ELASTOTET SA – Privacy Policy

Scope of the Privacy Policy

The company under the name “ELASTOTET S.A.” (ELASTOTET), with its registered seat in Avlonas Attiki (48th km Athens-Lamia National Road), guarantees respect for the private life of natural persons with whom it transacts, as well as the protection of their personal data, whether such data is kept online or on its premises.

For this reason, within the framework of the applicable national and EU legal framework governing personal data protection, in particular the General Data Protection Regulation (EU) 2016/679 (hereinafter the “Regulation” or “GDPR”) and Law 4624/2019, ELASTOTET hereby notifies this lawful, reasonable, and transparent personal data protection policy. The purpose of this policy is to provide natural persons (“data subjects”) with adequate information regarding the personal data it collects and processes.

This Privacy Policy applies to all premises and/or digital environments belonging to ELASTOTET and related to its activities (including, but not limited to: the production, marketing, import, export, and representation of all types of insulating and chemical-technical materials, the production of paints and varnishes, and related products).

Definitions

“Special categories of personal data”: Personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
“Processing”: Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
“Anonymization”: The processing of personal data in such a manner that the data can no longer be attributed to a specific data subject.
“Pseudonymization”: The processing of personal data in such a manner that the data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
“Controller”: The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. For the purposes of this policy, the Entity acts as the Controller.
“Processor”: A natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
“Data Subject”: The natural person whose personal data is being processed, e.g., trainees, associates, employees of the Entity, etc.
“Consent”: Any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
“Personal data breach”: A breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.
“Applicable Legislation”: The national and EU legislation on personal data protection, in particular the General Data Protection Regulation (EU) 2016/679 (hereinafter “GDPR”), Law 4624/2019, as well as the Decisions, Directives and Opinions of the Hellenic Data Protection Authority (hereinafter “HDPA”).

Scope of the Privacy Policy

Purposes of Processing – Legal Basis

ELASTOTET collects and processes personal data transparently in accordance with the principles of lawfulness, proportionality, confidentiality and integrity, purpose limitation and accuracy, specific data retention periods, and data minimization. Specifically, ELASTOTET collects and processes personal data for the following purposes:

Processing	Purpose of Processing	Legal Basis
Collection, maintenance, and processing of CVs of job candidates	Evaluation of candidates for filling positions to serve the corporate purposes, activities, and needs of the Company	Legitimate interests [Art. 6(1)(f) GDPR]
Collection, maintenance, transfer, and processing of employee data	Compliance with labor and social security legislation (e.g., for employment notification and management of the employment relationship).	Compliance with a legal obligation [Art. 6(1)(c) GDPR] / Performance of a contract [Art. 6(1)(b) GDPR]
Collection, maintenance, transfer, and processing of data of employees’ children and spouses as dependents	Compliance with labor and social security legislation for fulfilling insurance obligations	Compliance with a legal obligation [Art. 6(1)(c) GDPR]
Collection, maintenance, and processing of bank account details and other financial data of employees	Payroll processing and fulfillment of contractual obligations	Performance of a contract [Art. 6(1)(b) GDPR]
Collection, maintenance, and processing of data of associates and suppliers	Fulfillment of contractual obligations / Compliance with tax legislation	Performance of a contract [Art. 6(1)(b) GDPR] / Compliance with a legal obligation [Art. 6(1)(c) GDPR]
Collection, maintenance, and processing of contact details of associates and suppliers	Professional communication	Legitimate interests [Art. 6(1)(f) GDPR]
Collection, maintenance, and processing of client/customer data	Fulfillment of contractual obligations / Compliance with tax legislation	Performance of a contract [Art. 6(1)(b) GDPR] / Compliance with a legal obligation [Art. 6(1)(c) GDPR]
Collection, maintenance, and processing of client/customer contact details	Professional communication	Legitimate interests [Art. 6(1)(f) GDPR]
Collection, maintenance, and processing of data of prospective clients/customers	Evaluation of interest expression and potential collaboration, as well as communication	Legitimate interests [Art. 6(1)(f) GDPR]
Use of a security camera system (CCTV)	Security of facilities, equipment, and personnel	Legitimate interests [Art. 6(1)(f) GDPR]
Collection, maintenance, and processing of data from online visits to the corporate website	Evaluation of traffic and improvement of the corporate website	Legitimate interests [Art. 6(1)(f) GDPR]

Personal Data Collected

Depending on the form of processing, ELASTOTET may collect and process personal data, such as the following:

Clients/Prospective Clients and their Representatives: Full name, address, email address, telephone and fax numbers, ID card number, Tax Identification Number (TIN), details of the company they represent and business activity information, bank account information.
Visitors/Users of the Corporate Website: Unique device IP address, as well as full name, email address, and any other information voluntarily filled in by the visitor in the free text field when using the electronic contact form on the ELASTOTET website.
Employees/Job Candidates: Full name, father’s name, mother’s name, year of birth, place of birth, gender, nationality, residential address, email address, telephone and fax numbers, ID card number, Tax Identification Number (TIN), Social Security Number (AMKA) and other social security fund registry numbers, bank account number, data concerning health, family status, education and training of the employee, work experience, data concerning benefits provided by ELASTOTET to its employees.
Associates/Contractors/Suppliers (natural persons): Full name, contact telephone number, address, Tax Identification Number (TIN), bank account information.
Image Data: ELASTOTET collects, processes, and stores image data through video surveillance systems (CCTV), where applied, for the purpose of protecting the security of its equipment and facilities, adhering to the specifications and deadlines provided by the relevant national and EU legislation.
Audio Data: In certain cases, and following prior information to the data subjects, ELASTOTET may record telephone calls with clients for the purpose of better serving its clients, always adhering to the conditions set by national and EU legislation for maintaining audio and image data.

Special Categories of Personal Data

ELASTOTET may collect and process data belonging to special categories of personal data (“sensitive data”), such as health data, in order to comply with its legal obligations, for example, compliance with health regulations. Similarly, in exceptional cases where required by applicable law, ELASTOTET may collect and process data concerning criminal convictions or offenses, always respecting the principle of proportionality.

Data of Minors

It is not ELASTOTET’s policy to seek or receive personal data of minors (i.e., persons under 18 years of age), either directly or indirectly through third parties, except in cases concerning data of minor children in their capacity as dependents of insured parents who are employees of ELASTOTET.

However, as it is impossible to always control the age of persons entering or using the ELASTOTET website, parents and guardians of minors are advised to contact ELASTOTET directly if they become aware of any unauthorized disclosure of data by minors for whom they are responsible, in order to exercise their corresponding rights, such as the right to erasure of their data.

Method of Collecting Personal Data

ELASTOTET may collect personal data both in hard copy form (e.g., through the submission of necessary supporting documents for concluding a contract) and through its online/digital platforms and applications (e.g., electronic contact form, email). Furthermore, this data may be collected either directly from the data subject or through third parties, always in accordance with the applicable legal framework for personal data protection.

Online Technologies

ELASTOTET only collects the necessary information related to traffic on the ELASTOTET website and web pages, such as the IP address and browser type used by the visitor, cookies, invisible pixels, and web beacons to obtain information about browsing on them. Further relevant information is detailed in the Cookie Policy.

Disclaimer for Third-Party Websites

The ELASTOTET website may contain links that redirect the user to third-party websites. ELASTOTET does not control these third-party websites and is not responsible for the content posted on them or any further links appearing on them. ELASTOTET is not responsible for the privacy practices of third parties or the content of third-party websites.

Data Transfer

ELASTOTET may transfer data to third parties (legal or natural persons) acting as processors to support its operations (e.g., accounting support, technical support, payroll processing) and serve its purposes.

ELASTOTET may transfer the above data to third parties when required by applicable legislation, in accordance with the safeguards provided therein. In such cases, it must adequately inform the data subjects before proceeding with such transfer.

Specifically, if the transfer concerns a country outside the European Economic Area (EEA), ELASTOTET will carry it out provided the conditions of Chapter II and Chapter V of the GDPR are cumulatively met.

If the above conditions are not met, the transfer to a third country is prohibited, and ELASTOTET cannot transfer personal data to it unless one of the specific derogations provided for in the Regulation applies (e.g., explicit consent of the data subject and information regarding the risks of the transfer, the transfer is necessary for the performance of a contract at the data subject’s request, there are reasons of public interest, it is necessary for the establishment, exercise or defense of legal claims, or for protecting the vital interests of the data subjects, etc.).

Data Retention Period

Personal data collected by ELASTOTET is retained for a predetermined and limited period, depending on the purpose of the processing. After this period expires, the data is deleted from its records, unless a different retention period is provided or permitted by applicable law.

Data Protection Officer (DPO)

ELASTOTET has appointed a Data Protection Officer (DPO). Their contact details are as follows:
Tel: +30 22950 29995
Email: info@elastotet.gr

Rights of Personal Data Subjects

ELASTOTET takes care and takes appropriate measures to enable you to exercise the rights recognized by national and EU legislation regarding the collection and processing of your personal data. These rights are the following:

The Right of access to data
II. The Right to rectification of data
III. The Right to erasure of data (“right to be forgotten”)
IV. The Right to restriction of processing of data
V. The Right to data portability
VI. The Right to object to the processing of data
VII. The Right to withdraw consent

ELASTOTET may refuse to satisfy the relevant request, in whole or in part, if it is manifestly unfounded or excessive, or for other reasons provided by law. In any case, ELASTOTET will provide you with information on the processing actions taken following your request without undue delay, and in any case within one (1) month of receipt. This deadline may be extended by a further two (2) months if necessary, considering the complexity of the request and the number of requests. ELASTOTET will inform you of any such extension within one month of receipt, providing the reasons for the delay.

If your request is submitted by electronic means, the information will be provided by electronic means where possible, unless you request otherwise.

If the submitted request is manifestly unfounded or excessive, particularly due to its repetitive nature, ELASTOTET may either charge a reasonable fee for fulfilling it or refuse to act on the request.

Right to Appeal to the Hellenic Data Protection Authority

If you consider that ELASTOTET has not satisfied your rights or that your freedoms are affected, you have the right to appeal to the Hellenic Data Protection Authority (“HDPA”) regarding matters concerning the processing of your personal data. Detailed information on the Authority’s competence and how to file a complaint is provided on the HDPA website (http://www.dpa.gr → My Rights → File a Complaint).

Updates to the Personal Data Protection Policy

ELASTOTET may amend this Personal Data Protection Policy from time to time to comply with regulatory changes or to meet its operational needs and legal obligations. Updated versions of this Personal Data Protection Policy will be posted on the ELASTOTET website with a date indication, so that the most recent updated version is known.

March 2021