Privacy and Personal Data Protection Policy

1. Who is responsible for your data- Where do you go to exercise your rights?

1.1. Responsible for the processing of your Data is the company “GALATA THEODORA”, located in Argyroupoli, Attica and legally represented, with telephone number 210-9952961-2 and e-mail contact info@e-alouminio.gr (“the Company”).

1.2. The Data Controller as above Company has appointed a Data Protection Officer with a contact e-mail address info@e-alouminio.gr. You can address all requests for exercising your rights (under 3.1 to 3.7) below to the Data Protection Officer’s email address.

2. General principles of the company with regard to this information

2.1. Any information we provide you with this document and any information you may request in the future is provided free of charge, provided that the request is not repeated, excessive or manifestly unjustified (see more in 2.3.)

2.2. For each of the above rights that you exercise, the Company will respond to you within one (1) month from the receipt of the request or in case of objective difficulty, complexity of the request or the number of requests, the Company will respond within a maximum period of a total of three (3) months regarding either the completion of your request or the justified refusal to perform what you requested for legitimate reasons expressly specified in General Regulation 679/2016.

2.3. In case the Company considers that any of the above rights are exercised in a manifestly unfounded manner or the request is excessive or (even more so) of a repetitive nature, it is entitled to impose a reasonable fee for providing further information (which is in principle free of charge) and to refuse to follow up on the request.

2.4. In case the Company has reasonable doubts about your identity when you submit a request to exercise any of the above rights, it may request additional information necessary to confirm your identity before processing the request.

2.5 In case the Company delays beyond the justified period to respond to your request and in any case where you believe that your rights are violated or the Company is not consistent with its data protection obligations, you are entitled to file a complaint with the supervisory authority. (Personal Data Authority, Athens Kifissias 1-3, P.C. 115 23, Athens, Greece, contact@dpa.gr, +30-210 6475600.

2.6. You have the right to withdraw your consent (if any) at any time by submitting a written request to the email address of the Data Protection Officer info@e-alouminio.gr. ( see 1.2.)

3. What are your rights in relation to the Personal Data you have provided to us?

3.1. Right to Information You have the right to request information about the personal data we have received from you and that we hold for one or more of the purposes described below under A to D. This document as a whole is a guide to basic information and understanding of the philosophy of the regulatory framework governing the protection of your personal data. Updating, deepening and clarification of this text can be provided to you upon request for the exercise of the right to information. (see how in 1.2)

3.2. Right of Access You have the right to request from our Company access to your data that we hold and confirmation as to whether they are being processed and, in particular, information on the purposes of processing, the categories of personal data, the recipients or categories of recipients, the period of retention and processing, the existence of a right of complaint to the Personal Data Protection Authority, any available information on the origin of the data when (see how in 1.2.)

3.3. Right to rectification You have the right to request from our Company the rectification of your data in case any of the data for which we have the right to process has changed or has been incorrectly recorded. (see how in 1.2.)

3.4. Right to erasure You have the right to request from our Company the full or partial erasure of your data that we are entitled to keep and process, either because they are no longer necessary for the purposes for which they were collected, or because you withdraw your consent, or because the data were collected for a purpose that you consider unlawful. Our Company will respond to you within a reasonable time (not more than one month and under certain circumstances if there is a difficulty not more than three months in total) confirming the total or partial deletion of your data respectively or the impossibility of deleting specific data if a law or the fulfilment of a duty in the public interest, or the right to freedom of expression and information or the exercise or support of a legal claim requires their retention. In this case, you can complain to the supervisory authority on the one hand and take legal action on the other. (see how in 1.2.)

3.5. Right to restriction You have the right to request from our Company a restriction of the processing of your data, quantitatively, temporally or in relation to the purpose of their processing and more specifically (a) either because you question the accuracy of your data and for as long as it takes the Company to confirm their accuracy, (b) or because you consider the processing unlawful but instead of deletion you choose restriction (c) or because it is no longer necessary for the Company to use them but you do not wish their deletion as the deletion of your data is no longer necessary. (see how in 1.2.).

3.6. Right of Portability. You have the right to receive the personal data you have provided us with in a structured, commonly used and machine-readable format and the right to transmit it further without objection, since your data is processed on the basis of consent. In the context of exercising this right, you also have the possibility to request direct transmission from the Company to the third party without your mediation. This right is subject to the limitations of the right to erasure (see above under 3.4.) and its exercise may not adversely affect the rights and freedoms of others. (see how in 1.2.).

3.7.

3.7.1. You have the right to object to the use of your personal data for the purpose of direct marketing, in particular profiling related to such direct marketing. (see how in 1.2.).

3.7.2. There is no relevant right in the case of Employees / Prospective Employees and visitors to the company’s premises as these data are not transmitted to the Marketing department and are not treated as such.

4. Can your data be forwarded elsewhere?

Your data is not intended to be transferred to any organisation other than the Company and its subsidiaries with the exception of (a) the providers of services supporting our Company’s electronic systems and networks – and for the sole purpose of their performance of the contract for the support of our Company and (b) the competent tax authorities in the context of our mandatory compliance with tax legislation and to the extent (and subject to the condition) that this is required.

Guarantees

We assure you that the Company will exhaust every technical and organizational measure for the protection of the Data and will only make the optimal, minimal and absolutely necessary use and processing of the Data as required by law and strictly and exclusively for the purpose for which you have made them available to us. ,Specific provisions for the individual categories of Personal Data Subjects that are cumulative with the above general provisions of the Policy.

(A) COMMUNICATION RECIPIENTS

Α.1. Purpose: The receipt, processing and retention of your data provided exclusively in the context of communication is done to satisfy the exclusive purpose of informing you about the Company’s products and activities. All your data are kept only for this purpose and are processed only by the Company’s marketing department.

Α.2.. Legitimate basis for processing: The legal basis for the processing of your data is your consent to the processing for the fulfilment of the respective purposes mentioned above, pursuant to Art. 1(a) of the Personal Data Protection Regulation.

Α.3. Data Retention Period: for the fulfilment of the above processing purpose, i.e. informing you about our products and actions, we consider a reasonable and necessary period of retention of your relevant data to be three (3) years. After three years from the time you have given your consent, the relevant data will be deleted unless you give your consent again under the above conditions.

(B) CUSTOMERS-SUPPLIERS and UNABLE CUSTOMERS-SUPPLIERS

Β.1. Purpose – Legal Basis:

(a) during the pre-contractual stage, namely in case of filling in an electronic contact form on our website or sending an email or telephone contact directly or filling in a printed form (in which case you provide us with your name/ e-mail address and/or telephone number and/or address and/or property and/or our products of interest to you), the purpose is to investigate the possibility of a transaction with the Company and the legitimate basis is to serve the Company’s legitimate interest to pursue its commercial purposes in response to the request of the Company.

(b) In the event of a transaction with the Company, your Data that you have provided to us pre-contractually (as well as those that you will provide to us in the context of our transaction) will be processed for the purpose of implementing the contract between us and our compliance with tax legislation. In this case, the legal basis for the processing is the performance of the contract between us and our compliance with the law (Art. 6(1b) and (1c) of the Personal Data Protection Regulation.

Β.2. Data Retention Time:

We will keep the above data under B.1.(a) for five (5) years and then delete it. With regard to the above under B.1.(b) data will be retained for as long as required by tax legislation.

Β.3. Especially for the personal data of the subjects we receive during trade fairs, the Privacy Policy applies, which is an integral part of the “Attendee Form” that the interested parties are asked to fill in.