PRIVACY POLICY

At “Michalakis Estate” (hereinafter referred to as the “Company”), we are committed to protecting and respecting your privacy, as well as ensuring the proper and lawful processing of the Personal Data (PD) that you entrust to us. Your privacy is a fundamental priority for us and an integral part of the quality of the services we provide.

This Personal Data Protection Policy (the “Policy”) describes the way in which we collect, use, store, transfer and protect personal data of customers, visitors to the winery, associates, suppliers, employees, job applicants, participants in tours, wine tastings or other events, other natural persons who transact with the Company, and users of the Company’s website and online store. At the same time, it clearly informs you about the purposes and legal bases for processing, the retention period of the data, their potential recipients, as well as the rights granted to you by applicable legislation.

The Policy has been prepared in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), Law 4624/2019 and any other applicable Greek or European Union legislation, while the Company takes appropriate technical and organisational measures for the security and protection of personal data. Please take the time to read it carefully.

The Company collects and processes personal data that are necessary for its operation, the production, promotion and distribution of its products, and the provision of customer services, in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679 – GDPR), Law 4624/2019 and the applicable legislation in force from time to time.

Personal data are collected directly from you or through lawful and legitimate procedures, in particular: through the Company’s official website, through the online store (e-shop), when purchasing products from the winery’s premises, when participating in tours, wine tastings or other events organised by the Company, through telephone communication, through electronic mail (e-mail), upon entering into or performing a cooperation or supply agreement, as part of the personnel recruitment process, and through your communication with the Company’s sales, customer service or management departments.

We may need to contact you by email or telephone, or using social media or messaging systems, for clarification and administrative purposes, for general communication and coordination, and more generally to provide you with better service.

The data are collected either directly from you or through lawful and legitimate procedures and are used, as applicable, for: the sale and distribution of products, the processing of orders, the shipment of products and the management of deliveries, the transfer of strictly necessary information to courier or transport companies for the delivery of products, the issuance of tax documents, the management of payments, customer service, the management of reservations for visits, tours and wine tastings, communication with customers, suppliers and associates, personnel management, compliance with legal, tax, insurance and other regulatory obligations, the operation of the website and online store (e-shop), the security of information systems, and the improvement of the services provided and the customer experience.

The Company collects only the personal data that are strictly necessary for the achievement of the above purposes and ensures that such data are adequate, relevant and limited to what is necessary, in accordance with the principle of data minimisation set out in Article 5 of the General Data Protection Regulation (GDPR).
We also inform you that:

• The Company has a video surveillance system (CCTV) in areas designated by the relevant Greek legislation and the Greek Data Protection Authority. These areas bear specific signage and a reference via QR code to the relevant Personal Data processing policy through the system. The video surveillance system operates exclusively for the purposes of protecting persons and property, in accordance with Article 6(1)(f) of the GDPR, Law 4624/2019 and the guidelines of the Hellenic Data Protection Authority.
• The Company does not collect or process special categories of personal data (sensitive data), unless provided by you yourselves, potentially recorded by our video surveillance system, or required by applicable legislation and absolutely necessary for the provision of a specific service, or provided for by another lawful basis for processing in accordance with Articles 9 and 10 of the GDPR.

While providing our Company’s services, such as visits, tours, wine tastings, hosting of events (the above at our winery premises) and sales of products, we may process personal data (PD), which may include, indicatively:

• Full name, contact details (address, email, telephone)
• Details of reservations for visits, tours, wine tastings or events, such as the date of the visit, number of participants and special service requests. Also, any other data necessary for the organisation and execution of the visit or event experience
• Dietary requirements or allergies, where necessary for participation in wine tastings or events
• Transaction and payment details, including billing information, which are processed through secure payment providers
• Any other data you voluntarily provide to us or that is necessary for the provision of our services.

During your browsing of the website and the Company’s eshop:

• Information such as IP address, device type, browser, date and time of access, as well as the pages you visit, may be collected automatically.
• This data is used for security, technical operation, statistical analysis, improvement of the user experience, and development of the winery’s services
• Cookies or similar technologies may be used, in accordance with the Cookies Policy. Where required, their use is carried out following prior consent through a selection mechanism (cookie banner)

For our employees, we process data required by labor and tax legislation, as well as based on
our legitimate interest, such as:

• Full name, identity details, Social Security Number, Tax Identification Number, IBAN, contact details and nationality..
• Details of education, professional qualifications and certifications.
• Information included in the curriculum vitae.
• Details of leave, attendance, shifts and other employment-related data.
• Payroll, benefits, performance evaluation and professional development details.

For prospective employees, a specific CV evaluation procedure is applied, which is disclosed upon submission of the application.

For partners and suppliers of the Company, the necessary data are collected in accordance with tax legislation,such as:

• Company name or full name, contact details, Tax Identification Number, Activity Code Number and professional capacity.
• Invoicing and tax document details.
• Bank account details (IBAN) for the execution of payments.
• Information regarding the evaluation of cooperation and suppliers

The legal bases for the processing of personal data that apply are the following:

• The performance of a contract or taking steps prior to entering into the contract.
• Compliance with a legal obligation of the Company.
• The legitimate interest of the Company.
• Your consent, where required.
• The protection of vital interests in emergency situations.

For special categories of data, the specific exceptions under the GDPR apply.

The Company is committed to making every feasible effort to protect your Personal Data. For this reason, we use a variety of security technologies and procedures to protect Personal Data from unauthorized access and use or unlawful processing. For this purpose, we implement appropriate security policies and use modern technologies and protection procedures, which are reviewed and improved on a regular basis, considering technological developments and security best practices.

Please note, however, that no physical or electronic security system can be considered absolutely secure. We cannot guarantee the complete security of our databases, nor can we guarantee that the information you provide to us through the Internet will not be intercepted. We are, however, committed to continuing to review and improve our security policies and to implementing additional technical and organizational security measures as new technologies become available.

In the event of the use of external service providers (such as website hosting, email services or cloud infrastructure), the Company selects providers with adequate security guarantees, and they process data only upon its instructions and in accordance with the relevant contractual and legal obligations. The Company is committed to hosting the website and email with providers within the EU.

The Company retains personal data (Personal Data) only for as long as is necessary to fulfill the purposes for which it was collected or for as long as required by the applicable legislation in force at any given time.

In particular:

• Data concerning visits, tastings, events, product sales and transactions are retained for as long as is necessary for the performance of the relevant contract and, after its termination, for the period required by tax, commercial and other applicable legislation.
• Employee data are retained for the duration of the employment relationship and, thereafter, for as long as required by labor, social security and tax legislation.
• Data of partners and suppliers are retained for the duration of the cooperation and for as long as required to comply with legal obligations or to establish, exercise or support legal claims.
• Data of prospective employees are retained for a reasonable period after completion of the selection process, unless consent has been given for their retention on file for future positions or a longer retention period is required by law
• User account data (where an account is created, e.g. for online purchases) are retained for as long as the account remains active. In the event of a deletion request, the data are deleted or anonymized, unless their retention is required for legal obligations or for the establishment, exercise or support of legal claims.
• Technical website usage data, log files and cookie data are retained in accordance with the Cookies Policy and only for the absolutely necessary period of time for the purposes of their collection.

In the event of a legal dispute, an audit by a competent authority or the exercise of legal claims, the Company may retain the relevant data until the final resolution of the matter.

We ensure that Personal Data is processed lawfully, fairly and securely and is not transferred to third parties without a lawful basis for processing.

Access to the data may be granted to authorized employees of the Company, as well as partners or third-party service providers acting on our behalf and only to the extent necessary to fulfill the purposes of processing.
Indicatively, recipients of the data may include:

• Accountants, tax advisors and financial consultants.
• Legal advisors.
• Providers of IT services, technical support, website hosting and cloud services.
• Providers of email and communication services.
• Banks and payment service providers.
• Transport or courier companies where required.
• Public authorities, regulatory bodies or judicial authorities, when required by law.

All partners and third-party providers processing data on our behalf are contractually bound to maintain confidentiality, implement appropriate security measures and process the data only in accordance with our instructions and applicable legislation.
The Company does not make available, sell or lease personal data to third parties for their own commercial purposes.

This Policy is supplemented by specific policies for Cookies, CCTV, WiFi and Data Retention Periods, available either on our website or upon request.

• To know which of your personal data we retain and process, their source, the purposes of their processing, as well as the period for which they are retained (right of access).
• To request the correction and/or completion of your personal data so that they are complete and accurate (right to rectification). You must provide any necessary document demonstrating the need for correction or completion.
• To request the restriction of the processing of your data (right to restriction of processing).
• To refuse and/or object to any further processing of your personal data that we retain (right to object).
• To request that we transfer your personal data that we retain to any other controller of your choice (right to data portability).
• To lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr), f you consider that your rights are infringed in any way (right to lodge a complaint with the Authority).
• To request the deletion of your personal data from the records we retain (right to erasure).

• The Company has, in any case, the right to refuse to satisfy your requests for restriction of processing or deletion of your personal data, or your objection to processing, if the processing or retention of the data is necessary for the establishment, exercise or support of its legal rights or the fulfillment of its obligations.
• The exercise of the right to data portability does not entail the deletion of your data from our records, which is subject to the terms of the immediately preceding paragraph and the conditions of the Regulation.
• The exercise of the above rights applies prospectively and does not concern processing of data that has already been carried out.

For the exercise of your above rights in accordance with European and Greek legislation and the limitations set out therein, you may contact in writing the address of the Company under the name “Michalakis Estate”, which has its registered office in Partheni, Heraklion, Municipality of Heraklion, Prefecture of Heraklion, with Tax Identification Number EL- 099708090, Heraklion Tax Office (DOY), with General Commercial Registry number 077210227000, legally represented, or electronically at the e-mail address: contact@michalakis.gr and telephone number 2810 381303.

We reserve the right to amend this Policy by applying newer provisions of European and Greek legislation and at our discretion. If we make any changes, we will post the changes here so that you can have immediate access to them.
(Last update of this Policy: 20.09.2026).