1. Data Protection at a Glance
General Information
The following information provides a simple overview of what happens to your personal data when you visit our website. Personal data refers to any data that can be used to identify you personally. For detailed information on data protection, please refer to our Privacy Policy, which is set out below this text.
Data Collection on Our Website
Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. You can find their contact details in the legal notice section of this website.

How do we collect your data?
On the one hand, your data is collected when you provide it to us. This includes, for example, data that you send to us by email.
Other data is collected automatically by our IT systems when you visit the website. This consists primarily of technical data (e.g. internet browser, operating system or the time the page was accessed). This data is collected automatically as soon as you access our website.
What do we use your data for?
Some of the data is collected to ensure the website functions correctly. Other data may be used to analyse your user behaviour.
What rights do you have regarding your data?
You have the right at any time to obtain, free of charge, information about the origin, recipients and purpose of your stored personal data. You also have the right to request the rectification, restriction or erasure of this data. For this and any further questions regarding data protection, you may contact us at any time at the address provided in the legal notice. Furthermore, you have the right to lodge a complaint with the relevant supervisory authority.

Data erasure and retention period
The data subject’s personal data shall be erased or blocked as soon as the purpose for which it was stored no longer applies. Data may also be retained if this is provided for by European or national legislation in EU regulations, laws or other provisions to which the controller is subject. Data will also be blocked or deleted when a retention period prescribed by the aforementioned standards expires, unless there is a need to continue storing the data for the conclusion or performance of a contract.

Analytics tools and third-party tools
When you visit our website, your browsing behaviour may be analysed statistically. This is primarily done using cookies and so-called analytics programmes. The analysis of your browsing behaviour is carried out anonymously; your browsing behaviour cannot be traced back to you. You can find detailed information on this in the following privacy policy.

2. General information and mandatory notices
Data protection
The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.
When you use this website, various items of personal data are collected. Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.
Please note that data transmission over the internet (e.g. when communicating by email) may be subject to security vulnerabilities. It is not possible to guarantee complete protection of data against access by third parties.

Information on the data controller
The data controller responsible for data processing on this website is:
ThassosCats (AMKE)
Olive Garden Villas and Appartments
Skala Panagia
Thassos
6404 Greece

Data controller within the meaning of the GDPR: Karen Vaughan
Telephone: +30 694 993 6137
Email: thassoscats@gmx.com
The data controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g. names, email addresses, etc.).
Withdrawal of your consent to data processing
Many data processing operations are only possible with your explicit consent. You may withdraw any consent you have already given at any time. To do so, simply send us an informal notification by email. The lawfulness of the data processing carried out up to the point of withdrawal remains unaffected by the withdrawal.
Objection to promotional emails
We hereby object to the use of contact details published in accordance with the legal requirement to provide an imprint for the purpose of sending unsolicited advertising and information material. The operators of this website expressly reserve the right to take legal action in the event of the unsolicited sending of promotional information, for example via spam emails.

3. Data processing when accessing the website via the internet
This website is hosted by an external service provider, IONOS SE. When you visit our web pages, this service provider’s web servers record each visit in a log file. The following data is automatically transmitted by your browser:
• IP address of the requesting computer
• Date and time of access
• Name and URL of the file accessed
• Amount of data transferred
• Indication of whether the access was successful
• Identification details of the browser and operating system used
• Website from which the access originated
• Name of your internet service provider
This data is processed for the purpose of enabling use of the website (establishing a connection), ensuring system security, carrying out technical administration of the network infrastructure, and optimising the website. The IP address is only analysed in the event of attacks on the network infrastructure or for other data security reasons.

4. Rights of the data subject
Any use we make of your personal data is carried out for the purposes stated or as permitted by law, and to the extent necessary to achieve those purposes. Personal data refers to specific details concerning the personal or factual circumstances of an identified or identifiable natural person. Personal data is only disclosed to state institutions and authorities in accordance with statutory provisions or where such disclosure is necessary for legal or criminal proceedings in the event of attacks on our network infrastructure. Any service providers engaged in the course of processing your data will only receive the data necessary for them to fulfil their tasks. Data will only be transferred to other bodies (third parties) to the extent permitted by law. Beyond this, your data will not be passed on to third parties.
In accordance with the applicable legal provisions, you have the right at any time to obtain, free of charge, information about your stored personal data, its origin and recipients, and the purpose of the data processing, and, where applicable, the right to have this data rectified, restricted or erased. You may contact us at any time at the address given in the legal notice regarding this matter or any other questions concerning personal data.

Right of access
You may request confirmation from the data controller as to whether we are processing personal data relating to you. If such processing is taking place, you may request the following information from the data controller:
1. the purposes for which the personal data is being processed;
2. the categories of personal data being processed;
3. the recipients or categories of recipients to whom your personal data have been or will be disclosed;
4. the envisaged period for which your personal data will be stored or, if it is not possible to specify this, the criteria used to determine the storage period;
5. the existence of a right to rectification or erasure of the personal data concerning you, a right to restriction of processing by the controller, or a right to object to such processing;
6. the existence of a right to lodge a complaint with a supervisory authority;
7. any available information regarding the origin of the data, where the personal data are not collected from the data subject;

8. the existence of automated decision-making, including profiling, in accordance with Article 22(1) and (4) of the GDPR and – at least in such cases – meaningful information about the logic involved, as well as the scope and intended consequences of such processing for the data subject.
You have the right to request information as to whether personal data concerning you is transferred to a third country or to an international organisation. In this context, you may request to be informed of the appropriate safeguards pursuant to Article 46 of the GDPR in connection with the transfer.
Right to rectification
You have the right to request that the controller rectify and/or complete your personal data if the personal data concerning you that is being processed is inaccurate or incomplete. The controller must carry out the rectification without undue delay.

Right to restriction of processing
You may request the restriction of the processing of your personal data under the following conditions:
1. if you contest the accuracy of your personal data for a period enabling the controller to verify the accuracy of the personal data;
2. the processing is unlawful and you oppose the erasure of the personal data and instead request the restriction of its use;
3. the controller no longer needs the personal data for the purposes of the processing, but you require it for the establishment, exercise or defence of legal claims; or
4. if you have objected to the processing in accordance with Article 21(1) of the GDPR and it has not yet been determined whether the controller’s legitimate grounds override your grounds.
Where the processing of your personal data has been restricted, such data – apart from its storage – may only be processed with your consent, or for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person, or for reasons of an important public interest of the Union or of a Member State. If the restriction on processing has been imposed in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

Right to erasure
a) Obligation to erase data
You may request that the controller erase personal data relating to you without delay, and the controller is obliged to erase such data without delay, provided that one of the following grounds applies:
1. The personal data relating to you is no longer necessary for the purposes for which it was collected or otherwise processed.
2. You withdraw your consent on which the processing was based pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR, and there is no other legal basis for the processing.
3. You object to the processing in accordance with Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing in accordance with Article 21(2) of the GDPR.
4. The personal data relating to you has been processed unlawfully.
5. The erasure of the personal data relating to you is necessary for compliance with a legal obligation under Union law or the law of the Member States to which the controller is subject.
6. The personal data relating to you was collected in connection with information society services offered in accordance with Article 8(1) of the GDPR.
b) Notification to third parties
Where the controller has made the personal data concerning you public and is obliged to erase it pursuant to Article 17(1) of the GDPR, the controller shall, taking into account the state of the art and the cost of implementation, take reasonable measures, including technical measures, to ensure that other controllers processing the personal data that you, as the data subject, have requested the erasure of all links to that personal data or of copies or replicas of that personal data.

(c) Exceptions
The right to erasure does not apply where processing is necessary
1. for the exercise of the right to freedom of expression and information;
2. for compliance with a legal obligation which requires processing under Union or Member State law to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
3. for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3) of the GDPR;
4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of the GDPR, in so far as the right referred to in point (a) is likely to render impossible or seriously impair the achievement of the objectives of such processing; or
5. for the establishment, exercise or defence of legal claims.

Right to be informed
If you have exercised your right to rectification, erasure or restriction of processing vis-à-vis the data controller, the data controller is obliged to notify all recipients to whom your personal data has been disclosed of such rectification, erasure or restriction of processing, unless this proves impossible or involves a disproportionate effort. You have the right to be informed by the controller of the identity of these recipients.
Right to data portability
You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that

1. the processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, or on a contract pursuant to Article 6(1)(b) of the GDPR, and
2. the processing is carried out by automated means.
In exercising this right, you also have the right to have the personal data concerning you transmitted directly from one controller to another, in so far as this is technically feasible. This must not adversely affect the freedoms and rights of other individuals. The right to data portability does not apply to the processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

5. Electronic mail (e-mail)
If you send us e-mails, your e-mail address will only be used for correspondence with you. Information that you send to us via unencrypted e-mail may be read by third parties whilst in transit. We are generally unable to verify your identity and do not know who is behind an email address; consequently, legally secure communication via standard email cannot be guaranteed. We use SSL or TLS exclusively for sending and receiving emails. Emails are therefore transmitted in encrypted form.
We also use so-called spam filters to block unsolicited advertising; in rare cases, these may mistakenly classify normal emails as spam and delete them automatically. Emails containing malicious programmes (‘viruses’) are automatically deleted by us in all cases. Due to the general insecurity of email communication, we cannot guarantee that an email sent will reach the intended recipient. You should therefore check whether email is actually the most suitable method of communication for your purposes.

6. Cookies and analytics tools
Cookies are small text files that are stored on the internet user’s computer. They are used to manage the internet connection whilst you are visiting our websites. At the same time, these cookies provide us with information that enables us to optimise our websites to meet visitors’ needs. Some cookies are stored by your browser only for the duration of your visit to the website, whilst others are stored for a longer period. All cookies on our websites contain purely technical information; they do not contain any personal data.
Of course, you can also view our websites without cookies. However, most browsers accept cookies automatically. You can prevent cookies from being stored by adjusting your browser settings. If you do not accept cookies, this may result in some features of our services being restricted.
This website uses an analytics tool that collects statistical data (e.g. device type). No personal user behaviour is tracked or analysed.

7. Payment providers
PayPal
On our website, we offer payment via ‘PayPal’. PayPal is an online payment service provider. Payments are processed via so-called PayPal accounts, which are virtual personal or business accounts. PayPal also offers the option of processing virtual payments via credit cards if a user does not have a PayPal account. A PayPal account is managed via an email address, which is why there is no traditional account number. PayPal enables users to make online payments to third parties or to receive payments. PayPal also acts as a trustee and offers buyer protection services. PayPal’s European operating company is PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449, Luxembourg.

If you select PayPal as your payment method, you consent to the transfer of personal data to PayPal, which is necessary for the processing of the payment. The personal data transferred to PayPal usually comprises your first name, surname, address, email address, IP address, telephone number, mobile number or other data required for the processing of the payment. Personal data relating to the relevant order is also required to fulfil the contract of sale. The purpose of transferring this data is to process payments and prevent fraud. The data controller will transfer personal data to PayPal, in particular where there is a legitimate interest in doing so. The personal data exchanged between PayPal and the data controller may be transferred by PayPal to credit reference agencies. The purpose of this transfer is to verify identity and creditworthiness. PayPal may pass on the personal data to affiliated companies, service providers or subcontractors where this is necessary to fulfil contractual obligations or where the data is to be processed on its behalf.

The transfer of your data to PayPal is based on Article 6(1)(a) of the GDPR (consent) and Article 6(1)(b) of the GDPR (processing for the performance of a contract). You may withdraw your consent to the processing of personal data at any time by notifying PayPal. Withdrawal of consent does not affect personal data that must be processed, used or transferred for the purposes of (contractual) payment processing. Further information on the handling of user data can be found in PayPal’s Privacy Policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

8. SSL or TLS encryption
The operator of this website implements appropriate technical and organisational security measures to protect your personal data, which we manage, against accidental or deliberate manipulation, loss, destruction or access by unauthorised persons. Data transmission is secured by SSL encryption, ensuring that unauthorised third parties cannot gain access to personal data. Our security measures are continuously improved in line with technological developments.
9. Consent, current status and amendments to this privacy policy
By using our website, you consent to the data processing described above. We reserve the right to amend this privacy policy at any time, with future effect, in accordance with the applicable data protection regulations. We will publish any amendments here.