Privacy Policy

The following information relates to the protection of your Personal Data and explains the means and ways in which the NTNG processes your personal information (data) when you communicate with it, when you use any of the Theatre's services (e.g. browsing) including the use of electronic means (internet services), as well as when you contract or transact (also by electronic means) with it. The purposes for which your personal data is processed, and the security measures taken to protect such data, are also listed. In addition, this document can inform you of your rights and who you can contact to exercise them.  


Contents

1.-  The NTNG as a Data Controller 

The NTNG is a non-profit Legal Entity governed by Private Law which operates in the public interest and seeks to develop, promote and disseminate of art of theatre as a cultural, educational, and recreational element in the social life of Northern Greece and the whole country. The NTNG is obliged to comply with the requirements of the General Data Protection Regulation (GDPR) (EU) 2016/679 as well as with the national provisions, such as those laid down in Law 4624/2019, but also with the decisions and instructions of the Personal Data Protection Authority, with a view to keeping your personal data secure and limiting the processing of your data to what is legally necessary, respecting the principles of data confidentiality, integrity and availability.
When any processing of your personal data occurs, including such processing as occurs when you simply browse the NTNG's websites (ntng.gr, on.ntng.gr), the Data Controller is: the "National Theatre of Northern Greece", Ethnikis Amynis 2, 546 21, Thessaloniki, tel. 2315 200200 | Email: [email protected] 



2.- The processing of personal data by the NTNG 

According to Article 4 para. 1 of the GDPR, 'personal data' is defined as any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one whose identity can be established, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to physical, physiological, genetic, psychological, economic, cultural or social identity;

Article 4 para. 2 of the GDPR defines 'processing' as any operation or set of operations which is performed, whether or not by automated means, on personal data or on sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction,

The NTNG ensures that it processes only such personal data that is strictly necessary, which is appropriate, accurate and relevant to the legitimate purpose for which it is intended, following the principles governing the processing of personal data under Article 5 of the GDPR. Depending on the activity being performed the NTNG processes in an appropriate form (by automated or non-automated means) the necessary personal data for the following legitimate reasons:
 

3.- Personal data collected in accordance with the stated purpose 

 

4.- Legal basis for the processing of personal data  

The processing of your personal data by the NTNG is based on one of the following legal bases:  

5.- Access to your personal data for NTNG staff  

Access to your personal data is only available to competent NTNG personnel, and primarily to those staff members who belong to the Administrative and Financial Department, who are bound to maintain the confidentiality and privacy of the information which comes to their attention during the performance of their duties. Occasionally, your personal data may be transmitted to the NTNG's legal representatives for the purpose of establishing, exercising or supporting claims made by the Theatre.  



6.- Disclosure and transmission of data from the NTNG to third parties 

The NTNG does not disclose or transmit personal data to third parties, except to fulfil the purposes stated herein or if it is obliged to do so by a mandatory provision of law (e.g. transmissions to public authorities), or by a court decision or by an order to that effect issued by a public and independent police / judicial / investigative / prosecutorial / supervisory authority in the context of the exercise of their duties. The NTNG does not transmit your personal data to third countries outside the EU, with the exception of e-mail address data for sending the Theatre's newsletter, where the services of the company "The Rocket Science Group LLC d/b/a MailChimp", which implements policies compliant with the European General Data Protection Regulation (Regulation 2016/679/EU), having included in its terms of use the pre-written contractual clauses issued by the European Commission, nor does it disclose your personal data to third parties for the purpose of advertising or the commercial promotion of products or services. In the context of the preservation and dissemination of cultural heritage, the NTNG may transmit to third European cultural institutions (e.g. EUROPEANA) files of artistic content that may contain personal data, in compliance with the terms and conditions of article 89 of the GDPR and articles 29 and 30 of Law No. 4624/2019. 

The NTNG uses external partners (processors) for certain processing tasks, for the provision of payroll, ticketing, infrastructure security and website operation services, for the requisite processing of payment data, personal and property security, website hosting, management and maintenance, email distribution, research and analysis, as well as the management of certain web services. To this end, the NTNG, as data controller, will ensure that all processors act in accordance with its instructions and orders when processing data on its behalf for with the precise purposes it has specified. To this end, it has signed contracts with them which have been submitted in printed form, in full compliance with the provisions of Article 28 of the GDPR. The processors have fully accepted the relevant confidentiality clauses and have committed themselves in writing to the obligation to take appropriate technical and organisational measures to protect the personal data transmitted to them. In addition, when using the services of this website in the context of your registration as a user of the services it offers (e.g. contact form), your data is stored on servers belonging to Interworks.cloud within Greece and is not transmitted abroad; Interworks.cloud has undertaken to manage this website through the implementation of appropriate technical and organizational measures. Access to this data may be granted to the competent authorised personnel of the company concerned, if this is necessary for the provision of technical support to the system.  



7.- Storage/retention time for personal data 

The NTNG will retain your Personal Data for as long as is required to fulfil the purposes set out in this Privacy Policy (unless a longer retention period is required by the applicable legislation). The length of storage thus varies depending on the nature of the processing involved In the specific case of sending newsletters, your personal data is deleted immediately when you choose to unsubscribe from this service, thereby withdrawing your consent, so you receive no more informative material in the future. The data collected in the context of fulfilling contractual obligations is retained until these obligations have been discharged and subsequently for as long as required by the applicable legislation (e.g. tax, social security), and in any case not for longer than the limitation period for claims provided for in the relevant provisions of the Civil Code (CC 249 et seq.). In the case of an unsolicited CV, the CV will be kept for three years. Otherwise, CVs are kept until a decision on recruitment has been taken, at which time they are either returned or destroyed. Information submitted by candidates seeking to enrol in the Drama School is kept until the selection process it completed and the successful candidates chosen. The data of successful candidates is kept until they reach the end of their studies. The register of graduates is retained indefinitely. The personal data of participants in workshops and other educational activities, plus that of their guardians/carers, is kept until the end of the workshop. For the data collected during your visit and use of our website, the retention period does not exceed 12 months, after which it is deleted. The information you provide us with when you fill out a contact form is anonymized and deleted every twelve months. The data of registered users of the Digital Library are deleted every three years. Data recorded by the video surveillance system is kept for less than fifteen (15) days, and is automatically deleted. Finally, the archives of the National Theatre of Greece, in which personal data may be stored, may fall under the concept of public records, in which case the provisions of PD 480/1995 and Law 4610–2019 apply.  



8.- Measures taken to keep your personal data secure 

To ensure the confidentiality, integrity and availability of your personal data, acting in compliance with the GDPR, we take every appropriate organisational and technical measure to prevent any form of accidental or unlawful processing. We adopt and implement data privacy policies and update our security procedures, with technical and physical restrictions on the access and use of your personal data on our server. We also carry out network security audits, and use appropriate equipment and firewall software. These measures are reviewed and amended when and where necessary. 

All NTNG employees responsible for personal data processing are both familiar with this privacy policy, and our philosophy of processing personal data safely and lawfully, and are bound by it as well as by contractual confidentiality clauses.  



9.- Your rights in relation to your personal data 

In accordance with the legislation on the protection of personal data (GDPR, Law 4624/2019), you have the following rights:  

Right to Information/Transparency: you can know, among other things, who is processing your personal data, the type of your personal data that is being processed, the purpose of the processing, and the legal basis on which this processing is based. 

Right of access to your personal data: you can request at any time, and without charge, access to personal data of yours held by the NTNG and the provision of a copy,  

Right to rectification of inaccurate personal data: you can request the correction of inaccurate data (e.g. correction of your name), the completion of incomplete data, or the updating of data (e.g. a change of address). 

Right to erasure/Right to be forgotten: you may, under the terms of the law and individual provisions of the GDPR, request the deletion of your data when, for example, your data is no longer necessary for the above-mentioned purposes, or when you wish to withdraw your consent.  

Right to portability of your data: if we process your data on the basis of your prior consent, or for the signing and execution of a contract, and this processing is automated, you can request us to transfer the data you have provided to us to someone else.  

Right to restrict processing: you may, under the terms of the law and individual provisions of the GDPR, request that we temporarily restrict the processing of your data: for example, when an investigation of your objections to processing are pending.  

Right to object and withdraw consent to the processing of your personal data: you may, under the terms of the law and individual provisions of the GDPR, object to the processing of your personal data, and we will stop such processing, unless there are other compelling and legitimate reasons that override your right. If you have given your consent to the collection, processing and use of your personal data, you may withdraw your consent at any time, without prejudice and without justification, with future effect. 



10- Information on how to exercise your rights 

In order to exercise your rights, as provided for in the GDPR and Law 4624/2019 or for any other reason relating to the processing of personal data, you can contact us either electronically by email at the following address: [email protected] or by writing to the postal address: 

State Theatre of Northern Greece (NTNG)
2 Ethnikis Amynis, 54621
Thessaloniki, and marking it "for the attention of the Data Protection Officer". 

The NTNG will reply at no cost to you, without delay, and in any case within one month of receiving your request. This period may be extended to two months for reasons that may relate either to the complexity of the matter or to a large number of requests received. The National Theatre of Greece will inform you of any extension of this deadline and the reasons for any possible delay.  

If you believe that personal data of yours that we are processing has been compromised in any way, you can contact the Hellenic Data Protection Authority (www.dpa.gr) and make a complaint. Specifically, you can submit the complaint form to the HDPA online via the its web portal by completing the online form that corresponds to the type of complaint you want to make, as explained in more detail at the above link. Alternatively, if this is not possible, you can lodge a complaint with the HDPA in the following ways:

More information can be found here.



11.- Updates and amendments to this Policy 

The NTNG ensures this Policy is regularly reviewed and revised so that it remains up-to-date and accurate at all times. The Policy posted on our website (www.ntng.gr) will always be the updated version. We encourage you to review this Policy to ensure that you agree with any amendments and updates. 

The NTNG retains the copyright for this document, and third parties are prohibited from reproducing it, publishing it on the internet, or using any or all o it in any way.



12.- Privacy Policy for the use of Video Surveillance Systems

The theatre has a video surveillance system which is intended to serve the security of its indoor and outdoor facilities through the use of surveillance cameras pointed at specific parts of its infrastructure. Monitoring takes place in real time both with and without recording taking place and data being transmitted to third parties. This policy sets out to inform you about the system and its features. In the context of this activity, the NTNG is a Data Controller in the sense defined by the General Data Protection Regulation (EU) 679/2016 and Greek Law 4624–2019.

Purpose - Lawful Basis for Data Processing: The video surveillance system is employed solely for collecting image data for the security of persons, facilities and movable property and to prevent or immediately respond to accidents and damage occurring both within the NTNG and in its grounds. The legal basis for the use of such a system is that provided for by Article 6 para. 1(f) of the General Data Protection Regulation. It is noted hereby that this activity on the part of the NTNG does not constitute the exercising of a duty by a public authority.

Legitimate interest analysis: The NTNG's legitimate interest lies in the need to protect persons, with an emphasis on their physical integrity and health, but also to protect facilities, infrastructure, goods and moveable property in general from the risk of destruction, damage or being subject to criminal activities. Weighing this legitimate interest against the interests of third parties in general and data subjects in particular, we have taken appropriate technical and organisational measures to protect the latter and to limit the processing of their data to a minimum. Consequently, the cameras both inside and outside the theatre are installed in fixed locations where there is an increased risk of accidents or criminal behaviour, whether this be breaking and entering, forcing locks, stealing goods and equipment from the theatre, damaging property or committing other criminal offences (e.g. arson). It is noted that inside the theatre itself, cameras have only been installed to monitor the cash registers and cash flows and focus on these points alone. None of the cameras installed outdoors monitor public or private space (e.g. pavements, streets, neighbouring buildings, etc.), and their angle of view does not permit the physical characteristics of passers-by who do not use the NTNG's entrances/exits to be captured. With regard to the cameras possible viewing/recording NTNG employees, our video surveillance is carried out is purely and exclusively to monitor the Theatre's entrances and exits, its cash registers and other areas where money or other valuables are kept, with a view to protecting these facilities and these goods, and not to monitor employees or to evaluate them. There is no video surveillance system installed where a camera would violate the privacy of individuals, and in particular of employees (e.g. there are no cameras in offices, on or behind stages, or in sensitive areas such as changing rooms, toilets, lounges, etc.).

Data retention period: The data are stored for a period of less than 15 days and are then automatically and permanently deleted; retrieval is impossible. Recording data or individual video images (frames) may be retained for longer and up to one month if requested by a judicial, prosecutorial or police authority in the context of a criminal investigation, or in relation to an event which entitled the NTNG to begin legal proceedings in support of claims or legitimate interests. If the incident concerns a third party, the video recording of the incident can be kept for up to three months, if requested.

Recipients-Access: The camera control centre and the recordings made can be accessed by the competent and authorised members of the NTNG's security staff and the security company the NTNG has contracted. The data is not disclosed or transmitted to unauthorised third parties. Exceptionally, the data may be handed over to judicial, prosecutorial or police authorities when these authorities request it in the exercise of their duties in the context of a criminal investigation, or to persons allegedly involved (as either the victim or the perpetrator) in an incident under investigation that may constitute a criminal offence, provided that the data relates to evidence as defined by law.

Rights of data subjects: According to the GDPR, the data subject has the following rights, which are exercised in accordance with the more specific conditions laid down in the provisions of the same Regulation:

For more information on the processing of personal data, you can refer to the Privacy Policy available on our website.

If you have any further questions, or want additional information about this Policy, you can contact us by mail or in person at the National Theatre of Northern Greece, Ethnikis Amynis 2, 546 21, Thessaloniki, by phone on 2315 200 200, or by sending an email to [email protected]

You can also email the NTNG Data Protection Officer at: [email protected]

Right to complain: If you believe that the processing of your data contravenes Regulation (EU) 2016/679, you have the right to lodge a complaint with the supervisory authority, which is the Data Protection Authority. Specifically, you can submit the complaint form to the HDPA online via the its web portal by completing the online form that corresponds to the type of complaint you want to make, as explained in more detail at the above link. Alternatively, if this is not possible, you can lodge a complaint with the HDPA in the following ways:
 

• Electronically, by sending a mail to the email: [email protected].
• By post to the Authority's offices: Personal Data Protection Authority, 1–3 Kifissias Avenue, 115 23 Athens.
• In person at the Authority’s offices (1st floor). Opening hours: 09:00 – 13:00.

More information can be found here.