Legal
Privacy Policy
How we collect, use and protect your personal data when you visit this site or apply for a job at Pomegranate Wellness Spa Hotel and Potidea Palace Hotel.
Last updated:
Who is responsible for your data
The controller for the processing described on this page is:
- Registered name
- ΠΟΡΤΕΣ ΜΕΛΑΘΡΟΝ Α.Ε. ΞΕΝΟΔΟΧΕΙΑΚΕΣ - ΤΟΥΡΙΣΤΙΚΕΣ ΕΠΙΧΕΙΡΗΣΕΙΣ
- Registered seat
- Άγιος Μάμας 0, Άγιος Μάμας 63200, Χαλκιδική, Greece
- VAT number (ΑΦΜ)
- 094200151
- Companies register (ΓΕΜΗ)
- 122509557000
- Chamber of commerce
- Επιμελητήριο Χαλκιδικής
- Data protection contact
- [email protected]
- Telephone
- +30 23730 43070
The company operates Pomegranate Wellness Spa Hotel and Potidea Palace Hotel in Nea Potidea, Halkidiki. Its registered seat, shown above, is a different address from where the hotels operate.
What this policy covers
This policy covers the portesmelathron.com website and the job application process it serves.
It does not cover the processing of guest data inside the hotels — reservations, your stay, security systems — for which each hotel gives you a separate notice. It also does not cover employee data after you are hired, which is governed by a separate notice and by employment law.
References to the GDPR mean the General Data Protection Regulation (EU) 2016/679, as applied in Greece by Law 4624/2019.
What we collect and why
We collect only what the site needs to work and what we need to assess your application. We do not buy data from third parties and we do not build visitor profiles.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Application details and CV: name, email, telephone, hotel preference, your message and the file you upload | Assessing your application for the role and contacting you about it | Article 6(1)(b) GDPR — steps taken at your request before entering into a contract. Article 6(1)(a) — your consent, for keeping your CV on file and considering you for other roles | 12 months from the date of the application |
| Contact messages: your name, contact details and the content of your message | Answering your question or request | Article 6(1)(f) GDPR — our legitimate interest in replying to people who write to us | 12 months from the last message |
| Technical data about your visit: IP address, browser, pages requested, time of the request | Security, abuse prevention and diagnosing faults on our servers | Article 6(1)(f) GDPR — our legitimate interest in running the site securely and correctly | 30 days in server logs |
| Your cookie choice | Remembering whether you accepted or refused non-essential cookies, so we do not ask again | Article 4(5) of Greek Law 3471/2006 and Article 6(1)(a) GDPR — your consent | 6 months |
You do not have to give us any of this to browse the site. Without the application details, however, we cannot assess a candidacy.
Job applications and CVs
When you apply for a role we collect what you enter in the form — your name, email, telephone, hotel preference and your message — together with the CV file you upload.
Legal basis: assessing your application for the specific role is processing carried out at your request before entering into an employment contract (Article 6(1)(b) GDPR). Keeping your CV so that we can consider you for other or future roles is based on the consent you give on the form (Article 6(1)(a)).
Where it is stored: your file is uploaded to private storage. It is never publicly accessible, it has no public link and it is not indexed by search engines. Only our HR team and the managers of the department the role belongs to can open it.
We keep your application and CV for 12 months
Twelve months after the date you applied, the application record and the CV file are deleted. The deletion runs automatically on a schedule and removes both the application record and the file itself from storage. Twelve months is long enough for us to come back to you for the next season, and short enough that we are not holding data we no longer need.
You can withdraw your consent and ask us to delete everything sooner, at any time: email [email protected]. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.
Please do not include special categories of data in your CV — health data, religious or political beliefs, trade union membership, criminal convictions. We do not ask for them, we do not need them to assess your application, and if they reach us we delete them.
If you are hired, your details move into your employee file and from that point are governed by a separate notice and by the retention periods that employment, social security and tax law require.
Who has access to your data
We do not sell or forward your CV
We are the employer, not a recruitment agency. Your CV is not shared, sold or forwarded to other employers, recruitment agencies, HR consultancies or job boards.
Inside the company, access is limited to our HR team and the department managers of the two hotels, and only to the data they need for their role.
Outside the company, data is processed only by suppliers acting on our behalf as processors, bound by an Article 28 GDPR contract and with no right to use it for their own purposes:
- our website hosting and infrastructure provider
- our file storage provider, where CVs are held
- our email delivery provider, for notifications and our replies
- our content delivery and malicious-traffic protection provider
We disclose data to a public authority only where the law requires it or where a competent authority lawfully requests it, and only to the extent requested.
Transfers outside the European Economic Area
The website and the application data are hosted in data centres inside the European Union.
Where a supplier processes data outside the European Economic Area, the transfer relies on a European Commission adequacy decision or on the standard contractual clauses under Article 46 GDPR. You can ask for a copy of those safeguards at [email protected].
Security
We apply technical and organisational measures appropriate to the risk. CVs are the most sensitive data this site receives and are treated accordingly:
- all traffic to the site runs over an encrypted connection (HTTPS)
- CV files are held in private storage with no public link
- access is granted by role, only to people who need it for their work
- we check the type and size of uploaded files and apply measures against automated abuse
No system is completely secure. If a personal data breach occurs that poses a risk to your rights and freedoms, we notify the Hellenic Data Protection Authority within 72 hours and, where the risk is high, we notify you as well.
Automated decision-making
We do not make decisions about you based solely on automated processing, and we do not profile you. Every job application is read and assessed by a person.
Your rights
As a data subject you have the following rights:
- Access: to know what data we hold about you and to receive a copy (Article 15).
- Rectification: to correct inaccurate data or complete incomplete data (Article 16).
- Erasure: to ask us to delete it (Article 17).
- Restriction: to ask us to restrict the processing (Article 18).
- Portability: to receive your data in a structured, commonly used format (Article 20).
- Objection: to object to processing based on our legitimate interests (Article 21).
- Withdrawal of consent: at any time, without affecting the lawfulness of what came before (Article 7(3)).
To exercise any of these, email [email protected]. We reply within one month of receiving your request at the latest (Article 12(3) GDPR), and exercising your rights is free of charge. We may ask you for information to confirm your identity, so that we never hand your data to someone else.
If you believe the processing of your data breaches the law, you have the right to lodge a complaint with the supervisory authority: Hellenic Data Protection Authority, Kifissias 1-3, 115 23 Athens, tel. +30 210 6475600, www.dpa.gr.
Changes to this policy
We update this page when the way we process data changes. The date of the last update is shown at the top of the page. If a change materially affects you, we will tell you directly rather than relying on this page alone.