Data We Collect
The company collects only personal data that is adequate, relevant and necessary for the respective legitimate processing purposes. For example, the following may be collected:
- Identification and contact data: name, email, telephone, postal address.
- Transaction or service request data: information related to services you request or receive.
- Website usage data: IP address, browser type, date and time of access, pages visited, time spent on the site and technical navigation data.
- Contact data: content of contact forms, emails, messages or telephone requests.
- CV data: information included in job applications or accompanying documents.
- Marketing data: preferences for receiving informational material or other relevant communications.
Data Processing Purposes and Legal Basis
| Purpose of Processing | Legal Basis (GDPR) |
|---|---|
| Order processing and/or service provision | Performance of a contract — Article 6(1)(b) |
| Communication with stakeholders, customers and website visitors | Legitimate interest — Article 6(1)(f) or consent — Article 6(1)(a), as applicable |
| Marketing and newsletters | Consent — Article 6(1)(a) or legitimate interest — Article 6(1)(f), where permitted |
| Website and service improvement | Legitimate interest — Article 6(1)(f) |
| Compliance with legal or regulatory obligations | Legal obligation — Article 6(1)(c) |
| Protection of the company’s legal interests | Legitimate interest — Article 6(1)(f) |
| Manage job applications | Pre-contractual stage/performance of a contract — Article 6(1)(b) or legitimate interest — Article 6(1)(f) |
Data Recipients
Data may only be shared when necessary and permitted by law, in particular:
- to authorized company personnel, who are bound by an obligation of confidentiality,
- to third-party service providers who act as processors on behalf of the company,
- to public authorities, judicial or administrative authorities, when there is a relevant legal obligation,
- to external partners and consultants, when this is required for the proper functioning of the company and always under conditions of confidentiality.
The company does not disclose personal data to third parties for independent direct marketing purposes without a prior lawful basis for processing.
Data Transfer outside the EU/EEA
If personal data is required to be transferred outside the European Union or the European Economic Area, this will only take place if the conditions of the GDPR are met, such as, for example, the existence of an adequacy decision, the application of standard contractual clauses or other legal safeguard mechanism.
Data Retention Period
Personal data is retained only for as long as is necessary to achieve the purposes of the processing, to comply with legal and regulatory obligations or to establish, exercise and defend legal claims of the company. After the relevant period, the data is deleted or anonymized in a secure manner.
Data Security
The company implements a comprehensive Information Security Management System (ISMS), in accordance with ISO 27001:2022, and takes appropriate organizational, physical and technological measures to protect data. These measures include, but are not limited to:
- Organizational measures: security policies and procedures, segregation of duties, staff training.
- Physical measures: access control to facilities and critical areas, physical protection measures for equipment.
- Technological measures: encryption, firewalls, access control systems, logging mechanisms, regular backups, vulnerability scanning and multi-factor authentication (MFA).
Your Rights
As data subjects, you can exercise the rights provided for in the GDPR, in accordance with their respective application conditions:
- Right of Access — To be informed whether and what personal data is held about you.
- Right to Rectification — Request correction of inaccurate or incomplete data.
- Right to Erasure — Request deletion of your data, where the legal requirements are met.
- Right to Restriction — Request restriction of processing in certain cases.
- Right to Portability — To receive your data in a structured and commonly used format or to request transmission to another controller.
- Right to Object — To object to processing based on the company’s legitimate interest.
- Withdrawing Consent — When processing is based on your consent, you can withdraw it at any time.
- Right to Complain — Contact the Personal Data Protection Authority.
To exercise your rights, you can contact the company.
Use of Cookies
The website uses cookies and similar technologies for its operation, to improve the browsing experience, to analyze traffic and, where permitted, for content or communication customization purposes. For more information, a separate Cookie Policy applies.
Data Processor
Responsible: HEURISTIC DATA O.E.
Address: Rodou 172, Athens 104 43, Greece
Telephone: (+30) 211 1102031
Email: info@heuristicdata.gr
Data Protection Officer
Responsible: EMMANOUIL LASKARIDIS
Address: Leoforos Alexandras 132-134, Athens 114 71, Greece
Telephone: (+30) 210 3213863
Email: info@gdprteam.gr