A. What data do we collect about you and who is the Data Controller
This document has been drawn up pursuant to art. 13 of EU Regulation 2016/679 (hereinafter referred to as “GDPR”) in order to inform you about our privacy policy with regards to the processing of your personal data (including, but not limited to, your name, surname, mobile phone number, e-mail address and in general the contact information of your contact points), that are collected in the course of the performance of the contract concluded between your company and ΕΝΑRΤΙΑ Single Member S.A. (hereinafter “Enartia”) with registered office in Heraklion, Ionias Av.66, Greece.
According to the rules of the GDPR, the processing carried out by Enartia will be based on the principles of lawfulness, correctness, transparency, purpose and storage limitation, data minimization, accuracy, integrity and confidentiality.
The Data Controller of the personal data is Enartia, as defined above. For any information regarding the processing of the personal data, please write to the following e-mail address: dpo@enartia.com.
Enartia, as Controller of the personal data collected, informs you of the following.
B. For which purposes and on which legal basis we process your data
The processing that Enartia intends to carry out has the following purposes:
- Management and performance of the contract between your company and Enartia
- Fulfilment of any legal, accounting and tax obligations;
- Evaluating the reliability of its suppliers
Your personal data may be processed both automatically and manually.
The legal basis of the processing of your personal data are as follows:
- For the purposes referred to in point 1, the legal basis is provided by art. 6(1)(b) GDPR (“…processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;”), since the processing of your data enables the company and Enartia to perform the contract they have concluded or intend to conclude. The provision of your personal data for this purpose is optional, but failure to provide them could make it impossible for Enartia to execute the contract or provide the services concerned.
- For the purpose referred to in point 2, the legal basis is Enartia’s obligation to comply with requirements imposed by the law pursuant to art. 6(1)(c) GDPR.
The purpose referred to in point 3 is based on the legitimate interest of Enartia to assess the reliability of its suppliers, pursuant to ar.t 6(1)(f) GDPR, which according to our assessment does not override your interests or fundamental rights and freedoms of the data subject.
C. Data Recipients
Your personal data may be shared, for the above-mentioned purposes, with:
- subjects who typically act either as data processors or separate data controllers, i.e.: i) natural or legal persons that provide assistance and advise Enartia in accounting, administrative, legal, tax, financial and debt recovery matters;
- subjects, bodies or authorities to whom it is obligatory to communicate your personal data as required by law or as requested by the competent authorities;
- natural persons authorized by Enartia to process your personal data necessary to carry out activities strictly related to the performance of the contract, who are committed to confidentiality or have an adequate legal obligation of confidentiality (e.g. employees and/or external collaborators of Enartia).
Whenever it is necessary to transfer your personal data outside the EU/EEA, we ensure a similar degree of protection is afforded to your personal data, by ensuring at least one of the following safeguards is implemented:
- We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.
- Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe.
- We will implement supplementary measures where appropriate, including additional security measures to ensure adequate protection for personal data in line with our obligations as a responsible data controller.
For further information, please send a written request to dpo@enartia.com.
D. For how long we keep your data
The personal data processed for the purposes referred to in point 1 will be retained for the period strictly necessary to achieve those purposes. In any case, since the processing is carried out for the performance of a contract, Enartia will process your personal data for the period allowed by Greek law, which corresponds to the statutory limitation period for breach of contract proceedings, so as to protect our interests and be able to demonstrate that we have correctly fulfilled our contractual obligations.
The personal data processed for the purposes referred to in point 2 will be retained for the period required by the specific obligation or by applicable law, i.e. tax legislation for 20 years.
The personal data processed for the purposes referred to in point 3. will be retained for five years, from the termination of the contractual relationship between your company and Enartia, for the reasons explained above.
Further information regarding the retention period can be requested by writing to Enartia at the following e-mail address: dpo@enartia.com
E. Your rights under the GDPR
Pursuant to articles 15 et seq. GDPR, you shall have the right to request from Enartia, at any time, the access, rectification or erasure of your personal data. Furthermore, you shall have the right to request the limitation of the processing in the cases provided for by art. 18 GDPR, as well as the right to obtain your personal data in a structured, commonly used and machine-readable format in the cases provided for by art. 20 GDPR.
Requests should be sent in writing at the following e-mail address: dpo@enartia.com
In any case, you are always entitled to file a complaint with the competent Supervisory Authority (the Hellenic Data Protection Authority), pursuant to art. 77 GDPR, if you believe that the processing of your personal data violates applicable law, or to seek judicial redress through the appropriate courts (art. 79 GDPR).
F. Updates to this Notice
Enartia reserves the right to partly or fully amend or simply update its content, as a result also of changes in applicable law. If the changes to this policy concern substantial changes in processing activities or may have a significant impact on the data subjects, Enartia will notify them appropriately and in due time to the data subjects. The version that is the one that applies.