Data Protection Policy
DATA PROTECTION POLICY FOR THIS WEBSITE
1. INTRODUCTION
This Data Protection Policy (hereinafter the “Data Protection Policy” or “DPP”) applies to the website of the anonymous company trading as “Nera Pigon Grammou S.A.” (hereinafter the “Company”). The Company is the creator and holder of all rights to this website (hereinafter “the website”) with the domain name: https://www.arrena.gr/
The Company places great importance on the protection of personal data. For this reason it has drawn up this Data Protection Policy in order to inform users about how their personal data are processed, which are collected during their navigation of the website.
The website includes links to other websites, which are the responsibility of third parties.
2. DEFINITIONS RELATING TO PERSONAL DATA
(Note: the definitions follow Art. 4 of the GDPR)
Personal Data: any information by which a natural person (“Data Subject”) can be identified or identified.
Data Controller: the natural or legal person, public authority, service or other body which, alone or jointly with others, determines the purposes and means of processing personal data. In this case, the Company acts as Data Controller.
Data Processor: the natural or legal person, public authority, service or other body which processes personal data on behalf of the Data Controller.
Data Subject: the identifiable natural person whose identity can be verified, directly or indirectly, in particular by reference to an identifier such as a name, an identity card number, location data, an online identifier or one or more factors relating to the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person. In this case, the Data Subjects are the users of the website.
“Recipient”: the natural or legal person, public authority, service or other body to whom personal data are disclosed, whether a third party or not. Public authorities that may receive personal data in the context of a specific investigation under Union or Member State law are not regarded as recipients.
3. COLLECTION OF PERSONAL DATA: PURPOSE AND LEGAL BASIS
When a user visits the Company’s website and, insofar as:
(i) they interact with it, or
(ii) they complete standard contact pages (forms),
personal data are collected.
The purposes of the processing carried out in the operation of the website, the data that are processed and the corresponding legal bases are described below:
1. Contact via a standard page (form)
When you send a message to the Company via the relevant standard page (form) on the website, we process the following personal data:
1. Full name,
2. Email address,
3. Telephone number,
4. Any personal data included in your message.
The legal basis for processing depends on the nature and subject matter of your message and is primarily a) the taking of measures at your request prior to the conclusion of a contract (Art. 6(1)(b) GDPR) and b) the legitimate interests of the Company (Art. 6(1)(f) GDPR).
2. Contact via email message
When you send a message to the Company via the email addresses posted on the website, we process the following personal data:
1. Full name,
2. Email address,
3. Any personal data included in your message.
The legal basis for processing depends on the nature and subject matter of your message and is primarily a) the taking of measures at your request prior to the conclusion of a contract (Art. 6(1)(b) GDPR) and b) the legitimate interests of the Company (Art. 6(1)(f) GDPR).
Furthermore, information may be collected automatically such as:
• the user’s online address (IP address). The IP address is assigned by the connection provider through which the visitor/user accesses the internet and then the website. The IP address and any other data that may be derived from it (for example the user’s location – city level) are retained only in accordance with the law,
• the type of browser and operating system,
• the websites and links the user selects (by “click”) within the website’s pages,
• basic connection information with the server,
• information collected via software such as “HTML cookies”, “Flash cookies”, “web beacons” and other similar technologies.
RETENTION PERIOD
Personal data collected for the above (A and B) purposes are retained until the matters raised by your messages are fully resolved. Depending on the nature of the request/message, retention may be extended as required by law (e.g. a five‑year retention period to comply with tax legislation).
MAINTENANCE OF CONFIDENTIALITY
Access to users’ personal data on this website is restricted to appointed company personnel, who are bound to maintain confidentiality.
TRANSMISSION – DISCLOSURE OF PERSONAL DATA
Your personal data are not transferred to third parties, except to service providers responsible for the development, support and hosting of the website. These providers (Data Processors) have contractually guaranteed the protection of your personal data.
The data are stored on servers in Greece. No transfers occur outside the European Economic Area (EEA).
RIGHTS OF DATA SUBJECTS
The Company, as Data Controller, in compliance with data‑protection legislation, fulfils and facilitates the exercise of the following rights:
Right of access
Data subjects have the right, at any time, to receive from the Company information on whether their personal data are being processed and, if so, to be informed of the purpose of the processing, the type of data processed, the recipients, the storage period, the existence of the right to request rectification or erasure or restriction of processing, the right to object, the right to lodge a complaint with a supervisory authority, and whether automated decision‑making is involved. In addition, a copy of the personal data shall be provided to the data subject without undue delay.
Right of rectification
The data subject may request that the Company correct any inaccurate or incomplete personal data concerning them. They may also request the completion of missing personal data, for example via a supplementary statement. Furthermore, the Company undertakes to inform any recipient to whom the personal data were disclosed of any correction, unless this proves impossible or would entail a disproportionate effort. The Company also agrees to inform the data subject about those recipients, upon request.
Right to erasure
The data subject has the right, under Article 18 of the GDPR and Article 34 of Law 4624/2019, to request that the Company delete their personal data.
Right to restriction of processing
The data subject may ask the Company to restrict the processing of their personal data. When processing is restricted, the data may be stored but are only processed where specific exemptions apply.
Right to data portability
The data subject has the right, under Article 20 of the GDPR, to receive their personal data in a structured, commonly used and machine‑readable format.
Right to object
The data subject may object at any time, for reasons related to their particular situation, to the processing of their personal data, under Article 21 of the GDPR. If the data subject objects, the Company will cease processing the data unless it can demonstrate compelling legitimate grounds for the processing that override the data subject’s interests and rights, or for the establishment, exercise or defence of legal claims.
Automated individual decision‑making, including profiling
The Company does not carry out automated individual decision‑making. Should it do so in the future, the data subject has the right to object to a decision based solely on automated processing, including profiling, when that decision produces legal effects concerning them or significantly affects them.
Satisfaction of Rights
Overall, the Company ensures that:
1. Procedures exist that enable the prompt exercise of Data Subjects’ rights, so that all required actions are initiated immediately.
2. It will respond to a request submitted by a Data Subject without undue delay and in any case within thirty (30) calendar days. Where it is unable to satisfy a right exercised by the Data Subject, the Company will ensure that a specific, adequate and complete justification is provided.
3. Except in cases of manifestly unfounded or excessive requests, all actions relating to the fulfilment of Data Subjects’ rights will be carried out free of charge for the Subjects.
To exercise the aforementioned rights, Data Subjects may submit a written request to the Company’s Data Protection Officer (DPO) via the email address: dpo@tsthellas.gr.
If Data Subjects consider that the processing of their personal data breaches the applicable regulatory framework for personal data protection, they have the right to lodge a complaint with the Hellenic Data Protection Authority (postal address Leof. Kifisias 1‑3, 115 23 Athens, tel. 210 6475600, e‑mail contact@dpa.gr).
Amendment of This Policy
The Company reserves the right, when it deems appropriate, to amend this Policy, either in whole or in part, and to publish such amendment on this website. Any amendment to this Policy will take effect immediately upon its posting on the Company’s website. Users are advised to consult this Policy regularly to ensure they are aware of the most recent version.