1. Controller

The controller of your personal data is the company under the name “PentaSoft Consulting IT CONSULTATION SERVICES OF INFORMATION TECHNOLOGY SINGLE-PERSON ANONYME” and the distinctive title “PentaSoft Consulting Μ.Α.Ε.”, (“the Company”), based on Agricultural School Avenue no. 27, Pylaia Thessaloniki and legally represented, with a call center 2316 022030 and e-mail contact info@pentasoft.gr.

2. General principles maintained by the Company during the processing of data

2.1. Any information we provide to you with this Policy and any information that you request in the future related to the management and protection of your personal data is provided free of charge, subject to the request not to be repeatedly exercised, exaggerated or to be manifestly unjustified.

2.2. For each of the rights, which will be detailed below and that you can exercise, the Company will respond to you, in accordance with the envisaged internal procedure it maintains, within one (1) month of receipt of the request or in case of objective difficulty, complexity of the request or volume of requests. The Company will respond to a maximum period of a total of three (3) months, regarding your request, either by its processing or with the reasoned refusal as to its execution for legitimate reasons, expressly specified in the General Data Protection Regulation (EU) 2016/679 – GDPR, (“Regulation”).

2.3. In the event that the Company considers that any of your rights is exercised manifestly unfounded or the request is excessive or is of a repetitive nature, it is entitled on the one hand to impose your burden with a reasonable fee on the provision of further information (which is in principle free of charge) and on the other hand to refuse to follow up the request.

2.4. In the event that the Company is delayed beyond the justified period of time to respond to your request as well as in any case that you believe that your rights are violated or the Company is not consistent with their obligations of lawful processing and their safe retention, you have the right to lodge a complaint with the competent supervisory authority, (Personal Data Protection Authority,

“DPA”
Athens Kifissias 1-3
T.K. 115 23, Athens
E-mail: contact@dpa.gr
Tel.: +30-210 6475600

2.5. In the event that a specific processing of your data is based on consent, you reserve the right to revoke your consent at any time for the future, as well as the right to submit all your requests for the exercise of your rights below by completing the “special application form of subject,” provided by the Company in the context of the envisaged relevant process of responding and managing the requests of the subjects, at privacy@pentasoft.gr. Your requests will be maintained by the Company for a period of five (5) years from their receipt. Any documents other than the special form will not be taken into account and destroyed immediately.

3. Your Rights in relation to the personal data processed by the Company

3.1. Right of Information

You reserve the right to be informed about the personal data you provided to us and we hold for some or some purposes, as described below under 4. This Policy is in its entirety a manual of basic information and understanding of the regulatory framework governing the protection of your personal data.

3.2. Right of Access

You reserve the right to request from the Company access to your personal information, which we maintain and confirm in relation to whether they are processed and more specifically information on the purposes of processing, the categories of personal data, the categories of recipients, the period of their retention and processing, the existence of a right to terminate to the DPA, any available information on the origin of the data when they have not been made available by yourself, the existence or non-automated decision-making.

3.3. Right of Correction

You reserve the right to request the Company rectification of your data in the event that any of the data for which we have the right to process has been changed or has been incorrectly or incompletely registered.

3.4. Right to Delete

You reserve the right to request from the Company a full or partial deletion of your data, in which we have the right to observe and process, or because these are no longer necessary for the fulfillment of the purposes for which they were collected, or because you revoke your consent, or because the data was collected for a purpose deemed illegal. The Company, within a reasonable time, will reply to you by confirming the total or partial deletion of your data or regarding the inability to delete specific data in the event that a law or the fulfillment of a public interest or the fulfillment of a legal obligation or the exercise or support or support of a legal claim requires their retention. In the event that you consider – despite the Company’s reasoned refusal to delete your data – that this right is violated, the right to lodge a complaint with the DPA is reserved.

3.5. Right to Restriction

You reserve the right to request from the Company the limitation of the processing of your data, quantitatively, temporally and/or with regard to their processing purpose and more specifically: (a) or because you dispute the accuracy of your data and for as long as the Company needs to confirm their accuracy, (b) or because you deem the processing illegally but instead of deletion you choose a restriction, (c) or because it is no longer necessary to use them by the Company, but you do not wish to delete them.

3.6. Right of Portability

You reserve the right to receive the personal data you have provided to the Company in a structured, commonly used and machine-readable format as well as the right to transmit them further without objection, since the processing of your data is done on the basis of consent. In the context of the exercise of this right you have the opportunity to request immediate transmission from the Company to a third party without your mediation. This right is without prejudice to the limitations of the right to erasure and its exercise cannot adversely affect the rights and freedoms of others.

3.7. Right of Opposition

You reserve the right to object to the use of your processing data, unless the Company demonstrates compelling legitimate grounds for their processing, which override your interests or are necessary for the establishment, exercise or support of its legal claims.

CATEGORIES OF SUBJECTS

(A) CUSTOMER – SUPPLIER – ASSOCIATE & CANDIDATE CLIENT – SUPPLIER

A.1. Data Nature – Purpose of Processing – Legal Basis

a)  Your data (name, e-mail address, telephone, home address or registered office, status, professional activity and / or services of interest to you, etc.), which are collected pre-contractually, through sending an e-mail, telephone or filling in the contact form on the Company’s website, are processed for the purpose of investigating the possibility of a transaction with our Company, in order to pursue the purposes of the Company.

b)  Your data [personal identification details (name, VAT number, ID card, social security number, legal representative’s information), home address or registered office, contact details (phone, e-mail address), bank account number, full billing details, option payment method, payment execution information, etc.] which you provide yourself, by telephone, by e-mail and / or in writing.

c)  The legal basis for the processing of the above data (by A.1.a) is to serve the legal interests of the Company for the purposes of marketing and ensuring its proper operation, (article 6 par. 1 point (f) of Regulation (EU) 2016/679 on the Protection of Personal Data), while the legal basis for the processing of data (by A.1.b) is the execution of the contract between us as well as the compliance of the legislation (b).

(d)  The Company does not collect and process, in principle, special categories of personal data (sensitive), i.e. data related to your racial or ethnic origin, your political opinions, religious or philosophical beliefs or your participation in a trade union, data relating to your sexual life or sexual orientation, your genetic or biometric data and health data, for the purpose of your identification as an underlying

Exceptionally, the Company may collect and process the above data only if:

• you have expressly given your consent to this and for a specific purpose and a fixed time or the data has been manifestly made public by you;
• processing is necessary for the exercise of certain rights or the execution of specific obligations, either on the part of our Company or by you as a data subject (e.g. obligations and rights of labor law or social security);
• processing is necessary to protect your vital interests in the event of physical or mental incapacity/weissability for consent;
• processing is necessary for the establishment, exercise or support of legal claims both you and our Company,
• processing is necessary for reasons of genuine public interest, taking into account the principle of proportionality,
• the processing (health data and biometric data) is necessary in cases of extremely urgent and extraordinary circumstances (e.g. health crisis) to ensure the public interest and public health.

Α.2. Transmission of Data

a)  Your data (available for the purposes described above under A.1.a & b) are not provided (as not required by the purpose for which they are collected) to be transferred to any organization other than the Company. As a controller we have taken all the necessary security measures in order not to allow access to your personal data to anyone other than those properly authorized to do so and only for the processing purposes provided for in this purpose. In its context.

Our business, service and pursuit of our legitimate interests, we may disclose your data to the Company’s external partners, such as the related parent company, accounting and tax support company. These persons receive only the data that are strictly necessary for the fulfillment of the work they undertake, they are processed only with our explicit order and authorization and solely for the purposes mentioned in this Policy. We ensure that these persons are aware of this, as well as that they apply the regulatory framework and the legislation on the protection of Personal Data, even signing the relevant contractual conditions of confidentiality and data protection.

b)  Your data (available for the purposes described under A.1.a & b) other than the above under A.2.a) transmissions may be forwarded to public bodies and services, to competent tax authorities and/or insurance funds, to judicial and independent authorities, (such as auditors) in the context of our compliance with the corresponding legislation.

c)  The Company normally retains your personal data within the European Union. Where data are to be transmitted to third countries outside the European Union, for which there is exceptionally no adequacy decision of the European Commission or to International Organizations, all appropriate safeguards provided for in the applicable legislation on the protection of personal data relating to transfers to third countries will be taken.

Α.3. Data retention time

a)  We will retain the above (under A.1.a) data for the period of five (5) years to serve our commercial purposes and then we will delete them.

b)  We will retain the above data (under A.1.b) that have a financial, insurance and tax dimension for as long as the tax and/or insurance legislation stipulates.

c)  All other (under A.1.b) data (for which they are not required by law retention for a specific time) are deleted within five (5) years from the termination of the contract or cooperation relationship.

d)  After the expiration of the corresponding (legal) retention time of the Data, we will delete them at our own risk, following the prescribed relevant internal procedure of our Company.

(B) CANDIDATE WORKERS

Β.1. Purpose of processing – Legal Basis

The purpose of processing your data (personal identification details (name, ID), home address, contact details (phone, e-mail address), study details and / or professional training and experience, marital status, etc.] is the assessment of the possibility of your recruitment by our Company and staffing its human resources while its legal basis is your consent according to article 6 par.1(a) of the Regulation.

Β.2. Data retention time

In order to fulfill the processing purpose concerning the investigation of a job in our Company, we consider it reasonable and necessary time to retain your relevant data for twenty-four (24) months. After twenty-four (24) months from the time of receipt of your CV, the relevant file with the total of your details will be deleted.

Β.3. Note on the above Processing

It is noted that before processing your Personal Data to evaluate the possibility of your recruitment by our Company, you are invited to fill in the online CV submission form on the Company’s website by attaching your CV or in case of sending your CV by e-mail you are invited to fill in and sign the  Consent Form for the Candidate Employee Consent Form.  In case of your recruitment to the Company you can learn more about the processing of your data and the exercise of your legal rights in the “Privacy and Privacy Policy of an Employee”.

4. Violation of Personal Data

We will report any illegal and proven violation of our Company’s database to all stakeholders as well as to the competent supervisory authority, (“DPAG”), within seventy-two (72) hours from the violation, provided that it is obvious that the data of prospective employees, partners, suppliers, customers stored in recognizable form, has become theft product.

5. Guarantees

We assure you that our Company will exhaust every technical and organizational measure of protection of your Data and will make the optimal, minimum and absolutely necessary use and processing of the Data, as defined by law and strictly and exclusively for the purpose for which you have made them available to us.