Privacy Policy - Greek National Opera - The National Opera House of Greece

Which personal data do we collect from you?

When you subscribe to our newsletter: Full name and email address, if you have received our newsletter, if you have opened it, if you have unsubscribed from it and categorized it as ‘spam’, which links on the newsletter you were most interested in.
When you communicate with us: Full name, email address and any information you include in your message.
When you purchase tickets: Full name, email address, phone number, information related to your reservation, payment information (transaction amount, transaction date, payment method). The Greek National Opera does not receive or process credit/debit card information under no occasion.
Data we collect through cookies. For more information, please check our Cookies Policy .

Who controls and processes your personal data?

The Data Controller for your data is the Greek National Opera, located at 364 Andrea Syggrou Avenue, Kallithea, Attica, Greece and with VAT number 090196690.

Our platform is hosted on servers located in the European Union. If you contact us via email, your data is stored within the European Union on Microsoft infrastructure.

We use the services of Ticketservices, which acts as Data Processor for the provision of ticketing services.
Your data is also processed by:

Centiva, which acts as Data Processor in order for us to continuously improve the design and security of our website.
Mailchimp, which acts as Data Processor for sending our newsletters.
Third parties for analytics and marketing purposes. Please check our Cookies Policy for more information on these third parties.
Cloudflare, which acts as Data Processor. Cloudflare may only process your IP address (DNS Services). Please note that your IP address may be transferred by Cloudflare to the USA under the EU-US Data Privacy Framework.
The authorized Greek National Opera’s employees and associates.

All the above-mentioned parties are bound by confidentiality obligations.

Why and on what legal basis do we process your data?

For the performance of a contract and to provide you with the requested services.
To maintain our website secure, based on our legitimate interests.
To continuously improve our website and provide you with the best possible browsing experience, based on your consent.
To contact you upon your request or when it is necessary to serve you, based on our legitimate interests or on the contract we have with you (e.g., when you purchase tickets).
To inform you about news and events, based on your consent.
To comply with any legal obligations (e.g. tax legislation).

How long do we keep your data for?

The retention period of your data differs, according to the use:

For newsletter subscriptions, we retain your data until you request deletion or withdraw your consent.
We will keep any payment records for 15 years, to comply with our legal obligations, stemming from the applicable tax legislation.
If you contact us, we will retain the communication and its meta-data until you ask us to delete it, unless it needs to be retained for a longer period or for legitimate reason or for our compliance with a legal obligation.
For the data collected though cookies, please read our Cookies Policy .

Which rights do you have?

You may ask us:

To provide you with a copy of the personal data we keep for you
To correct some data if it is not correct
To erase your data
To stop processing your data or delimit its processing to certain uses
To send your data to another company or entity via logical means
To withdraw your consent if you have provided it to us (i.e. for the newsletter subscription)

How can you exercise your rights?

If, at any time, you would like to exercise your rights or ask any question regarding your personal data, please refer to the Greek National Opera Data Protection Officer Mr. Konstantinos Kakavoulis by sending:

an email to: dpo@nationalopera.gr or
a letter to the address: Greek National Opera, Stavros Niarchos Foundation Cultural Centre, 363, Andrea Syggrou Avenue, 176 74, Kallithea, Athens, Greece c/o DPO.

We will respond to you within 30 days from reception of your request.
If you believe that your personal data is not adequately protected, you may file a complaint with the Hellenic Data Protection Authority (www.dpa.gr)

Cookie	Purpose	Duration	Domain
`gno_oc_tier`	Opera Club paid membership tier (id, name, expiry). Used so other nationalopera.gr subdomains can show member benefits.	7 days, or until the subscription ends	.productionlh.com
`gno_oc_sso`	Opera Club SSO session hint: first/last name, language, country, member flag, email/SMS opt-in. No email, phone, birthday or Keycloak id.	7 days	.productionlh.com
`gno_oc_lang`	Preferred language from Keycloak (el / en) so other subdomains can stay in the same language.	7 days	.productionlh.com
`lh_oidc_rp_*`	HttpOnly password-reset handoff for Opera Club SSO. Required to complete “Forgot password?”.	Session	current host
`wordpress_logged_in_*`	WordPress logged-in session. Required to keep you signed in.	Session or 14 days if “Remember me”	current host
`wordpress_sec_*`	WordPress authentication (HTTPS). Required for the admin area.	Session or 14 days	current host
`wordpress_*`	WordPress authentication for /wp-admin and /wp-content.	Session or 14 days	current host
`wordpress_test_cookie`	Checks that the browser accepts cookies. Required for login.	Session	current host
`wp-settings-* / wp-settings-time-*`	Stores admin UI preferences (screen layout) for the logged-in user.	1 year	current host
`wp_lang`	Language selected on the WordPress login screen.	Session	current host
`comment_author_*`	Remembers name, email and site when you leave a comment.	1 year	current host
`wp-wpml_current_language`	WPML current front-end language. Required to keep Greek/English consistent.	1 day	current host
`wp-wpml_current_admin_language_*`	WPML admin language preference.	1 day	current host
`wp-wpml_login_lang`	WPML language during login.	2 minutes	current host
`moove_gdpr_popup`	Stores your cookie-banner choices. Strictly necessary for GDPR Cookie Compliance.	As configured in GDPR Cookie Compliance (typically 365 days)	current host
`wp_woocommerce_session_*`	WooCommerce cart/session for a logged-out or logged-in shopper. Required for checkout.	2 days	current host
`woocommerce_cart_hash / woocommerce_items_in_cart`	Lets WooCommerce know the cart changed. Required for the cart to work.	Session	current host
`PHPSESSID`	PHP session id when a plugin uses native sessions.	Session	current host