Privacy Policy

I. INTRODUCTION

1. Respecting your privacy and managing, protecting and securing your personal data is a priority for the sole-trader medical practice ''ATHANASIOS PALLANTZAS'' ("Physician", "Company", "we", "us", "our"), headquartered at Korai 4, Larissa, Greece, with clinics in Kifissia, Larissa, Trikala and Mykonos (see Section II). This Privacy and Personal Data Protection Policy (hereinafter "Privacy Policy") informs you — as a visitor to the website thanasispallantzas.com ("Website"), or as a person who in any capacity uses the Services offered on the Website, whether through the Website or at our physical clinics, or who participates in the Company's promotional activities, or uses the Website's social media channels — about:
   – the type of data collected or generated about you,
   – the purpose of collecting and processing your data,
   – the manner in which that data is processed,
   – its recipients and the purpose of processing on their part,
   – your rights and choices regarding your personal data, and
   – how to contact us about any issue relating to your personal data.
2. CHANGES TO THE PRIVACY POLICY
   We may modify or replace all or part of this Policy at our absolute discretion. If there are material changes to this Policy, or if our data practices change in the future, we will notify you by publishing the changes on the Website. Should you wish to obtain clarification or information regarding changes, or if you have any disagreement, reservation or question about them, you may contact us at info@beautybydesign.gr. We recommend that you check this Privacy Policy from time to time, as it will always be available as a permanent information point on our Website.
3. Merely browsing the Website or using our Services does not constitute consent to the processing of personal data. Where consent is required (for example to submit the contact form, or for analytics and advertising cookies), it is requested separately and you may withdraw it at any time. If you do not agree with this Policy or any amendment to it, you may choose not to use the contact form or not to provide personal data, and you are entitled to request the erasure of your data. In any case you may contact us for any information or clarification, and you retain your rights regarding your personal data as described in Section VI below.

II. DATA CONTROLLER & CONTACT

1. The Data Controller for your personal data is the sole-trader practice ''ATHANASIOS PALLANTZAS''. Personal data is collected when you access, browse and use the Website, when you use and receive Services either on the Website or at our clinics, when you communicate directly with us, and when you complete applications — whether paper or electronic.
2. Our clinics, where the Services are provided, are:
   Kifissia: Othonos 99, 145 61 – tel. 210 8086 930
   Larissa: Korai 4, 412 22 – tel. 2410 238 886
   Trikala: Asklipiou 23, 421 00 – tel. 24310 73327
   Mykonos: Ornos, 846 00 – tel. 22890 28545
3. You may contact us at our contact details, either by phone at +30 210 8086 930 or by e-mail at info@beautybydesign.gr, and submit your comments, questions, observations or any complaints regarding this Policy and the collection and processing of your personal data. You have the right to submit any complaint regarding personal data protection matters to the Hellenic Data Protection Authority (HDPA), the supervisory authority in Greece. Details can be found at www.dpa.gr.

III. DATA COLLECTION AND PROCESSING

Personal data means any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one whose identity can be determined, directly or indirectly. Anonymous data is excluded.

1. What data we collect
   When you browse the Website or its social media, request Services, visit our premises, communicate directly with us by any means, complete electronic or paper applications or contact forms, enter into any type of contract, provide services, or use our Services, we collect and process various types of personal data, including simple personal data, special-category data (such as health data), and other data as applicable — obtained directly from you, from third parties, or generated by our own means (including automated means).
   We collect, among others, the following personal data:
   1. Identity Data: First and last name, tax number (AFM), gender, date of birth, social security number (AMKA).
   2. Contact Data: Fixed or mobile phone number, e-mail address, residential address.
   3. Health Data: With your explicit consent, we collect personal data relating to your physical or mental health, including the provision of healthcare services, which reveals information about your health status. Specifically, in order to provide Services — whether for restoring a health problem, prevention, or aesthetic purposes — we collect data relating to:
      • Medical history (past, current or future medical examinations)
      • Physiological or biomedical condition
      • Medication
      • Photographs
   4. Activity data and other data we may collect automatically when you access and interact with the Website (connection information, device information, network information, usage information).
   5. Data collected via cookies and other tracking technologies. The Website uses strictly necessary storage technologies (for example to store your cookie choice) and, only if you consent, analytics cookies and identifiers (Google Analytics) and advertising cookies and identifiers (Google Ads) via Google Tag Manager, as well as embedded YouTube videos. These technologies may be used to collect activity data about your use of the Website, such as the pages you have visited and your interaction with the Website and our advertisements. For more information, please refer to our Cookie Policy.
2. How we collect your personal data
   • 2.1. Directly from you when you request Services, book an appointment, visit our premises or Website, contact us by any means including our social media, complete electronic or paper applications or contact forms, or enter into any contract.
   • 2.2. By automated means — activity data, cookies and other tracking technologies as described above (Section III.1, items 4 and 5).
   • 2.3. From third parties — independent organisations (which may include social media platforms) that share your personal data with us when there is a legal basis and they have the relevant right to do so.
   • 2.4. Personal data of persons under 16 years of age
     We do not knowingly collect information from anyone under the age of 16 without the consent of a legal guardian. If you are under 16, do not use or provide any information to us, and do not give us any personal information including your name, address or contact details. If we discover that we have collected data from a person under 16 without parental consent, we will delete it immediately.
3. How we use your personal data
   The main reason we collect and process data about you is to inform you and provide you with our Website and clinic Services, manage patients and clients, process payments, carry out promotional activities, and supervise the CCTV system at our clinics. We also collect data to:
   • Measure, analyse and improve the Services and functions of the Website and our clinics.
   • Provide and deliver the products and Services you request, process appointment information, and send you related information including confirmations.
   • Improve your experience through the Company's Services by providing content you may find relevant and interesting.
   • Resolve technical matters and send you technical notices, updates, security alerts and support messages.
   • Respond to your comments, questions and requests and provide customer service.
   • Comply with applicable laws or legal processes and respond to requests from competent authorities.
   • Complete a corporate transaction such as a proposed or actual restructuring, merger, sale, joint venture or other disposal of all or part of the business.
   • Personalise and improve the Services and offer advertising, content or features matching user profiles or interests.
   • Satisfy your data rights as described in Section VI.
4. Legal basis for processing your personal data
   The legal basis for using information about you is one of the following:
   • Performance of a contract with you as a contracting party (Article 6(1)(b), (c) and (f) GDPR).
   • Legitimate business interest, including managing and protecting the Company, the Website and our clinics; preventing fraud; managing medical and health services and collecting fees; creating electronic health records; and operating CCTV systems for security purposes (Article 6(1)(f) GDPR).
   • Purposes of preventive or occupational medicine, medical diagnosis, or the provision of healthcare or treatment (Article 9(2)(h) GDPR).
   • Compliance with a legal obligation to which we are subject.
   • Protection of your vital interests when you are legally or physically incapable of giving consent (Article 9(2)(c) GDPR).
   • Necessity for reasons of public interest in the area of public health (Article 9(2)(i) GDPR).
   • Consent, where further processing is carried out or processing is for the purpose of informing you about medical matters and our Services (e.g. the Website contact form, analytics and advertising cookies, promotional activities, questionnaire-based research) (Article 6(1)(a) GDPR and, for health data, Article 9(2)(a) GDPR).
5. Who we share your personal data with
   • 5.1. The Company may disclose your personal data for the purposes described in Section III to the following categories of recipients: staff, physicians, medical and administrative personnel; partner physicians and health professionals; the companies hosting and managing our Website and providing e-mail services; Google (Google Tag Manager, Google Analytics, Google Ads, YouTube), only as described in Section IV and the Cookie Policy; advertising and marketing companies; data analytics companies; IT systems companies; insurance companies; medical device suppliers; accountants and lawyers; affiliated companies; competent authorities; and third parties in connection with a corporate transaction.
   • 5.2. Links to other websites
     Our Services may provide links to other websites and services. We are not responsible for those websites or their privacy practices.
6. Transfer of personal data to third countries
   The Company generally retains your personal data within the European Economic Area. Where data is to be transferred to third countries outside the EEA for which there is no adequacy decision by the European Commission, all appropriate safeguards required by applicable data protection law will be applied. In particular, Google services (Google Tag Manager, Google Analytics, Google Ads and YouTube) are provided by Google Ireland Limited, and data may also be transferred to Google LLC (USA). Such transfers rely on the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.
7. Video surveillance
   • 7.1. The Company uses CCTV systems exclusively for the security and protection of persons and goods at its clinics.
   • 7.2. Purpose and legal basis: security of the premises and protection of staff and visitors (Article 6(1)(f) GDPR).
   • 7.3. Recipients: footage is accessible only to authorised security personnel and is shared only with competent judicial, prosecutorial and police authorities where required.
   • 7.4. Retention period: 45 days, after which recordings are automatically deleted. In the event of an incident, a portion may be retained for up to one additional month.
   • 7.5. Data subject rights: access, restriction, objection and erasure. Contact us at the details in Section II to exercise these rights.

IV. WEBSITE AND CONTACT FORM

1. Data collected through the contact form
   When you submit the Website contact or appointment request form, we collect: full name, telephone number, e-mail address (optional), the interest/treatment you select, the clinic of your choice, and the text of your message. Ticking the consent box is required in order to submit the form.
2. Purpose
   To reply to your request and to schedule an appointment.
3. Legal basis
   Your consent (Article 6(1)(a) GDPR) and taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR). You may withdraw your consent at any time by contacting us at the details in Section II.
4. Please do not include sensitive health data
   Please do not include sensitive health data (for example diagnoses, medical history or photographs) in your message. Such information will be discussed during your appointment.
5. Recipients
   Your message is delivered by e-mail to info@beautybydesign.gr and info@thanasispallantzas.com. The recipients of the data are the hosting provider and the e-mail provider, which act as processors on our behalf.
6. Automatic confirmation e-mail
   If you provide an e-mail address, you will receive an automatic e-mail confirming that your request has been received.
7. Retention
   Contact form data is retained for up to twenty-four (24) months from our last communication, unless a medical relationship arises, in which case the legislation on medical records applies (see Section V).
8. Anti-spam protection
   To prevent misuse of the form (limiting the number of submissions), your IP address is logged temporarily, for a limited period and solely for this purpose. The hosting provider may also keep technical access logs for server security.
9. Google Tag Manager, Google Analytics and Google Ads
   The Website uses Google Tag Manager, Google Analytics (statistical measurement of traffic) and Google Ads (measurement and advertising). Analytics and advertising functions are activated only after you give your consent, through Google Consent Mode, and you can change your choice at any time via the "Cookie Settings" link at the bottom of every page. See the Cookie Policy for more.
10. YouTube videos
    Some pages contain embedded YouTube (Google) videos, which are loaded via youtube-nocookie.com and only when you click play. Until then your browser does not contact YouTube. During playback, Google may process data in accordance with its own privacy policy.
11. Transfers to third countries
    See Section III, "Transfer of personal data to third countries" (transfers to Google LLC under the EU-US Data Privacy Framework and/or Standard Contractual Clauses).

V. PROTECTION AND MANAGEMENT OF YOUR PERSONAL DATA

1. The Company takes appropriate technical and organisational measures to protect the personal data it holds against unauthorised disclosure, use, alteration or destruction. We use encryption and other technologies where appropriate and require third parties to whom we disclose data to comply with strict data protection and security requirements. Security is subject to circumstances beyond our control, including technical failures not controlled by the Company or force majeure events. You are also responsible for ensuring that the equipment and software you use to browse the Website is adequately secure and protected against malware.
2. We will retain your data taking into account the reasons for processing it and any legal obligations. In particular:
   1. Where processing is based on performance of a contract, data is stored for as long as necessary to perform the contract and to establish, exercise or support legal claims arising from it.
   2. Where processing is based on legitimate interest, data is retained for as long as required to satisfy that interest.
   3. Where processing is for medical purposes or required by law, data is stored for the period prescribed by applicable provisions.
   4. For data submitted through the contact form, the retention period in Section IV applies (up to 24 months from the last communication, unless a medical relationship arises).
   5. Medical records must, pursuant to law, be retained for a period of 10 to 20 years from the patient's last visit, depending on the case.

VI. YOUR RIGHTS

1. Regarding the personal data we hold and process about you, you have the following rights under EU General Data Protection Regulation (EU) 2016/679:
   1. Right of access: to request access to your data to confirm that we are processing it lawfully.
   2. Right of rectification: to inform us of any changes to your personal data or ask us to correct any inaccuracies.
   3. Right to erasure or restriction: in certain circumstances, to ask us to erase or restrict the processing of your personal data, or to object to specific ways in which we use it, unless we are required by law to retain it.
   4. Right to data portability: in certain circumstances, to ask us to transmit your personal data to a third party.
   5. Right to withdraw consent: where we process your personal data on the basis of your consent, you may withdraw that consent at any time, subject to applicable law. For cookies, you can change your choice via the "Cookie Settings" link at the bottom of every page.
2. To exercise any of your rights or to make a complaint, please contact us at the details in Section II. The Company will respond to your request within one (1) month of submission. This period may be extended by a further two (2) months where necessary, taking into account the complexity and number of requests. Copies of all correspondence received by the Company in relation to any request to exercise rights will be retained in the Company's files for 2 years.

If you consider that your rights have been infringed in any way, you may lodge a complaint with the competent supervisory authority:

Hellenic Data Protection Authority
Website: www.dpa.gr
Postal address: Kifissias 1–3, GR-115 23, Athens
Telephone: +30 210 6475600
Fax: +30 210 6475628
Email: contact@dpa.gr