At Costa Navarino (hereinafter “CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS” FOUNDATION ”), we are dedicated to protecting your privacy and safeguarding your personal data. Our mission is to consistently exceed our guests’ expectations in terms of the products and services we provide to our business and leisure travelers. We strive to create an experience that is responsive to our guests’ needs by using the information you entrust us with responsibly. CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS FOUNDATION  is committed to respecting your privacy and adhering to the principles of applicable Greek and European data protection and privacy laws.

We have provided this Privacy Statement as an explanation of the information we collect, how we use it, and how the use of this information can benefit your experience on our premises and your digital experience on our websites. We wish to help you make informed decisions, so please take a moment to read the sections below.

Collection of Personal Data

 CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS FOUNDATION  collects personal data about our guests and visitors through different collection channels such as our website, our Costa Navarino Mobile Application, social media and of course onsite at our premises, so that we can provide an experience that is responsive to our guests’ and visitors’ needs. We endeavor to collect your personal data only with your knowledge and with your permission, if necessary. “Personal Data” are data that identify you as an individual or relate to an identifiable individual. Throughout your experience with us, we collect Personal Data in accordance with law, such as:

• Identity Data, e.g. name, surname, passport, visa or other government-issued identification data, tax number, membership or loyalty program data
• Demographic Data: place and date of birth, gender, nationality, language preference
• Contact Data, e.g. home or work postal address, work and personal e-mail address, telephone (Home/ Work/mobile) and fax numbers
• Family Data: data about family members and companions, such as names and ages of children
• Financial and Travel Data: Credit and debit card number or other payment data, Financial information in limited circumstances, Travel itinerary, tour group or activity data
• Social Media Data: social media account ID, profile photo and other data publicly available, or data made available by linking your social media
• Lifestyle Data: Guest preferences and personalized data, such as prior guest stays or interactions, goods and services purchased, your interests, activities, hobbies, food and beverage choices, services and amenities of which you advise us or which we learn about during your visit
• Health Data, e.g. as required for participation in certain activities, use of services and special service and amenity requests

How we collect Personal Data

 CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS” FOUNDATION collects personal information you provide, through multiple communication channels, such as:

• Data collection in our premises: We may collect personal data during your stay in our premises by asking you to fill in certain documents/forms in relation to your overall accommodation, check-in, concierge services, restaurants, spa treatments, activities (e.g. golf/ fitness activities), child care services and equipment rental. We also collect Personal Data when you make a reservation over the phone, communicate with us by email, fax or via online chat services or contact customer service. These communications may be recorded for purposes of quality assurance and
• Online Services/Website: We collect Personal Data when you communicate with us through our website, or otherwise connect with us or post to social media pages, or sign up for a newsletter or participate in a survey, contest or promotional
• Surveys and questionnaires: We may also collect further demographic data or other personal information via surveys and
• Through our Mobile Application CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS” FOUNDATION collects personal data that you may provide by downloading and registering to our Application. Registration with us is optional. However, if you don’t register with us you may not be able to use some of the features offered by the Application. When you register with us and use the Application, you generally provide: (a) your name, last name, email address, user name, password and other registration information; (b) transaction-related information, such as for when you make reservations; (c)information you provide us when you contact us for help; In addition, the Application may collect certain information automatically, including, the type of mobile device you use, your mobile devices unique device ID, the IP address of your mobile device, your mobile operating system, the type of mobile Internet browsers you use, and information about the way you use the Application.

• Events: Whether you plan an event with us or you just attend one as a guest, we may collect your personal data about the theme and date of the event, statistics and other personal information of guests attending the event. We may share personal information about you with event planners or third-party service providers or vice
  • Real Estate Offers: In case you are interested in obtaining more information about real estate opportunities, we may collect information about you, such as identity (e.g. name, surname) or contact data (e.g. telephone home or work address, work and personal e-mail address) telephone (Home/ Work/mobile) and eventually your Express of Interest either for a certain real estate opportunity or/and in order to provide you in the future with the most appropriate property offers and
• Third Parties: We may also collect information about you from third parties (such as airline companies, travel agents, real estate agents, and other business partners), as well as from other sources that share your data with us pursuant to legal or contractual obligations. We may also further use and share this information for the same

Special Categories of Personal Data – Sensitive Personal Data

The notion of “special categories of personal data” or “sensitive personal data” refers to personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. We do not collect sensitive personal data, unless you provide us them as required for participation in certain activities, use of services and special service and amenity requests, along with an explicit consent for every related purpose of processing.

Purpose for collection, processing, and disclosure

CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS FOUNDATION  is fully committed to providing you with information on the collection and use of your personal data while visiting our premises, using our websites, products and services. We ask for your personal data only to the extent that we need it or intend to use it for the following purposes:

• providing the services you request, based on our contractual relationship and our legal obligations. We use Personal Data to provide services you request, including:
  • To facilitate reservations, payment, send administrative information, confirmations or pre-arrival messages, to assist you with meetings and events and to provide you with other information about the area and the property at which you are scheduled to visit
  • To complete your reservation and stay, for example, to process your payment, ensure that your room is available and provide you with related customer service
• marketing and communication purposes in relation to our products and services, our strategic marketing partners, and other trusted third parties based on your consent. In this case you may receive tailor made offers & benefits, invitations to events, newsletters and optional participation in surveys, based on your preferences and your interests. In any case, you are entitled to withdraw any time your consent or/and to object to such processing of your personal data, without any negative consequence for you.
• performing market research via surveys to better serve your needs and improve your experience at Costa Navarino, improve the efficiency of our websites and our various means of communications, facilitate our advertising campaigns, and/or promotional activities, based on our legitimate business interest.

In particular, we may use your personal information for further processing purposes, as set forth below in more detail:

Transfer of data

 In most cases, the information you provide us is added to a local or global database. In the course of processing your information, it may be necessary to transfer your personal data to our affiliates within the Costa Navarino/Westin system and/or third-party service providers located in Greece and throughout the world for the purposes outlined within this Privacy Statement. In general, CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS FOUNDATION  does not sell, rent, or give physical possession of your personal data to unaffiliated third parties outside the Costa Navarino system.

Situations in which CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS FOUNDATION  may disclose your information to others may include:

 

• when we have your prior consent ;
• when sharing or disclosing your information is required, in order to offer you products or services (e.g. reservations);
• when third parties or service providers acting on behalf of CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS FOUNDATION require such information, subject to your prior consent;
• when necessary in order to comply with contractual obligations;
• when we must comply with legal or regulatory requirements or obligations, in accordance with applicable law or court order;
• In case of emergency such as to safeguard the life, health, or property of an

In all the above cases, we shall endeavor to limit the scope of personal information that is being disclosed to the amount necessary for the performance of the specific function. Unless otherwise precluded by legal requirements, we require third parties to protect your personal data and abide by applicable privacy laws and regulations.

Consent

 As part of our commitment to keep you informed, and upon obtaining your consent, we may mail, e- mail, telephone, text (SMS or MMS) or contact you by any other means to notify you of new Costa Navarino products and services, or upcoming Costa Navarino special offers, events, or other relevant information that may be of interest to you. We always offer you the option to decline any or all of these communications by following the directions included in our e-mails or other communications, or by contacting CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS FOUNDATION  directly. We would like to keep all of our guests and visitors informed and equally able to take advantage of the benefits offered by CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS FOUNDATION  and its strategic marketing partners.

In case of special categories of personal data – sensitive personal data, as afore-described, we make  sure to obtain in advance explicit consent (opt in) before any processing of them.

On-line technologies

 CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS FOUNDATION  may use cookies, invisible pixels, and web beacons to obtain information about you while visiting our websites. A cookie is a very small text file that is sent to your browser from a web server and stored on your computer’s hard drive. It assigns the computer with a unique identifier, which in turn, becomes your identification card whenever you return to the Costa Navarino website.

Cookies are designed to save you time because they help us to provide you with a customized experience without you having to remind us of your preferences each time you return to our web-pages. Cookies of the Costa Navarino website are not designed to damage your files, nor can they read information from other files on your computer hard drive.

Cookies can also help us provide you with a personalized on-line experience in the following ways:

• they remember your user name and password for future visits so log-in is easier and faster
• they ensure you are provided with the appropriate frames and content
• they ensure you obtain all requested information
• they help us deliver communications that are relevant and responsive to your interests and location

Cookies of the Costa Navarino website might follow you when traveling on the Internet after leaving the Costa Navarino website. We track the usage of our website in order to better meet your needs and to help make it easier for you to find information in the future. Please note that in addition to CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS FOUNDATION  cookies, various third parties may also place cookies on your computer’s hard drive as you navigate throughout other webpages on the web. CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS FOUNDATION  is not responsible for the presence or absence of third party cookies, or for the technological capabilities or practices employed by third parties in connection with third party cookies.

If you would prefer not to have the benefits of cookies, your Internet browser can be adjusted to treat cookies in different ways. Depending upon the type of browser you are using, you may be able to configure your browser so that: (i) you are prompted to accept or reject cookies on an individual basis or

• you may be able to prevent your browser from accepting any cookies at all. You should refer to the supplier or manufacturer of your web browser for specific details about cookie security. However, you should also understand that rejecting cookies might affect your ability to perform certain transactions on our websites and our ability to recognize your browser from one visit to the

CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS FOUNDATION  also uses invisible pixels, sometimes called web beacons, to count how many people visit certain web pages. Information collected from invisible pixels is used and reported in the aggregate and does not contain personal data. CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS FOUNDATION  may use this information to improve marketing programs and content.

Costa Navarino website uses Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses “cookies”, which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of the website will be transmitted to and stored by Google on servers in the United States. Google will use this information on behalf of the operator of this website for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing them other services relating to website activity and internet usage. The IP-address that your Browser conveys within the scope of Google Analytics, will not be associated with any other data held by Google. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website.

Links to other websites

 In order to anticipate your needs, the Costa Navarino website provides links to other websites for your convenience and information. CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS FOUNDATION  is not responsible or liable for any content presented by or contained on any independent website, including, but not limited to, any advertising claims or  marketing practices. Please note that while CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS FOUNDATION  will protect your information on CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS FOUNDATION  owned and operated websites, we cannot control and will not be responsible for the privacy policies of third party websites, including websites owned or controlled by operators, third party owners of hotel, resort, interval ownership, or residence properties that may use the name of a Costa Navarino brand, or websites not controlled or authorized by CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS” FOUNDATION . Third party websites that are accessed through links on our website have separate privacy and data collection practices, and security measures. Please note that the online booking process is managed by a third party through their websites. We have no responsibility or liability for the practices, policies and security measures implemented by third parties on their websites. We encourage you to contact them to ask questions about their privacy practices, policies and security measures before disclosing any personal data. We recommend that you review the privacy policies of linked websites to understand how those websites collect, use and store information.

Minors

 CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS FOUNDATION  does not seek to obtain nor does it wish to receive personal data directly from minors (i.e. under the age of 15) without their parental or legal guardian’s consent; however, we cannot always determine the age of persons who access and use our websites. If a minor (as defined by applicable law) provides us with his/her data without parental or guardian consent, we will not proceed with any data processing, unless the parent or guardian contact us having this information removed.

Your Rights

 Under the current privacy protection legislation, you have the following rights:

• You may ask to know if your personal data is being collected and to what extent;
• You may request a copy thereof;
• You may request that this data be corrected or completed if you believe it is incorrect or incomplete;
• You may request that your personal data be deleted. In this case, CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS” FOUNDATION /Costa Navarino will delete them unless it decides to retain them for one of the legitimate reasons under which it is entitled to refuse;
• You may object to any of the processing purposes or you may request that their processing be limited;

In these cases, CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS FOUNDATION  will respond in writing within 30 days of receipt and identification of the request.

In addition, in the event of exercising one or more of the above-mentioned rights of correction, deletion and restriction of your data, these requests shall also be forwarded to any third-party recipient to whom the personal information may have been disclosed in the scope of pursuance of the afore-mentioned processing purposes.

Data Protection Officer (DPO)

 To further facilitate customers’ communication and enforce their afore-mentioned rights related to their personal data, CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS FOUNDATION  and Costa Navarino system have appointed a Data Protection Officer (DPO), whom you may contact at:

Data Protection Office CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS” FOUNDATION ,

5 Pentelis str., P. Faliro, 17564

E-mail: dpo@costanavarino.com

Tel: +30 210 9490249

In case you consider your personal data affected in any way, you may contact the Greek national Data Protection Authority, as follows:

Website: www.dpa.gr

Postal Address: 1-3 Kifissias Avenue, PC 115 23, Athens

Call Center: +30 210 6475600

Fax: +30 210 6475628

E-mail: contact@dpa.gr

Information Security

 CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS” FOUNDATION /Costa Navarino has already applied the necessary technical and organizational measures and if needed we are willing to take any further reasonable measure to: (i) protect personal information from unauthorized access, disclosure, alteration or destruction, and (ii) keep personal information accurate and up-to-date, as appropriate. All CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS FOUNDATION  owned websites and servers have security measures in place to help protect your personal data against loss, misuse, and alteration while under our control. Although “guaranteed security” does not exist either on or off the Internet, we safeguard your information using both procedural and technical safeguards, including password controls and “firewalls”.

Please, notice that CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS FOUNDATION  will never contact you by mobile or email to ask for your confidential personal data or payment card details. We may only ask for payment card details by telephone when you are booking a reservation or promotional package.

Retention Period of Personal Data

Your personal data are retained for a predetermined and limited period depending on the purpose of processing, after the end of which, these personal data are being deleted from our files unless another retention period is required or permitted by applicable law.

Updates to the Privacy Statement

 CAPTAIN VASSILIS AND CARMEN CONSTANTAKOPOULOS FOUNDATION  may amend this Privacy Statement from time to time in order to meet changes in the regulatory environment, business needs, or to satisfy the needs of our guests, properties, strategic marketing partners, and service providers. Updated versions will be posted to our website and date stamped so that you are always aware of when the Privacy Statement was last updated.

Last Revised: 21 May, 2018