPR) (e.g. employment contracts, supply contracts, project contracts, ticket reservations/sales, collection and processing of CVs through to final recruitment, etc.).

3) The NTNG's compliance with a legal obligation (Article 6(1c) GDPR) (e.g. tax and social security legislation).

4) The performance of a duty performed in the public interest (Article 2 Law 2273/1994, Article 6(1f) of the GDPR, Article 5 of Law 4624/2019) (archiving of cultural material, keeping of historical records).

5) Overriding legitimate interest (when the NTNG is acting as a private entity) (Article 6(1f) of the GDPR). (e.g. to check the traffic on its website)

6) In the context of the above, processing may sometimes be necessary for establishing, exercising or maintaining legal claims, even if this involves the processing of special categories of data (Article 9(2f) GDPR.


5.- Access to your personal data for NTNG staff

Access to your personal data is only available to competent NTNG personnel, and primarily to those staff members who belong to the Administrative and Financial Department, who are bound to maintain the confidentiality and privacy of the information which comes to their attention during the performance of their duties. Occasionally, your personal data may be transmitted to the NTNG's legal representatives for the purpose of establishing, exercising or supporting claims made by the Theatre.


6.- Disclosure and transmission of data from the NTNG to third parties

The NTNG does not disclose or transmit personal data to third parties, except to fulfil the purposes stated herein or if it is obliged to do so by a mandatory provision of law (e.g. transmissions to public authorities), or by a court decision or by an order to that effect issued by a public and independent police / judicial / investigative / prosecutorial / supervisory authority in the context of the exercise of its duties. The NTNG does not transmit your personal data to third countries outside the EU, with the exception of e-mail address data required for sending the Theatre's newsletter, where the services of the company "The Rocket Science Group LLC d/b/a MailChimp" are used, which implements policies compliant with the European General Data Protection Regulation (Regulation 2016/679/EU), having included in its terms of use the pre-written contractual clauses issued by the European Commission. Nor does the NTNG disclose your personal data to third parties for the purpose of advertising or the commercial promotion of products or services. In the context of the preservation and dissemination

of cultural heritage, the NTNG may transmit to third European cultural institutions (e.g. EUROPEANA) files of artistic content that may contain personal data, in compliance with the terms and conditions of article 89 of the GDPR and articles 29 and 30 of Law No. 4624/2019.

The NTNG uses external partners (processors) for certain processing tasks, specifically the provision of payroll, ticketing, infrastructure security and website operation services, for the requisite processing of payment data, personal and property security, website hosting, management and maintenance, email distribution, research and analysis, as well as the management of certain web services. To this end, the NTNG, as data controller, will ensure that all processors act in accordance with its instructions and orders when processing data on its behalf, and for the precise purposes it has specified. To this end, it has concluded contracts with them, which have been submitted in printed form, in full compliance with the provisions of Article 28 of the GDPR. The processors have fully accepted the relevant confidentiality clauses and have committed themselves in writing to the obligation to take appropriate technical and organisational measures to protect the personal data transmitted to them. In addition, when using the services of this website in the context of your registration as a user of the services it offers (e.g. contact form), your data is stored on servers belonging to Interworks.cloud within Greece and is not transmitted abroad; Interworks.cloud has undertaken to manage this website through the implementation of appropriate technical and organizational measures. Access to this data may be granted to the competent authorised personnel of the company concerned, if this is necessary for the provision of technical support to the system.


7.-Storage/retention time for personal data

The NTNG will retain your Personal Data for as long as is required to fulfil the purposes set out in this Privacy Policy (unless a longer retention period is required by the applicable legislation). The length of storage thus varies depending on the nature of the processing involved In the specific case of sending newsletters, your personal data is deleted immediately when you choose to unsubscribe from this service, thereby withdrawing your consent, so you receive no more informative material in the future. The data collected in the context of fulfilling contractual obligations is retained for as long as required by the applicable legislation (e.g. tax, social security), and in any case not for longer than the limitation period for claims provided for in the relevant provisions of the Civil Code (CC 249 et seq.). For the data collected during your visit

and use of our website, the retention period does not exceed 12 months, after which it is deleted. The information you provide us with when you fill out a contact form is both anonymized and deleted every twelve months. Finally, the archives of the National Theatre of Greece, in which personal data may be stored, may fall under the concept of public records, in which case the provisions of PD 480/1995 and Law 4610/2019 apply.


8.- Measures taken to keep your personal data secure

To ensure the confidentiality, integrity and availability of your personal data, acting in compliance with the GDPR, we take every appropriate organisational and technical measure to prevent any form of accidental or unlawful processing. We adopt and implement data privacy policies and update our security procedures, with technical and physical restrictions on the access and use of your personal data on our server. We also carry out network security audits, and use appropriate equipment and firewall software. These measures are reviewed and amended when and where necessary.

All NTNG employees responsible for personal data processing are both familiar with this privacy policy and our philosophy of processing personal data safely and lawfully, and are bound by it as well as by contractual confidentiality clauses.


9.- Your rights in relation to your personal data

In accordance with the legislation on the protection of personal data (GDPR, Law 4624/2019), you have the following rights:
 
1) Right to Information/Transparency: you can know, among other things, who is processing your personal data, the type of your personal data that is being processed, the purpose of the processing, and the legal basis on which this processing is based.

2) Right of access to your personal data: you can request at any time, and without charge, access to personal data of yours held by the NTNG and the provision of a copy.

3) Right to have inaccurate personal data rectified: you can request the correction of inaccurate data (e.g. correction of your name), the completion of incomplete data, or the updating of data (e.g. a change of address).

4) Right to erasure/Right to be forgotten: you may, under the terms of the law and individual provisions of the GDPR, request the deletion of your data when, for example, your data is no longer necessary for the above-mentioned purposes, or when you wish to withdraw your consent.

5) Right to portability of your data: if we process your data on the basis of your prior consent, or for the concluding and execution of a contract, and this processing is automated, you can request us to transfer the data you have provided to us to someone else.

6) Right to restrict processing: you may, under the terms of the law and individual provisions of the GDPR, request that we temporarily restrict the processing of your data: for example, when an investigation of your objections to processing are pending.

7) Right to object and withdraw consent to the processing of your personal data: you may, under the terms of the law and individual provisions of the GDPR, object to the processing of your personal data, and we will stop such processing, unless there are other compelling and legitimate reasons that override your right. If you have given your consent to the collection, processing and use of your personal data, you may withdraw your consent at any time, without prejudice and without justification, with future effect.


10- Information on how to exercise your rights

In order to exercise your rights as provided for in the GDPR and Law 4624/2019, or for any other reason relating to the processing of personal data, you can contact us either electronically by email at [email protected] or by writing to the postal address: State Theatre of Northern Greece (NTNG), 2 Ethnikis Amynis, 54621, Thessaloniki and marking it "for the attention of the Data Protection Officer".

The NTNG will reply at no cost to you, without delay, and in any case within one month of receiving your request. This period may be extended to two months for reasons that may relate either to the complexity of the matter or to a large number of requests having been received. The National Theatre of Greece will inform you of any extension of this deadline and the reasons for any possible delay.

If you believe that personal data of yours that we are processing has been compromised in any way, you can contact the Hellenic Data Protection Authority (HDPA, www.dpa.gr) and make a complaint. Specifically, you can submit the complaint form to the HDPA online via the its web portal by completing the online form that corresponds to the type of complaint you want to make, as explained in more detail at the above link. Alternatively, if this is not possible, you can lodge a complaint with the HDPA in the following ways:
 
· Electronically, by sending an email to [email protected].

· By post to the Authority's offices: Personal Data Protection Authority, 1–3 Kifissias Avenue, 115 23 Athens.

· In person at the Authority’s offices (1st floor). Opening hours: 09:00—13:00 More information can be found here


11.- Updates and amendments to this Policy

The NTNG ensures this Policy is regularly reviewed and revised so that it remains up-to-date and accurate at all times. The Policy posted on our website (www.ntng.gr) will always be the updated version. We encourage you to review this Policy to ensure that you agree with any amendments and updates.

The NTNG retains the copyright for this document, and third parties are prohibited from reproducing it, publishing it on the internet, or using any or all of it in any way.