Who is responsible for your data – Where do you practice your rights?
The person responsible for processing your data is the “BUILDING SYSTEMS INNOVATION CENTER PRIVATE CAPITAL COMPANY”, based in Thessaloniki (Iatrou Gogoussi 8 – Nea Efkarpia Thessaloniki) and is legally represented by a telephone center (+30) 231 602 2310 and e-mail contact info.academy@aluminiumacademy.com (“the Company”). At the contact e-mail info.academy@aluminiumacademy.com, you can also practice the following under 3.1.-3.7. your rights.
General Principles of the Company regarding the Transparency of Information.
2.1. Any information we provide you with this document and any information you request in the future is offered free of charge, provided that the request is not repeated, exaggerated, or manifestly unjustified (see more in 2.3.)
2.2. For each of the above rights that you practice, the Company will respond to you within one (1) month from receipt of the request, or in case of any objective difficulty, the complexity of the request, or the number of requests, the Company will respond to the maximum period in the total of three (3) months, either regarding the termination of your application or the justified refusal to perform what you requested for legal reasons expressly specified in General Regulation 679/2016.
2.3. In the event that the Company deems that any of your above rights are manifestly unfounded, or the request is excessive or (much more) repetitive, it is entitled on the one hand to charge you with a reasonable fee for providing further information (which is in principle free of charge) and on the other hand to refuse to follow up on the request.
2.4. In the event that the Company has reasonable doubts about your identity when you submit a request to exercise any of your above rights, it may request the provision of additional information necessary to confirm your identity before processing the request.
2.5. In the event that the Company delays beyond the justified period to respond to your request as well as in any case where you consider that your rights are violated or the Company is not consistent with its obligations to keep your data, you have the right to file a complaint with the supervisory authority. (Personal Data Authority, Athens Kifisias 1-3, P.O. 115 23, Athens, contact@dpa.gr, +30-210 6475600.
2.6. You reserve the right to withdraw your consent (if any) provided at any time by submitting your relevant request document to the e-mail address (see 1.1.)
What are your Rights concerning the Personal Data you have provided to us?
3.1. Right to Information
You reserve the right to request information about the personal data that we have received from you and that we retain for one or more purposes as described below under A to D. This text is a manual of basic information and understanding of the regulatory framework’s philosophy of as a whole which governs the protection of your data. Updates, deepening and clarifications in this text can be given to you after submitting a relevant request to exercise the right to information (see how in 1.1.).
3.2. Right of Access
You retain the right to request from our Company access to your data which we retain and confirm concerning whether they are being processed, as well as more specific information regarding the purposes of the processing, the categories of personal data, the recipients or categories of recipients, the time of their retention and processing period, the existence of a right of complaint to the Personal Data Protection Authority, any available information about the origin of the data when it has not been made available by you, the existence or non-automated decision-making including profiling and the relevant methodology, as well as guarantees about the policy we follow when the transfer is made to third countries; a copy of the personal data kept and processed (see how in 1.1.)
3.3. Right of Correction
You reserve the right to request from our Company the correction of your data in the event that any element for which we have the right to process has been changed or has been entered incorrectly (see how in 1.1.).
3.4. Right to Erasure
You reserve the right to request from our Company the complete or partial deletion of your data that we have the right to keep and process, either because they are no longer necessary to fulfill the purposes for which they were collected, or because you revoke your consent, or because the data was collected for a purpose that you consider unlawful. Our Company will respond to you in a reasonable time (not longer than one month and under conditions, if there is a difficulty not longer than three months in total), confirming the total or partial deletion of your data respectively or regarding the impossibility of deleting specific data if any law or the fulfillment of a duty in the public interest, or the right to discharge of expression and information or the practice or support of a legal claim, requires their retention. In this case, on the one hand, you have the option of filing a complaint with the supervisory authority, and on the other hand, of filing a legal action (see how in 1.1.)
3.5. Right of Limitation
You retain the right to request from our Company a limitation of the processing of your data, quantitatively, temporally, or concerning the purpose of processing and more specifically (a) either because you question the accuracy of your data and for as long as it takes the Company to confirm their accuracy, (b) or because you consider the processing to be illegal but choose restriction instead of deletion (c) either because their use by the Company is no longer necessary but you do not wish to delete them as their retention will serve you for a legal claim, (d) or in the event that you object to the processing of the data and until it is verified whether your rights as a Subject prevail over the legal processing reasons of the Company (see how in 1.1.)
3.6. Right to Portability
You retain the right to receive the personal data you have provided to us in a structured commonly used and machine-readable format, as well as the right to further transmit it without objection, given that your data is processed based on consent. In the context of exercising this right, you can also request direct transmission from the Company to the third party without your mediation.
This right is exercised subject to the limitations of the right to erasure (see above under 3.4.) and its exercise cannot adversely affect the rights and freedoms of others (see how in 1.1.)
3.7. Right to Object
3.7.1. You retain the right to object to the use of your data for direct marketing and profiling related to this direct marketing (see how in 1.1.)
3.7.2. There is no relevant right in the case of Employees/Employee Candidates and visitors to the company’s facilities as this data is not transmitted to the Marketing department and is not treated as such.
Can your data be forwarded elsewhere?
Your data is not intended to be the subject of transmission to any organization outside the Company and its subsidiaries except for (a) our Company’s electronic systems and network support service providers – and for the sole purpose of their performance of the contract to support our Company and (b) the relevant tax authorities in the context of our mandatory compliance with tax legislation and to the extent (and subject to the condition) that this is required.
Guarantees
We assure you that the Company will exhaust every technical and organizational Data protection measure and will only make the optimal, minimal, and absolutely necessary use and processing of the Data as defined by law and strictly and exclusively for the purpose for which you have made it available to us.
Special provisions for the individual categories of Personal Data Subjects that coincide cumulatively with the above general provisions of the Policy:
(A) RECIPIENTS OF COMMUNICATION
A.1. Purpose: The receipt, processing, and storage of your data provided exclusively in the context of communication is done to satisfy the exclusive purpose of informing you about the Company’s products and actions. All your data is kept only for this purpose and is processed only by the Company’s marketing department.
A.2. Legal basis for processing: The legal basis for the processing of your data is your consent to it to fulfill the above-mentioned purposes, according to article 6 paragraph 1 point of the Regulation on the protection of personal data.
A.3. Data Retention Time: To fulfill the above purpose of processing, i.e., informing you about our products and actions, we consider a reasonable and necessary time to retain your relevant data for a period of three (3) years. After the expiration of three years from the time of obtaining your consent, the relevant data will be deleted unless you provide new consent under the above conditions.
(B) CLIENT-SUPPLIERS and POTENTIAL CLIENT-SUPPLIERS
B.1. Purpose – Legal Basis:
(a) During the pre-contractual stage and especially in the case of filling out an electronic contact form on our website or directly sending an e-mail or communication via telephone or via filling a paper form, (when you provide us with your name/e-mail address and/or telephone and/or Address and/or status and/or our products that interest you), the purpose is to investigate the possibility of a transaction with the Company and the legal basis is to serve the legitimate interest of the Company to pursue its commercial purposes by responding to the requested communication in order to investigate the possibility of a transaction with you.
(b) In the event that a transaction with the Company takes place, the Data that you have provided to us pre-contractually (as well as what you will provide to us in the context of our transaction) will be processed to implement the contract between us and our compliance with tax legislation. In this case, the legal basis for the processing is the execution of the contract between us, as well as our compliance with the legislation (Article 6 par. 1b and 1c of the Regulation on Personal Data Protection.
B.2. Data Retention Time: We will keep the above data under B.1.(a) for five (5) years and then we will delete it. Regarding the above under B.1.(b) data will be kept for as long as necessary by tax legislation.
(C) VISITORS TO THE COMPANY’S FACILITIES
C.1. Purpose: The reception, processing, and storage of your data concerning the determination of your identity and the time of your stay at the company’s premises is done to satisfy the exclusive purpose of the safety and protection of both the persons who are at the company’s premises (e.g., employees, visitors), as well as the company’s equipment in general (indicative of building, electronic, etc.).
C.2. Legal Basis for Processing: The legal basis for the processing of your data is the defense of the public interest, under Article 6, paragraph 1, point of the Regulation on the Protection of Personal Data and/or the obligation provided by law to take measures for the protection space, as each time this arises or is imposed by the applicable legislation. Our legal interest consists of the need to protect our site and the goods located in it from illegal acts, such as theft. The same applies to the safety of life, physical integrity, health, and property of our staff and third parties who are legally present in the supervised area. We only collect image data and limit downloads to areas we have assessed as having an increased likelihood of illegal acts being committed e.g., theft, without focusing on areas where the privacy of the persons whose image is taken may be unduly restricted, including their right to respect personal data.
C.3 Recipients of Data: The stored material can only be accessed by our competent/authorized personnel who is in charge of the site’s security. This material is not transmitted to third parties, except for the following cases: a) to the competent judicial, prosecutorial, and police authorities when it includes information necessary for the investigation of a criminal act, which concerns persons or goods of the data controller, b) to the competent judicial, prosecutorial and police authorities when they request data, legally, in the exercise of their duties, and c) to the victim or the perpetrator of a criminal act when it comes to data that may constitute evidence of the act.
C.4 Data Retention Time: We keep the video footage in the building facilities for fifteen (15) days, after which they are automatically deleted. In the event that we discover an incident during these intervals, we isolate part of the video and keep it for up to one (1) month, to investigate the incident and initiate legal proceedings to defend our legal interests, while if the incident concerns third, we will keep the video for up to three (3) more months.
(D) VISITORS TO THE COMPANY’S SHOWROOMS AND EXHIBITIONS
D.1. Purpose: The purpose of processing the Data is to communicate between us to explore the possibility of cooperation.
D.2. Legal Basis for Processing: The legal basis for the processing of your data is your consent, according to article 6 par. 1 item of the Regulation on the protection of personal data.
D.3 Data Retention Time: In order to fulfill the above processing purpose, we consider a reasonable and necessary time to retain your relevant data for a period of three (3) years. After the expiration of three years from the time of receiving your consent, the relevant data will be deleted unless otherwise required by applicable law or if you withdraw your consent earlier.
(E) PARTICIPANTS IN CORPORATE EVENTS
E.1. Purpose: The purpose of data processing is to strengthen the Company’s business communication and public image to third parties, through the organization of corporate events. In the context of your participation in company events, video recording and downloading of visual material may take place, which will be posted on the official website and social media of the Company. During this process, personal data (image and audio) of all participants, employees, and external partners are processed.
E.2. Legitimate Basis of Processing: Legitimate basis of the processing of your data is the legitimate interest of the Company, according to article 6 par. 1 item of the Regulation on the protection of personal data. As far as it is possible and legally reasonable, during the event it is pointed out that video recording and photographing are taking place. However, you may object to being photographed or videotaped by notifying the photographers in advance. Your rights as described in point 3 fully apply.
