GDPR

GDPR

Athens Climbing Project AE (operating under the trade name “Mono”) (hereinafter “Mono”, “we”, “us”) is committed to protecting your privacy. Our aim is to always respect the personal data we collect from you or receive from others and to keep it secure. This Privacy Notice (the “Notice”) outlines our practices regarding data processing, as well as your rights and choices regarding how your personal data is collected and used (including through our website – www.monoclimb.gr).

This Notice contains important information about your privacy rights. Please read it carefully to understand how we use your personal data.

Providing your personal data is voluntary. However, if you choose not to provide your personal data, your use of our services or interaction with us may be hindered. For example, you may not be able to register as a member or make online reservations.

Contents of this policy:

1. How we collect your personal data
2. What personal data we use
3. How and why we will use your personal data
4. Legal bases
5. Contact for marketing/fundraising purposes
6. Children’s personal data
7. How long we keep your personal data
8. Will we disclose your personal data?
9. Security/storage and access to your personal data
10. International data transfers
11. Exercising your rights
12. Changes to this Notice
13. Links and third parties
14. How to contact us

How we collect your personal data:

a) When you provide it to us directly
For example, personal data you submit via our website, such as pre-registration in our database, via reception tablets, booking to use our facilities, signing up for our newsletter, or personal data you give us when you contact us via email or phone.

b) When we receive it indirectly
For example, your personal data may be disclosed to us by third parties, including third-party service providers, analytics providers, and search information providers. If we have not already done so, we will inform you when we receive personal data about you from them and tell you how and why we intend to use that data.

c) When it is publicly available
Your personal data may be available to us from external publicly available sources. For example, depending on your privacy settings for social networking services, we may have access to information from those accounts or services (e.g., when you choose to interact with us via Facebook, Instagram, Twitter, and Google).

d) When you visit our website
When you visit our website, we automatically collect the following types of personal data:

i) Technical information, including the IP address used to connect your device to the internet, browser type and version, time zone settings, browser plug-in types and versions, and operating systems and platforms.

ii) Information about your visit to the website, including the URL clickstream to, through, and from the website (including date and time), services viewed or searched for, page response times, download errors, duration of visits to certain pages, referral sources, page interaction information (such as scrolling and clicks), and methods used to exit the page.

iii) We collect and use your personal data through cookies on our website – please see our Cookie Notice on the website.

Generally, we may collect personal data from a combination of the sources listed in points a–d above for the purposes specified in this Notice.

What personal data do we use?

We may collect, store, and process the following types of personal data:

• Your name and contact information, including postal address, phone number, email address, emergency contact details, and if applicable, your social media identifiers.
• Your date of birth and gender
• Your financial information, such as bank account details and/or credit/debit card details
• Information about your device and your visits to the website, for example, your IP address and geographic location
• Descriptions and photographs
• Details of your qualifications/work experience
• CCTV recordings
• Information about medical incidents or accidents on our premises
• Medical information you disclose when using our facilities and any other personal information received as described in section 1 above.

Do we process special categories of data?

The EU General Data Protection Regulation (“GDPR”) recognizes certain categories of personal data as sensitive and requiring greater protection—such as health information, ethnicity, and religious beliefs.

In some cases, we may collect and/or use these special categories of data (e.g., health status of climbers relevant to the use of our facilities). We will only process such data if there is a valid reason and if permitted under the GDPR.

How and why will we use your personal data?

Your personal data, as provided, will be used for the purposes identified in this Notice. Specifically, we may use your personal data:

a) To register you as a member of Mono
b) To enable you to book use of our facilities
c) To provide you with services, products, or information you have requested
d) To provide further information about our work, services, or activities (where necessary, and only with your consent to receive such information)
e) To assist you in participating in certification programs
f) To respond to your questions and requests and to communicate with you generally
g) To enable you to apply for a job or volunteer position with us
h) To manage our relationships with partners and service providers
i) To analyze and improve our work, services, activities, products, or information (including our website), or for internal records
j) To protect our premises
k) To operate/manage Mono’s activities, including our website, and to ensure content is presented in the most effective way for you and your device
l) To audit and/or manage our financial records
m) To comply with legal obligations binding upon us, such as in relation to regulatory authorities, public bodies, or law enforcement (e.g., tax requirements or anti-money laundering)
n) To prevent fraud or misuse of services
o) To establish, defend, or enforce legal claims

The processing of your personal data for the above purposes will be adequate, relevant, and limited to what is necessary for the intended purposes.

Legal Bases

Under the GDPR, we are required to rely on one or more lawful bases when using your personal data. The following processing reasons may apply:

a) Where you have provided your consent to use your personal data in a specific way (e.g., consent to receive email newsletters or to collect special categories of personal data—outlined in section 2 above).

b) Where it is necessary to comply with a legal obligation (e.g., if we are required to disclose your personal data to regulatory authorities overseeing our activities and services).

c) Where it is necessary to fulfill a contract to which you are a party or to take steps at your request before entering into a contract (e.g., to provide access to our facilities in return for your booking fee).

d) Where vital interests are at stake (e.g., in the event of a medical emergency involving a climber).

e) Where we have a legitimate interest in doing so.

The GDPR allows us to collect and process your personal data if it is reasonably necessary for our legitimate interests or those of a third party (provided such processing is fair, balanced, and does not unduly impact your individual rights).

Generally, by “legitimate interests” we mean the interests involved in operating Mono as a commercial entity and ensuring the best possible experience for our clients.

When we process your personal data for these legitimate interests, we consider and balance any impact on you (positive and negative) and your rights under data protection laws. We will not use your personal data for activities where our interests are overridden by the impact on you (unless otherwise required or permitted by law).

Contact for marketing/fundraising purposes

We may use your contact details to provide information about our activities, events, services, and/or initiatives we believe may interest you (e.g., related to services or special events).

Let me know if you would like the rest of the document translated as well.

Here is the continuation of the translation of the Privacy Notice (GDPR section) from Greek to English:

Contact for marketing/fundraising purposes (continued)

We will only send you marketing communications by email, SMS, or phone if you have expressly given your consent for us to do so.

You can update your preferences or unsubscribe from marketing communications at any time by contacting us at info@monoclimb.gr or by clicking the “unsubscribe” link in any marketing email we send you.

Children’s personal data

We may collect and use personal data for children (under 18 years old) only with the prior written consent of a parent or guardian and only for the purposes of using our facilities, participation in events, or other services we offer.

How long do we keep your personal data?

We keep your personal data for as long as necessary for the purposes set out in this Notice and to comply with legal obligations, resolve disputes, and enforce agreements.

When we no longer need your personal data, we will securely delete or anonymize it.

Will we disclose your personal data?

We do not sell, rent, or share your personal data with third parties for marketing purposes.

However, we may disclose your personal data to third parties in the following situations:

• To service providers, subcontractors, and partners who help us provide services (such as IT support, payment processing, marketing platforms), only to the extent necessary to perform those services on our behalf, and always under confidentiality obligations.
• When required by law, regulation, or legal process.
• To protect our rights, property, and safety, or those of others.
• In case of a merger, acquisition, or asset sale, your personal data may be transferred to the new owner.

Security/storage and access to your personal data

We are committed to keeping your personal data secure. We have implemented appropriate technical and organizational measures to protect it against unauthorized access, loss, destruction, or alteration.

Only authorized personnel and third parties acting on our behalf have access to your personal data, and they are required to treat it as confidential and use it only for the purposes set out in this Notice.

International data transfers

In some cases, we may transfer your personal data outside the European Economic Area (EEA) to countries that may not have the same level of data protection as those within the EEA. When we do this, we ensure that your personal data is protected, for example, by using standard contractual clauses approved by the European Commission or other appropriate safeguards.

Exercising your rights

You have the following rights under the General Data Protection Regulation (GDPR):

• Right to access: You can request a copy of your personal data we hold.
• Right to rectification: You can request that we correct any incomplete or inaccurate data.
• Right to erasure: You can request the deletion of your data where there is no legitimate reason for us to continue processing it.
• Right to restrict processing: You can ask us to suspend processing of your personal data.
• Right to data portability: You can request the transfer of your personal data to another organization.
• Right to object: You can object to the processing of your data where we rely on a legitimate interest.
• Right to withdraw consent: If we rely on your consent, you can withdraw it at any time.

To exercise any of your rights, please contact us at info@monoclimb.gr. We may ask for verification of your identity before fulfilling your request.

If you believe that your rights regarding your personal data have been violated, you also have the right to file a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

Changes to this Notice

We may update this Privacy Notice from time to time to reflect changes in our practices or legal obligations. The updated version will be posted on our website with the revised date.

We encourage you to review this Notice periodically.

Links and third parties

Our website may contain links to other websites operated by third parties. We are not responsible for the privacy practices of those sites. We encourage you to review their privacy notices before providing them with any personal data.

How to contact us

If you have any questions about this Notice or how we handle your personal data, please contact us at:

Athens Climbing Project AE (Mono)
Email: info@monoclimb.gr