Privacy policy

1. Who we are

The controller of your personal data is the Civil Non-Profit Company «YESSIOS MUSEUM “THE MACEDONIAN STRUGGLE AND EDESSA” A.M.K.E.» (hereinafter “the Museum”), which operates the website yessiosmuseum.com and its online shop.

• Registered office: 9 Dimokratias St., Eleftherias Square, 58200 Edessa, Greece
• Phone: +30 2381 020 013
• Email: contact@yessiosmuseum.com

This policy explains what data we collect through the website, why we use it, who we share it with and what rights you have, in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Law 4624/2019.

2. What data we collect and why

Contact form

When you write to us from the Contact page, we receive your full name, email, telephone number (if you provide it), subject and message. We use them only to reply to your request. The legal basis is your consent (Article 6(1)(a) GDPR), which you give by ticking the box on the form.

Applications for jobs and internships

If you apply, we receive your first name, surname, email, CV and any information you add. We use them only to assess your application (Article 6(1)(b) GDPR, steps prior to entering into a contract).

Newsletter

If you subscribe to the newsletter, we keep your email in order to send you news and invitations from the Museum. The legal basis is your consent. You can unsubscribe at any time using the link at the end of every email.

Orders from the online shop

For every order we need your full name, address, telephone number and email, as well as the order details. We use them to process, invoice and deliver the order and to communicate with you about it (Article 6(1)(b) GDPR), as well as for the Museum’s obligations under tax legislation (Article 6(1)(c) GDPR).

Card payments are made in the secure environment of Viva Payments. Your card details never reach and are never stored on the Museum’s website.

Technical data and security

Like every website, the server records technical details of the visit, such as the IP address and the type of browser. We use them only for the security and proper operation of the website, for example to block malicious attacks (legitimate interest, Article 6(1)(f) GDPR). The website does not use any analytics or advertising tools.

Cookies and embedded content

The map (Google Maps) and the videos (Vimeo) load only after you accept them or press play. The provider may then receive your IP address and place its own cookies. For the website’s cookies and your preferences, see the Cookie policy.

3. Who we share the data with

We do not sell or rent personal data. We share it only with partners who process it on our behalf, and only as far as necessary:

• Bluehost (Newfold Digital): website hosting
• Google (Google Workspace): sending and receiving the Museum’s email
• Mailchimp (Intuit): sending the newsletter
• Viva Payments: card payments
• Courier companies: delivery of orders, when they are shipped
• Accountant and public authorities: when required by law

Some of them (Bluehost, Google, Mailchimp, Vimeo) are based or have servers outside the European Union, mainly in the USA. Such transfers are made with the safeguards provided for by the GDPR, such as the EU-US Data Privacy Framework or the standard contractual clauses of the European Commission.

4. How long we keep the data

• Messages from the contact form: up to 2 years from our last communication.
• Applications and CVs: up to one year, unless you agree that we may keep them longer.
• Newsletter: until you unsubscribe.
• Orders: for as long as tax and accounting legislation requires.
• Technical security logs: a few weeks.

5. Your rights

You can at any time request access to your data, its rectification, erasure or the restriction of its processing, object to its processing, receive it in electronic form (portability) and withdraw your consent, without affecting the processing carried out until then. Email us at contact@yessiosmuseum.com and we will reply within one month.

If you believe that the processing of your data breaches the law, you have the right to lodge a complaint with the Hellenic Data Protection Authority (dpa.gr).

6. Security

The website uses an encrypted connection (HTTPS) and we apply technical and organisational measures to protect your data against loss, misuse and unauthorised access. Only those who need it for their work have access to it.

7. Minors

The forms and the online shop are intended for adults. For school visits and educational programmes, contact is made by the teacher or the parent.

8. Changes to this policy

If the way we use data changes, we will update this page and the date at the top of it.

Contact

For anything concerning your personal data, email us at contact@yessiosmuseum.com or call us on +30 2381 020 013.