Introduction

For the purposes of this policy, Qualiday Travel Ltd., hereinafter referred to as "QUALIDAY" is the controller of personal data. For our Company, respect for the safeguarding of your personal data is of the highest priority as well as of electronic transactions by taking all the necessary technical and organizational measures and at the same time complying with the applicable legislation. We want our customers, employees, partners and visitors of our website and offices to feel safe and confident when granting, collecting, and processing their data and to consider the application of data protection as a feature of the quality of service provided. For QUALIDAY, the processing of personal data is an integral part of the continuous effort to improve its services, which is why it is committed to comply with the applicable legislation and to apply this policy. This policy statement is an update on how we collect and process the personal data of customers, employees, and visitors to serve, inform them about new offers and promote new services through the application of appropriate security means and techniques. In addition, it aims to inform them of their rights in accordance with applicable law.

QUALIDAY reserves the right to renew or update this policy without any notice in accordance with applicable national and Community legislation. When a change is made, we will make the previous versions available upon request so that you can see what those changes are. If these changes change key elements of this Policy or its meaning, we will notify you in advance of these changes.

Explanation of terms used in this policy:

"Personal Data" is any information through which a natural person is identified or identifiable (Article 4(1) GDPR).

"Processing of Personal Data" is any action taken using personal data such as the collection, storage, use thereof, disclosure to third party partners, who undertake the management and/or processing of personal data in the name and on behalf of QUALIDAY to achieve a specific business purpose each time (Article 4(2) GDPR).

"Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its appointment may be provided for by Union law or by Member State law (Article 4(7) GDPR).

«Processors' means a natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller (Art. 4(8) GDPR).

"Data subject" means a natural person to whom the data refer and who is known or can be identified can be identified directly or indirectly, by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural, political or social identity.

"Legal basis" is in accordance with Article 6 of the General Data Protection Regulation the basis on which Personal Data is processed.

1. Our Basic Principles governing the protection of Personal Data

• Collection and processing of data solely for business purposes, promoting the improvement of the services provided and safeguarding the legitimate interests of the company.
• Collection and management of the necessary data for the respective purpose of processing
• Compliance with the relevant laws and regulations in force.
• Maintaining transparency regarding the use and processing of the Personal Data held as well as informing the data subjects honestly and honestly.
• Taking the appropriate technical and organizational measures in relation to the security of the personal data processed by us.

2. How QUALIDAY collects Personal Data

QUALIDAY collects Personal Data in various ways.

The information collected is that which you provide directly when you transact with us in one of the following ways:

• Provision of services to us either by entering a contract or by serving an invoice
• By subscribing to our newsletter.
• When you contact or transact with us.
• Through our website
• Through our social media pages
• Via email
• Phone
• Through customer surveys
• From complaints you post
• Through the investigation of accidents that occurred within our premises
• Through participation in competitions (inside the stores or through social media)
• By sending CVs either printed or electronically.
• Through installed CCTV security circuit
• Through logging in and browsing the website where we may collect some of your personal information using automated technologies - cookies, server logs and so on

3. What Personal Data QUALIDAY Collects

QUALIDAY collects your necessary data which are relevant to the purpose of the processing.

• Personal information: e.g., Full name, gender, identity card number, title, occupation, date of birth, marital status – information about members of a large family, nationality, language, business license, photo (in cases of winners of competitions / employees) and additionally about employees (social insurance number, job position, professional history, health status)
• Contact details: e.g., Postal address, e-mail address
• Bank details: e.g., bank account number/IBAN for individuals entitled to payment by us.
• Website: e.g., Information about your activity
• Any other information you share with us: e.g., for a personalized service to you, or for any other purpose.

4. Why we process your personal data and on what legal basis

As mentioned earlier, we are committed to protecting your privacy and processing your data in an open and transparent manner and, therefore, we process your personal data in accordance with the GDPR and Cyprus data protection law for one or more of the following reasons:

• For the performance of a contract. We process personal data on this legal basis in cases involving suppliers and/or partners with whom there is a relevant contract.
• To comply with a legal obligation. There are certain legal obligations arising from the relevant laws applicable to us as well as requirements of legal provisions. Such obligations and requirements may impose on us the necessary personal data processing activities for identity verification, compliance with court decisions / court orders and reporting obligations of tax or other legislation.
• For the protection of legitimate interests. We process personal data to safeguard the legitimate interests pursued by us. A legitimate interest exists when we have a business or commercial reason why we use your information. But, even then, you should not unfairly oppose what is right and best for you.
• With your consent. We process personal data after your explicit and unambiguous consent. Examples of processing your personal data after your consent are the sending of information material by QUALIDAY.

5. How QUALIDAY uses your Personal Data

• Promotional offers/ actions: We would like to send you informational material to inform you about our new offers, products, competitions, and other promotions if we have received from you your explicit and free consent to this. You can change your mind and opt out of this type of communication at any time by following the instructions included in the relevant contact method. We may process your personal data to inform you about products, services and offers that may be of interest to you or your business. The contents of the newsletter include promotions (offers, discount offers, contests, etc.) as well as products and services of QUALIDAY.
• Data processing for marketing purposes: The personal data we process for this purpose consists of information you provide to us and data we collect and/or infer when you use our services, such as information about your purchases. We study all this information to form an opinion about what we think you might need or what you might be interested in. We may use your personal data to promote our products and offers to you only if we have your explicit consent to do so or if, in certain circumstances, we consider that we have a legitimate interest in doing so. You have the right to object at any time to the processing of your personal data for marketing purposes, including profiling, by contacting us using the contact method set out below.
• Closed circuit television: We collect data from the CCTV we have installed in our stores solely for the protection of the health and safety of QUALIDAY employees, customers, and visitors as well as for the protection of our legitimate interests.
• Communication with you: we use your information for your best service, such as to optimize the management of your complaints, inform you of changes to the data security policy, participate in satisfaction surveys.
• Other purposes: We will only use your personal information for the purposes for which we collected, unless we reasonably consider that we should use it for another reason and that the reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so. Please note that we may process your personal information without your knowledge or consent, in accordance with the above rules, where required to do so by law.

6. Protecting your information

• QUALIDAY applies high levels of security, both technically and organizationally when collecting and processing your data. This is regularly reviewed to ensure that these measures remain effective and are kept up to date through internal feedback as well as with current technological developments.

7. Retention of Information

• QUALIDAY makes every effort to limit the retention time of your Data to a minimum. To ensure that we meet our legal obligations under applicable law, we only retain your information for as long as we need it and only for the purposes for which we first obtained it.
• In most cases, this means that we will retain your information for as long as you continue to shop with us or use our services and in case you decide to stop shopping with us for another period after you stop so that you do not lose your rights in case you start shopping with us again. After that we will either delete or anonymize your data with a specific algorithm so that it becomes impossible to connect them with your person.
• In cases where your personal data is anonymized, it will be done solely for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
• In addition, applicable laws require us to retain basic information about our customers and partners (including contact, identity, financial and transaction information) for six years after they cease to be customers for tax purposes.
• In addition, if you exercise your right to erasure as described in paragraph 10. Subsection IV, it will be impossible to comply with some of our contractual obligations such as product warranty unless you keep a relevant document proving our contractual obligation.
• In some cases, you can request that we delete your data: see section 11 (The rights of data subjects) below for more information.

8. social media

• Your interactions with the various social media features and widgets present on the website either by a third party or hosted directly by our Company, are governed by the privacy policy of the company providing this service.
• Depending on your own settings or social media and messaging services policies such as Facebook, you may provide access to certain information to QUALIDAY and other organizations. You should check with these services to make sure you are satisfied with the sharing of this information.

9. Personal Data of Minors

• The protection and preservation of the privacy of minors at QUALIDAY is of paramount importance and we try to avoid the collection of such data.
• Where and where it is necessary to collect such information, we apply procedures appropriate to the specific age group.
• If the age of the minor is under 14 years old, we always ask for the consent of at least one of his parents or guardians in accordance with the "The Protection of Natural Persons with regard to the Processing of Personal Data and the Free Movement of Such Data Law of 2018 (125(I)/2018)".

10. Transfer of your Personal Data to third parties

• QUALIDAY in the context of promoting its legitimate interests of its activities may share information with carefully selected organizations that offer certain services necessary for the conduct of its business. These include:
• Specialist service companies
• Training Organisations
• Insurance Companies
• Suppliers
• Hotels or other tourism-related organisations
• No information is shared with any organization outside the Republic.

11. The rights of data subjects

• QUALIDAY takes seriously and promotes your rights regarding the collection and processing of your Personal Data. If you wish to exercise any of the following rights, you can do that by message to the e-mail address info@qualiday.com or to the postal address presented at the end of this policy.
• For your safety and for our fullest legal compliance, we reserve the right to request further information necessary to confirm your identity when responding to an existing request. If identification is not possible, we further reserve the right to refuse to respond to your request.
• Right to be Informed: You have the right to request information from us about your personal data stored with us, the purpose of their processing and any third-party recipients.
• Right to rectification: You have the right to request the immediate rectification and/or completion of your personal data stored with us.
• Right to restriction of processing: You have the right to request the restriction of the processing of your personal data in case you contest the accuracy of your data stored with us, in case the processing is unlawful and in case the data is no longer necessary to us, but you do not wish the data to be deleted and you require the data for the foundation, the exercise or support of legal rights, or in case you have notified your objection to the processing.
• Right to erasure: You have the right to request the deletion of your personal data stored by us.
Note: When you exercise the right to erasure, some data may be required to be retained / stored in accordance with applicable laws, our contractual obligations, for reasons of public interest, for the establishment of legal claims or defence against them or for the exercise of our legal rights. This data will be restricted rather than deleted to prevent it from being used for other purposes. Also, in case you exercise your right to erasure and to avoid your own inconvenience, we point out the provisions of article 6 paragraph 6 above, regarding product guarantees.

• Right to data portability You have the right to receive a copy of the data you have provided to us, which will be sent to you or to a third party in a structured, commonly used, and machine-readable format. In case you request that the data be sent immediately to another data controller, this will only be done if technically feasible.
• Right to object: If your personal data is processed based on legitimate interests in accordance with Art. 6 para. 1 lit. f GDPR, you have the right to object to the processing at any time in accordance with Art. 21 GDPR.
• Right to withdraw consent: You have the right to withdraw your consent to the collection of data at any time, which revocation will be valid for the future. The data collected until the revocation acquires legal force are not affected by it. We hope you understand that processing your revocation may take some time for technical reasons and that you may still receive messages from us in the meantime.
• Right to lodge a complaint with a supervisory authority: In case you believe that the processing of your personal data violates data protection legislation or in case you believe that your data protection rights have been violated in any other way, we will be happy to have an update/complaint from you at the email address info@qualiday.com or to the postal address indicated at the end of this policy for the investigation of your complaint and for our own improvement, alternatively you can file a complaint at any time with the Personal Data Protection Office http://www.dataprotection.gov.cy, the supervisory authority of the Republic of Cyprus for data protection issues.

12. Data Protection Officer

• The QUALIDAY Data Protection Officer (DPA) oversees compliance with this privacy policy. If you have any questions or concerns about this privacy notice or how we handle your personal information, please contact our Data Protection Officer as follows:
• By sending us a message at info@qualiday.com
Either
• Writing to us at:
QUALIDAY TRAVEL LTD 108 Apostolou Pavlou 8046 Paphos-CYPRUS