The public benefit and non-profit organisation (governed by private law) with the name “Thessaloniki Film Festival” (hereinafter “TFF”) supervised by the Ministry of Culture, with registered offices in the “OLYMPION” building, 10 Aristotelous Square, Thessaloniki, taking into serious consideration the fundamental right of natural persons – users regarding the processing of their personal data and the necessary protection thereof, undertakes to protect your personal data as specified in the European Union Regulation 2016/679 – hereinafter “the GDPR”.
- Data Controller
The data controller of your data is the public benefit and non-profit organisation (governed by private law) with the name “Thessaloniki Film Festival” (“TFF”), with registered offices in the “OLYMPION” building, 10 Aristotelous Square, Thessaloniki and offices in Athens, 7 Dionisiou Areopagitou St. (ZIP: 11742).
1. What is processing of personal data of a natural person?
Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
The procession of personal data is performed in the context of the TFF’s activities, provided that the processing activities are related to the provision of goods or services to said data subjects, whether payment by the data subjects is required or not. The right to the protection of personal data is not an absolute right; it must be considered in relation to its function in society and be balanced against other fundamental rights, in accordance with the principle of proportionality.
The TFF processes and stores files with the personal information of the data subjects, for financial, fiscal, accounting, archiving and communication purposes, pursuant to the provisions of article 5 of the GDPR. In the context of continuous improvement of its services and information, it may process for statistical purposes, applying strict confidentiality terms, part or all the data that the data subjects have submitted. The TFF keeps a physical or electronic record of its processing. The same record is kept by the data processor performing the processing on behalf of the TFF.
Minors may access the website and the services of the TFF with the consent of their parents or legal guardians, otherwise all relevant information provided by minors without said consent will be deleted.
2. How is your personal data collected?
The TFF collects information directly from you when you access its services, either in person or electronically by means of its databases. Furthermore, it collects data from publicly available sources, when required (websites, public telephone directories etc.).
The specific personal data requested in our various forms, is determined by your relationship with us, the purpose you are accessing our website and required for the fulfillment of the purposes for which the TFF requests said information. This means that if you do not provide your personal data or submit it incorrectly, we are not able to fulfill said purposes.
The TFF, depending on its relationship with you, the request you have submitted in the form/forms you fill and your capacity, creates lists/files where it records you and will request exclusively the personal data necessary for each list. Optionally, the data subjects may provide additional information, if they wish. For certain functions and if required by law, it will be necessary to disclose your age to us.
Certain applications/forms do not require all the aforementioned information (e.g. electronic ticket buyers that are required to provide full name, e-mail, telephone).
Said data is not published, is accessible only to the data processors on behalf of the TFF and is disclosed only for lawful purposes, always in accordance with the provisions of the GDPR. The data subjects are responsible for the accuracy and authenticity of the data they submit.
3. Which personal data do we process?
The personal data processed by the TFF is determined by the request and form/forms filled by the data subjects, providing their consent and simultaneously determining their relationship with use.
The following data may be submitted to processing, as appropriate: full name, date of birth, country, address, e-mail, telephone number, nationality, gender, photograph, ID or passport number, digital signature, education information, etc, which is provided directly by you when you use the functions of the TFF website, including the data of the browser or the requests to use the services provided in the Website (e.g. by filling the various forms of the TFF for the submission of participation applications in invitations, contests or other activities and initiatives or by filling contact forms, submitting questions, etc.).
4. Why do we process your personal data?
Below you will find a brief review of the purposes for which the TFF, with your consent, process your personal data, depending on the form you filled and your request. In particular:
- For the communication, via newsletter, of the purposes, the activities and the services of the TFF, the schedules of the events and film screenings in the cinemas it operates.
- In order to be able to process your registration, the requests and reports received through its website, allowing the processing to fulfill your request and the purposes for which your data has been collected.
- For the fulfillment of obligations deriving from laws, regulations and European Union law. The lawful basis for processing is provided by article 6 paragraph 1 of the GDPR.
Your usual personal data, only with your consent, may also be used in the official publications of the TFF for your information with various means of communication (e.g. by mail, telephone, fax, e-mail, etc.). The lawful basis for this purpose is article 6 paragraph 1 point a) of the GDPR.
During the processing of your personal data we ensure their full protection and confidentiality and we use all the required technical and organizational means and policies. The TFF may process your usual and sensitive personal data should it need to defend its rights before any court and in any legal procedure in general.
Furthermore, by registering in the TFF website you may participate:
- In electronic commerce activities, with your explicit and informed consent, providing payment services for the goods and/or services you purchased, using payment gateways established for this purpose.
- In the purchase of Electronic Tickets, through third party platforms.
In particular, for the purchase of tickets for cinema screenings using third party electronic platforms, your will be requested to provide basic personal data necessary for the electronic reservation of tickets. The lawful basis for the processing of said data is the informal but free contract concluded between the TFF and the customer for the provision of cinema services.
Furthermore, it may collect data in other cases for your information needs, about which you will be promptly informed at the moment of collection thereof, ensuring the lawfulness of the processing by complying with the principles of lawfulness, fairness, transparency, accuracy, integrity, confidentiality, data minimization and purpose limitation.
5. Lawful basis for data processing
The TFF will process your personal data with your explicit consent, always in accordance with the GDPR requirements and regarding the purpose specified in the form you have filled. However, if you subsequently wish to withdraw your consent to any data processing, this will not affect the lawfulness of the processing already performed by TFF, or of any subsequent processing required for other lawful procedures in accordance with the GDPR.
6. What are your rights?
7. How and for how long do we store your data?
TFF stores your persona data exclusively in accordance with the definitions of article 5 par. 1 c’ and e’ of the GDPR, i.e. their storage is limited to what is necessary in relation to the purposes for which they are processed and for no longer than is necessary for the specific purposes declared with the relevant request/form filled by the data subject. After the fulfillment of the relevant purpose, TFF will erase your personal data. Furthermore, exceptionally your personal data may be stored for longer periods, provided that you did not request their erasure, for archiving purposes in the public interest, for statistical purposes as well as for the period required for the fulfillments of our relevant legal and fiscal obligations. In any case, the criterion used for the determination of the storage period is based on the compliance with the deadlines allowed and/or imposed in some cases by the law or the Authorities. The personal data that you made available to us must be accurate and in case of changes you, as the data subject, must ensure that we are promptly informed in order to erase or rectify it.
It is noted that you have the right to request the erasure of information, as mentioned above, except in certain cases where TFF is obligated to preserve the information (indicatively for archiving, fiscal, insurance or accounting purposes).
8. Data recipients
TFF does not transfer or transmit your personal data to third parties within or outside the European Union or the European Economic Area, in any manner whatsoever, except in the following cases:
a. To Public Authorities, following relevant order or when provided/required by applicable legislation (lawful purposes).
b. If we believe that the disclosure is necessary to prevent personal injury or financial loss or for the investigation of suspicious or unlawful conduct.
c. To third parties, when required for the purposes for which it was collected, e.g. to credit card companies, banks, natural and legal persons, which will be transmitted your personal data and payment method details, if required for the processing of transactions related to registrations or to third parties that have agreements with TFF for the provision of services to its visitors (e.g. arranging accommodation / transportation on behalf of the data subjects, etc.) and other purchases made by the data subject.
d. To the personnel and trusted third parties that provide assistance for the operation of the entity, provided that said parties agree to maintain said information strictly confidential.
TFF implements and applies appropriate technical and organizational measures and policies in order to protect your personal data from risk of loss or erroneous processing, in full compliance with the provisions of the European General Data Protection Regulation (GDPR). Furthermore, we request from our service providers to comply with the strict requirements for the security of your personal data. In case of breach of your personal data, TFF will promptly inform you in accordance with the definitions of the Regulation.
12. Browsing data
If you simply browse the website, without sending a message, the processing of your data is limited to the browsing data, i.e. the data that must be sent to the website for the operation of the computers on which the website runs and the Interned protocols.
TFF collects this and other data, such as the number of visits and the time spent on the website, exclusively for statistical reasons and anonymously, in order to monitor its operation and improve its performance. Said data is not collected in order to be associated with other user related information and in no case whatsoever to identify users. Browsing data is usually deleted after being anonymously processed, but may be stored and used by TFF for the detection and identification of the perpetrators of computer crimes committed against or using the website.
13. Persons that have access to the data
Persons belonging to the following categories are authorized to process user data, i.e. technical and management personnel, product managers, as well as other staff members that must process the data for the performance of their duties. Persons that provide technical services for the data controller and the Data Protection Officer (DPO) also have access, exclusively for the purposes of their duties.
Regarding the transfer of data outside the EU, any transfers will be made in accordance with the GDPR and the data may be disclosed to authorities, public entities for institutional reasons, as well as to third parties and service providers that provide to TFF the technologies required for the above mentioned purposes and for supporting TFF to provide the services you requested. The aforementioned recipients receive only the data required for the respective operations and duly undertake to process it only for the aforementioned purposes and in accordance with personal data protection laws.
14. Where can you submit your questions or complaints?
Furthermore, you can always contact the competent Data Protection Authority.