Personal Data Protection Notice

The Ministry of Culture (hereinafter the “Ministry”), which has its seat in Athens, at 20-22 Bouboulinas St., P.O. Box 10682, through the Ephorate of Antiquities of Chania, in its capacity as Data Controller, collects and processes your personal data only if absolutely necessary for explicit and legitimate purposes, in accordance with Regulation (EU) 2016/679 of the European Parliament and Council, Law 4624/2019 and Law 3471/2006 as applicable. This notice is intended to inform users of the Archaeological Museum of Chania Website (“https://amch.gr/”) about the processing of their personal data.

Definitions

For the purposes of this Notice, the following terms have the following meanings:

1. “Personal data”: any information relating to an identified or identifiable natural person (“data subject”). An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity.

2. “Special personal data categories”: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

3. “Processing”: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

4. “Anonymisation”: the processing of personal data in such a manner that the data can no longer be attributed to a specific data subject.

5. “Pseudonymisation”: ”: the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

6. “Controller”: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law. For the purposes of the present policy, the Ministry acts as Controller.

7. “Processor”: the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

8. “Data subject”: the natural person whose personal data are processed. e.g. trainees, colleagues, Ministry staff, etc.

9. “Consent” of the data subject: any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

10. “Personal data breach”: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

11. “Regulatory Framework”: the relevant national and EU data protection regulatory framework, namely Regulation (EU) 2016/679 (hereinafter referred to as the “GDPR”); Law 4624/2019, Law 3471/2006, the jurisprudence of the Court of Justice of the European Union (hereinafter referred to as the CJEU) as well as the Decisions, Directives and Opinions of the European Data Protection Board (hereinafter referred to as the “EDPB”) and the Hellenic Data Protection Authority (hereinafter referred to as the “DPA”).

Personal data collected and processed by the Ministry

Data collected by the Ministry through the website https://amch.gr/

When browsing and using the website, the following data are collected and processed:

Send Newsletter

No automated decision-making processes including profiling are carried out.

Data we collect automatically

When you use our Website, we also collect information automatically, some of which may constitute personal data. This includes information such as language settings, IP address, location, device settings, device settings, device operating system, activity data, time of use, redirect URL, status report, user information (browser version), operating system, browsing result (simple visitor or registered customer), browsing history, type of data viewed. We may also collect data via cookies. For information on the use of cookies, click here.

Collection and further processing of Personal Data of Minors

In principle, the Ministry does not collect or process personal data of minors (persons under the age of 18) directly or indirectly. However, as it is impossible to always determine and confirm the age of persons who access or use our website, we recommend that parents or guardians contact the Ministry directly if they notice any case of unauthorised disclosure of data provision on behalf of the minors for whom they are responsible, in order to exercise their rights, such as deletion of their data, accordingly. If the Ministry realises that it has collected personal data of a minor, it undertakes to delete the data immediately and to take all necessary measures to protect those data.

Data Subject rights

The Ministry ensures that it is able to respond promptly to the requests of data subjects to exercise their rights in accordance with the Regulatory Framework. Specifically, each data subject has the following rights:

If any of the above rights are exercised, the Ministry will respond promptly [in any case within thirty (30) days of the submission of the request], informing you in writing of the progress of the request.

If you have any complaints regarding this notice or personal data protection issues, if we do not meet your request to your satisfaction, you can contact the Hellenic Data Protection Authority via the following link: www.dpa.gr.

Data Protection Officer (DPO) Contact Information

To exercise all the above rights and for any issue related to the processing of your personal data by the Ministry, you can contact the Data Protection Officer of the Ministry at the email: dpo@culture.gr.

Third Party Site Disclaimer – Social Media Widgets

On this Website there are social media widgets (e.g. Facebook, Instagram), using which, once the user logs in to the social network, a special digital fingerprint is created, for which both the Ministry and the social network itself act as joint controllers.

For the Ministry, the purpose of processing these data is to improve the functionality of the website and the services provided, and to analyse website traffic. The legal basis for the processing of personal data is the fulfilment of the Ministry’s responsibility in the public interest (GDPR Article 6(1)(e) & Article 5 of Law 4624/2019).

The Ministry does not control and is not responsible for any subsequent processing carried out by the Joint Controllers.
For further information on the data processing policy and configuration options of these networks, please visit the following websites:

https://www.facebook.com
https://www.instagram.com
https://www.youtube.com
https://www.vimeo.com
https://www.tripadvisor.com

Personal Data Protection Notice Updates

This Personal Data Protection Notice may be amended/revised in future, in the context of the regulatory compliance of the Ministry and the optimisation and upgrading of the Website services. We therefore recommend that you refer to the updated version of this Notice for adequate information.

September 2023