Personal Data Protection Policy
This Policy explains which personal data Attica Zoological Park processes, why, for how long and what rights you have, in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), Greek Law 4624/2019 and Greek Law 3471/2006.
It applies to visitors to the Park, users of the atticapark.com website, online ticket buyers, annual card holders, newsletter subscribers and anyone who contacts us.
1. Who we are – Data controller
The data controller is the société anonyme "ΑΤΤΙΚΟ ΘΕΜΑΤΙΚΟ ΠΑΡΚΟ Α.Ε." (Attica Thematic Park S.A.), trading as "Attica Zoological Park" (the "Company", "we", "us").
| Detail | Value |
|---|---|
| Registered office | Thesi Gialou, 190 04 Spata, Attica, Greece |
| Tax ID (VAT) | 094508298 |
| General Commercial Registry (G.E.MI.) No. | 002490201000 |
| Telephone | +30 210 6634725, +30 210 6634724 |
| Contact email | zoo@atticapark.gr |
Data Protection Officer (DPO): for any matter concerning your data, contact aspa@atticapark.gr or write to our registered office, marked "For the attention of the Data Protection Officer".
2. What data we collect
We collect only the data needed in each specific situation:
| Situation | Data | Source |
|---|---|---|
| Buying a ticket at the Park's ticket office | No identity details. If you pay by card, the transaction is handled by the bank/POS provider; we receive only a transaction receipt (amount, date, masked card number). We do not store your full card details. | You, bank |
| Buying tickets online (atticapark.digitickets.co.uk) | Full name, address, city, email, ticket category (e.g. child under 12), order and payment details (amount, date, order number), technical browsing data | You, via the DigiTickets platform |
| Annual membership card | Full name, photograph, email, mobile phone number, renewal and visit history | You |
| Newsletter | Email and, optionally, name; subscription/unsubscription history | You |
| Contact form, email, telephone | Full name, email, telephone, message content | You |
| School/educational programmes, guided tours, Zoo Camps | Contact person's details (school or parent), number and ages of participants and, for camps, only the child's details needed for participation and safety | School or parent/guardian |
| Animal adoption, "Friend of the Park", donations | Full name, email, telephone, billing details, amount | You |
| Job applications | CV and any other details you send us | You |
| Video surveillance (CCTV) on Park premises | Images | Security cameras |
| Browsing the website | IP address, device/browser type, pages visited, cookies (see section 8) | Automatically |
We do not collect special categories of data (e.g. health data) unless you provide them to us for accessibility or safety reasons (e.g. a child's allergy at a camp); in that case we process them only for that purpose and with your explicit consent.
3. Purposes and legal bases
| Purpose | Legal basis (Article 6 GDPR) |
|---|---|
| Selling and issuing tickets, sending e-tickets, entry control, handling changes or cancellations | Performance of a contract – Article 6(1)(b) |
| Issuing and managing annual cards, identifying the holder at entry | Performance of a contract – Article 6(1)(b) |
| Issuing invoices/receipts, accounting and tax records | Legal obligation – Article 6(1)(c) |
| Responding to enquiries and requests | Performance of a contract or pre-contractual steps (6(1)(b)) / legitimate interest (6(1)(f)) |
| Sending the newsletter and offers | Consent – Article 6(1)(a), which may be withdrawn at any time |
| Informing existing customers about similar services | Legitimate interest – Article 11(3) of Law 3471/2006, with the option to opt out in every message |
| Safety of visitors, staff, animals and facilities through CCTV | Legitimate interest – Article 6(1)(f) |
| Fraud prevention for online payments, website security | Legitimate interest – Article 6(1)(f) |
| Visitor statistics and website improvement (non-essential cookies) | Consent – Article 6(1)(a) and Article 4(5) of Law 3471/2006 |
| Assessing job applications | Pre-contractual steps – Article 6(1)(b) |
| Defending legal claims | Legitimate interest – Article 6(1)(f) |
We do not sell your data, we do not create profiles and we do not make decisions based solely on automated processing that significantly affect you.
4. Children and minors
Online tickets may only be purchased by adults. For child tickets (under 12) we record only the ticket category, not the child's name or any other details.
We receive children's data (e.g. for Zoo Camps or a minor's annual card) only from a parent or guardian, and only what is necessary. Newsletter sign-up is allowed from the age of 15, in accordance with Article 21 of Law 4624/2019; younger children need parental consent.
5. Who we share data with
Your data is accessible only to authorised Company staff and to partners acting on our behalf (processors), under a contract that binds them to confidentiality and security measures (Article 28 GDPR).
| Recipient | Role | Data |
|---|---|---|
| Digital Ticketing Systems Ltd (DigiTickets), United Kingdom | Online ticketing platform | Buyer and order details, platform cookies |
| Cardlink | Card payment processor | Card and transaction details – we do not receive these |
| Banks / POS providers | Payments at the ticket office | Transaction details |
| Intuit Mailchimp, USA | Newsletter delivery and subscriber list management | Email, name, open and click history |
| Google Ireland Ltd (Google Analytics, Google Ads, YouTube) | Visitor statistics, ad measurement and remarketing, embedded videos – only with consent | Cookie identifiers, IP address, browsing data |
| Meta Platforms Ireland Ltd (Meta Pixel) | Ad measurement and remarketing on Facebook/Instagram – only with consent | Cookie identifiers, IP address, pages visited |
| Usercentrics A/S (Cookiebot), Denmark | Cookie consent management | Consent choices, anonymised IP |
| Moovit | Embedded public transport directions service | Technical browsing data |
| Accountants, legal advisers, auditors | Professional services | As required in each case |
| Public authorities, courts, the Independent Authority for Public Revenue (AADE) | Where required by law | As lawfully requested |
About DigiTickets: when you buy online, you enter your details on the DigiTickets platform, which processes them on our behalf to sell our tickets. For the cookies and analytics of its own platform, DigiTickets provides information in its own Privacy Policy. For requests about your tickets, you can contact us.
6. Transfers outside the European Economic Area
DigiTickets is established in the United Kingdom, which benefits from a European Commission adequacy decision; transfers there are treated as equivalent to transfers within the EU.
Some providers (Mailchimp, Google, Meta) may transfer data to the USA. For analytics and advertising tools this happens only with your cookie consent; in all cases the transfer relies on the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.
7. How long we keep data
We keep data only as long as needed for its purpose and as long as the law requires. After that it is deleted or anonymised.
| Category | Retention period |
|---|---|
| Online ticket orders and invoices/receipts | For as long as the statutory tax record-keeping obligation applies (normally 5 years from the end of the financial year) |
| Annual card | While the card is active and up to [12 months] after it expires, to make renewal easier |
| Newsletter | Until consent is withdrawn (unsubscribe) |
| Enquiries and requests | Up to [12 months] after they are resolved |
| Job applications | Up to [6 months], unless you agree to a longer period |
| CCTV footage | Up to 15 days, unless needed to investigate an incident |
| Cookies | According to each cookie's duration (see section 8) |
If a legal dispute is pending, the relevant data is kept until it is finally resolved.
8. Cookies
Cookies are small files stored on your device. We use only strictly necessary cookies without your consent; all others are activated only if you accept them in the cookie banner.
| Category | Purpose | Consent required? |
|---|---|---|
| Necessary | Website operation and security, recording cookie choices | No |
| Preferences | Remembering your language | Yes |
| Statistics | Measuring website traffic through Google Analytics | Yes |
| Marketing | Ad measurement and remarketing (Google Ads, Meta), embedded YouTube videos, Mailchimp | Yes |
You can change or withdraw your consent at any time through the "Cookie settings" link. Cookies used by the ticketing platform are described in the DigiTickets Privacy Policy.
Detailed list of atticapark.com cookies
Consent is managed through the Cookiebot platform (Usercentrics A/S, Denmark). The list is updated automatically by its periodic scans.
Necessary
| Cookie | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| CookieConsent | Cookiebot | Stores your cookie choices | 1 year | HTTP cookie |
| PHPSESSID | atticapark.com | Maintains your session on the website | 400 days | HTTP cookie |
| covid_rtn | atticapark.com | [To be documented] | Session | HTTP cookie |
| _abck | Mailchimp (Akamai) | Security: detecting and preventing attacks | 1 year | HTTP cookie |
| ak_bmsc | Mailchimp (Akamai) | Distinguishes humans from bots | 1 day | HTTP cookie |
| bm_sz | Mailchimp (Akamai) | Bot detection (Bot Manager) | 1 day | HTTP cookie |
| _csrf | Moovit | Protection against CSRF attacks | Session | HTTP cookie |
| test_cookie | Checks whether the browser accepts cookies | 1 day | HTTP cookie |
Preferences
| Cookie | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| lang | atticapark.com | Remembers your selected language | 1 year | HTTP cookie |
Statistics
| Cookie | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| _ga | Google Analytics | Distinguishes unique visitors and records website usage | 2 years | HTTP cookie |
| _ga_L92S0B0TSZ | Google Analytics | Maintains session state in GA4 | 2 years | HTTP cookie |
Marketing
| Cookie | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| _gcl_au | Google Ads | Measures conversions from ads | 3 months | HTTP cookie |
| _gcl_ls | Google Ads | Measures conversions from ads | Persistent | Local storage |
| pagead/1p-user-list/# | Google Ads | Remarketing and measurement of advertising activity | Session | Pixel |
| IDE | Google (DoubleClick) | Serving and measuring targeted ads | 13 months | HTTP cookie (third-party) |
| _fbp | Meta (Facebook Pixel) | Ad measurement and remarketing on Facebook/Instagram | 3 months | HTTP cookie |
| fr | Meta | Serving and measuring ads | 3 months | HTTP cookie (third-party) |
| _mcid | Mailchimp | Records the visitor to optimise email marketing | 1 year | HTTP cookie |
| _mc_anon_id | Mailchimp | Records visitor behaviour | Session | HTTP cookie |
| YSC | YouTube | Viewing statistics for embedded videos | Session | HTTP cookie |
| VISITOR_INFO1_LIVE | YouTube | Estimates connection speed for videos | 180 days | HTTP cookie |
| __Secure-YNID | YouTube | Records interaction with embedded content | 180 days | HTTP cookie |
| __Secure-ROLLOUT_TOKEN | YouTube | Records interaction with embedded content | 180 days | HTTP cookie |
Unclassified
| Cookie | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| bit | atticapark.com | [To be documented] | 30 days | HTTP cookie |
9. Security
We take appropriate technical and organisational measures to protect your data against loss, alteration or unauthorised access: encrypted connections (HTTPS), access limited to authorised staff, confidentiality obligations and contracts with our partners. Online payments take place in a PCI DSS-certified environment.
If a breach is likely to put your rights at risk, we will notify the Hellenic Data Protection Authority and, where required, you, in accordance with Articles 33 and 34 GDPR.
10. Your rights
You can exercise the following rights at any time (Articles 15–22 GDPR):
- Access to your data and a copy of it.
- Rectification of inaccurate or incomplete data.
- Erasure, when there is no longer a reason to keep the data.
- Restriction of processing.
- Portability, i.e. receiving your data in a structured format or having it transmitted to someone else.
- Objection to processing based on legitimate interest, and in all cases to direct marketing.
- Withdrawal of consent, without affecting the lawfulness of prior processing. For the newsletter, the unsubscribe link in every email is enough.
How: email aspa@atticapark.gr or write to our registered office. We will reply within one month, which may be extended by two further months for complex requests, after informing you. We may ask for information to confirm your identity. Exercising your rights is free of charge.
Complaints: you have the right to lodge a complaint with the Hellenic Data Protection Authority, 1-3 Kifisias Avenue, 115 23 Athens, Greece, www.dpa.gr.
11. Changes to this Policy
We may update this Policy when our services or the law change. The current version is always posted on this page with its last-updated date; for material changes we will also notify you by email, if we have your address.
This Policy is available in Greek and English; in case of any discrepancy, the Greek text prevails.