Of the Website www.hellenicbattlefieldtours.com and provision of our services
Our company, Hellenic Battlefield & Heritage Tours A.E. (Tax Identification Number 803100786, 9 Dervenakion Street, Rafina 19009, hereinafter referred to as the Company, we) takes the appropriate measures to comply with applicable national and European legislation regarding the protection of your personal data. We have established this Personal Data Protection Policy (Policy) with the aim of informing visitors to our Website (Website or Company) about the processing of your personal data.
The Policy is addressed to those who visit our Website to obtain information about our Company's services and Programmes in the field of themed excursions/walks, seminars and related experiential activities of historical and cultural interest, as well as those who wish to make a reservation and register for them, contact us and take part in our promotional activities (hereinafter referred to as Users, you, your).
This Policy should be read in conjunction with the Cookies Policy and the Terms & Conditions of our Website, as these texts form an integral part of this Policy and govern the operation of the Website and the conduct of transactions (purchases) through it in a uniform and comprehensive manner.
By continuing to browse our Website and/or making reservations/purchases or contacting us, you automatically and unreservedly accept the terms of this Policy as amended from time to time. We invite you to refer to this Policy from time to time in order to be informed of any changes we may make. If you do not agree with the amendments, you must not take any action (use of the Website and/or booking/purchase).
1. Data Controller & Contact Details
The Data Controller of your personal data is the company named Hellenic Battlefield & Heritage Tours SA, with the details listed above.
Contact details: For any matter relating to this Privacy Policy and the processing of your personal data, you can contact us in the following ways:
By telephone: 0030 6970500580
By sending an email to: hello@hellenicbattlefieldtours.com
Through the "Contact" section.
We invite you to contact us for any information or clarification you may need regarding the Policy. Any relevant information or clarification provided by the Company does not constitute a replacement, substitution or modification thereof and will be provided solely for the purpose of serving the User and providing assistance regarding the Website. The Policy is the only binding text and information provided by the Company regarding the processing of Users' personal data, in relation to the points it concerns, unless otherwise expressly stated.
2. What is personal data?
Your personal data includes any information that allows, either alone or in combination with other information, your unique identification, in accordance with the provisions of the General Data Protection Regulation (GDPR 2016/679/EU – GDPR), the applicable Greek legislation and the decisions of the Hellenic Data Protection Authority (HDPA), as well as the directives and decisions of the competent European bodies.
The processing of personal data is carried out in accordance with the provisions of the GDPR, any specific national and European legislation for certain sectors, the applicable Greek legislation on the protection of personal data, as well as for the protection of personal data and privacy in the electronic communications sector (Law 3471/2006, as applicable) and the decisions of the Hellenic Data Protection Authority.
This is information collected about you either following specific interaction with us or the Website, or following its submission by a third party or by automated means during your visit, such as when you register/book a place on one of our Programmes, when you subscribe to our Newsletter mailing list, when you participate in one of our Programmes or when you voluntarily contact us via email or the contact form.
3. What data do we collect about you?
For example, we collect the following personal data about you:
- Identity & contact details: full name, email address, telephone number, tax identification number
- Demographic data: age, gender, marital status
- Your data contained in photos and videos (image, voice)
- Financial and tax data: payment method, card type, transaction value, refunds, receipt/invoice details
- Minor & accompanying person data (where applicable): minor's name/age, parent/guardian and/or accompanying person contact details, as well as declarations/authorisations required for the minor's participation.
- Transaction/purchase data: type of services you have purchased from us, transaction value, billing address, time of purchase
- Technical data: Internet Protocol (IP) address, operating system
- Analytics/statistics/marketing data: statistical/pseudonymous data collected through cookies. For more details, please refer to our Cookies Policy.
We would like to clarify that during the payment process, we do not record or store payment information for this transaction, e.g. credit card numbers, etc. You provide this information directly to the relevant payment service provider exclusively.
Our services are intended exclusively for persons over the age of ten (10). Reservations for Programmes are made exclusively by the parent/guardian/person exercising parental care or custody, who declares and guarantees that they have the legal capacity to consent to the participation of the minor, either jointly with the other parent/guardian/person exercising parental care or custody, or alone, and has been informed of the application of this Policy for the processing of the minor's data, assuming responsibility for compliance with it.
The participation of minors in the respective Programme is permitted exclusively with the mandatory accompaniment of an adult throughout its duration. The adult accompanying person may be the parent/guardian or another adult designated in writing by the parent/guardian. In organised/group participation (e.g. school/tutorial), the adult may accompany more than one minor and must ensure that the necessary declarations/authorisations have been obtained from the parents/guardians and made available to the Company upon request.
If you are under 18 years of age, please do not use the Website and do not provide us with any information without the consent of your parent/guardian/carer (i.e. do not provide your e-mail address to subscribe to our newsletter, do not make any purchases and do not provide us with any personal information, including your name, address or contact details – e.g. telephone number, e-mail address).
4. Collection & Processing of personal data (purpose & legal basis for processing)
| Purpose | Data | Legal basis |
|---|---|---|
|
Managing your booking and providing you with services related to your participation in the Programme We collect data related to your registration in the Programme and any communication you have in relation to it (including any cancellations) in order to record your registration and provide you with updates regarding the Programme and your billing. |
Identity Data Contact Data Financial Data Demographic Data The above data is collected either directly from you or through the third party who invited you (e.g. friend, relative) Additional data/documents as applicable (e.g., details of parent/guardian and/or accompanying person, as well as any accompanying declarations/authorisations) |
Performance of our Contractual Relationship. We process your personal data under the contract we have entered into and to which you are a party at the pre-contractual stage and during the conclusion, duration or termination thereof. Furthermore, where required by law, we will process certain demographic data about you, such as your age, gender or marital status, in order to provide the necessary insurance coverage for your participation in the Programme. In addition, we may process certain tax data, such as your proof of income, based on our legal obligations under tax law relating to the management and maintenance of tax data arising from the sales contract, as well as for any claim made by any contracting party. If the documentation of some of the above information requires the submission of relevant documents by law or under our relevant contract, we will inform you accordingly. |
| Customer and visitor service through communication with the company |
Identity data Contact details Transaction data Information you provide us with regarding your request The above data is collected either directly from you or through the third party who submitted it to us |
Depending on the case, if you deem it necessary to be served, the processing is carried out on the following legal bases: The execution of our contractual relationship. When you are or become our customer, i.e. you register for a Programme and wish to receive additional information, your data is processed within the framework of the contract we have concluded, either at the pre-contractual stage, within the framework of its execution, or for your service after its termination. Our Company's compliance with its legal obligations. We process your personal data for the adoption of customer service tools/means before and after your transactions. Your consent. If you are not our customer and wish to receive communication from us regarding our services, we process the data you provide to us at your discretion. Please do not provide us with more data than is strictly necessary to fulfil your request. We consider data submitted to us via contact forms to have been provided with your consent or with the consent of the person to whom it relates. We bear no responsibility for the processing of data that may be submitted to us in excess or without permission/consent. |
| Commercial Communication |
We collect your contact details when you provide them to us in the special field on the Website for sending newsletters (Newsletters), participate in customer satisfaction surveys, promotional competitions or when we have obtained it in the context of our previous transactional relationship Contact Data The above data is collected directly from you |
Depending on the commercial communication and your relationship with us, the following legal bases apply to the processing of your data: Your consent. We process your data for commercial communication, customer satisfaction measurement or your participation in one of our promotional activities with your consent. You can withdraw your consent at any time by clicking on the unsubscribe button in the communication you receive or by contacting our Company. Our legitimate interest. If you are already our customer, i.e. you have purchased a service from us, we process your data to promote similar services, which is reasonably balanced with your rights to the protection of your personal data. |
| Taking and publishing photos |
Identity Data Data contained in photographs, videos The above data is collected directly from you |
Our legitimate interest. Our Company relies on its legitimate interest in the promotion, promote, secure and/or document the Programmes, which is reasonably balanced against the protection of your privacy, especially in certain cases where it is not feasible or obtaining consent is disproportionate in view of the circumstances (e.g. in the case of larger programmes). Please note that you always have the right to ask us to stop processing your data (opt-out) for the purpose of taking and publishing photographs by asking us not to include you in the relevant material. Your consent. Where our legitimate interest does not prevail, the relevant processing will only be carried out with your consent. |
| Operation of the Website |
We collect your personal data related to your browsing on our Website by automated means. Technical Data The above data is collected by automated means, based on your browsing. |
The legitimate interest of our Company. We process data related to your browsing for the proper technical operation of our Website, the management and optimisation of technical systems and the security of transactions, which in this case is adequately balanced against your privacy and rights. In addition, we process certain data through Cookies based on your consent when you accept the relevant cookies through the cookie banner on our Website during your browsing – see our Cookies Policy for more details. In some cases, we may process your personal data on the basis of our legal obligation, when this is, for example, necessary for the proper functioning of the Website and its protection from malicious content that may undermine its security. In such cases, you cannot object to the processing of your data, which we retain for reasons that are reasonably balanced against your rights, and which we seek to keep anonymous in all cases. |
We may process your personal data on the basis of our legitimate interest and our Company's compliance with its legal obligation when we receive documents, requests, orders, pleadings, warrants, etc. from third-party legal authorities or bodies, such as supervisory, prosecutorial, judicial, and tax authorities, for the investigation of crimes and your protection against fraud or the fight against all forms of crime and infringement of legal rights.
Where we rely on your consent to process your data, you may ask us to stop such processing by withdrawing your consent. Please note that the withdrawal of consent applies to the future and therefore any processing that has taken place up to the point of withdrawal is not affected. Also, if you withdraw your consent, we may no longer be able to provide you with certain services (e.g. receiving newsletters).
Right to object/opt-out: When the processing of your data is based on our legitimate interest, you have the right to request that we do not process it (opt-out). Please note that if you exercise this right, our Company has the right to object on the basis of its overriding legitimate interest, which, when reasonably weighed against your right to privacy, does not allow it to cease processing, as there are compelling and legitimate reasons that override your rights and freedoms or that relate to the establishment, exercise, or defence of legal claims to continue such processing. In these cases, you retain your specific rights described below.
Where our commercial communication is based on our legitimate interest, you have the option to request that we stop communicating with you in this manner at any time by clicking on the unsubscribe button in the communication you receive or by contacting our Company.
Disclosure of third-party information: When using the Website, making reservations and participating in our Programmes, you disclose third party information (your friends, acquaintances, children, etc.), we assume that you have obtained the consent or permission of the person concerned to provide us with their data. In any case, you are obliged to inform them that the processing of their data by our Company is carried out in accordance with the terms of this Policy. Please do not provide us with any data other than what is strictly necessary to fulfil your request. We bear no responsibility for the processing of data submitted to us in excess or without permission/consent. Our Company bears no responsibility in relation to any processing carried out in violation of your above obligations, and you, in turn, assume responsibility for indemnifying the Company, its executives and staff from any damage or other harm that may be brought against us by third parties due to a breach of the above.
Social Networks: If you interact with us through our social media pages in order to participate in our promotional activities, learn about our news or generally communicate with us, we process the personal data you share in this context based on your consent to participate in the relevant activity or to carry out the communication in question. However, we remind you that your data is subject to additional processing by the providers of the relevant social media sites, for which the relevant data processing policy and terms of use of the respective provider apply.
5. How long is your data retained?
We will retain your personal data for as long as you continue to interact with us and it is necessary for the fulfilment of the processing purposes described above. The data is retained by us until you request its deletion, unless its retention is required by law (e.g. for tax purposes) or to support a legitimate right of our Company. In any case, the data is deleted immediately after the purposes for which it is kept have been fulfilled, while some data (e.g. booking/purchase data) will be kept anonymously or pseudonymously for statistical analysis purposes. Specifically:
| Purpose of Processing | Data Retention Periods |
|---|---|
| Management of your reservation and service related to your participation in a Programme | We retain your data until the end of our transactional relationship and for an additional two (2) years from the last time you participated in a Programme of our Company. After that, your data is deleted, unless its retention is necessary for the exercise or support of legal claims. |
| Customer and visitor service through communication with the Company | We will retain your data for as long as necessary to fulfil your request. If you are our customer, we will retain your data for the periods described above in relation to the management of your booking and your participation in the Programme. If you are a simple visitor to our Website, we will retain your data for one (1) year from the resolution of your issue or your last communication with us, whichever comes first. |
| Commercial Communication |
When we process your data on the basis of our legitimate interest, i.e. when you are already our customer (you have purchased a Programme from us), we will retain your data for two (2) years from your last interaction with us (e.g. since the last time you opened one of our promotional emails) or until you exercise your right to opt out or unsubscribe, whichever comes first. When we process your data on the basis of your consent, i.e. when you have subscribed to a specific commercial communication acceptance list (e.g. newsletter), we will retain your data for two (2) years from your last interaction with us (e.g. from the last time you opened our relevant newsletter) or until you withdraw your consent (e.g. unsubscribe or contact us in this regard), whichever comes first. |
| Taking and Publishing Photos |
The photos and videos taken are kept in our archives for at least five (5) years from your participation in the relevant Programme. If the processing is done with your consent, you can withdraw it. Instead of deletion, if other persons are included or deletion is not possible, we may blur your image so that you cannot be identified. When taking photos and videos based on our legitimate interest, we try to take photos that don't identify you or don't identify you right away, by choosing various methods, such as not photographing people or taking photos and videos from a distance. If you wish us to stop this processing, we may, instead of deleting the image, blur your image so that you cannot be identified, if other people are also included in the image. |
| Website Functionality |
When the legal basis for processing your data is our legitimate interest in the technical operation and improvement of the application (e.g. during the automated processing of data obtained from browsing the Website), we generally anonymise personal data for research or statistical purposes, so that it can no longer be linked to an identifiable person, and we use it in this form for an indefinite period of time. In some cases, we retain the data as is, if necessary, for purposes related to the proper functioning of the Website and the security of access to it. |
6. What are your rights and how can you exercise them?
You can exercise your rights by contacting our Company at the above contact details.
- Right of Access: You can ask us to confirm that our Company processes your personal data, to access the data we process, to receive relevant information about its processing, such as: what data our Company has, why it uses it, to whom it transfers it, whether it transfers it to third countries, how it protects it, and how long it keeps it.
- Right to Rectification: You may request that our Company correct any false or inaccurate data or update it. We reserve the right to verify the accuracy of the data.
- Right to Erasure: You may request that your data be erased when: you have withdrawn your consent on which the processing is based or if you object to the processing, it is no longer necessary for the purposes for which it was collected, in the event that you find that it is otherwise or unlawfully processed. Our company reserves the right to refuse to exercise the above right if the processing of the data is necessary (a) for the purpose for which it was collected, (b) to comply with a legal obligation, (c) for the establishment, exercise or defence of legal claims.
- Right to Restriction: You may ask us to restrict the processing of your data, i.e. to keep it but not use it, when its accuracy is disputed, when it is likely that the processing is unlawful but you do not want it deleted, when the processing is no longer necessary for the purposes for which it was collected, when you object to their processing and await verification of the outcome, i.e. whether our company's legitimate reasons override your legitimate claims.
- Submitting a complaint to the Data Protection Authority: You have the right to submit your complaints or reports to the local supervisory authority regarding the processing of our personal data. In Greece, the supervisory authority for data protection is the Personal Data Protection Authority – www.dpa.gr/
As the protection of your privacy is a priority for our company, you can contact us at any time with any questions or complaints you may have regarding the processing of your personal data.
In addition, our company recommends that you choose alternative dispute resolution – mediation as a more flexible means of resolving disputes between you and our company.
Procedure for exercising your rights: In order to exercise your rights, we reserve the right to ask you for proof of your identity. We will respond to valid and accurate requests within one (1) month of receipt, unless the request you submit is particularly complex or you have submitted several requests. If we need more time (up to an additional 2 months) to respond to your request for the reasons mentioned above, we will inform you accordingly within one month. You must provide specific and accurate information and facts so that we can respond to your request accurately, otherwise we reserve the right to correct any errors that are beyond our control. Our Company reserves the right to reject requests that are unfounded, excessive, abusive or illegal under the law. We will not charge you for exercising your rights in relation to your personal data, unless, as provided by law, your request for access to information is unfounded or excessive, in which case we have the right to charge a reasonable fee under the specific circumstances. In any case, we will inform you of any charges before completing your request.
7. Third-party recipients of your data
In order to ensure the proper functioning of the Website and to fulfil its contractual obligations, our Company cooperates with third-party companies that only have access to data that is absolutely necessary for the completion of your purchases, your participation in the Programme, the execution of the Programme by third-party professionals with whom we cooperate, the execution of the contract between us, your payments and refunds, the provision of accounting and legal services, the creation and technical support of our Website, the hosting of our databases and our Website, marketing and communication activities and the provision of our services to you in general, the operation and organisation of our Website, compliance with our legal obligations and the optimisation of our products and services.
When transferring your personal data, we always ensure the highest possible level of security. Therefore, your data will only be transferred to service providers and partner companies that have been carefully selected and are bound by a prior contract. In the event of compliance with our legal obligations, your data will only be transferred to the authorities responsible in each case. All partner companies that support our company's systems and operations only have access to the data that is absolutely necessary for the service they provide for us. They are contractually bound to maintain confidentiality and all technical and organisational measures for secure processing and not to use your information in any other way except to help us provide you with the products and services we have agreed upon.
The Company generally keeps your personal data within the European Economic Area (EEA).
We reserve the right to disclose your personal data to a third party to whom we choose to transfer all or part of our business. Furthermore, in the event of a merger or acquisition, or other change in our business, the new owners, shareholders, managers, etc. have the right to use your personal data in the same manner as set out in this Policy.
Your stored data may be disclosed to the competent judicial, police and other administrative authorities upon their lawful request and in accordance with the applicable legal provisions. Furthermore, in the event of a legal order, official request or official preliminary investigation, the Company has the right to make the relevant information available to the respective service without further notice.
8. Data security
The Company takes all necessary technical and organisational security measures to protect and ensure the confidentiality of your personal data. To carry out the processing, the Company selects persons with the appropriate professional qualifications who provide sufficient guarantees in terms of technical knowledge and personal integrity to maintain confidentiality. Through the relevant contractual commitments and its partners, the Company takes all necessary security measures to protect and ensure the confidentiality, secrecy and integrity of personal data. In any case, their security within the platform environment is subject to events beyond its control, as well as errors due to technical or other network failures that are not controlled by the Company or reasons of force majeure or fortuitous events.
9. Changes to this Policy
We reserve the right to amend this Policy, for example to comply with new requirements imposed by applicable laws, directives, or technical requirements, or in the event of a review of our procedures or practices. We will notify you of any revisions to our Privacy Policy by posting them on our Website. We encourage you to periodically review this page.
Last updated: 13/2/2026