SCOPE
OLYMPIACOS FC S.A. (hereinafter referred to as the “Club,” “we,” or the “Data Controller”) attaches the utmost importance to the protection of the privacy of users of its official Website, its Social Media accounts, and its official Video Sharing Platforms (hereinafter referred to as “you”), and takes all necessary organisational and technical measures to ensure its full and continuous compliance with the applicable national and European legislative and regulatory framework governing the protection of personal data.
This Privacy Policy provides detailed information regarding the manner in which your personal data are processed when you:
a) visit our Website,
b) register with and/or use the Club’s official corporate accounts on social media platforms or digital applications (apps), such as indicatively Facebook, Instagram, X, YouTube, TikTok, Viber, Threads, LinkedIn, WhatsApp,
c) purchase Tickets through the Website.Furthermore, this Privacy Policy provides detailed information regarding:
– the purposes for which we collect, use, and process your personal data,
– the legal basis for such processing, as well as
– your rights as data subjects,
in full compliance with the transparency and information obligations imposed by the General Data Protection Regulation (GDPR).
This Privacy Policy provides detailed information regarding the manner in which your personal data are processed when you:
a) visit our Website,
b) register with and/or use the Club’s official corporate accounts on social media platforms or digital applications (apps), such as indicatively Facebook, Instagram, X, YouTube, TikTok, Viber, Threads, LinkedIn, WhatsApp,
c) purchase Tickets through the Website.Furthermore, this Privacy Policy provides detailed information regarding:
– the purposes for which we collect, use, and process your personal data,
– the legal basis for such processing, as well as
– your rights as data subjects,
in full compliance with the transparency and information obligations imposed by the General Data Protection Regulation (GDPR).
DEFINITIONS
“General Data Protection Regulation (GDPR)” means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, as incorporated into the Greek legal order by Law 4624/2019, as currently in force, including any amendments thereto.
“Health Data” means personal data relating to the physical or mental health of a natural person, including the provision of health care services, which reveal information about the individual’s state of health. Such data include, indicatively, medical diagnoses and medical opinions, medical history, test and examination results, disability information or disability percentage, information relating to injuries, medication, dietary habits, medical certificates (e.g. fitness to play, sick leave), data generated by wearable devices insofar as they reveal a health condition, as well as indirect indicators of health, where these lead to conclusions regarding the medical condition of the Data Subject.
“Tickets” means Season Tickets for Olympiacos FC S.A. home matches, Single-Match Tickets, Tickets for the Olympiacos Museum, as well as Tickets for any other event made available through the Website or the Communication Channels.
“Processor” means the natural or legal person, public authority, agency, or other body which processes personal data on behalf of the Data Controller.
“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
“Website” means the official website of Olympiacos FC S.A., www.olympiacos.org, or as it may be renamed in the future.
“Communication Channels” means collectively the Website, the Club’s Social Media accounts, as well as all forms of digital communication between supporters and Olympiacos FC S.A.
“Members” means the holders of Membership Cards or Supporter Cards issued by the amateur sports club “OLYMPIACOS S.F.P.”.
“Privacy Policy” means the policy governing the protection of users’ privacy and the protection of personal data when interacting with Olympiacos FC S.A., as published on the Club’s Website.
“Personal Data” means any information relating to an identified or identifiable natural person (the “Data Subject”).
“Data Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union law or Member State law, the Data Controller or the specific criteria for its designation may be provided for by Union law or Member State law.
“Personal Data Subject” means the natural persons for whom the Data Controller collects and processes personal data (for the purposes of this Privacy Policy, Data Subjects are the users of the Communication Channels, whether identified or not, in connection with the use of a service).
“Sponsor(s)” means the official Sponsors of Olympiacos FC S.A., as listed on the Website.
“Health Data” means personal data relating to the physical or mental health of a natural person, including the provision of health care services, which reveal information about the individual’s state of health. Such data include, indicatively, medical diagnoses and medical opinions, medical history, test and examination results, disability information or disability percentage, information relating to injuries, medication, dietary habits, medical certificates (e.g. fitness to play, sick leave), data generated by wearable devices insofar as they reveal a health condition, as well as indirect indicators of health, where these lead to conclusions regarding the medical condition of the Data Subject.
“Tickets” means Season Tickets for Olympiacos FC S.A. home matches, Single-Match Tickets, Tickets for the Olympiacos Museum, as well as Tickets for any other event made available through the Website or the Communication Channels.
“Processor” means the natural or legal person, public authority, agency, or other body which processes personal data on behalf of the Data Controller.
“Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
“Website” means the official website of Olympiacos FC S.A., www.olympiacos.org, or as it may be renamed in the future.
“Communication Channels” means collectively the Website, the Club’s Social Media accounts, as well as all forms of digital communication between supporters and Olympiacos FC S.A.
“Members” means the holders of Membership Cards or Supporter Cards issued by the amateur sports club “OLYMPIACOS S.F.P.”.
“Privacy Policy” means the policy governing the protection of users’ privacy and the protection of personal data when interacting with Olympiacos FC S.A., as published on the Club’s Website.
“Personal Data” means any information relating to an identified or identifiable natural person (the “Data Subject”).
“Data Controller” means the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union law or Member State law, the Data Controller or the specific criteria for its designation may be provided for by Union law or Member State law.
“Personal Data Subject” means the natural persons for whom the Data Controller collects and processes personal data (for the purposes of this Privacy Policy, Data Subjects are the users of the Communication Channels, whether identified or not, in connection with the use of a service).
“Sponsor(s)” means the official Sponsors of Olympiacos FC S.A., as listed on the Website.
PURPOSES OF PROCESSING
The Club collects and processes your personal data, as described in this Privacy Policy, exclusively for the purposes set out below and only to the extent strictly necessary for their proper and effective fulfilment:
User Communication and Support
• Provision of information upon your request.
• Responding to your messages, requests, or comments.
• Ensuring smooth communication with and support for users of the Website.
Commercial Communication and Promotion of Activities
• Sending informational and promotional material relating to news, initiatives, events, competitions, tickets, products, and services of the Club and/or its Sponsors, provided that you have given your relevant consent.
• Promotion of the Club’s activities and commercial initiatives and/or those of its cooperating Sponsors.
Personalisation of Experience and Improvement of Services
• Personalisation and enhancement of the user experience across the Club’s digital platforms.
• Adaptation of content, products, and services to your preferences and choices.
• Improvement of the functionality, security, and performance of the Website and the Club’s applications.
Use and Behaviour Analysis
• Analysis of the behaviour and habits of users of the Website and the Club’s digital services.
• Statistical analysis, measurement of traffic, and evaluation of the effectiveness of actions and campaigns.
Data Analytics, Market Research, and Profiling
• Conducting internal research and analysis to understand the behaviour of supporters, Members, and participants in the Club’s initiatives.
• Analysis, categorisation, and grouping of data in order to identify common characteristics and preferences (e.g. based on activity, age groups, or geographical area).
• Creation of supporter profiles for the purpose of sending targeted and relevant communications and developing new products and services, including through the use of anonymised or aggregated third-party data.
Performance of Contractual and Pre-Contractual Relationships
• Performance of the Club’s contractual obligations towards users, in particular in relation to the issuance, distribution, and management of tickets.
• Ensuring the smooth operation of the transactional relationship between the Club and users.
Legal Compliance, Security, and Protection of Interests
• Compliance with obligations arising from the applicable legislative and regulatory framework, including sports legislation.
• Establishment, exercise, or defence of the Club’s legal claims, as well as its defence against such claims.
• Management of business risks and protection of the assets and legitimate interests of the Club.
Accounting, Tax, and Regulatory Purposes
• Use of data for tax purposes, invoicing, issuance of receipts, and compliance with related record-keeping obligations.
The above purposes do not entail automated decision-making producing legal effects concerning you or similarly significantly affecting you, unless expressly provided for and following specific prior notice to you.
User Communication and Support
• Provision of information upon your request.
• Responding to your messages, requests, or comments.
• Ensuring smooth communication with and support for users of the Website.
Commercial Communication and Promotion of Activities
• Sending informational and promotional material relating to news, initiatives, events, competitions, tickets, products, and services of the Club and/or its Sponsors, provided that you have given your relevant consent.
• Promotion of the Club’s activities and commercial initiatives and/or those of its cooperating Sponsors.
Personalisation of Experience and Improvement of Services
• Personalisation and enhancement of the user experience across the Club’s digital platforms.
• Adaptation of content, products, and services to your preferences and choices.
• Improvement of the functionality, security, and performance of the Website and the Club’s applications.
Use and Behaviour Analysis
• Analysis of the behaviour and habits of users of the Website and the Club’s digital services.
• Statistical analysis, measurement of traffic, and evaluation of the effectiveness of actions and campaigns.
Data Analytics, Market Research, and Profiling
• Conducting internal research and analysis to understand the behaviour of supporters, Members, and participants in the Club’s initiatives.
• Analysis, categorisation, and grouping of data in order to identify common characteristics and preferences (e.g. based on activity, age groups, or geographical area).
• Creation of supporter profiles for the purpose of sending targeted and relevant communications and developing new products and services, including through the use of anonymised or aggregated third-party data.
Performance of Contractual and Pre-Contractual Relationships
• Performance of the Club’s contractual obligations towards users, in particular in relation to the issuance, distribution, and management of tickets.
• Ensuring the smooth operation of the transactional relationship between the Club and users.
Legal Compliance, Security, and Protection of Interests
• Compliance with obligations arising from the applicable legislative and regulatory framework, including sports legislation.
• Establishment, exercise, or defence of the Club’s legal claims, as well as its defence against such claims.
• Management of business risks and protection of the assets and legitimate interests of the Club.
Accounting, Tax, and Regulatory Purposes
• Use of data for tax purposes, invoicing, issuance of receipts, and compliance with related record-keeping obligations.
The above purposes do not entail automated decision-making producing legal effects concerning you or similarly significantly affecting you, unless expressly provided for and following specific prior notice to you.
DATA COLLECTED
Collection and Use of Non-Personal Data during Simple Browsing of the Website
When you visit the Website without providing us with data in any other manner (such as, indicatively, through a registration process), the Club collects only the technically necessary data, which are automatically transmitted to our server by your web browser (“log data”). Such data may include, in particular: the IP address through which your device connects to the internet, the type and version of the web browser you use, the referring URL, the date and time of your visit to the Website, the duration of your stay on each page, as well as other statistical or technical information generated through technically necessary or functional cookies. For more information, you may refer to the Club’s Cookie Policy at the following address: https://www.olympiacos.org/politiki-cookies/
Collection and Use of Data when accessing and interacting with Social Media, Social Plug-ins, and Hashtags
Olympiacos FC S.A. maintains official accounts on social media platforms, applications, and video-sharing platforms (indicatively Facebook, Instagram, X/Twitter, YouTube, TikTok, Viber) and integrates social plug-ins of such platforms into its Website.
Within this context, the Club may receive or have access to certain information, as described below.
a. Access to Content – Anonymous or Non-Logged-In Use
When you access the Club’s official accounts on social media platforms or the relevant content, even if you do not have an account or are not logged in to the respective social network, the Club receives only aggregated, statistical, and anonymised usage data (such as the number of visits or interactions), which are provided by the respective social network through reporting tools (insights).
Such data do not allow your identification, are not linked to specific user profiles, and do not constitute personal data within the meaning of the GDPR. Consequently, no data-retention period is applicable.
b. Technical Connection via Browser, Applications, or Social Plug-ins
When you visit the Club’s Website or interact with social plug-ins of social media platforms, the browser or application you use establishes a direct technical connection with the servers of the respective social network.
Within this context, the social network may collect technical information (such as IP address, device information, and browser data), even if you do not have an account or are not logged in. Such information:
• is transmitted directly to the servers of the respective provider,
• may be stored on servers outside the European Union or the European Economic Area,
• is not collected, stored, or accessible by the Club.
If you are logged in to the social network at the time of your visit or upon activation of a plug-in, your visit or interaction may be directly associated with your personal account by the social media provider.
c. Interaction with the Club’s Official Pages on Social Media Platforms
When you engage in any form of interaction with the Club’s official pages on social media platforms (indicatively: following an account, “Like”, Follow, reaction, sharing, or posting a comment), the relevant information becomes visible on the respective social network and to your contacts, in accordance with your account settings.
The Club may have access to limited personal data made available through the platform (such as full name, gender, or age category), without, however:
• storing such data in internal files or databases,
• extracting or combining them with other data,
• using them for purposes other than facilitating communication and managing its official accounts.
Any further processing of such data is carried out exclusively by the respective social network, in accordance with its Terms of Use, Privacy Policy, and Cookie Policy.
d. Use of Hashtags on Social Media Platforms
The Club may process public user posts that include hashtags related to the Club (e.g. #olympiacosfc), for the purpose of displaying and sharing supporter-generated content on the Website or on its official social media accounts.
Such processing is based on the legitimate interest of the Club (Article 6(1)(f) GDPR), consisting in the promotion of its activities and the enhancement of interaction with the supporter community.
Where such posts depict you or third parties, processing is carried out only upon consent, in accordance with Article 6(1)(a) GDPR. By using the hashtag #olympiacosfc in a public post, you grant your consent to the Club. Such consent may be withdrawn at any time with future effect by submitting a relevant request to dpo@olympiacos.org, without affecting the lawfulness of processing carried out prior to the withdrawal.
e. Management of Comments and Content
The Club reserves the right to remove or conceal comments or posts that violate the terms of use of its official accounts or the applicable legislation (indicatively, offensive, unlawful, or malicious content).
The Club does not modify the content of your comments, nor does it carry out any further processing of your personal data beyond what is described above. You may at any time delete or modify your posts, as well as adjust the level of protection of your personal data through the settings of your personal account on the respective social network.
f. Legal Basis for Processing
The processing of the above data by the Club is carried out on the basis of its legitimate interest (Article 6(1)(f) GDPR) to provide a technically functional, secure, and reliable presence and interaction across its digital channels. Such data are not combined with other sources, unless expressly provided for and following appropriate prior notice.
Collection and Use of Data when completing the Contact Form
If you use the contact form on our Website, the Club processes the personal data that you voluntarily provide, which may include, indicatively:
• Your first name
• Your surname
• Your email address
• The comment or message you submit to us
The data you provide via the contact form are used exclusively for communication purposes and are processed by the Club until your request has been definitively handled and responded to. Following the completion of the communication, the data are stored in our database solely for purposes relating to the establishment, exercise, support, or defence of any legal claims of the Club, or for such period as is required by the applicable statutory record-keeping obligations.
The legal basis for such processing is Article 6(1)(b) GDPR (processing necessary for the taking of steps at the request of the data subject prior to entering into a contract).
Commercial Communication – Newsletter, Content Personalisation, and Sponsor Communications
a. Collection and Use of Data upon Subscription to the Newsletter
Following your relevant request, which incorporates your consent, the Club processes your personal data for the purpose of sending newsletters and promotional material via electronic mail. The newsletters include information regarding current events, initiatives, activities, events, and commercial offers of the Club and its Sponsors.
Subscription to the newsletter is possible exclusively:
a) provided that you have reached the age of fifteen (15) years, which you are required to confirm at the time of subscription, and
b) upon provision of your explicit consent.
In the event of your subscription, the Club processes the following personal data for the purpose of sending the newsletter:
• Your first name
• Your surname
• Your mobile phone number
• Your email address
• Any optional data you may provide (e.g. country, language, name, date of birth, etc.)
The processing of the above data aims to inform you about Club news, competitions, Tickets, initiatives, events, as well as offers for products and services of the Club and its official sponsors or partners.
The legal basis for such processing is Article 6(1)(a) GDPR (consent).
Your personal data are retained:
(i) until you withdraw your consent with future effect. You may unsubscribe from the newsletter at any time via the relevant link included at the end of each newsletter email or by submitting a relevant request to the email address: dpo@olympiacos.org. Any processing of the data carried out up to the time of withdrawal of consent remains unaffected.
(ii) for as long as you demonstrate interest in receiving the newsletters. The absence of withdrawal of consent constitutes confirmation of such interest.
Beyond the above, the data are stored solely for the purposes of supporting legal claims or defending the Club against legal claims, or for such period as is required by mandatory data retention provisions.
b. Personalisation of Messages and Content
Provided that you have given your explicit consent:
• via the cookie banner for personalisation cookies, and
• upon your registration for the Newsletter and/or the Club’s official social media accounts,
and on the condition that you have not subsequently withdrawn or modified your consent, the Club may send you personalised newsletters and notifications, as well as provide tailored content on its Website, Applications, and other digital channels.
For this purpose, the Club processes:
• data collected through personalisation cookies,
• Newsletter usage data (e.g. email openings, interactions),
• Newsletter registration data (including the email address).
Such processing aims at identifying your preferences and delivering personalised and targeted content.
The legal basis for this processing is your consent, in accordance with Article 6(1)(a) of the GDPR.
You have the right to withdraw your consent at any time, with effect for the future. Withdrawal may be carried out via the relevant link included in each Newsletter or by submitting a request to the email address: dpo@olympiacos.org.
The withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.
c. Personalised Communications from the Club’s Sponsors
Following the above-mentioned consent (provided via the cookie banner for personalisation cookies and upon your registration for the Newsletter and/or the Club’s official social media accounts), you may receive personalised communications from the Club’s Sponsors. For this purpose, the Club transfers to its Sponsors only those data that are strictly necessary, such as your email address and general information regarding your stated interests.
A detailed and up-to-date list of the Club’s Sponsors is available in the relevant section of the Club’s Website.
The legal basis for such transfer and communication is your consent, in accordance with Article 6(1)(a) of the GDPR.
You have the right to withdraw your consent at any time, with effect for the future. Withdrawal may be carried out via the relevant link included in each Newsletter or by submitting a request to the email address: dpo@olympiacos.org.
The withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.
Collection and Use of Data in Connection with the Purchase of Tickets
(Season Tickets, Individual Match Tickets, Museum Tickets)
During the process of purchasing Tickets (of any type), the Club collects and processes—depending on the type of Ticket—all or some of the following personal data:
• Full name
• Age
• Contact details (telephone number, postal address, e-mail address)
• Social Security Registration Number (AMKA)
• National Identity Card Number
• Tax Identification Number (TIN)
• Competent Tax Office (D.O.Y.)
• Other identification data (e.g. Personal Identification Number, Olympiacos Fan Card details)
During the Ticket purchase process, you may also be required to provide Health Data. Such data are processed exclusively on the basis of your explicit and freely given consent, in accordance with Article 9(2)(a) of the GDPR, and solely for the purposes specified in the relevant consent statement (e.g. granting of discounts). Further information is provided at the time consent is requested.
The legal basis for the processing of the data you provide during the acquisition of Tickets is Article 6(1)(b) GDPR (performance of a contract or taking steps at the request of the data subject prior to entering into a contract), and Article 6(1)(c) GDPR (processing necessary for compliance with a legal obligation to which the controller is subject).
The Club collects and processes the above data exclusively to the extent required by the applicable legislation governing the distribution of tickets for professional sporting events and for the purposes of fulfilling its contractual obligations, ensuring the proper performance of the contractual relationship, or protecting the Club’s legitimate interests.
Your refusal to provide such data may render it impossible to perform our contractual obligations or may adversely affect the proper functioning of our relationship. In certain cases, the completion of the transaction may not be possible.
Collection and Use of Data When Viewing Content on the Website, Social Media, Applications, or Video-Sharing Platforms
The Club uses service providers and technologies for the display of the Website and related content (such as videos, images, or posts from social media platforms) in your web browser. In certain cases, personal data may be processed for the purposes of the technical transmission of content to your device, confirmation of participation in surveys, or the identification and display of user-generated posts relating to the Club. The legal basis for such processing is Article 6(1)(f) of the GDPR (legitimate interest).
When you visit the Website without providing us with data in any other manner (such as, indicatively, through a registration process), the Club collects only the technically necessary data, which are automatically transmitted to our server by your web browser (“log data”). Such data may include, in particular: the IP address through which your device connects to the internet, the type and version of the web browser you use, the referring URL, the date and time of your visit to the Website, the duration of your stay on each page, as well as other statistical or technical information generated through technically necessary or functional cookies. For more information, you may refer to the Club’s Cookie Policy at the following address: https://www.olympiacos.org/politiki-cookies/
Collection and Use of Data when accessing and interacting with Social Media, Social Plug-ins, and Hashtags
Olympiacos FC S.A. maintains official accounts on social media platforms, applications, and video-sharing platforms (indicatively Facebook, Instagram, X/Twitter, YouTube, TikTok, Viber) and integrates social plug-ins of such platforms into its Website.
Within this context, the Club may receive or have access to certain information, as described below.
a. Access to Content – Anonymous or Non-Logged-In Use
When you access the Club’s official accounts on social media platforms or the relevant content, even if you do not have an account or are not logged in to the respective social network, the Club receives only aggregated, statistical, and anonymised usage data (such as the number of visits or interactions), which are provided by the respective social network through reporting tools (insights).
Such data do not allow your identification, are not linked to specific user profiles, and do not constitute personal data within the meaning of the GDPR. Consequently, no data-retention period is applicable.
b. Technical Connection via Browser, Applications, or Social Plug-ins
When you visit the Club’s Website or interact with social plug-ins of social media platforms, the browser or application you use establishes a direct technical connection with the servers of the respective social network.
Within this context, the social network may collect technical information (such as IP address, device information, and browser data), even if you do not have an account or are not logged in. Such information:
• is transmitted directly to the servers of the respective provider,
• may be stored on servers outside the European Union or the European Economic Area,
• is not collected, stored, or accessible by the Club.
If you are logged in to the social network at the time of your visit or upon activation of a plug-in, your visit or interaction may be directly associated with your personal account by the social media provider.
c. Interaction with the Club’s Official Pages on Social Media Platforms
When you engage in any form of interaction with the Club’s official pages on social media platforms (indicatively: following an account, “Like”, Follow, reaction, sharing, or posting a comment), the relevant information becomes visible on the respective social network and to your contacts, in accordance with your account settings.
The Club may have access to limited personal data made available through the platform (such as full name, gender, or age category), without, however:
• storing such data in internal files or databases,
• extracting or combining them with other data,
• using them for purposes other than facilitating communication and managing its official accounts.
Any further processing of such data is carried out exclusively by the respective social network, in accordance with its Terms of Use, Privacy Policy, and Cookie Policy.
d. Use of Hashtags on Social Media Platforms
The Club may process public user posts that include hashtags related to the Club (e.g. #olympiacosfc), for the purpose of displaying and sharing supporter-generated content on the Website or on its official social media accounts.
Such processing is based on the legitimate interest of the Club (Article 6(1)(f) GDPR), consisting in the promotion of its activities and the enhancement of interaction with the supporter community.
Where such posts depict you or third parties, processing is carried out only upon consent, in accordance with Article 6(1)(a) GDPR. By using the hashtag #olympiacosfc in a public post, you grant your consent to the Club. Such consent may be withdrawn at any time with future effect by submitting a relevant request to dpo@olympiacos.org, without affecting the lawfulness of processing carried out prior to the withdrawal.
e. Management of Comments and Content
The Club reserves the right to remove or conceal comments or posts that violate the terms of use of its official accounts or the applicable legislation (indicatively, offensive, unlawful, or malicious content).
The Club does not modify the content of your comments, nor does it carry out any further processing of your personal data beyond what is described above. You may at any time delete or modify your posts, as well as adjust the level of protection of your personal data through the settings of your personal account on the respective social network.
f. Legal Basis for Processing
The processing of the above data by the Club is carried out on the basis of its legitimate interest (Article 6(1)(f) GDPR) to provide a technically functional, secure, and reliable presence and interaction across its digital channels. Such data are not combined with other sources, unless expressly provided for and following appropriate prior notice.
Collection and Use of Data when completing the Contact Form
If you use the contact form on our Website, the Club processes the personal data that you voluntarily provide, which may include, indicatively:
• Your first name
• Your surname
• Your email address
• The comment or message you submit to us
The data you provide via the contact form are used exclusively for communication purposes and are processed by the Club until your request has been definitively handled and responded to. Following the completion of the communication, the data are stored in our database solely for purposes relating to the establishment, exercise, support, or defence of any legal claims of the Club, or for such period as is required by the applicable statutory record-keeping obligations.
The legal basis for such processing is Article 6(1)(b) GDPR (processing necessary for the taking of steps at the request of the data subject prior to entering into a contract).
Commercial Communication – Newsletter, Content Personalisation, and Sponsor Communications
a. Collection and Use of Data upon Subscription to the Newsletter
Following your relevant request, which incorporates your consent, the Club processes your personal data for the purpose of sending newsletters and promotional material via electronic mail. The newsletters include information regarding current events, initiatives, activities, events, and commercial offers of the Club and its Sponsors.
Subscription to the newsletter is possible exclusively:
a) provided that you have reached the age of fifteen (15) years, which you are required to confirm at the time of subscription, and
b) upon provision of your explicit consent.
In the event of your subscription, the Club processes the following personal data for the purpose of sending the newsletter:
• Your first name
• Your surname
• Your mobile phone number
• Your email address
• Any optional data you may provide (e.g. country, language, name, date of birth, etc.)
The processing of the above data aims to inform you about Club news, competitions, Tickets, initiatives, events, as well as offers for products and services of the Club and its official sponsors or partners.
The legal basis for such processing is Article 6(1)(a) GDPR (consent).
Your personal data are retained:
(i) until you withdraw your consent with future effect. You may unsubscribe from the newsletter at any time via the relevant link included at the end of each newsletter email or by submitting a relevant request to the email address: dpo@olympiacos.org. Any processing of the data carried out up to the time of withdrawal of consent remains unaffected.
(ii) for as long as you demonstrate interest in receiving the newsletters. The absence of withdrawal of consent constitutes confirmation of such interest.
Beyond the above, the data are stored solely for the purposes of supporting legal claims or defending the Club against legal claims, or for such period as is required by mandatory data retention provisions.
b. Personalisation of Messages and Content
Provided that you have given your explicit consent:
• via the cookie banner for personalisation cookies, and
• upon your registration for the Newsletter and/or the Club’s official social media accounts,
and on the condition that you have not subsequently withdrawn or modified your consent, the Club may send you personalised newsletters and notifications, as well as provide tailored content on its Website, Applications, and other digital channels.
For this purpose, the Club processes:
• data collected through personalisation cookies,
• Newsletter usage data (e.g. email openings, interactions),
• Newsletter registration data (including the email address).
Such processing aims at identifying your preferences and delivering personalised and targeted content.
The legal basis for this processing is your consent, in accordance with Article 6(1)(a) of the GDPR.
You have the right to withdraw your consent at any time, with effect for the future. Withdrawal may be carried out via the relevant link included in each Newsletter or by submitting a request to the email address: dpo@olympiacos.org.
The withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.
c. Personalised Communications from the Club’s Sponsors
Following the above-mentioned consent (provided via the cookie banner for personalisation cookies and upon your registration for the Newsletter and/or the Club’s official social media accounts), you may receive personalised communications from the Club’s Sponsors. For this purpose, the Club transfers to its Sponsors only those data that are strictly necessary, such as your email address and general information regarding your stated interests.
A detailed and up-to-date list of the Club’s Sponsors is available in the relevant section of the Club’s Website.
The legal basis for such transfer and communication is your consent, in accordance with Article 6(1)(a) of the GDPR.
You have the right to withdraw your consent at any time, with effect for the future. Withdrawal may be carried out via the relevant link included in each Newsletter or by submitting a request to the email address: dpo@olympiacos.org.
The withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.
Collection and Use of Data in Connection with the Purchase of Tickets
(Season Tickets, Individual Match Tickets, Museum Tickets)
During the process of purchasing Tickets (of any type), the Club collects and processes—depending on the type of Ticket—all or some of the following personal data:
• Full name
• Age
• Contact details (telephone number, postal address, e-mail address)
• Social Security Registration Number (AMKA)
• National Identity Card Number
• Tax Identification Number (TIN)
• Competent Tax Office (D.O.Y.)
• Other identification data (e.g. Personal Identification Number, Olympiacos Fan Card details)
During the Ticket purchase process, you may also be required to provide Health Data. Such data are processed exclusively on the basis of your explicit and freely given consent, in accordance with Article 9(2)(a) of the GDPR, and solely for the purposes specified in the relevant consent statement (e.g. granting of discounts). Further information is provided at the time consent is requested.
The legal basis for the processing of the data you provide during the acquisition of Tickets is Article 6(1)(b) GDPR (performance of a contract or taking steps at the request of the data subject prior to entering into a contract), and Article 6(1)(c) GDPR (processing necessary for compliance with a legal obligation to which the controller is subject).
The Club collects and processes the above data exclusively to the extent required by the applicable legislation governing the distribution of tickets for professional sporting events and for the purposes of fulfilling its contractual obligations, ensuring the proper performance of the contractual relationship, or protecting the Club’s legitimate interests.
Your refusal to provide such data may render it impossible to perform our contractual obligations or may adversely affect the proper functioning of our relationship. In certain cases, the completion of the transaction may not be possible.
Collection and Use of Data When Viewing Content on the Website, Social Media, Applications, or Video-Sharing Platforms
The Club uses service providers and technologies for the display of the Website and related content (such as videos, images, or posts from social media platforms) in your web browser. In certain cases, personal data may be processed for the purposes of the technical transmission of content to your device, confirmation of participation in surveys, or the identification and display of user-generated posts relating to the Club. The legal basis for such processing is Article 6(1)(f) of the GDPR (legitimate interest).
INTERACTIVE CONTENT, SURVEYS & COMPETITIONS
Surveys, Mini Games and Related Interactive Content
From time to time, the Club conducts surveys, mini games and other types of interactive content through its Communication Channels. Participation in such activities is voluntary and entails the corresponding provision of your consent.
Upon your participation (either through a relevant form or without the use of a form), the Club processes the personal data that you provide, which may indicatively include:
• gender, first name, last name, address, e-mail address, telephone number, date of birth,
• preferred language of communication,
• responses, results, scores or digital content requested or submitted by you,
• technical data, such as IP address, device type, etc. (“Survey Data”).
Such data are used for:
• the delivery of relevant and personalized content via the Communication Channels you have selected,
• maintaining up-to-date and accurate information in your profile.
The legal basis for the processing is Article 6(1)(a) GDPR (consent), where such consent has been provided, or Article 6(1)(b) GDPR (performance of a contract), where your participation constitutes a contractual relationship.
Survey Data are retained until consent is withdrawn or for as long as required for the performance of the relevant contract. Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.
Competitions
The Club also organizes, from time to time, competitions or prize draws through its Communication Channels. Participation is voluntary and requires the provision of the necessary personal data as well as acceptance of the processing thereof. Unless otherwise specified in special notices contained in the Terms and Conditions of a specific competition, the following shall apply:
Upon your participation, the Club processes data such as:
• first name, last name, address, e-mail address, telephone number, date of birth,
• responses or participation details relating to the competition (“Competition Data”).
Such data are processed exclusively for the purposes of conducting and administering the competition, notifying the winners, and verifying the contact details and identity of the participants.
The legal basis for the processing is Article 6(1)(b) GDPR (performance of a contract).
Special Promotional Activities with Partners
From time to time, the Club carries out special promotional activities in cooperation with its Sponsors, through which participants may benefit from preferential offers (“Special Promotional Activities”).
For the implementation of such Special Promotional Activities, the processing and transfer of your personal data to the respective Sponsors may be required. Relevant information — in particular the identity of the Sponsor and the data to be processed (e.g. name, address, e-mail address) — will be fully provided in each individual activity, in order for you to grant your consent pursuant to Article 6(1)(a) GDPR (consent), which also constitutes the legal basis for the processing.
Following such transfer, the Sponsors process the data under their own responsibility. You are advised to consult the respective Data Protection / Privacy Policies of the Sponsors.
From time to time, the Club conducts surveys, mini games and other types of interactive content through its Communication Channels. Participation in such activities is voluntary and entails the corresponding provision of your consent.
Upon your participation (either through a relevant form or without the use of a form), the Club processes the personal data that you provide, which may indicatively include:
• gender, first name, last name, address, e-mail address, telephone number, date of birth,
• preferred language of communication,
• responses, results, scores or digital content requested or submitted by you,
• technical data, such as IP address, device type, etc. (“Survey Data”).
Such data are used for:
• the delivery of relevant and personalized content via the Communication Channels you have selected,
• maintaining up-to-date and accurate information in your profile.
The legal basis for the processing is Article 6(1)(a) GDPR (consent), where such consent has been provided, or Article 6(1)(b) GDPR (performance of a contract), where your participation constitutes a contractual relationship.
Survey Data are retained until consent is withdrawn or for as long as required for the performance of the relevant contract. Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.
Competitions
The Club also organizes, from time to time, competitions or prize draws through its Communication Channels. Participation is voluntary and requires the provision of the necessary personal data as well as acceptance of the processing thereof. Unless otherwise specified in special notices contained in the Terms and Conditions of a specific competition, the following shall apply:
Upon your participation, the Club processes data such as:
• first name, last name, address, e-mail address, telephone number, date of birth,
• responses or participation details relating to the competition (“Competition Data”).
Such data are processed exclusively for the purposes of conducting and administering the competition, notifying the winners, and verifying the contact details and identity of the participants.
The legal basis for the processing is Article 6(1)(b) GDPR (performance of a contract).
Special Promotional Activities with Partners
From time to time, the Club carries out special promotional activities in cooperation with its Sponsors, through which participants may benefit from preferential offers (“Special Promotional Activities”).
For the implementation of such Special Promotional Activities, the processing and transfer of your personal data to the respective Sponsors may be required. Relevant information — in particular the identity of the Sponsor and the data to be processed (e.g. name, address, e-mail address) — will be fully provided in each individual activity, in order for you to grant your consent pursuant to Article 6(1)(a) GDPR (consent), which also constitutes the legal basis for the processing.
Following such transfer, the Sponsors process the data under their own responsibility. You are advised to consult the respective Data Protection / Privacy Policies of the Sponsors.
COOKIE POLICY
General
When using the Communication Channels, the Club uses “cookies” in compliance with applicable legislation. “Cookies” are small pieces of information (files), in plain text format, which are stored on the user’s computer (or on other internet-enabled devices, such as a smartphone or tablet) when visiting any website. Cookies do not cause any damage to the user’s computer or to the files stored thereon. Without them, it would be impossible to store users’ personal preferences.
Cookies help collect information necessary to measure the effectiveness of a website, improve and upgrade its content, adapt it to users’ demand and needs, and measure the effectiveness of the presentation and promotion of the website on third-party websites. The cookies used on the website do not collect information that personally identifies users, nor do they access or obtain knowledge of any document or file stored on users’ computers.
The data collected by cookies may include the type of browser used by the user, the type of computer, the operating system, internet service providers, and other similar information. In addition, the website’s information system automatically collects information regarding the pages visited by the user and links to third-party websites that may be included on the Portal.
Cookies Used by the Website
The Website, like all websites, uses cookies in order to operate smoothly and provide the best possible service to users. Below are the four categories of cookies used:
A) Necessary Cookies
Necessary cookies help make the Website usable by enabling basic functions such as page navigation and access to secure areas of the Website. The Website cannot function properly without these cookies.
B) Preference Cookies
Preference cookies allow the Website to remember information that changes the way the Website behaves or appears, such as the user’s preferred language or the region the user is located in.
C) Statistical Cookies
Statistical cookies help Website owners understand how visitors interact with the Website by collecting and reporting information anonymously.
Management and Deletion of Cookies
The menus of most web browsers provide options regarding the management of cookies. Depending on the options offered by the browser, users may allow the installation of cookies, disable or delete existing cookies, or be notified each time cookies are received. Instructions for managing and deleting cookies are usually found in the “Help”, “Tools” or “Edit” menu of each browser. In addition, users may find more detailed guidance at: https://www.olympiacos.org/politiki-cookies/ where the methods for controlling and deleting cookies in most browsers are explained in detail.
Users should be aware that if they reject or disable the Website’s cookies, the functionality of the Website may be partially affected. Furthermore, disabling a cookie or a category of cookies does not delete the corresponding file from the browser. Such deletion must be carried out by the user by modifying the internal settings of the browser in use.
When using the Communication Channels, the Club uses “cookies” in compliance with applicable legislation. “Cookies” are small pieces of information (files), in plain text format, which are stored on the user’s computer (or on other internet-enabled devices, such as a smartphone or tablet) when visiting any website. Cookies do not cause any damage to the user’s computer or to the files stored thereon. Without them, it would be impossible to store users’ personal preferences.
Cookies help collect information necessary to measure the effectiveness of a website, improve and upgrade its content, adapt it to users’ demand and needs, and measure the effectiveness of the presentation and promotion of the website on third-party websites. The cookies used on the website do not collect information that personally identifies users, nor do they access or obtain knowledge of any document or file stored on users’ computers.
The data collected by cookies may include the type of browser used by the user, the type of computer, the operating system, internet service providers, and other similar information. In addition, the website’s information system automatically collects information regarding the pages visited by the user and links to third-party websites that may be included on the Portal.
Cookies Used by the Website
The Website, like all websites, uses cookies in order to operate smoothly and provide the best possible service to users. Below are the four categories of cookies used:
A) Necessary Cookies
Necessary cookies help make the Website usable by enabling basic functions such as page navigation and access to secure areas of the Website. The Website cannot function properly without these cookies.
B) Preference Cookies
Preference cookies allow the Website to remember information that changes the way the Website behaves or appears, such as the user’s preferred language or the region the user is located in.
C) Statistical Cookies
Statistical cookies help Website owners understand how visitors interact with the Website by collecting and reporting information anonymously.
Management and Deletion of Cookies
The menus of most web browsers provide options regarding the management of cookies. Depending on the options offered by the browser, users may allow the installation of cookies, disable or delete existing cookies, or be notified each time cookies are received. Instructions for managing and deleting cookies are usually found in the “Help”, “Tools” or “Edit” menu of each browser. In addition, users may find more detailed guidance at: https://www.olympiacos.org/politiki-cookies/ where the methods for controlling and deleting cookies in most browsers are explained in detail.
Users should be aware that if they reject or disable the Website’s cookies, the functionality of the Website may be partially affected. Furthermore, disabling a cookie or a category of cookies does not delete the corresponding file from the browser. Such deletion must be carried out by the user by modifying the internal settings of the browser in use.
DATA RETENTION PERIOD
Except for the cases specifically set out in this Policy, the Club retains your personal data only for the strictly necessary period of time required to achieve the processing purposes described above, in each of the respective cases.
The retention of your data beyond the strictly necessary period may also be extended where:
• such retention is required by provisions of law or regulatory obligations,
• it is deemed necessary for the exercise of the Club’s legal claims or for the defense of the Club against legal claims.
When there is no longer a lawful or operational need for the continuation of the processing:
• the data are permanently erased, or
• anonymized, or
• stored in a secure manner and placed under restricted access (archiving), until permanent erasure becomes possible, in particular where they are included in backup systems.
The retention of your data beyond the strictly necessary period may also be extended where:
• such retention is required by provisions of law or regulatory obligations,
• it is deemed necessary for the exercise of the Club’s legal claims or for the defense of the Club against legal claims.
When there is no longer a lawful or operational need for the continuation of the processing:
• the data are permanently erased, or
• anonymized, or
• stored in a secure manner and placed under restricted access (archiving), until permanent erasure becomes possible, in particular where they are included in backup systems.
INFORMATION SECURITY
The processing of your personal data by the Club is carried out in a manner that ensures their confidentiality. Specifically, such processing is performed exclusively by personnel of the Club duly authorized for this purpose, while all appropriate organizational and technical measures are implemented to ensure data security and to protect them against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure or access, and any other form of unlawful processing. The Club employs the most modern and advanced methods in order to ensure the highest possible level of data security.
Despite the fact that the Club implements appropriate security measures to safeguard the confidentiality, integrity, and availability of your personal data, the transmission of information via the internet is never entirely secure. Consequently, the Club cannot guarantee their security when transmitted through any electronic means, and therefore any such transmission is carried out at the sender’s own responsibility.
Despite the fact that the Club implements appropriate security measures to safeguard the confidentiality, integrity, and availability of your personal data, the transmission of information via the internet is never entirely secure. Consequently, the Club cannot guarantee their security when transmitted through any electronic means, and therefore any such transmission is carried out at the sender’s own responsibility.
TRANSFERS TO THIRD PARTIES
The Club does not engage in the sale, leasing, or any other form of commercial exploitation of your personal data, nor does it interconnect its records with third parties in exchange for financial or other consideration.
a. Transfer to Data Processors
The Club may grant access to or transfer your personal data to third-party service providers, who act exclusively as Data Processors within the meaning of Article 28 GDPR and process the data on behalf of and in accordance with the instructions of the Club.
These categories include indicatively:
• providers of technical and support services (IT services, system hosting, information security),
• providers of facility operation and security services,
• providers of communication services and digital tools,
• external advisors, such as lawyers, accountants, auditors, and other professionals.
In such cases, the Club:
• enters into written data processing agreements,
• selects providers that offer sufficient guarantees regarding the implementation of appropriate technical and organizational security measures,
• ensures that Data Processors act exclusively upon the instructions of the Club and observe confidentiality.
b. Transfer to Independent Data Controllers
The Club may disclose personal data to third-party recipients acting as independent Data Controllers, to the extent that such disclosure is necessary for its compliance with legal or regulatory obligations or for the protection of its legitimate interests.
Such recipients may include, indicatively:
• national or supranational football authorities and federations,
• other football clubs (e.g. in the context of transfers or regulatory procedures),
• financial institutions,
• tax, auditing, and other public authorities,
• judicial authorities and law enforcement authorities (including the Hellenic Police).
Such transfer is carried out exclusively:
• for the purposes of preventing, investigating, or reporting incidents of fraud, deception, terrorism, violations of ticketing legislation, security incidents, or other criminal acts,
• for the prevention, investigation, or handling of incidents of discrimination,
• or where required by the applicable legislative or regulatory framework.
c. Transfers to Third Countries outside the EU/EEA
Any transfer of personal data to countries outside the European Economic Area (EU/EEA) is carried out only where the conditions set out in Articles 44 et seq. of the GDPR are met and, indicatively:
• an adequacy decision of the European Commission exists, or
• appropriate safeguards are applied, such as Standard Contractual Clauses, or
• one of the specific derogations of Article 49 GDPR applies.
In all cases, the Club takes all necessary measures to ensure an adequate level of protection of your personal data.
d. Links to Third-Party Websites
The Club’s Website may contain links to third-party websites or digital services which are not under the control of the Club. The Club bears no responsibility for the content, privacy policies, or data processing practices of such third parties.
You are advised to carefully review the Terms of Use and Personal Data Protection Policies of each third-party website you visit.
a. Transfer to Data Processors
The Club may grant access to or transfer your personal data to third-party service providers, who act exclusively as Data Processors within the meaning of Article 28 GDPR and process the data on behalf of and in accordance with the instructions of the Club.
These categories include indicatively:
• providers of technical and support services (IT services, system hosting, information security),
• providers of facility operation and security services,
• providers of communication services and digital tools,
• external advisors, such as lawyers, accountants, auditors, and other professionals.
In such cases, the Club:
• enters into written data processing agreements,
• selects providers that offer sufficient guarantees regarding the implementation of appropriate technical and organizational security measures,
• ensures that Data Processors act exclusively upon the instructions of the Club and observe confidentiality.
b. Transfer to Independent Data Controllers
The Club may disclose personal data to third-party recipients acting as independent Data Controllers, to the extent that such disclosure is necessary for its compliance with legal or regulatory obligations or for the protection of its legitimate interests.
Such recipients may include, indicatively:
• national or supranational football authorities and federations,
• other football clubs (e.g. in the context of transfers or regulatory procedures),
• financial institutions,
• tax, auditing, and other public authorities,
• judicial authorities and law enforcement authorities (including the Hellenic Police).
Such transfer is carried out exclusively:
• for the purposes of preventing, investigating, or reporting incidents of fraud, deception, terrorism, violations of ticketing legislation, security incidents, or other criminal acts,
• for the prevention, investigation, or handling of incidents of discrimination,
• or where required by the applicable legislative or regulatory framework.
c. Transfers to Third Countries outside the EU/EEA
Any transfer of personal data to countries outside the European Economic Area (EU/EEA) is carried out only where the conditions set out in Articles 44 et seq. of the GDPR are met and, indicatively:
• an adequacy decision of the European Commission exists, or
• appropriate safeguards are applied, such as Standard Contractual Clauses, or
• one of the specific derogations of Article 49 GDPR applies.
In all cases, the Club takes all necessary measures to ensure an adequate level of protection of your personal data.
d. Links to Third-Party Websites
The Club’s Website may contain links to third-party websites or digital services which are not under the control of the Club. The Club bears no responsibility for the content, privacy policies, or data processing practices of such third parties.
You are advised to carefully review the Terms of Use and Personal Data Protection Policies of each third-party website you visit.
STORAGE
Your personal data are stored on servers located within countries of the European Economic Area and are not transferred to third countries (countries outside the EU/EEA).
Countries of the European Economic Area are considered to provide the same level of personal data protection as Greece. In the event that the Club transfers your personal data outside the European Economic Area, it is legally obliged to inform you of the purposes of such transfer and to provide appropriate safeguards for the protection of the personal data transferred (Chapter V, Articles 44–49 of the GDPR).
Countries of the European Economic Area are considered to provide the same level of personal data protection as Greece. In the event that the Club transfers your personal data outside the European Economic Area, it is legally obliged to inform you of the purposes of such transfer and to provide appropriate safeguards for the protection of the personal data transferred (Chapter V, Articles 44–49 of the GDPR).
YOUR RIGHTS AS DATA SUBJECTS
One of the core principles of the GDPR is the protection of the rights of natural persons with regard to the processing of their personal data. Within this framework, you have a set of rights in relation to your personal data processed by the Club. In particular, and in accordance with Chapter III of the GDPR, you have the right to:
• Information, Access, Rectification, and Erasure. You may at any time request to be informed about the personal data that the Club maintains concerning you and request the modification, rectification, updating, or erasure of such information. We may request additional information from you in order to process your request; however, where we provide you with access to the information we hold about you, such provision shall be free of charge, unless your request is “manifestly unfounded or excessive.” If you request additional copies of such information from us, we may charge you a reasonable administrative fee. Where we have a lawful right to refuse your request, in the event of such refusal we will inform you of the specific reasons for the refusal.
• Right to Object. You may at any time object to the processing of data (based on your consent) for reasons relating to your particular situation, with effect for the future. In the case of direct marketing, you may always object to the processing, including profiling. The lawfulness of prior processing is not affected.
• Restriction of Processing: In certain cases, you have the right to “block” or restrict the further use of your personal data. In practice, this means that we may store your data but will not be able to process them further, unless such processing is carried out with your consent, or such processing is necessary either for the establishment, exercise, or defense of the Club’s legal claims, or for the protection of the rights of another person, or for reasons of public interest. We maintain records of individuals who have requested that the further use of their personal data be “blocked,” in order to ensure that the restriction is respected in the future.• • • Data Portability: You have the right to transfer your personal data to other data controllers. In practice, this means that you have the ability to transfer the information we hold about you to any third party. For the exercise of this right, we will provide you with your data in a structured, commonly used, and machine-readable format, so that you can transmit your data to another data controller. Alternatively, we may transmit the data directly on your behalf. The right to data portability applies to: (a) data that we process by automated means (i.e. without human intervention), (b) personal data that have been provided by you, and (c) personal data that we process on the basis of your consent or where such processing is necessary for the performance of a contract.
• Right to Lodge a Complaint with the Competent Authorities: You have the right to lodge a complaint before the competent supervisory authority, which for Greece is the Hellenic Data Protection Authority (“HDPA”). You may contact the Hellenic Data Protection Authority by the following means:
(a) Postal Address: Hellenic Data Protection Authority, Offices: 1–3 Kifisias Ave., P.C. 115 23, Athens,
(b) Telephone Center: +30-210 6475600,
(c) Fax: +30-210 6475628,
(d) Email: contact@dpa.gr.
• Withdrawal of Consent. In cases where the processing of your personal data is based on your prior consent, you have the right to withdraw your consent at any time, and the Club will cease the specific processing activity for which you had previously given your consent, unless there is an alternative legal basis justifying the continuation of the processing of your data for that purpose, in which case you will be informed accordingly.
• Information, Access, Rectification, and Erasure. You may at any time request to be informed about the personal data that the Club maintains concerning you and request the modification, rectification, updating, or erasure of such information. We may request additional information from you in order to process your request; however, where we provide you with access to the information we hold about you, such provision shall be free of charge, unless your request is “manifestly unfounded or excessive.” If you request additional copies of such information from us, we may charge you a reasonable administrative fee. Where we have a lawful right to refuse your request, in the event of such refusal we will inform you of the specific reasons for the refusal.
• Right to Object. You may at any time object to the processing of data (based on your consent) for reasons relating to your particular situation, with effect for the future. In the case of direct marketing, you may always object to the processing, including profiling. The lawfulness of prior processing is not affected.
• Restriction of Processing: In certain cases, you have the right to “block” or restrict the further use of your personal data. In practice, this means that we may store your data but will not be able to process them further, unless such processing is carried out with your consent, or such processing is necessary either for the establishment, exercise, or defense of the Club’s legal claims, or for the protection of the rights of another person, or for reasons of public interest. We maintain records of individuals who have requested that the further use of their personal data be “blocked,” in order to ensure that the restriction is respected in the future.• • • Data Portability: You have the right to transfer your personal data to other data controllers. In practice, this means that you have the ability to transfer the information we hold about you to any third party. For the exercise of this right, we will provide you with your data in a structured, commonly used, and machine-readable format, so that you can transmit your data to another data controller. Alternatively, we may transmit the data directly on your behalf. The right to data portability applies to: (a) data that we process by automated means (i.e. without human intervention), (b) personal data that have been provided by you, and (c) personal data that we process on the basis of your consent or where such processing is necessary for the performance of a contract.
• Right to Lodge a Complaint with the Competent Authorities: You have the right to lodge a complaint before the competent supervisory authority, which for Greece is the Hellenic Data Protection Authority (“HDPA”). You may contact the Hellenic Data Protection Authority by the following means:
(a) Postal Address: Hellenic Data Protection Authority, Offices: 1–3 Kifisias Ave., P.C. 115 23, Athens,
(b) Telephone Center: +30-210 6475600,
(c) Fax: +30-210 6475628,
(d) Email: contact@dpa.gr.
• Withdrawal of Consent. In cases where the processing of your personal data is based on your prior consent, you have the right to withdraw your consent at any time, and the Club will cease the specific processing activity for which you had previously given your consent, unless there is an alternative legal basis justifying the continuation of the processing of your data for that purpose, in which case you will be informed accordingly.
DATA PROTECTION OFFICER
The Data Protection Officer has the duties provided for in Article 39 of the GDPR.
The contact details for the Data Protection Officer, in the context of your interaction with the Club for the purposes referred to in this Policy, are as follows:
Name: OLYMPIACOS SYNDESMOS FILATHLON PEIRAIOS FOOTBALL SOCIÉTÉ ANONYME
Address: Alexandras Square, ΤΚ 18534, Piraeus, Attika
Telephone: 2104143000
E-mail: dpo@olympiacos.org
If you have any questions regarding data protection or the manner in which we process your data, you may at any time contact the Data Protection Officer at the following email address: dpo@olympiacos.org
The contact details for the Data Protection Officer, in the context of your interaction with the Club for the purposes referred to in this Policy, are as follows:
Name: OLYMPIACOS SYNDESMOS FILATHLON PEIRAIOS FOOTBALL SOCIÉTÉ ANONYME
Address: Alexandras Square, ΤΚ 18534, Piraeus, Attika
Telephone: 2104143000
E-mail: dpo@olympiacos.org
If you have any questions regarding data protection or the manner in which we process your data, you may at any time contact the Data Protection Officer at the following email address: dpo@olympiacos.org
CHANGES
Our Privacy Policy, as well as the descriptions in the cookie consent tool, may be amended from time to time by decision of the Club. This includes developments arising from changes within our organization, changes in legislation, or the implementation of new technologies or services on our Website or on the Club’s social media accounts. Any updates will be published on this page, and any such changes shall take effect from the date of their publication. In the event of significant changes, a relevant notice will be provided.
This Policy should be read in conjunction with the Terms of Use of our Website, which govern the use of our electronic services, as well as the Terms & Conditions of Entry for Season Tickets and single-match Tickets. You may read the Terms of Use of our Website at
https://www.olympiacos.org/oroi-chrisis/ , the Terms & Conditions of Entry for Season Tickets HERE, for single-match Tickets HERE, and the Terms & Conditions of Entry to the Museum HERE. If you have any further questions not addressed by this Policy, you may send an email to the following address:
dpo@olympiacos.org.
This Policy should be read in conjunction with the Terms of Use of our Website, which govern the use of our electronic services, as well as the Terms & Conditions of Entry for Season Tickets and single-match Tickets. You may read the Terms of Use of our Website at
https://www.olympiacos.org/oroi-chrisis/ , the Terms & Conditions of Entry for Season Tickets HERE, for single-match Tickets HERE, and the Terms & Conditions of Entry to the Museum HERE. If you have any further questions not addressed by this Policy, you may send an email to the following address:
dpo@olympiacos.org.