Terms and Conditions

These terms and conditions, as may be amended from time to time, apply to all our services directly or indirectly (through distributors) made available online, through any mobile device, by email or by telephone. By accessing, browsing and using our (mobile) website or any of our applications through whatever platform (hereafter collectively referred to as the "website") and/or by completing a reservation, you acknowledge and agree to have read, understood and agreed to the terms and conditions set out below (including the privacy statement).

These pages, the content and infrastructure of these pages, and the online reservation service provided on these pages and through the website are owned, operated and provided by and are provided for your personal, non-commercial use only, subject to the terms and conditions set out below.

1.0 Definitions

””, "us", "we" or "our" means , a company incorporated under the laws of the Greece, and having its registered address at  263 Kifissias Avenue ,   Kifissia, Greece 14561

 "Platform" means the (mobile) website and app on which the Service is made available owned, controlled, managed, maintained and/or hosted by .

"Service" means the online reservation service (including the facilitation of payments) of various products and services as from time to time made available by Suppliers on the Platform.

"Supplier" means the provider of accommodation (e.g. hotel, motel, apartment, bed & breakfast), (theme) parks, attractions, museums, sightseeing tours, cruises, rail and coach tours, transfers, tour operators, insurances, and any other travel or related product or service as from time to time available for reservation on the Platform.

2.0 Scope of Service

Through the Platform, we provide an online platform through which Suppliers can advertise their products and service for reservation, and through which visitors of the Platform can make such reservations (i.e. the reservation service). By making a reservation through , you enter into a direct (legally binding) contractual relationship with the Supplier with which you make a reservation or purchase a product or service (as applicable). From the point at which you make your reservation, we act solely as an intermediary between you and the Supplier, transmitting the details of your reservation to the relevant Supplier(s) and sending you a confirmation email for and on behalf of the Supplier.

When rendering our Service, the information that we disclose is based on the information provided to us by Suppliers and certified by us. Also, the Suppliers are given access to online and offline tools through which they fully comply for updating all rates, availability and other information which is displayed on our Platform. We will use reasonable skill and care in performing our Service, and we will verify if, so we can guarantee that, all information is accurate, complete or correct. We thought cannot we be held responsible for any errors (including manifest and typographical errors), any interruptions (whether due to any (temporary and/or partial) breakdown, repair, upgrade or maintenance of our Platform or otherwise), inaccurate, misleading or untrue information or non-delivery of information. Our Platform does not constitute and should not be regarded as a recommendation or endorsement of the quality, service level, qualification or (star) rating of any Supplier (or its facilities, venue, products or services) made available.

Our Service is made available for personal and non-commercial use only. Therefore, you are not allowed to re-sell, deep-link, use, copy, monitor (e.g. spider, scrape), display, download or reproduce any content or information, software, reservations, tickets, products or services available on our Platform for any commercial or competitive activity or purpose.

3.0 Prices, crossed-out rates and Best Price Guarantee

The prices on our Platform are highly competitive. All room/property prices are per room/property for your entire stay and all prices are displayed including VAT/sales tax and all other taxes (subject to change of such taxes), unless stated differently on our Platform or the confirmation email/ticket. Ticket prices are per person or group and subject to validity as indicated on the ticket, if applicable. Applicable fees and taxes (including tourist/city tax) may be charged by the Supplier in the event of a no-show or cancellation fee. Applicable taxes may be charged by the accommodation in the event of a no-show or cancellation fee.

Sometimes cheaper rates are available on our Platform for a specific stay, product or service, however, these rates made available by Suppliers may carry special restrictions and conditions, for example non-cancelable and non-refundable. Please check the relevant product, service and reservation conditions and details thoroughly for any such conditions prior to making your reservation.

The crossed-out rate shown for rooms is based on the third highest current price of the Supplier for your product or service with the same booking conditions in a 30-day window around your check-in date (15 days before and 15 days after check-in date; if less than 15 days are between today and the check-in date, we will use the corresponding number of days after the check-in date to result in a 30-day total). To ensure we are making a fair comparison, we always use the same reservation conditions (e.g. meal plan, cancellation policy and room type). This means that you get the same room for a lower price compared to other check-in dates at the same time of year.

The currency converter is for information purposes only and should not be relied upon as accurate and real time; actual rates may vary.

Obvious errors and mistakes (including misprints) are not binding.

All special offers and promotions are marked as such.

4.0 Privacy and cookies

respects your privacy. Please have a look at our privacy and cookies policy for further information.

5.0 Free of charge

Our service is free of charge because, unlike many other parties, we will not charge you for our Service or add any additional (reservation) fees to the rate.

Suppliers pay a commission (being a small percentage of the product price (e.g. room price) to after the end user has consummated the service or product of the Supplier or after the guest has stayed at (and paid) the accommodation.

6.0 Credit card or bank transfer

If applicable and available, certain Suppliers offer the opportunity for reservations to be paid (wholly or partly and as required under the payment policy of the accommodation) to the Supplier during the reservation process by means of secure online payment (all to the extent offered and supported by your bank). For certain products and services, facilitates (through third party payment processors) the payment of the relevant product or service (i.e. the payment facilitation service) for and on behalf of the Supplier (acts and operates as the merchant of record). Payment is safely processed from your credit/debit card or bank account to the bank account of the accommodation provider through a third-party payment processor.

For certain (non-refundable) rates or special offers, please note that Suppliers may require that payment is made upfront by wire transfer (if available) or by credit card, and therefore your credit card may be pre-authorized or charged (sometimes without any option for refund) upon making the reservation. Please check the (reservation) details of your product or service of choice thoroughly for any such conditions prior to making your reservation.

In the event of credit card fraud or unauthorized use of your credit card by third parties, most banks and credit card companies bear the risk and cover all the charges resulting from such fraud or misuse, which may sometimes be subject to a deductible (usually set at EUR 50 (or the equivalent in your local currency)). In the event that your credit card company or bank charges the deductible from you because of unauthorized transactions resulting from a reservation made on our Platform, we will pay you this deductible, up to an aggregate amount of EUR 50 (or the equivalent in your local currency). In order to indemnify you, please make sure that you report this fraud to your credit card provider (in accordance with its reporting rules and procedures) and contact us immediately by email  book&themykonist.com. Please state 'credit card fraud' in the subject line of your email and provide us with evidence of the charged deductible (e.g. policy of the credit card company). This indemnification only applies to credit card reservations made using ’s secure server and the unauthorized use of your credit card resulted through our default or negligence and through no fault of your own while using the secure server.

7.0 Pre-payment, cancellation, no-show and fine print

By making a reservation with a Supplier, you accept and agree to the relevant cancellation and no-show policy of that Supplier, and to any additional (delivery) terms and conditions of the Supplier that may apply to your visit or stay (including the fine print of the Supplier made available on our Platform and the relevant house rules of the Supplier), including for services rendered and/or products offered by the accommodation provider (the delivery terms and conditions of an accommodation provider can be obtained with the relevant accommodation provider). The general cancellation and no-show policy of each Supplier is made available on our Platform on the Supplier information pages, during the reservation procedure and in the confirmation email or ticket (if applicable). Please note that certain rates or special offers are not eligible for cancellation or change. Applicable city/tourist tax may still be charged by the Supplier in the event of a no-show or charged cancellation. Please check the (reservation) details of your product or service of choice thoroughly for any such conditions prior to making your reservation. Please note that a reservation which requires down payment or (wholly or partly) prepayment may be cancelled (without a prior notice of default or warning) insofar the relevant (remaining) amount(s) cannot be collected in full on the relevant payment date in accordance with the relevant payment policy of the Supplier and the reservation. Cancellation and prepayment policies may vary according to room type. Please carefully read the fine print (below the room types or at the bottom of each Supplier page on our Platform) and important information in your reservation confirmation for additional policies as may be applied by the Supplier (e.g. in respect of age requirement, security deposit, non-cancellation/additional supplements for group bookings, extra beds/no free breakfast, pets/cards accepted). Late payment, wrong bank, debit or credit card details, invalid credit/debit cards or insufficient funds are for your own risk and account and you shall not be entitled to any refund of any (non-refundable) prepaid amount unless the Supplier agrees or allows otherwise under its (pre)payment and cancellation policy.

If you wish to review, adjust or cancel your reservation, please revert to the confirmation email and follow the instructions therein. Please note that you may be charged for your cancellation in accordance with the accommodation provider's cancellation, (pre)payment and no-show policy or not be entitled to any repayment of any (pre)paid amount. We recommend that you read the cancellation, (pre)payment and no-show policy of the accommodation provider carefully prior to making your reservation and remember to make further payments on time as may be required for the relevant reservation.

If you have a late or delayed arrival on the check-in date or only arrive the next day, make sure to (timely/promptly) communicate this with the Supplier so they know when to expect you to avoid cancellation of your reservation or room or charge of the no-show fee. Our customer service department can help you if needed with informing the Supplier. does not accept any liability or responsibility for the consequences of your delayed arrival or any cancellation or charged no-show fee by the Supplier.

8.0 (Further) correspondence and communication

By completing a booking, you agree to receive (i) an email which we may send you shortly prior to your arrival date, giving you information on your destination and providing you with certain information and offers (including third party offers to the extent that you have actively opted in for this information) relevant to your reservation and destination, and (ii) an email which we may send to you promptly after your stay inviting you to complete our guest review form. Please see our privacy and cookies policy for more information about how we may contact you.

disclaims any liability or responsibility for any communication with the Supplier on or through its platform. You cannot derive any rights from any request to, or communication with the Supplier or (any form of) acknowledgement of receipt of any communication or request. cannot guarantee that any request or communication will be (duly and timely) received/read by, complied with, executed or accepted by the Supplier.

In order to duly complete and secure your reservation, you need to use your correct email address. We are not responsible or liable for (and have no obligation to verify) any wrong or misspelled email address or inaccurate or wrong (mobile) phone number or credit card number.

Any claim or complaint against or in respect of the Service must be promptly submitted, but in any event within 30 days after the scheduled day of consummation of the product or service (e.g. check out date). Any claim or complaint that is submitted after the 30 days period, may be rejected and the claimant shall forfeit its right to any (damage or cost) compensation.

Due to the continuous update and adjustments of rates and availability, we strongly suggest to make screenshots when making a reservation to support your position (if needed).

9.0 Disclaimer

Subject to the limitations set out in these terms and conditions and to the extent permitted by law, we shall only be liable for direct damages actually suffered, paid or incurred by you due to an attributable shortcoming of our obligations in respect to our services, up to an aggregate amount of the aggregate cost of your reservation as set out in the confirmation email (whether for one event or series of connected events).

However and to the extent permitted by law, neither we nor any of our officers, directors, employees, representatives, subsidiaries, affiliated companies, distributors, affiliate (distribution) partners, licensees, agents or others involved in creating, sponsoring, promoting, or otherwise making available the site and its contents shall be liable for (i) any punitive, special, indirect or consequential loss or damages, any loss of production, loss of profit, loss of revenue, loss of contract, loss of or damage to goodwill or reputation, loss of claim, (ii) any inaccuracy relating to the (descriptive) information (including rates, availability and ratings) of the Supplier as made available on our Platform, (iii) the services rendered or the products offered by the Supplier or other business partners, (iv) any (direct, indirect, consequential or punitive) damages, losses or costs suffered, incurred or paid by you, pursuant to, arising out of or in connection with the use, inability to use or delay of our Platform, or (v) any (personal) injury, death, property damage, or other (direct, indirect, special, consequential or punitive) damages, losses or costs suffered, incurred or paid by you, whether due to (legal) acts, errors, breaches, (gross) negligence, willful misconduct, omissions, non-performance, misrepresentations, tort or strict liability by or (wholly or partly) attributable to the Supplier or any of our other business partners (including any of their employees, directors, officers, agents, representatives or affiliated companies) whose products or service are (directly or indirectly) made available, offered or promoted on or through the Platform, including any (partial) cancellation, overbooking, strike, force majeure or any other event beyond our control.

By uploading photos/images onto our system (for instance in addition to a review) you certify, warrant and agree that you own the copyright to the photos/images and that you agree that may use the uploaded photos/images on its (mobile) website and app, and in (online/offline) promotional materials and publications and as at its discretion sees fit. You are granting a non-exclusive, worldwide, irrevocable, unconditional, perpetual right and license to use, reproduce, display, have reproduced, distribute, sublicense, communicate and make available the photos/images as at its discretion sees fit. By uploading these photos/images the person uploading the picture(s) accepts full legal and moral responsibility of any and all legal claims that are made by any third parties (including, but not limited to, accommodation owners) due to publishing and using these photos/images. does not own or endorse the photos/images that are uploaded. The truthfulness, validity and right to use of all photos/images is assumed by the person who uploaded the photo, and is not the responsibility of . disclaims all responsibility and liability for the pictures posted. The person who uploaded the photo warrants that the photos/images shall not contain any viruses, Trojan horses or infected files and shall not contain any pornographic, illegal, obscene, insulting, objectionable or inappropriate material and does not infringe any third party (intellectual property right, copyright or privacy) rights. Any photo/image that does not meet the aforesaid criteria will not be posted and/or can be removed/deleted by at any time and without prior notice.

10.0 Intellectual property rights

Unless stated otherwise, the software required for our services or available at or used by our Platform and the intellectual property rights (including the copyrights) of the contents and information of and material on our Platform are owned by, its suppliers or providers. exclusively retains ownership of all rights, title and interest in and to (all intellectual property rights of) (the look and feel (including infrastructure) of) the Platform on which the service is made available (including the guest reviews and translated content) and you are not entitled to copy, scrape, (hyper-/deep)link to, publish, promote, market, integrate, utilize, combine or otherwise use the content (including any translations thereof and the guest reviews) or our brand without our express written permission. To the extent that you would (wholly or partly) use or combine our (translated) content (including guest reviews) or would otherwise own any intellectual property rights in the Platform or any (translated) content or guest reviews, you hereby assign, transfer and set over all such intellectual property rights to. Any unlawful use or any of the aforementioned actions or behavior will constitute a material infringement of our intellectual property rights (including copyright and database right).

11.0 Miscellaneous

To the extent permitted by law, these terms and conditions and the provision of our services shall be governed by and construed in accordance with Greek law and any dispute arising out of these general terms and conditions and our services shall exclusively be submitted to the competent courts in Greece.

The original Greek version of these terms and conditions may have been translated into other languages. The translated version is a courtesy and office translation only and you cannot derive any rights from the translated version. In the event of a dispute about the contents or interpretation of these terms and conditions or inconsistency or discrepancy between the Greek version and any other language version of these terms and conditions, the Greek language version to the extent permitted by law shall apply, prevail and be conclusive. The Greek version is available on our Platform (by selecting the Greek language) or shall be sent to you upon your written request.

If any provision of these terms and conditions is or becomes invalid, unenforceable or non-binding, you shall remain bound by all other provisions hereof. In such event, such invalid provision shall nonetheless be enforced to the fullest extent permitted by applicable law, and you will at least agree to accept a similar effect as the invalid, unenforceable or non-binding provision, given the contents and purpose of these terms and conditions.

12.0 About the company and the support companies

The online reservation service is rendered by, which is a company, incorporated under the laws of Greece and having its offices at and registered with the trade register of the Chamber of Commerce in Greece under registration number. Our VAT Registration Number is 801533418.

13.0  Data Controller

The Mykonist operates this booking system through a data processor, as explained below. For the purposes of the General Data Protection Regulation (“GDPR”) (EU) 2016/679, we are the Data Controller. There is a strict contractual framework between the data controller and the data processor for the protection of your personal information. We are: 

The Mykonist

Merchia beach, Mykonos

84600 , Mykonos - GR

The User may contact our Data Protection Officer:

[email protected]

Data Processor

WebHotelier operates this booking system on behalf of The Mykonist and is committed to protecting the privacy of the users of this system. WebHotelier is:

WebHotelier Technologies Limited

Mnasiadou 9 (Demokritos Building, Office 16) ,  1065 Nicosia , Cyprus

For the purposes of the GDPR, where WebHotelier processes your personal data on behalf of The Mykonist, WebHotelier is the the Data Processor. When this notice mentions “data processor,” “processor,” “WebHotelier,” it refers to WebHotelier Technologies Limited.

WebHotelier is a certified PCI-DSS Level 2 Service Provider audited monthly by Trustwave.

The User may contact WebHotelier's Data Protection Officer:

At The Mykonist, we are committed to protecting and respecting your privacy. Please read this notice as it contains important information about how we use personal data that we collect from you or that you provide to us.

Information & Consent

This Privacy Notice describes how we collect, use, process, and disclose your information, including personal information about you (hereinafter, the “User”), in conjunction with your access to and use of our booking system.  By reading this Privacy Notice, the user is hereby informed on how we collect, process and protect personal data furnished through the booking engine.

The User must carefully read this Privacy Notice, which has been written clearly and simply, to facilitate its understanding, and to freely and voluntarily determine whether they wish to provide their personal data, or those of third parties, to The Mykonist.

When this notice mentions “booking system,” “booking engine,” “system,” “website,” “platform,” “app,” “webapp,” “services,” “online services,” it refers to all pages and functions under https://themykonist.reserve-online.net/ unless specified otherwise.

By accessing the platform or providing information, you agree to our privacy practices as set out in this privacy statement. We may change this notice from time to time. You should check this notice frequently to ensure you are aware of the most recent version.

Identity

When this notice mentions “we,” “us,” or “our,”, “data controller,”, “controller,”, it refers to The Mykonist.

Data Controller

The Mykonist operates this booking system through a data processor, as explained below. For the purposes of the General Data Protection Regulation (“GDPR”) (EU) 2016/679, we are the Data Controller. There is a strict contractual framework between the data controller and the data processor for the protection of your personal information. We are:

The Mykonist

Merchia beach, Mykonos

84600 , Mykonos - GR

The User may contact our Data Protection Officer:

Data Protection Officer

[email protected]

Data Processor

WebHotelier operates this booking system on behalf of The Mykonist and is committed to protecting the privacy of the users of this system. WebHotelier is:

WebHotelier Technologies Limited

Mnasiadou 9 (Demokritos Building, Office 16)

1065 Nicosia , Cyprus

For the purposes of the GDPR, where WebHotelier processes your personal data on behalf of The Mykonist, WebHotelier is the the Data Processor. When this notice mentions “data processor,” “processor,” “WebHotelier,” it refers to WebHotelier Technologies Limited.

WebHotelier is a certified PCI-DSS Level 2 Service Provider audited monthly by Trustwave.

The User may contact WebHotelier's Data Protection Officer:

Obligatory nature of providing the data

The data requested in the forms accessible from the booking engine are, in general, mandatory (unless specified otherwise in the required field) to meet the stated purposes. Accordingly, if they are not provided or are not provided correctly, we will be unable to process the request.

Personal data we collect and process

This will include:

• personal information about you which we ask you for (e.g. your name, address, and email address) when you make a booking from our booking engine;
• financial details in order to process your booking when we require pre-payment;
• details of transactions you carry out through our booking engine and details of the fulfilment of your orders.
• our data processor may only collect and process personal data collected and/or processed on behalf of us in accordance with our instructions. WebHotelier cannot process it in any other way or for any other purpose.

We grant permission to our data processor:

• to use your personal information for reserving rooms and/or other services for you at The Mykonist;
• to pass on your financial details to The Mykonist and/or appropriate third party (for example, credit card company) for the purpose of confirming or paying for a booking;
• to use your information for marketing purposes (where you explicitly agree to this); and
• to pre-complete forms and other details on our website to make your next visit to our booking engine easier (e.g. when amending or cancelling a booking).

Social Login:

In the event of registration and/or access through a third-party account, we may collect and access certain information of the User’s profile from the corresponding social network, solely for internal administrative purposes and/or for the purposes indicated above.

Third-party data (e.g. book for a friend)

In the event that the User provides third-party data, they declare that they have the third party’s consent and undertake to provide the interested party -the data holder- with the information contained in this Privacy Notice, duly exonerating us and our data processor from any liability in this regard. However, we may carry out the necessary verifications to verify this fact, adopting the corresponding due diligence measures, in accordance with the data protection regulations.

Sensitive Data

Unless specifically requested, we ask that you not send us, and you not disclose, on or through the Services or otherwise to us, any Sensitive Personal Data (e.g., social security numbers, national identification number, data related to racial or ethnic origin, political opinions, religion, ideological or other beliefs, health, biometrics or genetic characteristics, criminal background, trade union membership, or administrative or criminal proceedings and sanctions).

Use of Services by Minors

The Services are not directed to individuals under the age of sixteen (16), and we request that they not provide Personal Data through the Services.

Purpose of processing personal data

Depending on the User’s requests, the personal data collected will be processed in accordance with the following purposes:

• To manage the bookings made, including payment management (where applicable) and the management of the user’s requests and preferences.
• To manage registration in loyalty or membership programs, as well as obtaining and redeeming points.
• To manage the User’s contact requests with us through the channels provided to this end.
• To manage the sending of personalised commercial communications from us, by electronic and/or conventional means, in cases in which the User expressly consents.
• To manage the provision of the contracted accommodation service, as well as additional services.
• To manage surveys and/or evaluations regarding the quality of the services provided by us and/or the perception of its image as a company.

Data Retention

We will retain your Personal Data for the period necessary to fulfill the purposes outlined in this Privacy Notice unless a longer retention period is required or permitted by law or if the User requests their withdrawal from us, opposes or revokes their consent.

The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you and provide the Services to you (for example, for as long as you have an account with us or keep using the Services or if you have a booking that has not yet been fulfilled)
• Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them)
• Whether retention is advisable considering our legal position (such as, for statutes of limitations, litigation or regulatory investigations)

Legitimate interest for processing your data

The data processing required in fulfilment of the aforementioned purposes that require the User’s consent cannot be undertaken without said consent.

Likewise, in the event that the User withdraws their consent to any of the processing, this will not affect the legality of the processing carried out previously.

To revoke such consent, the User may contact us through the appropriate channels.

By the same token, in those cases in which it is necessary to process the User’s data for the fulfilment of a legal obligation or for the execution of the existing contractual relationship between us and the User, the processing would be legitimized as it is necessary for compliance with said purposes.

Data Disclosure

We will use and disclose Personal Data as we believe to be necessary or appropriate:

• to comply with applicable law, including laws outside your country of residence;
• to comply with legal process;
• to respond to requests from public and government authorities, including authorities outside your country of residence and to meet national security or law enforcement requirements;
• to enforce our terms and conditions;
• to protect our operations;
• to protect the rights, privacy, safety or property of our own, you or others; and
• to allow us to pursue available remedies or limit the damages that we may sustain.

We may use and disclose Other Data for any purpose, except where we are not allowed to under applicable law. In some instances, we may combine Other Data with Personal Data (such as combining your name with your location). If we do, we will treat the combined data as Personal Data as long as it is combined.

International transfers of personal data

We may transfer your personal information to our data processor(s) or/and sub-processor(s) based outside of the EEA for the purposes described in this notice. If we do this, your personal information will continue to be subject to one or more appropriate safeguards set out in the law. These might be the use of model contracts in a form approved by regulators, or having our suppliers sign up to an independent privacy scheme approved by regulators (like the US ‘ Privacy Shield’ scheme).

Our data is stored in the cloud using Amazon Web Services in N. Virginia, USA and in Frankfurt, Germany. If you are accessing any of our systems from outside the USA, you acknowledge that your personal information may be transferred to the USA, a jurisdiction which may have different privacy and data security protections from those of your own jurisdiction, to be processed and stored.

User's  Responsibility

The User:

Guarantees that they are of legal age or legally emancipated, where applicable, fully capable, and that the information furnished to us is true, accurate, complete and up-to-date. For these purposes, the User is responsible for the truthfulness of all the data communicated and will keep the information updated, so that said data reflects their actual situation.

Guarantees that he/she has informed third parties on whose behalf he/she has provided data, where applicable, of the aspects contained in this document. Also guarantees that he/she has obtained the third party’s authorisation to provide their data to us for the purposes indicated.

Will be responsible for false or inaccurate information provided through the Website and for damages, whether direct or indirect, that this may cause to us or third parties.

Exercise of Rights

The User may contact us at any time free of charge, to:

• To obtain confirmation about whether or not personal data concerning the User are being processed by us.
• To access their personal details.
• To rectify any inaccurate or incomplete data.
• To request the deletion of their personal data when, among other reasons, the data are no longer necessary for the purposes for which they were collected.
• To confirm revocation of consent.
• To obtain from us the limitation of data processing when any of the conditions provided in the data protection regulations are met.
• To request the portability of your data.

Likewise, the user is informed that at any time he/she may file a complaint regarding the protection of their personal data before the competent Data Protection Authority.

Security Measures

We will process the User’s data at all times in an absolute confidential way and maintaining the mandatory duty to secrecy with regard to said data, in accordance with the provisions set out in applicable regulations, and to this end adopting the measures of a technical and organisational nature required to guarantee the security of their data and prevent them from being altered, lost, processed or accessed illegally, depending on the state of the technology, the nature of the stored data and the risks to which they are exposed.