The Website compasslemnos.gr, hereinafter the "Website", is managed by the company SKAPETIS ZARIMIS S.A., headquartered in Agios Dimitrios, Lemnos, on the provincial road of Agios Dimitrios - Myrina, P.C. 81400, tel. +302254062505, e-mail: info@compasslemnos.gr, hereinafter the "Company". Personal data—meaning all information that identifies you as a person or can identify you directly or indirectly, which you provide optionally or mandatorily when you enter the website or register for various applications related to services provided by our Company, as well as any additional personal data requested at later stages—are collected, processed, transferred, stored, and used by us, in our capacity as the data controller, as well as by service providers including personal data processors and service providers.

Our Company takes the protection of your privacy and personal data very seriously and has taken all necessary measures to safeguard the security and maintain the confidentiality of the information concerning the visitors/users of its Website.

Please read this Privacy and Personal Data Protection Policy carefully to be informed about the information collected from you when you visit the Website and use its online services, the information posted on it, its use, as well as your rights. These terms may be improved, updated, or in any way completely or partially modified at any time.

This Policy serves as a notification to data subjects, in accordance with Articles 13-14 of the EU General Data Protection Regulation (GDPR) 679/2016. If you have any questions regarding this Policy and, in general, the way our Company collects and processes your personal data, please contact us at info@compasslemnos.gr.

WHAT INFORMATION OUR WEBSITE COLLECTS

1. Information collected automatically during your visit and interaction with our Website

Our Website contains informational content about the provided services and actions of our Company. Every time you visit the Website and/or use its applications, our Company, as its administrator, may collect and use data concerning you. A part of this data is necessary for you to access the Website and the services it provides.

Specifically, simply by visiting and browsing the website, certain information that can identify you directly or indirectly may be collected automatically, such as:

• the Internet Protocol (IP) address of your computer,

• the type of browser and the operating system,

• the web pages you visited immediately before and after your visit to the page,

• the connection speed and information about the software programs installed on the computer,

• basic server connection information, and

• information collected through HTML cookies, Flash cookies, web beacons, and other similar technologies (see Cookies Policy https://compasslemnos.gr/cookies-policy/). 

• Regarding the information automatically collected from your browsing on our Website, please refrain from visiting it if you do not wish for this information to be collected and processed.

2. Information you provide directly to us:

A. Car rental In the context of providing our services, i.e., the reservation and rental of passenger vehicles to you, you enter the following personal data on our website:

• Identification data: first name, last name, date and place of birth, gender, ID/passport number, country, driving license.

• Contact information: email address, home address and postal code, mobile phone number, flight number (optional).

• Payment details: bank account number (IBAN) and beneficiary name.

Our website provides the option to pay via bank card and retains debit/credit card details, i.e., card number, beneficiary name, expiration date. Furthermore, the charges and amounts paid are retained.

Please be informed that the commitment of your reservation is made by depositing the advance payment into a bank account or by paying it with a bank card through our website. Regarding the payment of the remaining amount, it is possible from the beginning to pay in full using the aforementioned methods or to pay upon collection of the vehicle.

• Car rental details: place of reservation, place of vehicle collection, place of vehicle return, rental period, choice of insurance coverage.

Identification and contact details are also collected for any additional drivers of the vehicle.

• Collection of special category data (sensitive personal data): Special category data is not collected through our website. We may collect and process your health data in case you are involved in an accident in order to take all necessary actions in cooperation with insurance companies. In case we need to collect your special category personal data to provide our services (e.g., health condition, any disability to provide a special vehicle), we will inform you accordingly and ask for your consent for this processing in accordance with applicable legislation.

   

B. Contact form You have the option to contact us through an online contact form provided via the Website. When filling out the form, you yourself provide us with your personal data, specifically:

• first name,

• last name,

• email address (email),

• phone number,

• the subject of your concern,

• and other information contained in the message (e.g., issues regarding the provision of our services).

We process this data in order to serve you and answer your queries. Your messages are received exclusively by the authorized personnel of our Company. The personal data filled in is declared by you and collected on your own responsibility. If you send a message (communication, question, request) using the relevant form and fill in your personal details, you explicitly consent to the use of this data by our Company. In any case, you declare your consent before sending your details through a relevant option provided on our website. Our Company, within the framework of the Website's operation, will process your personal data and any information you declare in order to communicate with you and implement any request related to the provision of our services. You may request the deletion of the information you have provided through the contact form at any time, knowing that this may in some cases prevent your further communication with our Company.

C. Member registration 

Through our website, you are provided with the option to register as a member in order to receive offers and enjoy privileges during the provision of our services to you. For your registration, you provide us—by filling out the relevant form—with the following personal data:

• Identification data: first name, last name.

• Contact information: email address, home address and postal code, mobile phone number.

The personal data filled in is declared by you and collected on your own responsibility. By filling in your personal details, you explicitly consent to the use of this data by our Company. In any case, you declare your consent before sending your details through a relevant option provided on our website and before your registration as a member. You have the right at any time to withdraw your consent regarding the processing of your data and to be deleted as a member, knowing that you will no longer enjoy the aforementioned privileges.

D. Marketing/ Promotional messages

 Our Company, in the context of promoting its services, wishes to send you promotional messages and inform you about its offers and the privileges it provides you. In order to carry out the relevant promotional actions, we ask for your consent to collect your email account and send you promotional messages. In any case, you must declare your consent in the relevant field of our website by clicking the relevant option. You have the right at any time to withdraw your consent regarding the processing of your personal data, and we will immediately stop sending you promotional emails.

3. We may collect personal information from various sources, including: [IK9]

• via the Website

• via social media and brand channels (e.g., Facebook, Instagram)

• from rental agreements

• from the transaction you have with us, in the context of any additional charges or in the event of an accident when we receive additional information or if you require roadside assistance

• from telephone communication – reservation made with our Company

• from our partners in the context of providing our services (e.g., hotels, airlines, insurance companies)

FOR STATISTICAL ANALYSIS:

To learn more about how our Website is used by its visitors, we retain in aggregate form and analyze the data we collect. We may use this information, for example, to monitor and analyze the use of the Website, to enhance its functionality, and to better shape its content and design according to the needs of our visitors.

MINORS

When collecting information directly from you, we take appropriate care to ascertain which of the collected personal information relates to minors. In any case, if we discover that we have collected any personal information from a minor under the age of 15 without verifiable parental consent, in accordance with the provisions of Article 21 of Law 4624/2019, we will delete the information from our database as soon as possible, with relevant notification to the minor's parent or guardian. If you believe we may have collected information from a minor under 15 years old, please contact us immediately.

FOR WHAT PURPOSES WE USE THE INFORMATION WE COLLECT

We collect, process, use, and store your personal data:

• To verify your details when you log in to our websites (in case you register and log in as our member).

• For the smooth and efficient operation of our Company and our compliance with legal and contractual obligations.

• To provide our services to you (car rental).

• To submit, examine, and process your requests regarding the provision of our services.

• To conclude and execute the contract between us.

• To communicate with you during our contract and the provision of our services.

• To provide our services and process our clients' cases in cooperation with insurance companies and our other partners (e.g., in the event of an accident, use of roadside assistance, or cooperation with hotels, airlines, etc.).

• To process matters related to the car rental, safety, maintenance, and insurance coverage of the rented vehicle.

• To operate and improve the quality and efficiency of our services, our websites, and other actions related to our operations.

• To promote our services, for marketing purposes, to send promotional messages, provided we receive the explicit consent required by applicable legislation from you.

• To defend the interests of our Company before judicial and other authorities.

• To recover our vehicles or recover outstanding monetary amounts owed to our company.

   

• To protect and secure our property (our fleet) and the property of others.

   

• For record-keeping when required by law.

   

• To comply with applicable law and fulfill our legal and insurance obligations.

   

• To support IT purposes and for the operation of the Website.

   

• To support our Company's procedures.

• For your registration as a member.

LEGAL BASES FOR DATA PROCESSING

Our Company relies on the following legal bases for the processing of your personal data:

• The processing of your personal data is allowed provided it is necessary for the performance of a contract (vehicle rental) to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR).

• The processing is allowed provided it is necessary for compliance with a legal obligation to which our Company is subject (Article 6(1)(c) GDPR).

• The processing is allowed provided it is necessary for the purposes of the legitimate interests pursued by the Data Controller (e.g., legal claim, property protection, etc.) (Article 6(1)(f) GDPR).

Regarding special categories of data, our Company relies on the following legal bases:

• Processing of special categories of data is also possible for the establishment, exercise, or defense of legal claims by our Company (Article 9(2)(f) GDPR).

When it is deemed necessary to obtain the data subject's consent for the processing of their personal data (according to the conditions of Article 7 GDPR), the legal basis is Article 6(1)(a) GDPR or, if it concerns special categories of data, Article 9(2)(a) GDPR. Consent can be withdrawn at any time and easily, without affecting the lawfulness of processing based on consent before its withdrawal.

USE AND SHARING OF INFORMATION

• Our Company respects your right to the protection of your privacy and the information concerning you, and for this reason, uses this information for the aforementioned purposes. Therefore, it does not share, transfer, or make the information concerning you accessible to third parties. Also, we do not transfer this information outside the European Union. In the event that the transfer of your data to a country outside the EU is necessary for the provision of rental services you requested, then the processing of your data will be carried out in compliance with the provisions of Articles 44 et seq. of the GDPR.

We may make information about you available to other companies, applications, or individuals in the circumstances outlined below:

• We may share aggregate information or information that does not directly identify you with third parties to help us develop the content and services of our Website. Please note that we do not share your contact details with third parties in any way.

• We may use or use in the future third parties to provide services related to our Website, such as database management, maintenance services, analytics, data processing, and distribution of email and text messages. These third parties will have access to the information concerning you only to perform their above duties on our behalf and under strict contractual commitments regarding the protection of your privacy and personal data.

• We may, in the context of providing our services, transfer your personal data to our partners regarding the vehicle rental, charges, and the collection of outstanding rents, for customer satisfaction survey purposes, to provide you with assistance under our contract, and to make the reservation.

• We may transfer your data to the partner who repairs or maintains the vehicle, to a company providing you a reward through renting from us as a frequent traveler (e.g., an airline), to the intermediary (agent) you use to make the reservation, and to the credit card provider regarding charges.

• We may share information about you to investigate, prevent, or take action regarding illegal activities, if there are suspicions of unlawful conduct or criminal acts against the rights and legitimate interests of any natural or legal person, in case of a violation of our Website's Terms of Use, or if required by law, as well as in other cases where we believe in good faith that sharing the information is necessary.

• We may share information concerning you to respond to subpoenas, search warrants, judicial proceedings, court orders, legal processes, or other law enforcement measures from any competent authority, including the Hellenic Data Protection Authority and the Supervisory Data Protection Authorities of other European Union member states, as well as to establish and defend our legal rights or to counter claims against us.

• We may share information concerning you, indicatively, with Public Services, Public and Judicial Authorities, and Auditing Mechanisms only in cases where it is explicitly provided for in applicable legislation and to fulfill our legal obligations.

Please note that third parties may independently collect data about you, including your IP address and information about the websites you visit and the links you click on, through cookies, "clicks" on links, or other means during your visit. For more information, see our detailed Cookies Policy (link).

In cases where you provide us with personal data of third parties, you guarantee that you have informed them of the purposes and the manner in which we must process their personal data.

DATA RETENTION PERIOD

Our Company will retain the personal data it collects through its Website for the period strictly necessary to fulfill the above processing purposes or to comply with applicable laws, agreements, or terms of this Policy. We will retain automatically collected information for a period of up to 12 months, and thereafter it may be stored in an unidentifiable summary format. Emails containing personal data are not kept longer than necessary to process the matter, unless it is deemed necessary to comply with a legal or contractual obligation of our Company, in which case they are kept longer subject to applicable legislation. If you revoke your consent to the collection and processing of your personal data, we will delete your data from our electronic and physical records, unless their retention is necessary to comply with our legal obligation or for the establishment, exercise, or defense of our legal rights or legitimate interests before judicial authorities.

• When processing is imposed as an obligation by provisions of the applicable legal framework, your personal data will be stored for as long as the relevant provisions dictate.

• When processing is performed on the basis of a contract, your personal data is stored for as long as necessary for the performance of the contract and for the establishment, exercise, and/or defense of legal claims based on the contract.

• When processing is performed to serve a request of yours, we will process your data for as long as needed to satisfy your request.

• When processing is performed to update you on your affairs, the data will be kept until you request their deletion and the cessation of your updates.

INFORMATION SECURITY

Your personal data is stored on cloud servers of pointer.gr. The servers storing information are located in Greece and Europe. 

The security of your personal data is an absolute commitment for us. To achieve this, we implement all modern and appropriate technical and organizational measures for the purposes of processing, aiming for the reasonable protection of your personal data from unauthorized and illegal access and processing or accidental loss, destruction, damage, theft, use, or disclosure, the responsiveness and adequacy of which we check at regular intervals.

We make every effort to ensure the secure use of our website as fully as possible. We advise you not to include any confidential information when using email. For your own protection, our email responses to you will not include any confidential information.

Third-party social networks that provide interactive activities, plugins, or social networking features (e.g., to allow you to log into Facebook or Google to find friends to add as connections or to "Like" a page) may use cookies or other methods (e.g., web beacons) to collect information about your use of our website and applications. The use of this information by third parties depends on the privacy policy available on the social network's website, which we encourage you to review carefully. Such third parties may use these cookies or other tracking methods for their own purposes, associating information about your use of our site with any personal information of yours they may possess.

YOUR RIGHTS

You may exercise, as appropriate, the following rights:

• the right to be informed,

• the right of access, to find out what data of yours we process, for what purpose, and their recipients,

• the right to rectification, to correct any omissions or inaccuracies in your data,

• the right to erasure (right to be forgotten), to delete your personal data from our files, provided, however, that their processing is no longer necessary or the retention of your data is not required for us to comply with our legal obligations,

• the right to restriction of processing, in case of dispute over the accuracy of your data,

• the right to data portability, to receive your data in a structured and commonly used format. This right applies only to cases where the processing of personal data is based on consent or a contract and under the terms of Article 20 of the GDPR.

• the right to object, if you do not wish your data to be used, in accordance with the provisions of Article 21 of the GDPR.

If the processing of your data relies on your consent, you have the right to freely and at any time revoke it in order for us to stop the further processing of your personal data. The lawfulness of the processing based on consent before its withdrawal is not affected.

Your rights are subject to the terms and limitations of applicable legislation (Articles 12 – 23 of the GDPR and the provisions of Law 4624/2019).

To exercise your rights, please submit your respective request by contacting our Company in writing at the postal address: Agios Dimitrios, Lemnos, 81400 or by phone by calling +302254062505 and +306976907250 or by email at: info@compasslemnos.gr

Our Company will make every effort to respond to any relevant request of yours within thirty (30) days of its receipt. However, if due to the complexity of your request or the volume of information it is not possible to satisfy your request within thirty days, we commit to informing you within the above deadline in writing about the reasons for the delay and making every effort to satisfy your request as soon as possible and in any case within two (2) additional months.

Our Company reserves the right not to satisfy your request if it is deemed manifestly unfounded or excessive, informing you of the reasons for its non-satisfaction.

In any case, you have the right to file a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

DATA CONTROLLER

SKAPETIS ZARIMIS S.A., Agios Dimitrios Lemnos, 81400, +302254062505, +306976907250

CHANGES TO THIS POLICY

Our Company reserves the right to amend this Policy, always in accordance with applicable legal rules on privacy and personal data protection. Visitors to our Website should periodically read the Privacy and Personal Data Protection Policy to be informed of any changes made, while our Company commits to making the necessary updates to its visitors and users by any appropriate means, in compliance with the requirements set by the EU General Data Protection Regulation 679/2016.