B. PRIVATE DATA THAT WE COLLECT
DVLAW, acting in its capacity as Data Controller, under the meaning of article 4 (7) of GDPR, collects, processes and retains further personal data that you voluntarily provide us with, as well as data obtained from third parties, including public and judicial authorities, that is necessary for our transactions and the communication between us. In particular, we may collect personal data from you, for the purposes mentioned when we provide legal advice to you, when we prepare your representation before courts and other authorities, when you send us your resume to apply for a job, when you associate with the Company within the frame of your business activity, when you use our website or other websites accessible through our website, when you sign up for our electronic services, when you request to receive our Company’s newsletter and event invitations or when you become a member or comment on the Social Media accounts of the Company (such as Linkedin etc.), when you submit requests, complaints, comments, reviews or contact us on any matter.
More specifically, we may collect the following categories of data:
– Personal details, such as your name, the company you work for, your title or position, date of birth, marital status, ID, Τax Identification Number, or any other identifying information that is required, per case;
– Contact information, such as your postal address, your e-mail address and phone number(s) and other information you provide to us;
– Financial data, such as credit/debit card numbers, bank account information, and other invoicing and payment related information;
– Identification and other background verification data provided by you or collected as part of our business acceptance processes, such as a copy of passports or utility bills or evidence of beneficial ownership or the source of funds to comply with client due diligence/”know your client”/anti-money laundering laws and collected as part of our client acceptance and ongoing monitoring procedures;
– Profile and technical Information, such as information about your preferences in receiving newsletters, your communication preferences and information about how you use our website(s), information collected during your visits to our website(s), the Internet Protocol (IP) address, browser type and version, as well as communications to us or regarding us on social media;
– Personal data provided to us by or on behalf of our clients or generated by us in the course of providing our services, which may, where relevant, include special categories of personal data;
– Education data such as studies, skills, knowledge of foreign languages, professional experience;
– Personal data of third parties: If you provide information to us about any person other than yourself, your employees, counterparties, your advisers or your suppliers, you must ensure that they have been made aware of how their personal data will be used by us, and that they have given their consent for you to disclose it to us and for you to allow us to use it;
– Any other personal information you choose to give us when you interact with us.
C. LEGAL BASIS FOR PROCESSING
The legal basis for processing your personal data may be, per case, the following:
a) The fulfillment of our contractual and pre-contractual obligations (article 6(1), first section, case (b) of GDPR): It is necessary to provide us with the personal data required in order to prepare and carry-out the contractual and advisory relationship between us. Without this data, we are not able to process your request or to execute the contract between us;
b) The processing is necessary for the conclusion of an employment contract or, after the conclusion, for its execution (article 27 par. 1 of Law 4624/2019);
c) Compliance with the Company’s legal obligations (article 6(1), first section, case (c) of GDPR): If the required data is not provided to us, we may not be able to abide by our obligations under law;
d) The fulfillment of the legitimate interests of the Company or third parties (article 6 (1), first section, case (f) of GDPR);
e) Your consent (article 6(1), first section, case (a) of GDPR): If you have provided your consent for specific purposes, these purposes arise from the corresponding content of that consent. In cases where you have to provide data for this purpose, we will explicitly mention it to you. If this data is not provided to us, we will not be able to comply with your will, as set forth in your consent. You can withdraw your consent at any time, which, however, will not affect the lawfulness of the processing based on your consent before its withdrawal;
f) Your consent as an employee of the Company (article 27 par. 2 of Law 4624/2019), for specific purposes of processing arising from the content of the consent, which you can withdraw at any time, but without prejudice to the lawfulness of the processing based on your consent before its withdrawal;
Specifically for the processing of special categories of your personal data, within the meaning of article 9 par. 1 of GDPR, the legal bases for its processing are, per case, the following:
a) Your consent (article 9 (2) case (a) of GDPR) which you have expressly provided to us for one or more specific purposes that arise from the respective content of the consent. You can withdraw your consent at any time, but without prejudice to the lawfulness of the processing based on your consent before its withdrawal;
b) The exercise of rights or the fulfillment of legal obligations deriving from labor law, social security law and social protection (article 27 par. 3 of Law 4624/2019);
c) The data has been manifestly made public by the data subject (article 9 (2) case (e) of GDPR);
d) Processing is necessary for the establishment, exercise or defense of legal claims (article 9 (2) case (f) of GDPR);
e) The processing is necessary for the purposes of assessing the ability to work (article 22 par. b of Law 4624/2019);
f) In the cases of article 25 par. 2 of Law 4624/2019.
D. DATA CONCERNING MINORS
Any processing of personal data of minors under 15 years of age is carried out if and to the extent that consent has been given by their legal representatives.
E. PURPOSES FOR PROCESSING
We process personal data that concern you for the following purposes:
a) to communicate with you on any matter arising from our relationship, such as registering you as our client, drafting / processing / submitting a variety of documents, answering your specific requests / queries, providing advice to you, monitoring our relationship, including conflict checks, accounting, auditing purposes, as well as for confirming legal representation of your counter parties and in general to provide our legal and other services to you and to conduct our business;
b) to send you legal updates, details of new services, announcements, publications and newsletters, event invitations, invites to seminars and other information about our services and events or initiatives organized, where you have chosen to receive these. We will provide an option to unsubscribe or opt-out of further communication on any such electronic communication sent to you or you may opt out by contacting us as set out below;
c) to ensure the correctness and accuracy of the data, so that any transaction can be executed properly;
d) to process invoicing, payments and other monetary transactions, to recover any payments due to us and where necessary to enforce such recovery through the engagement of debt collection agencies or taking other legal action (including the commencement and carrying out of legal and court proceedings);
e) to facilitate the use of our website and to ensure that content from our website is presented in the most effective manner for you and for your device;
f) to enable us to process applications for employment submitted to us and to assess your suitability for any position for which you may apply;
g) to fulfil our legal, regulatory, or risk management obligations, in particular to comply with our legal obligations (performing client due diligence/”know your client”, anti-money laundering, anti-bribery, sanctions or reputational risk screening, identifying conflicts of interests); for the prevention of fraud and/or other relevant background checks as may be required by applicable law and regulation and best practice at any given time (if false or inaccurate information is provided and fraud is identified or suspected, details may be passed to fraud prevention agencies and may be recorded by us or by them); to enforce our legal rights, to comply with our legal or regulatory reporting obligations and/or to protect the rights of third parties;
h) to comply with disclosure duties to the authorities and to comply with processing requirements as defined by commercial and tax legislation.
F. RECIPIENTS OF DATA
1. The Company guarantees that it will not transmit or disclose your data in any way to third parties (other than the recipients mentioned herein) for any purpose or use, unless required by applicable law or required by public / prosecutor / judicial services / authorities.
2. Recipients of your personal data, to whom it is disclosed are indicatively:
a) employees/associates of the Company, only to the extent necessary, which are bound by confidentiality clauses;
b) affiliated and cooperating companies, such as companies that provide services in the fields of telecommunications, technical support, insurance, advertising, printing, etc., as processors under the meaning of article 4 (8) of GDPR, which process your data on our behalf and are subject to our instructions and mandates;
c) certified auditing companies that audit the financial statements of our Company;
d) external associates of the Company, such as accountants, legal, insurance and other consultants, to whom the Company entrusts the execution of certain actions and which are bound by confidentiality clauses;
e) associates and service providers in general, to whom the data is transmitted to process a request or to execute a contract with you or to safeguard legitimate interests;
f) public authorities or prosecutor and judicial authorities or tax and customs authorities to whom we are obliged to disclose personal data that concern you.
Besides the aforementioned persons, your personal data will not be further disclosed to third parties.
3. In case data is disclosed to our third party associates, the Company will ensure that the processors acting on its behalf meet the conditions and provide sufficient assurances (guarantees) for the implementation of appropriate technical and organizational measures to ensure the protection of your personal data.
4. Access to your data may, per case, be granted to authorized external associates of the Company. Your information is disclosed to the above persons, if disclosure is necessary for the proper performance of the transaction and in order to ensure the high quality of services provided by our associates.
5. In addition, we may transfer your personal data to suppliers or service providers established outside the European Economic Area (EEA). In this case, your personal data will continue to be subject to an adequate level of protection and appropriate safeguards provided for by law.
G. DATA RETENTION PERIOD
We retain your personal data only for the duration necessary to achieve the purposes, as entailed in this document, or generally in our contractual documents or -if your consent has been granted- until you withdraw your consent. We further retain your data within the required period for commercial and tax retention obligations. In any case, this period shall not exceed twenty (20) years.
After the expiration of the above period, your personal data is destroyed. In particular, we delete your personal data immediately, when the legal basis for its processing does no longer exist, if it is no longer necessary for the purpose of drafting and executing our contract or maintaining our relationship and if no other special legal basis for processing exists, in case of objection on your part, unless further processing is permitted according to the relevant legal provisions, if we are obliged to do so for other legitimate reasons and in any case after twenty (20) years. It is especially pointed out that any CV that you may send us in order to apply for a job posting in the Company and is subject to par. 6 of article 27 of Law 4624/2019 is retained by the Company for a period of six (6) months from sending it to the Company, after which it is deleted.
In case retention of personal data is necessary for the exercise or defense of the Company’s legitimate rights before judicial or other authorities provided for under the applicable law, the above period is extended until the end of the period during which such data is no longer necessary for the above purposes.
We make every effort to minimize the personal data we use over time and, if possible, to anonymize it, so that it can no longer be associated with you or render you identifiable. In the case of anonymized data, we may use it without further notice.
H. COMMUNICATE WITH THE COMPANY AND EXERCISE YOUR RIGHTS
According to the applicable data protection legislation you have the following rights:
1. At any time, in accordance with Article 7 of GDPR, to withdraw your consent to the processing of your personal data, in cases where the processing takes place with your consent or, in case of processing of your personal data under employment relations, your consent according to article 27 par. 2 case (b) of Law 4624/2019. In this case, any processing will cease, without this affecting the lawfulness of the processing based on your consent before withdrawal;
2. Without prejudice to the provisions of article 33 of Law 4624/2019, to request access to your personal data, according to article 15 of GDPR. Specifically, you can receive information regarding which personal data that concern you is or has been processed, its categories, the purposes for which we process it, its origin, the categories of recipients to which it is transmitted and the retention period. Upon request, the Company will provide you with a copy of your personal data being processed;
3. Without prejudice to the provisions of article 35 of Law 4624/2019, to object to the processing of data that concern you, according to article 21 of GDPR, at any time;
4. Without prejudice to the provisions of article 34 of Law 4624/2019, to request the deletion of your data, if it is no longer necessary for the purposes for which it is collected or otherwise processed, if you withdraw your consent on which the processing is based or if the personal data have been processed illegally (Article 17 of GDPR);
5. To request the correction of your personal data that we retain. This allows you to correct any incomplete or inaccurate information we have collected about you (Article 16 of GDPR);
6. To request the restriction on the processing of your personal data, only for specific purposes, including the case of contested accuracy of the data or illegal processing (Article 18 of GDPR);
7. You have the right to the portability of your personal data to another controller, provided that the processing is based on your consent and is carried out by automated means (Article 20 of GDPR);
8. To submit a report / complaint to the Hellenic Data Protection Authority, 1-3, Kifissias Avenue, PC 115 23, Athens, tel : +30 210 6475600, fax: +30 210 6475628, web portal of the Authority: www.dpa.gr, e-mail address: firstname.lastname@example.org.
For the exercise of the above rights, as well as for the communication between us or for any questions regarding the processing of your personal data, you can contact us in writing at the Company’s postal address: 4, Karageorgi Servias St., 10562 or at the e-mail address: email@example.com, or by phone: +30 210 3227000, or by fax: +30 210 322 7111, and we will make sure to reply to you as soon as possible.
J. COMPANY OBLIGATIONS
The Company is obliged to take every reasonable measure to ensure the confidentiality and security of data processing and its protection against accidental or unlawful destruction, accidental loss, alteration, prohibited dissemination, abuse or access by anyone and any other form of unlawful processing.
Your personal data will not be processed for any purpose other than those provided herein, without your prior knowledge and / or consent.
K. CHANGES IN DATA PROTECTION POLICY