Privacy Policy

Last modified on 25/7/2018

This Privacy Policy explains our practices regarding the processing of your personal data and provides you with the information required by the General Data Protection Regulation EU 2016/679 (hereafter the «Regulation»).

Contents

Data Controller – Contact info
Personal data we collect and process
Sources of personal data
Purpose and legal basis of processing your data
Retention period – Deletion
Protection of your personal data
Recipients of your personal data
Your rights
Children
International data transfers
Modifications

1. Data Controller – Contact info

According to the Regulation, the legal entity “P. Karfopoulos – D. Papadouli O.E.” is the Data Controller of your personal data (hereafter «Company», «we», «us» or «our»). You may contact us at: Dimiourgia Promotional Displays, 3, V. Antonopoulou street, GR- 14561, Kifissia, Athens, Greece. Tel: +30 210 346 5887.

If you have questions regarding the way we process your personal data, or if you wish to exercise any of the rights you have under the Regulation, please contact us at: dataprivacy@dimiourgia. eu.

2. Personal data we collect and process

We collect and process the following categories of personal data:

Identification and communication data: name, surname, email address, postal address, telephone number (landline and/or mobile), for the purposes of identification and communication.
Invoicing and payment data, such as a VAT number, bank account information, payment card information etc.; such data however are seldom personal and usually belong to a legal entity.
Online activity information: We collect certain data about your activity in the internet, including your IP address and identification information. Please, read our Cookie Policy.
Image and motion data, as processed via the CCTV system established on our premises and which is in compliance with GDPR requirements, such as proper signage etc.

3. Sources of personal data

We collect and process the personal data you provide us with, on a voluntary basis, either directly from you or by a third party acting on your behalf (for example, when your outsourced accountant provides your bank account data to us). It is also possible that you provide us with information that belongs to other third parties (for example, when you provide us with the contact details of your accountant). It is also possible that we collect personal data from public sources. In general, we process personal data in the following instances:

When you visit our website or submit a contact form through www.dimiourgia.eu
When you contact us by phone or email
When you visit our premises or our booth in a trade fair or in other corporate or social events, where we could also exchange business cards, as usual
When you express your interest in conducting business with us, as a customer, as a supplier or as a business partners,
When you place an order or close a deal with our company

Please note: Before submitting personal information about another individual (for example when you introduce to us an external service provider of yours), you are responsible for notifying such individual about this Policy.

4. Purpose and legal basis of processing your data

We process your personal data in a fair and transparent manner, for specific and lawful purposes, such as:

We use your identification and contact data for the purpose of identifying you and contacting you, on the legal basis of pre-contractual negotiations and contractual agreements.
We also use your identity and contact data for the purpose of promoting our products and services, on the legal basis of serving our legitimate business interests. In case such interests override your interests or your fundamental rights and freedoms, we will process your personal data only on the legal basis of your consent.
We use your identity and content data in combination with your payment data, in order to arrange the delivery of your orders, your payments or other purposes serving or related to our contractual agreement.
We also use the above data for the following purposes:
To offer after-sales support
To measure customer satisfaction and improve our services (as per our ISO-9001 quality standards),
To comply with legal or contractual obligations, to protect vital or public interests, or to establish, exercise or defend our legal claims.
We use data under points (3) and (4) of paragraph 2 above, to ensure a safe environment for our personnel and visitors, as well as to secure our assets and protect our transactions and the personal data we process and store.

5. Retention period – Deletion

We maintain your personal data as long as necessary according to the legal and compliance framework.

In case you sign a contract with our company, your data will be maintained for the period of twenty (20) years after the last year of our contractual relationship.
In case you haven’t signed a contract with us, as well as in case of rejection of a business proposal, your data will be maintained for a period of five (5) years after the last year of our business relationship.

After this period, your data is deleted in a safe way, unless otherwise required by laws (such as tax legislation for example).

6. Protection of your personal data

We use the appropriate technical and organizational measures and we apply the best security practices, in order to protect your personal data from unauthorized access, misuse, alteration, accidental or unlawful transfer, loss or destruction. For example:

We apply firewall protection, encryption, secure remote access (VPN); we take regular safety backups and we maintain a tested Disaster Recovery plan and encryption as necessary.
We maintain, regularly test and update the appropriate Security Policies, as well as Processes for the detection, prevention and management of security breaches, including notification of the competent Authorities.
We periodically train our personnel, in order to respect the personal data.
Finally, we bind our personnel and external partners with the appropriate confidentiality agreements.

7. Recipients of your personal data

We share your personal data with certain recipients, as explained below:

With our employees, as required for performing their duties in relevance to our contract or preparing for a business contract with you (for example, we may share your data with our employees in the Sales Dept. for writing an offer, to our Accounting Dept. for issuing an invoice to you, to the Production Dept. and so on), as well as for complying with legal obligations.
To credit/payment service providers, locally or abroad, for the execution of a contract or for a payment you asked or you performed, such as SEPA, SWIFT, VISA, PAYPAL, MASTERCARD, etc.
To legal entities (and/or freelancers), who process your data on our behalf (the so-called “data processors”), such as IT service providers, exports consultants, lawyers and law firms, cloud computing providers, telecoms, security, advertising and promotion agencies etc., all bound with the appropriate confidentiality agreements.
We are obliged to disclose your personal data when required so, by official authorities.

8. Your rights

According to the Regulation, as the data subject, you have the following rights:

Access and information: which data are collected, the sources, the purpose of use, the legal bases, any recipients or transfers outside EU, retention periods, safeguards, etc.

Correction and update, by submitting to us a written request.

Erasure of your personal data, on the following cases:

When your data is no longer required for the purposes they have been collected or otherwise processed,
When you withdraw your consent and there is no other legal basis for the processing of your data,
When your data have been processed without the proper legal basis,
When such erasure is permitted by the law.

Restriction of processing of your personal data in the following cases:

When your data is inaccurate and until their accuracy is validated
When the conditions for the deletion of your data are met, according to the previous paragraph, but you prefer restricting their processing rather than deleting them
When your data are no longer needed by us, but they are needed by you, in order to help you establish, execute or defend your legal claims.

Objection to the processing of your personal data, including profiling and automated decision making, unless we have legitimate interests to establish, exercise or defend our legal claims that override your rights and freedoms.

Data portability, meaning the delivery of your data to you in a compatible, machine readable format, on condition that such data has been processed based on your consent or contract.

Withdrawal – at any time – of the consent at any time, that you have given us for processing your data. Withdrawal does not affect the lawfulness of the process that took place based on your consent before withdrawing it.

The above rights may be subject to limitations, due to legal obligations or rights of our Company, such, as for example, when you request erasure of your data, while we are obliged to maintain it in order to comply with the tax legislation.

In order to exercise your rights or ask questions related to your personal data, you may contact us by email at dataprivacy@dimiourgia.eu, ή or by post at the following address: P. Karfopoulos – D. Papadouli O.E. 3, Vassili, Antonopoulou str., 145 61 Kifissia, Attica, Hellas.

We will respond to your request free of charge within 30 days after we receive it, unless there are exceptional circumstances that oblige us to extend our response up to 60 days, if necessary, taking into account the complexity of your request and the total incoming number of requests. In case of such delay, we are going to notify you within the first 30 days after the receipt of your request, stating the reasons of such delay. Our company may contact you for identification.

If your claim is considered manifestly unfounded or excessive by our Company, we may request a reasonable fee, considering the expenses involved, or we may deny to further process your claim.

File a complaint

In case you believe that our Company did not respond adequately to your request, regarding your data privacy, you have the right to file a complaint to the competent authority. The Hellenic Authority provides relevant instructions online: www.dpa.gr. You also have the right of legal appeal.

9. Children

Our products and services do not address children. However, if you believe that we may have accidentally collected personal data of a person under the age of 16, please notify us by email at dataprivacy@dimiourgia.eu.

10. International data transfers

We don’t transfer your personal data outside the EU or to international organizations, except in the following cases:

– Money transfer to or from a foreign financial institution (bank), for the purpose of executing a contract between us; only the data required for such purpose will be transferred (SWIFT, SEPA, etc.)

– Where an obligation arises, on the basis of a provision of law, a contract, a court order, or when it is required to establish, support or exercise our rights or to defend our legitimate interests.

11. Modifications

We have the right to modify this Policy at any time. You will be notified in case of a material change, by a notice placed on this website or by contacting you to the primary contact details you have provided to us.

End of document.