Welcome to the website of Baraonda Music Hall (https://baraonda.gr). In our effort to protect your privacy, to the extent that this is our responsibility, and to comply with the principles of applicable Greek and European data protection law, we inform you below about how we collect, use and protect your personal data.
Before using our website and our premises, please read this Policy carefully. If you do not agree with its terms, please do not continue to use our website.
Data controller
The data controller is the company «ΕΥΑΓΓΕΛΟΣ ΧΟΥΛΙΑΡΑΣ ΨΥΧΑΓΩΓΙΚΗ ΕΤΕΡΟΡΡΥΘΜΟΣ ΕΤΑΙΡΙΑ», trading as «BARAONDA ΕΕ» (hereinafter “the Company”), with registered office in Athens (43 Tsocha St, 115 21), VAT No. 999372834, GEMI No. 006447801000, email: info@baraonda.gr, phone: +30 210 6444308, as legally represented.
The Company takes the protection of visitors to its website and venue seriously and informs you about how and for what purposes your personal data are processed, in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and national legislation.
Sources of data
We collect personal data from the following sources:- from your visit to the website https://baraonda.gr, through the browser you use;
- from the reservation form on the “Reservations” page of the website;
- from phone calls, emails and other means of communication, such as messaging apps (WhatsApp, Viber, etc.), when you contact us for information or to make a reservation;
- from your visit to our venue (e.g. when you tell us about dietary preferences or about your satisfaction);
- from your transactions at our venue;
- from social media (Instagram, Facebook, TikTok), regarding information that you make public;
- from third parties, such as corporate clients and business partners, in accordance with legal or contractual obligations.
Categories of data we collect
We collect only the personal data that are strictly necessary, relevant and appropriate for the purpose for which they are intended. These data are processed only for specified and lawful purposes, to inform you and to provide our services properly.
- Identification data: full name.
- Contact data: email address, phone number (landline and/or mobile), social media and messaging app details.
- Reservation information: reservation date, number of guests, comments you write to us (e.g. a special occasion), and employer details for corporate reservations.
- Financial and payment data: data collected when you pay at the venue and when invoices or receipts are issued (company name, address, business activity, VAT number and tax office). The reservation form on the website does not collect credit or debit card details. In exceptional cases where a deposit is required, card payment takes place in a banking institution’s environment, which records the card details; these details are transmitted encrypted and are not stored by us. If a deposit is paid by bank transfer, we process the details of the transfer.
- Technical device information: information about the device you use to visit the website, such as IP address, device type, screen resolution, operating system and browser type/version.
- Social media information: information you share publicly on social networks (comments, reviews, questions, etc.) or that forms part of your public profile.
- Health data: only if you disclose them to us, such as food allergies, dietary requirements or accessibility needs, solely in order to serve you during your visit.
Purposes and legal basis of processing
We process your personal data with respect and for the following purposes:- Reservation management and customer service: to manage the reservation and contact requests you submit through the website, by phone or in person, to confirm reservations, to process payments and deposits, and to handle questions, comments and complaints. Legal basis: performance of a contract or taking steps at your request before entering into one.
- Legal compliance: to meet our obligations under tax law and the legislation on food service and entertainment businesses, and to protect your rights and those of the Company against unlawful activities. Legal basis: legal obligation.
- Marketing and communication: to inform you about shows, events and offers by email, SMS, messaging apps or social media. Legal basis: your consent, which you may withdraw at any time.
- Service improvement and website security: to improve your experience on the website and at the venue, to protect the website and the reservation form from misuse and spam, and for statistical purposes. Legal basis: our legitimate interest.
- Health data you disclose to us (e.g. allergies): processed solely in order to serve you. Legal basis: your explicit consent.
Recipients of data
Your personal data may be disclosed to:- employees and partners of the Company responsible for fulfilling our contractual obligations to you and the obligations imposed by law;
- banks/credit institutions, based in Greece or abroad, that you authorise to make your payment to us;
- third parties providing accounting and tax services, in order to fulfil our tax obligations;
- third-party service providers processing data on our behalf, such as website hosting, management, maintenance and security companies, email delivery providers and providers protecting the reservation form against spam (Google reCAPTCHA);
- third-party legal or natural persons to whom the management of all or part of the business has been contractually assigned or transferred;
- public authorities, courts, law enforcement, regulatory authorities and health and safety authorities, when we are required to do so by prosecutorial orders, court decisions or law;
- third parties, where disclosure is necessary to exercise legal claims or defend the Company’s rights;
- other third parties, provided you have given your consent.
Data security
We apply appropriate physical, electronic, organisational and technical measures when collecting, storing and processing personal data, which ensure their security and confidentiality and minimise (without eliminating) accidental or unlawful destruction, loss, alteration, prohibited disclosure or access and any other form of unlawful processing. We use TLS/SSL encryption for all data transmitted to and from the website and apply a need-to-know access policy.
Although we make every effort to obtain adequate contractual guarantees, we cannot guarantee the security of data hosted in third-party databases. Please also note that no form of communication, regardless of the medium, is completely secure; this is an inherent risk of any physical or electronic communication.
Transfers of data to third countries
The personal data we collect are stored in Greece and in countries of the European Union. Certain providers used by the website, specifically Google for the Google reCAPTCHA and Google Fonts services, may process data such as your IP address outside the EU/EEA.
In such cases, we check as far as possible that an adequate level of protection is ensured, either through an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework) or through appropriate safeguards, such as standard contractual clauses or the recipient’s binding corporate rules.
Links, social media and third-party websites
Our website includes links to third-party websites and applications (such as Instagram, Facebook, TikTok and Google Maps). These third parties may collect information about you when you interact with their content, websites or applications. We are not responsible for their processing of your personal data or for the content of their websites. These third parties are governed by their own privacy policies, which you can read on their websites.
Data retention
We keep your personal data for as long as necessary in order to a) inform you about our services, b) fulfil our contractual obligations to you, c) comply with our obligations under applicable law and d) protect or assert our rights.
Data processed on the basis of your consent (e.g. for sending newsletters) are kept until you withdraw your consent. The retention period is shortened or extended accordingly where the law or regulations provide for a different period.
Access to your data
You have access to all the data you have provided to us, and you can obtain a copy upon written request.
Your rights
- Right to information / transparency: you have the right to know who processes your data, what those data are and for what purpose.
- Right of access: you can find out which categories of your data we hold, their origin, the purposes of processing, the recipients, the retention period and your related rights.
- Right to rectification: you can request that your data be corrected and/or completed so that they are complete and accurate.
- Right to restriction: you can request that the processing of your data be restricted.
- Right to object and to withdraw consent: you can object to further processing of your data and withdraw your consent at any time.
- Right to erasure (“right to be forgotten”): you can request the deletion of your data where there is no other lawful basis for keeping them.
- Right to data portability: you can request to receive your data in a structured, commonly used format, or to have them transferred to another controller.
We reserve the right to refuse a request for restriction or erasure where the processing or retention of the data is necessary to establish, exercise or defend our legal rights or to fulfil our obligations. Exercising the right to portability does not entail deletion of the data from our records. Exercising the above rights applies to the future and does not affect processing that has already taken place.
In any case, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) if you believe that the processing of your data infringes applicable law. More information: www.dpa.gr.
Exercising your rights
Any request concerning your personal data and the exercise of your rights must be submitted in writing, by post to: BARAONDA EE, 43 Tsocha St, 115 21 Athens, Greece, or by email to info@baraonda.gr.
We will make every effort to respond to your request within thirty (30) days of its submission. This period may be extended by a further sixty (60) days if necessary, taking into account the complexity or number of requests; in that case you will be informed within thirty (30) days.
Requests are handled free of charge. If requests are manifestly unfounded, excessive or repetitive, we may either charge a reasonable fee, after informing you, or refuse to act on them.
Automated decision-making and profiling
“Automated decision-making” means any decision taken solely on the basis of automated processing of data that produces legal effects concerning a person. “Profiling” means any form of automated processing that uses personal data to evaluate or predict aspects of a natural person, such as their personal preferences, interests or behaviour.
We inform you that no automated decision-making or profiling is carried out on the basis of your data.
Cookies and similar technologies
The website uses cookies and similar technologies, which store information on your device for its proper operation and security. The Google reCAPTCHA service is used to protect the reservation form against misuse and spam. In addition, the server hosting the website keeps log files, which help us resolve technical problems, maintain the performance and security of the website, and detect or prevent fraud and other harmful activities.
For more information about the cookies we use, their purposes and how you can manage them, please read our Cookie Policy.
Minors
Our website and services are not intended for minors, and we do not process their personal data without the consent of their parent or legal guardian. However, we are unable to determine the age of the persons using the website. If a minor provides us with personal data without the consent of their parent or guardian, we will not process them and will delete them. If you are a minor, we will need the consent of the person exercising parental responsibility or guardianship; otherwise, please do not use our services or provide us with personal data.
Governing law
This Policy is governed by Greek law, as shaped by the General Data Protection Regulation (EU) 2016/679 and the national and European data protection framework in force from time to time. The courts of Athens have jurisdiction over the application and interpretation of this Policy and over any dispute concerning personal data.
Final provisions
We are not responsible for the accuracy of the information (including personal data) you provide to us, nor for any incomplete or incorrect provision of information or services resulting from it. Please therefore make sure that the information you provide to us is true, correct, complete and up to date.
The Company may revise or amend this Policy in line with the applicable legal and regulatory framework. The updated Policy will always be available on the website https://baraonda.gr before any changes to the way your data are processed take effect.