Policy for the Processing of Personal Data

With the present “Policy for the processing of Personal Data – Information Notice” (the “Policy”), the Hellenic Corporation of Assets and Participations SA (“HCAP” or “the Company” or “our” or other references in the first plural), informs the users / visitors of the HCAP website or in general the natural persons-data subjects (the “users / visitors” or “you” or other references in the second plural) that, in the context of its works, HCAP may collect and process personal data concerning them, provided that the users / visitors provide them to the Company.

HCAP is a societe anonyme that has been established under Law 4389/2016, is registered in the General Commercial Register (GEMI) with no. GEMI 140358160000 and has tel .: +30 210 0106900, Fax: +30 210 0106953, Email: contact@www.hcap.gr and website: https://www.hcap.gr/. HCAP performs the processing of personal data as a controller.

Users / visitors are invited to disclose to HCAP only the data that the latter requests through the respective call for offers, expression of interest for the filling of a certain position, etc. In case of non-provision of these data to HCAP, it may not be possible to carry out and / or complete the activity for which the said data are requested.

HCAP does not in principle require users / visitors to provide personal data concerning another person. However, if such data is required, users / visitors must first ensure the following before providing this data to HCAP: (a) that they have informed that person of the content of this Policy, and (b) that they have obtained their express consent to share them with HCAP in accordance with this Policy, if required or as otherwise may be required by applicable law.

The HCAP website is addressed to adults.

We take every precaution to maintain the personal data we collect and process in accordance with this Policy, for as long as it is absolutely necessary for the purposes for which we have collected it, as well as for our compliance with any legal obligations or our internal procedures, as well as for as long as it takes to protect our legal rights and interests, taking into account the applicable provisions in relation to limitation periods.

According to this Policy, only competent / authorized members of the staff and / or members of HCAP corporate bodies will have access to the personal data collected and processed according to this Policy and only to the extent required in the context of the above processing purposes.

Furthermore, HCAP may, as the case may be, transmit the said data to third parties, provided that it is required and to the extent required for the fulfillment of the above processing purposes, such as e.g. to companies of its portfolio, to its shareholder, its consultants and / or partners in general, as well as to all kinds of authorities, bodies, services, institutions and / or organizations, etc.

In the event that HCAP is interested in concluding a partnership with other persons, which (cooperation) will involve the processing of personal data by these persons – as data processors – on behalf of HCAP -, these persons will have to comply with the national and EU legal framework for the protection of personal data and to sign a contract with HCAP that will govern the terms and conditions of the data processing carried out in this context and shall have the content that is provided for by the applicable provisions.

If required for the above processing purposes, HCAP may transmit your personal data to recipients in third countries, outside the EU. In such a case, HCAP will ensure that all the relevant requirements of the current legislation are met.

Finally, according to the applicable provisions of GDPR (articles 13-22) and Law 4624/2019, you have the following rights regarding the personal data that concern you and that we collect and process in accordance with this Policy:

(a) the right to receive confirmation as to whether or not your personal data is being processed and, if so, to access such data and certain information regarding the processing in accordance with the applicable provisions subject to the requirements of these applicable provisions.

(b) the right to request correction of inaccurate data or the completion of incomplete data.

(c) the right to request that we delete the data we collect and process, for certain reasons and under the conditions laid down in the applicable provisions. Please note that, in certain cases referred to in the applicable provisions, including cases where processing is necessary to comply with our legal obligation under EU or national law and / or to perform a duty in the public interest and / or for establishing, exercising or supporting legal claims, we may not satisfy your request for data deletion.

(d) the right to request the limitation of data processing, in the cases provided for in the applicable provisions. Please note that we may continue to process the data, the processing of which has been restricted in the exercise of this right, for certain reasons referred to in the applicable provisions, including the establishment, exercise or support of legal claims or EU or national public interest grounds.

(e) the right to object, at any time and for reasons related to your particular situation, to our processing of data, in accordance with the applicable provisions. In such a case, we will hereby terminate the processing of the data, unless there are compelling and legitimate grounds for processing which override your interests or liberties or for the establishment, exercise or support of our legal claims.

(f) the right, subject to and to the extent applicable, to receive the data in a structured, commonly used and legible format or to transfer it to another controller, in accordance with the applicable provisions.

(g) the right to revoke, depending on the case and to the extent applicable, the consent you may have given us for our collection and processing of the data, provided that the processing is based on your consent. Please note that in the event of such a revocation, the legitimacy of your previous data processing will not be affected.

For the exercise of any of your above rights, as well as for any issue arising from or in relation to this Policy, you can contact the Data Protection Officer appointed by the Company: dpo@www.hcap.gr. Please note the following in this framework:

(a) If we have reasonable doubts about your identity, we may ask you for further information to confirm your identity.

(b) We will make every effort to respond to your requests without delay and within one (1) month of receipt of the request. If required, this period may be extended for another two (2) months, taking into account the complexity of the request and the number of requests. However, we will make sure to inform you of any extension and the reasons for the delay within one (1) month from the receipt of your request.

(c) Responding to your requests is free of charge in the first place. However, if your requests are clearly unfounded or excessive, especially due to their recurring nature, HCAP may either impose a reasonable fee or refuse to comply with your request.

In any case, you can contact the Data Protection Authority (www.dpa.gr), where depending on the circumstances you have the right to file a complaint.

The HCAP website may include links to other websites under the responsibility of third parties, natural or legal persons. HCAP is not responsible for the terms of protection and management of personal data which these websites apply.

HCAP regularly monitors the content of its website, as well as this Policy. HCAP reserves the right to modify the content of its website, as well as this Policy, at any time deemed necessary, without prior notice or warning, with only the relevant announcement of the new content through this website. For this reason, we recommend that you check this Policy regularly for any changes.

This Policy, as well as the use of this website in general, are governed by Greek law. Any dispute that may arise will fall under the jurisdiction of the courts of Athens.