Privacy Policy

INFORMATION FOR DATA SUBJECTS

The protection of personal data is a key priority for PED South Aegean. Under the General Data Protection Regulation (EU) 2016/679 (GDPR), in force since 25/05/2018 as amended from time to time, this text provides useful information about the processing of personal data and the rights of data subjects, in accordance with Article 12 of that Regulation.

Under Article 4 of the Regulation:

• ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
• ‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
• ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law;
• ‘processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

In accordance with Article 37 of the GDPR, PED South Aegean has appointed a Data Protection Officer (DPO). The DPO independently oversees the strategy and compliance of the controller and the processor with the provisions of the GDPR (EU) 2016/679 and acts as an intermediary between the various parties concerned (e.g. supervisory authorities, data subjects). The DPO’s role is advisory (not decision-making) and the DPO bears no personal liability for non-compliance with the Regulation.

This protection covers all personal data that have come or will come to the attention of the services of PED South Aegean in the course of its lawful operation and its cooperation with citizens and public- or private-sector bodies.

Regulation (EU) 2016/679 does not abolish obligations arising from the provisions of other laws.

In order to operate in compliance with the legislative framework in force, PED South Aegean has taken the necessary steps, applying appropriate technical and organisational measures for the lawful keeping, processing and secure storage of personal data files, so as to safeguard and protect the processing of personal data in every way from loss or leakage, alteration, transfer or any other unlawful processing.

Lawfulness of processing

As controller within the meaning of Article 4(7) of the General Data Protection Regulation, PED South Aegean collects personal data for the purpose of exercising its responsibilities. The processing of personal data by PED South Aegean is permitted only where provided for by the relevant provisions.

The legal basis for this processing is:

Article 6(1)(b) GDPR: “processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”;

Article 6(1)(c) GDPR: “processing is necessary for compliance with a legal obligation to which the controller is subject”. PED South Aegean processes only the data it is required to process in order to exercise the responsibilities assigned to it by law. All responsibilities already provided for PED South Aegean by law continue to be exercised, with the legal basis for the data processing being the provision that already provides for them;

Article 6(1)(d) GDPR: “processing is necessary in order to protect the vital interests of the data subject or of another natural person”;

Article 6(1)(e) GDPR: “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”.

For the processing of special categories of personal data, the legal basis is Article 9(2)(b), (g) and (j) of the Regulation.

Citizens who provide their data in order to exercise rights or receive benefits from PED South Aegean do not do so on the basis of their consent, but within the framework of PED South Aegean’s obligation to exercise its responsibilities, always after informing citizens in advance. However, where a service of PED South Aegean is provided to citizens as a “value-added service”, personal data may be processed on the basis of “consent”.

As regards the placing of cookies for personalised browsing on our website, the legal basis is the consent of the data subjects under Article 6(1)(a) GDPR.

What data we collect and from where

The personal data collected by PED South Aegean are limited to what is necessary for the purposes for which they are processed and are strictly those required for compliance with its legal obligations or the performance of its tasks carried out in the public interest or in the exercise of the official authority vested in it. Personal data are provided to our organisation directly by the data subjects, obtained lawfully from other government services in the course of our legal obligations, or collected through our websites (cookies, via the web browser, etc.).

Due to the nature of PED South Aegean’s activities, the personal data it collects relate mainly to the following categories of data subjects:

• Employees of the organisation
• Job applicants
• Partners of the organisation (suppliers and other partners in general)
• People dealing with the organisation (citizens and, in general, people who contact our organisation)
• Trainees of the organisation
• Natural persons entering the organisation’s premises, only in specific areas where a video surveillance system operates for the safety of persons and property

Examples of data collected:

• Contact details: first name/surname, marital status, home address, personal email, home telephone, mobile telephone, etc.
• Demographic and identity data: date of birth, identity card number, passport number, tax identification number (AFM), social security number (AMKA), etc.
• Photographs (with prior consent).

Please note that we do not collect special categories of personal data beyond what is provided for in Article 9 GDPR and in no case personal data concerning race, religion, sexual orientation, genetic or biometric data, etc., which receive additional protection under European data protection law.

Children’s privacy in particular

Personal data of children may be collected solely in the context of fulfilling our legal obligations and the employment relationship with our employees, i.e. to describe employees’ family status for matters of pay, employment rights, etc. Such data are understood to be provided with the consent of the person who has parental responsibility for the child.

Profiling

The organisation does not use personal data for profiling.

Principles of processing

The processing of personal data (ordinary and special “sensitive” categories) by PED South Aegean is governed by the principles clearly set out in Article 5 GDPR.

The services of PED South Aegean process personal data in accordance with the legislation in force and transparently. In the interests of transparency, data subjects are informed in a concise, intelligible way, using clear and plain language (“lawfulness, fairness and transparency”).

Personal data provided to PED South Aegean are not further processed in a manner incompatible with the purposes for which they were collected. These purposes are specified, explicit and legitimate, within the framework of its operation and the provision of services to citizens (“purpose limitation”).

PED South Aegean collects only personal data that are adequate, relevant and limited to what is necessary for the purposes for which they are processed (“data minimisation”).

The services of PED South Aegean aim to ensure that the personal data collected are accurate and, where necessary, kept up to date, taking every reasonable step to ensure that inaccurate data are erased or rectified without delay, having regard to the purposes of the processing (“accuracy”).

Personal data are kept in physical or digital files for as long as necessary for the purposes of the processing. This period is determined by the legislation in force (“storage limitation”).

The competent services of PED South Aegean take appropriate technical and organisational measures to ensure that personal data are processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage (“integrity and confidentiality”).

PED South Aegean is responsible for the processing of personal data and is able to demonstrate its compliance with the GDPR principles before the supervisory authorities and the courts (“accountability”).

Please note that PED South Aegean uses cookies on its website. For details about cookies, please see our Cookie Policy.

Who we disclose data to

Personal data are processed solely and exclusively for the purposes for which they are submitted.

PED South Aegean never sells, rents or in any other way discloses or transfers to third parties personal data submitted to its services. The only exception is where disclosure is required by an express provision of law, and then solely to the competent authorities.

Where, following the application of the legislation on public procurement, a contractor is selected who, in performing the contract, has access to personal data processed by PED South Aegean, the competent services ensure that a confidentiality and non-disclosure agreement is signed, or that its terms are incorporated into the main contract.

The aim is to obtain sufficient guarantees that contractors apply appropriate technical and organisational measures, so that the processing meets the requirements of the GDPR and the protection of the rights of the data subject is ensured.

How we protect data

The processing of personal data is subject to the terms of this data protection policy and to the relevant provisions of Greek legislation and EU law on the protection of individuals and of personal data.

PED South Aegean takes all reasonable physical, technical and organisational security measures to ensure that personal data are processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, unlawful destruction or disclosure, and damage.

Data protection by design: when initially designing services (electronic or otherwise), PED South Aegean creates favourable conditions for protecting data subjects’ data, for example by offering, in its electronic services, the option to choose settings that give greater protection to personal data.

Data protection by default: PED South Aegean implements appropriate technical and organisational measures to ensure that, by default, only personal data necessary for each specific purpose of the processing are processed.

Notification of data breaches

As soon as it becomes aware of a breach, PED South Aegean is obliged to notify the competent supervisory authorities and, where the breach is likely to result in a high risk to them, the data subject, in accordance with Articles 33 and 34 GDPR.

Impact assessment and prior consultation

Where processing is likely to result in a high risk to the rights of individuals, in particular because it is systematic, large-scale, involves special categories of data or relies on new technologies, PED South Aegean is obliged to carry out a data protection impact assessment. Where, based on that assessment and despite the safeguards provided, the processing still presents a high risk, PED South Aegean must consult the supervisory authority beforehand.

Records of processing activities

PED South Aegean must keep records, per service and overall, describing its personal data processing activities. Keeping these records is not only an obligation under Article 30 GDPR as an accountability tool, but also helps organise the procedures for handling the personal data held.

Data retention period

PED South Aegean retains personal data only for as long as necessary for the purposes of the processing, as determined in each case by the legislation in force, in the course of performing its tasks and exercising the official authority vested in it, and for as long as necessary for the establishment, exercise or defence of legal claims.

Rights of data subjects

Data subjects retain all rights arising from the applicable Greek and EU provisions, in particular the rights to information, access, rectification, completion, erasure and restriction of processing of their personal data, bearing in mind that the GDPR does not abolish obligations arising from the provisions of other laws.

In particular, subject to the personal data protection framework in force from time to time, every data subject has the following rights:

• Right to information (Articles 13–14) and right of access (Article 15): more and clearer information for data subjects about the personal data collected and processed by the services of PED South Aegean, and the right to access those data.
• Right to rectification (Article 16): data subjects have the right to ask PED South Aegean to rectify inaccurate data and complete incomplete data concerning them.
• Right to erasure (“right to be forgotten”) (Article 17): where data subjects no longer wish their personal data to be processed and kept, they have the right to ask PED South Aegean to erase them, provided that the data are not kept for a specific lawful and declared purpose, as determined in each case by the legislation in force, under the responsibility of the competent service.
• Right to restriction of processing (Article 18): data subjects are entitled to obtain from PED South Aegean the restriction of processing of their data under specific conditions, where provided for by the legislation in force.
• Right to data portability (Article 20): data subjects are entitled to receive their data, or to request that they be transferred, in a machine-readable format from one controller to another under specific conditions.
• Right to object to processing (Article 21) and rights related to automated individual decision-making (Article 22): data subjects have the right to object to the processing of their data under specific conditions and, in particular, not to be subject to a decision based solely on automated processing, including profiling.

Where the exercise of the above rights depends solely on action by the services of PED South Aegean, once the lawfulness of the request has been verified, PED South Aegean responds within the one-month period provided for by the Regulation. In any case, you will be informed of any justified need to extend this period.

Notification of changes

We reserve the right to change the above terms in accordance with the legal framework in force from time to time.

If the above terms change in any way, this will be announced on our website.

How to exercise your rights

Any request concerning personal data and the exercise of your rights must be addressed in writing to PED South Aegean and its Data Protection Officer (DPO).

Right to lodge a complaint with the Authority

You have the right to lodge a complaint with the Hellenic Data Protection Authority on matters concerning the processing of your personal data. For information on the Authority’s competence and how to submit a complaint, please visit its website (www.dpa.gr / My rights / Submit a complaint), where detailed information is available.

Final provisions

The above terms, and any amendment to them, are governed and supplemented by Greek law, European Union law and the relevant international treaties. Any provision of the above terms that becomes contrary to law automatically ceases to apply and is removed from this text, without in any way affecting the validity of the remaining terms.