Author: GrCycling Team

May 2020

GrCycling, Travel Agency, 16, Tzaferi Street, 11854, Greece is the owner and, therefore, responsible for the projects indicated below, including any of their subdomains or sections (hereinafter, “Website” as corresponds):

• www.GrCycling.com
• booking.GrCycling.com

This legal text applies to the information we collect from you when you visit our Website, as in the following cases: user registration, using any of our services, collaboration, subscription to our newsletters or personal information provided when filling in online forms.

The present Privacy Policy regulates the processing of personal data belonging to the Website’s users (hereinafter, “User” or “Users”, as applicable) performed by GrCycling Travel Agency, 16, Tzaferi Street, 11854, Greece (hereinafter, “GrCycling Company”), collected through the use of the services offered on the Website (hereinafter, “Services”).

By using and accessing our Website, the User acknowledges that they have read this Privacy Policy and that they fully agree with it. The latest update of this Privacy Policy is indicated at the top of this text and it will become effective immediately upon being posted. GrCycling Company, thus, recommends reviewing this Privacy Policy from time to time.
Some of the Services offered on the Website may be subject to specific privacy policies that will supplement this general Privacy Policy or, in case they differ from the terms of this Privacy Policy, they will substitute the present Privacy Policy. These additional privacy policies must be accepted by the User before initiating the corresponding Service. Additionally, the access and use of the Website and the accompanying Services are governed by the Terms of Use of the Website.

PERSONAL DATA PROCESSING

The following sections address the collection and processing of Users’ personal information through any of the projects run by GrCycling Company, including any of their subdomains and sections.

DATA CONTROLLER

GrCycling Company as data controller, is responsible for the processing of Users’ personal information on the Website:
GrCycling, Travel Agency
16, Tzaferi Street
11854, Athens Greece
Tax ID No. EL102717017
Email: info@GrCycling.com or support@GrCycling.com.

DATA WE COLLECT

According to the EU General Data Protection Regulation (GDPR, 679/2016/UE), personal data refers to any information relating to an identified or identifiable natural person (User), that is, any information which can identify a natural person. Therefore, it is not applicable to anonymous data.
GrCycling Company collects different types of personal data, which include:
Profile Data: username and password, profile settings (bookmarks, follows, saved routes, bicycles rental, etc.), comments, responses to surveys and additional or optional information such as links to social networks, profession, city and website.

• Identity Data: first name and last name and government-issued identification number.
• Contact Data: email address, telephone number and postal address.
• Payment Data: payment and billing information, depending on the payment method selected by the User, as well as other details related to information about the purchased services or subscriptions. No credit or debit card information is collected or stored in our servers
• Technical Data: login information, language, Internet Protocol (IP) address, browser type and version, time zone settings, operating system, browser plug-in types and versions and other technical data used by the User when visiting the Website.
• Usage Data: information about how the User uses the Website, products and services.
• Marketing and Communications Data: User’s preferences regarding marketing communications from GrCycling Company and information about enabling and disabling notifications.
• Bicycle Usage Data: height, shoe sizes, helmet size and cycling preferences (road cycling, ebike etc)

GrCycling Company does not collect any personal data related to sensitive categories (racial or ethnic origin, political opinion, religious or philosophic beliefs, membership in a union, health information or genetic data).
In case the User is asked to provide personal data, by law or by contract terms, and chooses not to provide them, we may not be able to carry out the contract nor provide them with the service. If this is the case, the User will be notified in advance.

GrCycling Company does not collect the age nor the date of birth of their Users. Consequently, a specific data treatment for minors has not been established. GrCycling Company is exclusively targeted to users of legal age.

HOW WE COLLECT DATA

GrCycling Company collects data through different interactions, which include:

1. Browsing and using the Website:
   Generally, Users navigate our Website anonymously without revealing any personal data to GrCycling Company.
   When a User visits and uses our Website, it stores and collects information automatically using technologies or automatic tools. In general, this collected information is related to technical information about the device, browsing activity and usage patterns. We collect this data through the use of cookies and similar technologies. If you want to learn more about it, you can consult our Cookies Policy.
   Moreover, we also store information about the number of downloads, bookings and searches run by the User. This information is collected in order to control the number of downloads and bookings by the User in compliance with the Terms of Use of this Website and to detect fraudulent and illegitimate usages of the Website, if any. In addition, we use personal information to perform analyses that help us to improve the quality of our Website, offer new products and ensure our Users’ satisfaction.
2. User booking / registration, or subscription to newsletters:
   User Registration:
   When a User registers on our Website or subscribes to our informative newsletter, GrCycling Company stores data to develop the Website, provide the service and offer certain features and options related to the service itself. We also use this data to send information, offers, promotional communications and news about the Services offered by GrCycling Company, sponsors or third-parties, which provide services and products within the cycling sector through newsletters or any other communication method (including e-mail and phone number). The User can choose not to receive this information at any moment through the user account or by sending an email to info@GrCycling.com.
   Payment and billing data, which depend on the payment method selected by the User, will be sent directly to the corresponding external payment service provider which is in charge of processing the payment.
3. Requests for information about products, services or publications, and requests for Website’s support services:
   “Contact” and “Support” Forms: Any information received by GrCycling Company will be stored in a file of GrCycling Company and will be used merely to respond to inquiries, suggestions or complaints sent by the Website’s Users. This information includes data collected from Contact forms, from the section ‘Can we help you?’, from satisfaction surveys as well as other information received via these two email addresses: info@GrCycling.com or support@GrCycling.com.
4. Information provided through job and collaboration offers:
   “Jobs” and “Join Us” Forms: Any information provided to GrCycling Company through the ‘Jobs” or “Join Us” forms available on the Website, will be stored in a file belonging to GrCycling Company and it will be only used to manage internal recruitment processes.
   Furthermore, if the individual enters our internal recruitment process further to their application being accepted, we will request and collect all the necessary information as it is established by the Greek labor and tax legislation.
   “We’re Hiring” Form: Any information provided to GrCycling Company requesting for collaboration with any of their projects, will be stored in a file belonging to GrCycling Company and it will be only used to manage recruitment processes of external collaborators.
   Furthermore, if the individual enters our internal recruitment process further to their application being accepted, we will request and collect all the necessary information as it is established by the Greek labor and tax legislation.

OUR PURPOSE AND LEGAL BASIS OF DATA WE COLLECT

We mainly use personal data of our Website’s Users in the following cases:

• To manage and implement the Terms of Use of the Website
• To create and manage User accounts
• When the User agrees that their personal data can be collected
• To enter into a collaboration contract
• Whenever it is required in compliance with legal obligations
• Whenever it is necessary to ensure the legitimate interest of GrCycling Company or third parties

The User can withdraw their consent at any time in writing to info@grcycling.com

Promotional Communications: we will send communications if:

• The User is registered or has accessed any of the Services of the Website (booking a rental bike is also included)
• The User requests for information through any of the forms available on the Website
• The User has not explicitly opted-out of receiving promotional communications

HOW WE KEEP DATA

We store personal information for as long as is needed to fulfill the purposes outlined in this privacy policy and, then, as long as it is permitted by applicable law.

DISCLOSURE OF DATA

GrCycling Company does not transfer nor share collected personal data with third parties external to the company. The information provided will only be used for identifying the User and managing the account on the Website.

Our Website includes plugins which allow the User to carry out actions on social networks of third parties such as Facebook, Twitter, Pinterest or Google+, like, for instance, sending a publication or showing support to the Website. These plugins are indicated with the corresponding social network logotype. If these plugins are accepted, the content will be transferred to the corresponding social network. The User can find information regarding plugins and how they process personal data in the privacy statements of these social networks. If the User does not want their data to be collected by these social networks, they must not accept plugins and must sign out of their account before navigating the Website.

We may disclose personal information of our Users to third parties only in cases when it is strictly necessary for GrCycling Company to perform their functions and to comply with the Terms of Use. We may also share personal information with other third parties to ensure compliance with applicable laws, including:

• Service providers, to manage systems and information technology.
• Payment platforms, banks and companies involved in the transaction process, to ensure the fulfillment of the necessary transactions.
• Other possible third parties with which GrCycling Company is compelled to share personal data, as permitted or required by law. These include professional advisers such as lawyers, auditors, legal and accounting consultancy services and financial institutions.
• Services provided by third parties are necessary for the development of GrCycling Company’s business activity. The processing of personal data is at all times subject to a contract which establishes the duties of the data processor towards the data controller. Under no circumstances will personal information be used for other purposes and it will be managed in compliance with GrCycling Company policy guidelines, their privacy policy and the applicable data protection regulation.
• GrCycling Company, in compliance with User privacy and data protection of Users, will only rely on service providers which adopt enough and proper technical and organizational measures to ensure that data processing complies with the applicable law regarding data protection and guarantee the protection of Users rights.

RIGHTS OF THE USER

GrCycling guarantees the exercise of rights established in the General Data Protection Regulation 2016/679 (hereinafter, GDPR), that will start to be applicable on 25th of May, 2018.

The User can exercise the rights by emailing us at info@GrCycling.com.
Please note that GrCycling Company may require the User to verify their identity before taking action on the request for the exercise of rights.
The User has the following rights:

• Right to Access: The User has the right to obtain from GrCycling Company confirmation about whether or not personal data concerning them are being processed and, if that is the case, receive information about it.
• Right to Rectification: The User has the right to request us to correct personal data where it is inaccurate or incorrect. When requesting for rectification, the User must indicate the data to be rectified and provide the correct information. In addition, where necessary, the request must be sent together with supplementary documentation that accounts for the incomplete or inaccurate data.
• Right to Erasure: The User has the right to request the erasure of personal data concerning their personal account. Therefore, individuals can close their User Account at any moment in an easy and straightforward way within the booking / account webpage.
• When requesting for terminating the account and, therefore, erasing all personal information, the User must note the following:
  • GrCycling Company may keep and use personal information where it is necessary in compliance with the legal obligations enforced by fiscal obligations and connected to judicial information and auditing.
  • If the User sends an erasure request, the personal data will be erased from the safety back-up systems at GrCycling when the next back-up is done.
• Right to Object: The User has the right to object to the processing of their personal data by GrCycling Company at any time. In some cases, we may continue processing personal information because of legitimate grounds or for the exercise or defense of possible legal claims.
• Right to Restrict Processing: The User has the right to request the restriction of personal data where they have particular reason for wanting the restrictions.
  • This right entitles the User to request the restriction of personal data in the following circumstances:
  • The accuracy of the personal data is contested by the User, while GrCycling Company verifies the accuracy of the personal data.
  • The User has objected to processing their data, pending the verification whether the legitimate grounds of the controller override those of the User.
• Furthermore, the User has the right to request us to retain their personal data when:
  • The processing is unlawful and the User opposes the erasure of the personal data and requests the restriction of their use instead
  • GrCycling Company no longer needs the personal data for the purposes of the processing, but they are required by the User for the establishment, exercise or defense of legal claims.
• Right to Data Portability: The User has the right to request us a copy of the personal information provided to GrCycling Company in a structured form and of common and legible use. The user is also entitled to request that this information be sent to another service provider (where technically possible).
• Right to Withdraw Consent: In the cases in which the User has authorized their data processing, the User has the right to withdraw their consent at any time. Please note that revocation of consent does not affect the lawfulness of processing based on consent before its withdrawal.
• The User can access and update their personal information in the settings of the User Account.
• The User is responsible for updating their personal information.

DATA SECURITY

GrCycling Company implements strong security controls to safeguard User’s personal information against loss, misuse, unauthorized access, disclosure or alteration.

INTERNATIONAL DATA TRANSFERS

Some external service providers of GrCycling Company are outside the European Economic Area (EEA), which implies that the User’s personal information may be transferred to countries outside the European Union.
In order to offer assistance when providing services, GrCycling Company works with subprocessors, subcontractors and other content delivery networks.

A sub-processor is an external data processor contracted by GrCycling Company, who has been granted access to information (which may be personal) about clients and collaborators and who can process it.
In any case, and concerning international data transfers, GrCycling Company commits to ensure that transfers of personal information outside the EEA comply with this Privacy Policy and meet any applicable law regarding data protection regulations of the European Union.

COMPLAINT SUBMISSION

If you, the User, do not agree with the way GrCycling Company processes your personal data, you can contact us by sending an email to info@GrCycling.com

May 2020

This website is operated by GrCycling, registered in the Commercial Registry of Athens, with Tax Number EL102797017 and registered office at 16, Tzaferi Street, 11854, Athens, Greece (“Company“).

This page contains important information about your legal rights and obligations when using any of the websites and services belonging to the Company.

Before accessing and using any of the Company’s websites (“Websites“) or services (“Services“), you must read the specific terms of use applicable to the access, browsing and use by the users (“User” or “Users“, as applicable) of the relevant Website/Service (displayed above), as accessing and using any of the Websites or Services implies that you have read and accept to be bound by the terms of use of the relevant Website or Service. We also recommend regularly checking the applicable terms of use as the Company reserves the right to modify these at any time (the date at the beginning of these terms refers to the latest update of these terms, which will be applicable from the date of publication).

If you have any objections regarding the terms of use of the Websites or Services, please refrain from using these.

Should any conflict arise between the content of the terms as they are laid out below and the content of the specific terms of use of each Website or Service (displayed above), the specific terms of use of each Website or Service shall always prevail.

In respect of collection and processing of personal data, the Privacy policy will apply.

Registration or Booking

In order to use certain Services, the User must register or complete a booking, creating a username and password and activating an account or just by using the booking details to access the order product of services. To this end, the User must provide a valid email address where the User will receive notifications related to the Services. If the User is a legal entity or business, its username must be its full name or corporate name and the person registering on behalf of the legal entity or business declares that he/she is duly authorized to bind such legal entity or business and that such legal entity or business shall be bound to the terms of the relevant Website/Service.

The User agrees to provide the mandatory information required for registration and also acknowledges that such information is true, complete and up to date. The User is solely responsible for keeping such information updated. Should the User provide false, outdated or incomplete information, or should the Company have reasons to suspect it, the Company reserves the right to suspend or cancel the User’s account.

The User must protect and keep the account password confidential and must not disclose it to third parties. The User must neither allow other Users to access the Services through the User’s account nor use the account of another User to access the Services.

The User is responsible for all operations carried out through the User’s account through any device. If the User suspects that another User is using his account, he/she/it should immediately inform the Company.

The Company may suspend or cancel the User’s account if it considers that the User has breached these terms.

Liability

The User acknowledges and agrees that he/she/it uses the Website and its Services at the User’s own risk and under the User’s responsibility and, therefore, the Company does not accept any responsibility for misuse or use in breach of the terms of the relevant Web Site/Service.

The User will be responsible for any damages to the Company resulting from the User’s use of the Website and the Services in breach of the terms and accepts to indemnify the Company and its directors, employees, agents and representatives from any liability in which they may incur as a result of the User’s breach of these terms.

The Company does not warrant the availability or continuity of the Website or the Services, neither its reliability, quality, completeness, accuracy or whether they are fit for a specific purpose or activity.

As way of example and without limitation, the Company shall not be liable for any damages that may result from:

• Interruptions, viruses, technical problems, interferences, omissions, unavailability, power cuts, failure of the telecommunication networks or the User’s equipment which are not the Company’s responsibility.
• Delays or unavailability of the Website and the Services due to deficiencies or traffic overload on the Internet, in the communication network or the electricity grid.
• Third-party actions.
• Unavailability of the Website and the Services due to maintenance or software updates.
• Any other event beyond the Company’s direct control.

SAVE FOR THE COMPANY’S WILFUL MISCONDUCT, AND THOSE CASES IN WHICH DUE TO THE SPECIFIC CIRCUMSTANCES OF THE USER INVOLVED OR THE NATURE OF THE MATTER, APPLICABLE LAW PROVIDES THAT LIABILITY CANNOT BE LIMITED BY AGREEMENT, USE OF THE WEBSITE AND THE SERVICES IS AT SOLE RISK OF THE USER AND THE COMPANY SHALL NOT BE LIABLE FOR ANY DAMAGE OF ANY KIND CAUSED TO THE USER AS A RESULT OF USING THE WEBSITE AND/OR THE SERVICES.

Regarding contents owned by third parties, whether sponsored or otherwise (if any), the Company acts exclusively as a provider of a search service as requested by the User, without assuming any responsibility for search results.

The insertion of links in the Services does not imply any relationship, recommendation or supervision by the Company of the linked website and, accordingly, the Company does not accept any liability in relation to the content of any linked website except in the specific circumstances provided by applicable law.

Regarding content owned by third parties and offered through the Websites and/or Services in collaboration with the Company (if any), the Company acts exclusively as the provider of the intermediation service between the third parties’ offer of content and the Users interested in downloading them, without any liability in relation to such contents, except for those cases expressly stated by the applicable law.

The Company will make reasonable commercial efforts in order to ensure the accuracy of keywords and descriptions, as well as the identification of content as exclusively for editorial use or any equivalent expression. However, THE COMPANY NEITHER WARRANTS NOR MAKES ANY REPRESENTATION REGARDING ANY KEYWORD, TITLE OR DESCRIPTION; OR THE IDENTIFICATION OR LACK OF IDENTIFICATION OF ANY VISUAL CONTENT AS EXCLUSIVELY FOR EDITORIAL USE. For this reason and notwithstanding any other liability limitation that may be applicable in accordance with these terms, the Company shall neither indemnify nor assume any liability in connection with any claim resulting from inaccurate keywords, titles or descriptions, or from the use of the visual content identified as exclusively for editorial use.

Intellectual Property

All intellectual property rights over the Website, the Services, its design, and source code, and all content included in any of them (including without limitation text, images, animations, databases, graphics, logos, trademarks, icons, buttons, pictures, videos, sound recordings, etc.) belong or are licensed to the Company.

Except as expressly authorized under the terms of the relevant Website/Service, the reproduction or distribution, as well as transformation, producing any derivative works of any kind, public communication, making available, extraction, reuse or any other use of the Website, the Services or its content or any of its parts, is strictly forbidden.

Changes and Closure of the Website

The Company may, at any moment, and without incurring in any responsibility towards the User, modify the content of the Website or the Services, limit or modify the conditions or cease to provide some or all the Services and features available or deactivate and delete all or some of the User accounts and their corresponding information. However, the Company will comply with its obligations regarding the keeping of records in relation to certain transactions for the relevant period as provided by applicable law or refund the Users of Subscriptions in force at that time with the proportional part of the price not accrued before the termination.

General and Contact Information

The use of the Website and the Services and the interpretation and application of these terms shall be governed by Greek Law. Except for those cases in which the applicable law impose a specific jurisdiction, any dispute in connection with these terms shall be resolved by the Courts of Athens (Greece), and the parties expressly waive any other applicable jurisdiction.

If any provision in these terms is declared to be invalid or unenforceable, it shall be substituted or deemed as not included. The remaining provisions in these terms shall not be affected in any way.

May 2020

GrCycling, Travel Agency, 16, Tzaferi Street, 11854, Greece is the owner and, therefore, responsible for the projects indicated below, including any of their subdomains or sections (hereinafter, “Website” as corresponds):

• www.GrCycling.com
• booking.GrCycling.com

GrCycling Company uses both first and third party cookies to ease and personalize the navigation of Users on the Website.

WHAT ARE COOKIES?

A cookie is a small file or device that is placed in the User’s PC (or any other device with access to Internet), when they visit the Website and that is used to store and recover data of Users on the navigation of the Website.

GrCycling Company’s cookies are used to improve on the User’s experience, allowing them to navigate comfortably through the Website, interact with third party sites, provide additional functionalities and additional services to those on the Website and analyze the use of the Site more precisely. For example, the Website is able to place a cookie in your navigator to avoid the User has to remember and enters their password more than once on their visit to the Website.

TYPES OF COOKIES AND PURPOSE

There are different types of cookies with diverse purposes. Some cookies that can be found on the Website are:

• Technical Cookies: These are those that allow the User to navigate through the Website and use the different options or Services available.
• Personalization Cookies: These are those that allow the User to access the Services with some general characteristics predefined in relation to a series of criteria.
• Analysis Cookies: these allow the responsible of the cookies to follow and analyze the behavior of the Users of the Website. The information collected through this kind of cookies is used to measure activity of the Website and elaborate on User navigation profiling, with the purpose of improving and enhancing the Website.
• Publicity Cookies: These cookies allow the management, in the most efficient way possible, of the publicity spaces on the Website related to criteria such as edited content or the frequency at which adverts are shown.
• Behavioral Publicity Cookies: These cookies allow the management, in the most efficient way possible, of the publicity spaces on the Website. These cookies collect data about the User in order to track their activity and behavior on the Website. They remember User’s behavior on the Website through the continued observation of their activity, which allows us to develop a specific profile to show publicity according to the information collected.

We provide you with a list of cookies that are used on the Website:

First Party Cookies

• Language detection: Helps us to collect information about the language preferences of the User to provide visitors with information in their preferred language Duration: Session
• User login: Used to manage and store information about the user login Duration: Session
• Remembers user’s personal ID each time they log on: This cookie is only created if the user agrees to be remembered Duration:30 days
• Avoids CSRF attacks in forms: Duration:2 hours
• Stores information on marketing campaigns in which the User has participated. Duration: 30 days
• Used in the payment process to redirect the user to the payment platform in case they are logged off. Duration: 7 days
• Collects information about visits 2 years Freepik, Flaticon
• Develops statistics Duration: 2 years
• Measures data collected from searches 1 year

Third Party Cookies

In the following table you can find third party cookies used on GrCycling Company’s Website together with a general description. Links to the third parties’ websites are also provided to obtain more information about their privacy policies and cookies policies.
Purpose: Statistics
Google Analytics: Registers users’ activity on the Website and collects information about how the User navigates the site. This allows us to know the user’s activity on the site or on prior interactions.

MORE INFORMATION

The usage of cookies can be modified in the navigator settings. In most navigators, the User may find a “Help” section in the tool bar. For more information, you can find links to cookies settings of the most used browsers below:

• For cookies on Internet Explorer, press here.
• For cookies on Firefox, press here
• For cookies on Chrome, press here
• For cookies on Safari, press here

GrCycling Company remits to these sections to obtain information on how to deactivate or eliminate cookies.

GrCycling Company recommends that Users leave their cookies on as this helps to take advantage of some of the functions on the Website.
This Website also has access to the IP address with which the User accesses the Website. The IP address with which the User accesses the Website cannot be the same in every occasion. Also, the different Users can share one same IP address. Although GrCycling Company does not carry out any actions associated to the IP address with concrete physical people, the access to IP addresses can be considered as a treatment of data due to the potentially identifying character of a physical person that may be associated to this IP, (more a theoretical possibility than a real one), for this, in agreement with the European General Data Protection Regulation (GDPR), it shall be applied what is specified in the Privacy Policy.
Third parties that are advertised on the Website or those that the Users are connected to through plugins, may use cookies or ‘web beacons’ of those that GrCycling Company has no control over. These third parties would not be responsible for or would be covered by the present Cookies and Privacy Policy, therefore, it is responsibility of the User to configure the browser’s settings so that cookies may only be used in agreement with their own preferences.

UPDATES AND CHANGES

GrCycling Company may modify this Cookies Policy in compliance with new legal requirements.