INFORMATION WITH REGARD TO THE PROCESSING OF PERSONAL DATA IN ACCORDANCE WITH REGULATION (EU) 2016/679 AND THE RELEVANT GREEK LEGISLATION
The sole proprietorship under the name “A. KARAMITSOS” – Dimitriadis Emmanouil (henceforth the “Company”), with headquarters in Greece (34, Tsimiski street – Thessaloniki), in view of the implementation of Regulation (EU) 2016/679 of the European Parliament and the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, as well as on the provisions of the respective existing Greek legislation, wishes to provide information on the implemented Personal Data Protection Policy (henceforth the “Protection Policy”). In particular, the Company, in its capacity as data controller, hereby provides information as regards the processing of personal data by the Company or by third parties, on the instructions of, under the surveillance and on behalf of the Company, for specific and legitimate purposes and on the condition of the explicit consent of the natural person, in accordance with what follows:
1. Definition of Regulation (EU) 2016/679 of the European Council:
By means of Regulation (EU) 2016/679 of the European Parliament and the Council of 27th April 2016, regulations were adopted on the protection of natural persons with regard to the processing of personal data and on the free movement of such data
2. Is the implementation of Regulation (EE) 2016/679 of the European Council mandatory for the Company?
This Regulation applies to the processing of personal data wholly or partly by automated means, and to the processing, other than by automated means, of personal data which form part of a filing system or are intended to form part of a filing system. The implementation of the Regulation is mandatory for the Company. Failure to supply the personal data required by the Company would make it impossible for us to collaborate with you.
3. Type of personal data compiled by the Company:
Within the framework of its activities, the Company collects the following data:
A. Categories of personal data supplied by you:
Name and surname, father’s name, mother’s name, date of birth, ID card number, Taxpayer’s Identification Number (TIN), Public Financial Service (PFS), credit/debit card number, bank account number, postal address, e-mail address, mobile phone number, telephone number, user name, access code (encrypted), auctions participation record, payment records, IP address, type of browser and operating system, cookies. We use cookies (small text files embedded in your device during your navigation in the Internet) in order to support our webpage, provide our online services and collect information. Cookies allow us, among other things, to store your preferences and settings and to analyze how our website and online services operate.
B. Direct collection of personal data from the cyberspace and from social media:
The data under point A above could be collected from websites and social media pages, where you have published your personal data (e.g. Google, Facebook, Twitter, Instagram).
C. Personal data collected from publicly accessible sources:
In the event of any breach of contractual obligations you undertook towards the Company, your personal data could be compiled from Courts, Land Register Offices etc. The Company is entitled to demand the updating of your personal data.
4. The reasons for collecting and the manner of processing your personal data by the Company:
In order to ensure the uninterrupted and proper collaboration with you, it is mandatory by law to collect data essential for your identification. The reasons for which the Company processes your personal data, which are collected either with your explicit consent or by the cyberspace or by publicly accessible sources are the following:
- i) The conclusion of the contractual relationship entered between us.
- ii) The completion of the financial transaction undertaken by you.
- iii) Forwarding the newsletter with our company’s products to you.
- iv) Forwarding information brochures regarding the services provided by our company and by the Group of companies whose part we form.
- v) Ensuring your participation in the auctions organized by the Company.
- vi) Eventually safeguarding our claims in case you fail to comply with the obligations you undertook towards the Company.
- vii) The overall communication with you.
- viii) The prevention and repression of money laundering and the prevention of fraud against the Company, as well as any other illegal activity.
- ix) The Company’s compliance to the obligations imposed by the existing legal, regulatory and supervisory framework, as well as to the decisions adopted by public authorities or courts.
The company reserves the right to file the collected data for statistical reasons. In order to achieve the above goals, the Company may use automated methods for processing your personal data and/or profiling.
5. The recipients of your personal data:
- i) Company employees, who, on behalf of and under the supervision of the data controller, contribute to the execution of the contractual relationship you have entered into with the Company.
- ii) The employees of any business controlled by the Company, who on behalf of and under the supervision of the data controller, contribute to the execution of the contractual relationship you have entered into with the Company.
- iii) Supervisory, judicial, public and/or other authorities, within their respective competencies.
- iv) Scientific partners of the Company, to whom the latter entrusts the execution of certain works on the Company’s behalf, and who act within the framework of the Regulation on behalf of and under the supervision of the data controller. In particular, your personal data could be processed by Company collaborators within the framework of the execution of a service you requested (e.g. a banking company for the completion of a payment operation, transportation companies, scientific collaborators authenticating the product etc.).
It is noted that, in our company’s web page, there could be references/ links to web pages and/or e-mail addresses of collaborators, who nevertheless do not form part of our company’s Group. In this case, we explicitly declare that we will not transmit your personal data to such companies. As regards eventual compilation of your personal data from the aforementioned web pages, on the basis on the privacy policy they implement per case, our company explicitly declares not bearing any responsibility whatsoever.
6. Principles governing the processing of your personal data
The Company collects personal data for the above explicitly specific legitimate purposes. The personal data collected are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed, in a manner that ensures their appropriate security. In the event that the personal data were collected through other means, other than their submission by you in person, the Company will inform you on the source of the information. The Company collects personal data under fully transparent procedures. In order to safeguard the confidentiality of your personal data, the Company has implemented appropriate technical measures, such as various advanced safety technologies and procedures, such as encryption, detection and management of security breach incidents etc., in order to protect the data from unauthorized or illegal processing and from unauthorized accessibility, as well as from accidental loss, alteration, destruction or damage. In reality, personal data are stored in servers, which are located in rooms with limited access and subjected to controls. Furthermore, the information and computer systems used by the Company have been installed in a way that the use of personal data and/or user identity verification data is minimized. Data Subjects can assist the Company in order to update and/or safeguard the accuracy of their personal data by disclosing information regarding their address of residence, their contact details etc.
7. Possibility of transmitting your personal data to third countries:
The Company is entitled, after obtaining your express consent, which is granted by the present act, to transmit your personal data to third countries, always abiding by the principles detailed in point 6, in the following cases:
- i) for the execution of an explicit mandate granted by you (e.g. effecting a bank transfer to a bank account held in a third country financial institute), in which case your data that are per case necessary to this end will be transmitted to the bodies that must obligatorily interfere.
- ii) to the extent that the Company is obliged to do so by a legal provision or a transnational agreement.
8. Personal data retention time by the Company:
The Company shall be entitled to retain your personal data throughout the time period of the contractual relationship with you. In any case, the Company shall be entitled to retain your personal data throughout the period of time in which they have the right to claim from you any and all demands, in line with the applicable law. By virtue of the Greek legislation, the company’s claim is subject to a twenty year (20) write-off from the commencement of the contractual liability. In case you do not undertake a contractual liability towards the Company, your personal data will be retained for 5 years.
9. Your rights with respect to the protection of your personal data:
- a) Right of access: You shall have the right to receive a confirmation as regards the categories of personal data we retain and process, the purpose of such processing, the recipients to whom your personal data have been disclosed, the data retention time, as well as any information regarding the origin thereof.
- b) Right to rectification: You shall have the right to rectify inaccurate personal data or to obtain completion of incomplete personal data. In the above cases, you should submit all documents necessary to demonstrate the need for such rectification or completion.
- c) Right to erasure (“right to be forgotten”): You shall have the right to request the erasure of your personal data from the archives we maintain, as long as they are not necessary for the purposes for which they were collected.
- d) Right to restriction of processing: You can impose a restriction on the processing of your data. In any case, the Company shall be entitled to decline your request for restriction on the processing or erasure of your personal data, in case the processing or retaining of such data is necessary for the establishment, exercise or defense of the Company’s legal claims or for the fulfillment of the Company’s obligations.
- e) Right to data portability: You can ask and receive the personal data that regard you and which you have provided to the Company in a structured format and transmit them to any other data controller. Exercising the right to data portability does not entail the erasure of your data from the files of the Company, which falls under the terms of the immediately preceding paragraph.
- f) Right to object: You can deny and/ or object any further processing of your personal data retained by us, as long as such retention does not serve any imperative and legal purposes.
- g) Lodging a complaint: You have the right to lodge a complaint before the competent Supervisory Authority, should you deem that your rights are being infringed in any way. It should be noted that the exercise of the above rights shall apply in the future and does not regard already executed data processing.
10. How to exercise your rights:
With regard to the exercise of your rights, as they were previously set forth under point 9, you can:
- a) send an e-mail to the company’s e-mail address: karamitsos[@]karamitsos[.]gr
- b) address your demand in writing to the address 34, Tsimiski street, Thessaloniki – Greece, P.C. GR-54623
- c) contact us at the telephone number +302310264366. Communication hours: 07:00 – 15.00
- d) send a fax to the number +302310274031
The Company will make its best efforts to reply to your request within thirty (30) days from submission. The said deadline can be extended for sixty (60) more days, should this be deemed necessary at the Company’s sole discretion, taking in consideration the request’s complexity and the number of requests. The Company will inform you in the event of extension of the said deadline within thirty (30) days. In case the request is submitted in electronic form, the Company can reply using electronic means as well, unless otherwise specified by you. The aforementioned service is provided by the Company free of charge. Nevertheless, in case your requests are manifestly unfounded, excessive or repeated, the Company shall be entitled to either impose a logical fee, after notifying you accordingly, or to recline to meet your request/ requests. In the framework of a given request and in order to identify the applicant, the Company reserves the right to ask for additional data regarding the identity of the natural person submitting the request.
The Company’s Protection Policy will be subject to updating from time to time within the current legal framework, through the uploading of a new version in our website.