Information on the Processing of Personal Data, in accordance with (EU) Regulation 2016/679 and current national legislation.
The Public Properties Company S.A. (HPPC SA or Company) as Data Controller during the exercise of business activities on the management and utilization of its real estate portfolio and operation of its individual business units sets as the primary goal the protection of personal data from clients, associates and staff.
For this reason, we take the appropriate organizational and technical measures to protect the personal data we process and to ensure that the processing is always carried out in accordance with the obligations set by the legal framework, both regarding the company itself as Data Controller, as well as by third parties, as processors on its behalf.
Depending on the subject’s relationship with HPPC SA that is, either at the level of simple communication or pre-contractual actions or contractual provisions, personal data collected and processed by the company can be, indicatively and divisively, the following:
a) Identification data: name, father’s name, mother’s name, identity card or passport, VAT number, tax office, AMKA, date and place of birth, sex, citizenship. This data is collected directly by you and is updated with your contribution.
b) Contact data: postal address, email address, landline and mobile phone, etc. The data is collected directly by you and is verified/updated with your contribution.
c) Data on financial and property status, such as: profession and duration that it was exercised, earnings, personal (family) status, tax returns (forms E1, E9, etc.), liquidation notes, certificates of social insurance and/or tax information, acquisition documents or transfer of movable or immovable property, etc. This data is collected/verified/updated either directly by you, or obtained/verified/updated from other sources, such as mortgage offices, cadastral offices, courts, tax authorities, where permitted, by data files of TIRESIA SA
d) Data arising from documents and supporting documents that you submit or send to the company, questionnaires that you complete either on the basis of a contractual relationship or cooperation, or at a pre-contractual stage.
e) Image data from the video recording systems on the premises of business units of the company, in which there are the relevant signs/notifications, according to the law.
f) Data of minors is collected and processed by the company only if the respective legal conditions are met and, in any case, if the minors are over 15 years old.
The above data may be retrieved/verified/updated by the company, where permitted and appropriate, and through publicly accessible sources such as, for example, mortgage offices, cadastral offices, courts, registries, the Internet, accessible social media profiles, media outlets, etc.
In the sense of the above collection of data directly from you, also included is the collection of your data from a third party, natural or legal person acting on your behalf or related to you, as well as the collection of your data that is done through company associates that operate by order and on its behalf, to whom you have provided your personal data for the latter to transmit them to HPPC SA. In case you provide our company with third party personal data, you must have previously informed them in advance and have secured their consent, where required.
.
Legal reasons for the processing of your personal data are:
(a) The in accordance with the purposes and business activities of HPPC SA actions we take to provide you with the services you expect and wish to receive from us.
(b) The consent you provide to us under specific conditions, such as the applicable legal framework, such as in cases where you wish to receive promotional updates from our company.
(c) The collection of criminal records in the context of participation in a tender, is carried out on a case-by-case basis and in special circumstances.
(d) The processing of personal data carried out in the context of compliance with an obligation imposed by law.
(e) the safeguarding and protection of the legal interests, primarily of yours and of our company.
• To execute a contract and take action at your request before concluding a contract.
• For our compliance with a legal obligation.
• For the protection of our legal interests and the protection of persons and property.
HPPC SA transmits your personal data to the following categories of recipients:
- State Authorities, law enforcement agenciesWhen necessary e.g. in cases where we are obliged to disclose personal data to public bodies, during the tender process, in the case of a tax audit and even in the case where we will need to provide information to police and/or judicial authority, in the event of any legal proceedings or dispute , as well as to a competent public financial service, by sending a Money and Certificate List and in any case in order to protect our business interests and the reputation of our company.
- Partners of our company (service providers, consultants, advertising companies, etc.)
HPPC SA has associates to whom it entrusts the processing of personal data on its behalf. In these cases, our company remains responsible for the processing of your personal data and defines the different processing details and receives from the partners to whom it assigns the execution of processing activities all the necessary guarantees (Data Privacy Assignment), in order to ensure that the processing is performed accordingly within the current legal framework and that every natural person can freely and unhindered exercise the rights conferred on him by the legal framework.
Furthermore, our company may transmit to cooperating third companies (marketing companies) in order to inform the public about the promotion of our real estate and services, provided that the consent of any individual has been previously provided and is valid.
- To the shareholder company “Hellenic Corporation of Assets and Participations”.
HPPC SA may transmit personal data it processes, such as employees, customers, employees, etc. to the parent company and its sole shareholder societe anonyme “Hellenic Corporation of Assets and Participations” (HCAP), in the context of drawing up, approving or controlling its strategic planning, its financial activities and data and in general to exercise on behalf of HCAP all of its rights as a sole shareholder and to serve the purposes of its establishment and operation, as defined by Law 4389/2016.
Transmission of personal data outside the EEA
Your personal data is not transmitted to third countries [ie. to countries outside the European Economic Area].
The data storage period is decided based on the following specific criteria depending on each case
When processing is required as an obligation by provisions of the applicable legal framework, your personal data will be stored for as long as the relevant provisions require.
When processing is based on the execution of a contract, and/or the taking of measures for the purpose of drawing up a contract, your personal data is stored for as long as the provision stipulated in the contract, as well as for the duration of the establishment, exercising, supporting or refuting of the legal claims arising from the contract and until their legal limits. The above personal data may be kept even for as long as it is determined by other tax or more specific legal provisions.
For the purposes of promoting our products and services and in so far as the availability of your personal data is based on your consent, your personal data is kept until your consent is revoked. This can be done by you at any time. Withdrawal of consent shall not affect the lawfulness of the proceedings based on consent in the period prior to its withdrawal.
Every natural person whose data is processed by HPPC SA, has the following rights:
Right of access:
You have the right to be aware of and to verify the legality of the data processing. Thus, you have the right to access the data and receive additional information about its processing.
Right of correction:
You have the right to study, correct, update or modify your personal data.
Right to delete:
You have the right to request the deletion of your personal data when we process it with your consent or in order to protect our legitimate interests. In all other cases (such as when there is a contract, obligation to process personal data imposed by law, public interest), this right is subject to certain restrictions or does not exist as the case may be.
Right to restrict processing:
You have the right to request a restriction on the processing of your personal data in the following cases: (a) when you dispute the accuracy of the personal data and until it is verified; (b) when you oppose the deletion of personal data and request instead of deletion the restriction of their use; (c) when personal data are not needed for processing purposes but are necessary for the establishment, exercise, support of legal claims; (d) when you object to the processing and until it is verified there are legitimate reasons that concern us and prevail over the reasons why you oppose the processing.
Right to object to processing:
You have the right to object at any time to the processing of your personal data in cases where, as described above, it is necessary for the purposes of the legitimate interests we pursue as processors.
Right to portability:
You have the right to receive your personal data free of charge in a form that allows you to access, use and process it using commonly used processing methods. You also have the right to request, if technically possible, that we transfer the data directly to another controller. This right exists for the data you have provided to us and their processing is carried out by automated means based on your consent or in the execution of a relevant contract.
Right to withdraw consent
Where the processing is based on your consent, you have the right to revoke it freely, without affecting the legality of the processing based on your consent before revoking it.
To exercise any of the above rights you can contact the Data Protection Officer (DPO) Ms. Marilena Bellou, postal address: Voulis 7, 10562 email: [email protected].
Right of complaint to the HDPA
You have the right to submit a complaint to the Hellenic Data Protection Authority (www.dpa.gr): Call Center: +302106475600, Fax: +30210 6475628, E-mail: [email protected]
HPPC SA implements appropriate technical and organizational measures, aimed at the safe processing of personal data and the prevention of accidental loss or destruction and unauthorized and/or illegal access to them, their use, modification or disclosure. In any case, the way the internet works and the fact that it is open to anyone does not allow for guarantees that unauthorized third parties will never be able to violate the applied technical and organizational measures by gaining access and possibly using personal data for unauthorized and/or illegal purposes.