Preamble
The protection of natural persons with regard to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union (” Charter”) and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of personal data concerning them.
Furthermore, since May 25, 2018, Regulation (EU) 2016/679 (GDPR) of the European Parliament and of the Council has been in force, introducing a stricter framework for the protection of natural persons with regard to the processing of personal data and for the free movement of such data (hereinafter referred to as the “General Regulation”).
The protection of natural persons with regard to the processing of personal data is of paramount importance to KSM HUMAN RESOURCES S.A. (hereinafter referred to as the “Company”). Therefore, the collection and processing of personal data by the Company is carried out only in accordance with the General Regulation and the applicable legislation in general and where required in relation to the functioning of labor relations and the business activity of the Company. The Company allows only authorized persons to access such data and takes increased data security measures, including against loss, mishandling, unauthorized access, modification, or disclosure.
Processing of personal data on the Company’s websites
Categories of personal data
We take care to collect only the absolutely necessary and appropriate Data to serve the purpose for which it is intended. With the exception of Data collected by Cookies (see more about the Cookies Policy here), Data is limited to what you submit when you fill out online forms on the www.ksmhr.grwebsite (first name, last name, e-mail, CV) and what we collect in the context of our contractual relationship with you.
The website collects personal information from visitors or users only when they voluntarily provide it in the following cases:
- sending a CV via the entry form
- sending a message via the contact form
- when sending a message to the contact email
- through the use of cookies
- through Google Analytics
The personal data of visitors or users that is collected is as follows:
Email address *
* Please note that along with your email address, any other information provided to your email provider (Gmail, Outlook, Yahoo! Mail, etc.) when you contact us.
CV – Contact message
The online application form, contact form, and CV submission form contain free text fields (message field). Users should not enter confidential or sensitive information in these fields, such as their racial or ethnic origin, ideology or political, religious, or philosophical beliefs, information about their physical or mental health, biometric data or genetic characteristics, sexual orientation, information about criminal records, social security or identity number, etc.
Under no circumstances is personal data collected from minors without the express consent of their parents or guardians.
Purposes of processing
We collect your Data exclusively for the purposes of providing the services offered on the website www.ksmhr.gr, and in particular:
- to respond to your questions, to satisfy the requests you submit to us via the electronic contact form,
- to evaluate your applications for possible future cooperation with you,
- to process your application on a general basis or for a specific position,
- to provide you with job alerts,
- to match your details with job vacancies in or through our Company,
- to make informed decisions about your recruitment,
- to provide you with informational material, if you have subscribed to the newsletter,
- to establish any legitimate legal claim or defense of the Company against fraud, potential cyber attacks, or other illegal activity,
- to send you informational/promotional material (newsletter) about offers and new services to your email address. Your email address will only be used by the Company or third-party providers performing processing on behalf of the Company and with whom the Company has entered into agreements that require them to implement appropriate technical and organizational measures to protect your personal data, and will not be disclosed to third parties , even if the newsletter concerns products and/or services of third-party companies with which the Company has a commercial partnership.
- to generate anonymous statistics on the traffic and accessibility of the main website and subsequent pages, so that we can take the necessary steps to improve them and enhance your browsing experience.
Legal bases for processing
The processing of your personal data is necessary for the fulfillment of the aforementioned purposes. Unless otherwise specified when collecting personal data, the legal basis for processing is one of the following:
(a) processing is necessary for the performance of the contractual relationship with you (Article 6 (1) (b) of the General Regulation),
(b) processing is necessary for the purposes of the legitimate interests pursued by the Company (Article 6 (1) (f) of the General Regulation),
(c) your explicit consent has been given for the processing of personal data (Article 6 (1) (a) of the General Regulation).
Processing of personal data related to your transactional relationship with the Company.
In the context of an impending or existing transactional relationship with the Company, the Company may process the following categories of personal data of its transactional partners:
(a) Identity and contact details, such as name, tax identification number, tax office, address, telephone number, mobile phone number, fax number, email address provided to us by the business partner or its representatives for identification and communication purposes.
(b) Data processed in the context of a project, a sale or purchase of a product or service, or provided by the business partner, such as personal data relating to orders, payments made, requests, and reports in the context of a project or general cooperation.
(d) Creditworthiness and integrity data (information regarding court cases or other legal proceedings against business partners) collected from publicly available sources, databases, and credit rating agencies.
Recipients and transfers
Access to your Data is limited to the Company’s essential personnel, who are bound by confidentiality obligations, and to our business partners or third-party service providers who process your Data as Processors on our behalf and in accordance with our instructions.
Third-party IT companies (processors) may manage some of our websites. In such cases, we ensure through contractual terms and regular checks that, if and when they have access to personal data, the legislation for their protection is adequately complied with.
Sharing of Data by the Company
The Company shares your Data with:
- Companies within the Company’s group for the purposes and under the terms set out in section 3 of this Privacy Policy
- Third-party service providers who process personal data on behalf of the Company, for example (by way of indication) management and maintenance of our data, management of brand and product promotions, Google, Facebook, as well as management of certain services and data. When we use third-party service providers, we enter into agreements that require them to implement appropriate technical and organizational measures to protect your personal data.
- Other third parties, to the extent necessary for the following purposes: (i) compliance with a government request, court order, or applicable law; (ii) prevention of illegal use of our website or violations of our website Terms of Use and policies; (iii) our own protection from third-party claims, and (iv) contributing to the prevention or investigation of fraud (e.g., counterfeiting)
- To other third parties when you yourself have given your consent
The following is the policy we apply to those with whom we share your Data as described below:- We only provide the information necessary for them to perform their specific services.
- They may only use your Data for the exact purposes we specify in our contract with them.
- We work closely with them to ensure that your privacy is respected and protected at all times.
- If we stop using their services, any data they hold about you will be deleted or anonymized.
Cookie policy
Cookies are small text files that a website stores on your computer or mobile device when you visit that website. Cookies allow the website to remember your actions and preferences (such as language) for a period of time, so you don’t have to re-enter these preferences each time you visit the website or browse its pages. Among other things, cookies help us analyze how you use our website and whether you encounter any problems while browsing. The information related to cookies is not used to identify you personally. Cookies cannot be used to transmit viruses to your computer, nor do they run programs.
More information about cookies can be found at www.allaboutcookies.org.
Our website uses functionality and usage statistics cookies.
You can control and/or delete cookies according to your preferences. Details can be found here: aboutcookies.org. You can delete all cookies already on your computer and set most browsers to prevent them from being installed. However, in this case, you may need to adjust certain preferences yourself each time you visit a website, and some services may not work.
You can see a list of the types of cookies Google uses (https://policies.google.com/technologies/types?hl=el) and learn how Google and its partners use cookies in advertising. The privacy policy explains how we protect your privacy when we use cookies and other information.
Personal data of underage persons
The Company and its websites are intended for persons who are at least eighteen (18) years of age. If minors voluntarily visit our websites, the Company bears no responsibility. If, during the collection of data, it becomes apparent that the user is younger than this, the Company will not process their personal data.
International Data Transfer
The personal data we collect (or process) in the context of our website is stored within the European Economic Area. However, some of the recipients of the Data with whom the Company shares your Personal Data may be located in countries other than the one in which your Personal Data was originally collected. The laws in these countries may not provide the same level of data protection as the country that originally provided your Personal Data. However, when we transfer your Personal Data to recipients in other countries, including the US, we are committed to protecting your Personal Data as described in this Privacy Policy and in accordance with applicable law. In such cases, the Company takes steps to implement adequate and appropriate safeguards for the protection of personal data by other means, primarily through the use of standard EU binding clauses.
Data Retention Period
The Company will retain your personal data for as long as necessary to fulfill the purposes described in this policy, unless applicable law requires or permits a longer period. The criteria governing the determination of the data retention period include the following: (a) for as long as our contractual relationship lasts, (b) for as long as necessary for the Company to comply with a legal obligation incumbent upon it, (c) as long as necessary in view of the Company’s legal position (such as defending rights before courts, regulatory authority audits, etc.).
Technical and organizational measures
The Company effectively implements, both at the time of determining the means of processing and at the time of processing, appropriate technical and organizational measures, such as pseudonymization, designed to implement data protection principles, such as data minimization, and to incorporate the necessary safeguards into the processing in such a way as to meet the requirements of applicable law and protect the rights of individuals. These measures shall be reviewed and amended when necessary.
Right to withdraw consent
If you have given your consent to the processing of specific personal data by the Company, you have the right to withdraw your consent at any time, with future effect. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. In the event of withdrawal of consent, the Company may continue to process personal data only in cases where there is another legal reason for processing.
Subject rights
- Right of access
You have the right to be informed if the Company processes your data, to access the data, and to receive additional information about its processing. - Right to rectification
You have the right to request the updating, rectification, or completion of your personal data. - Right to erasure
You have the right to request the erasure of your personal data, which will be granted provided that there is no other legal basis for processing (such as, for example, a legal obligation to process personal data). - Right to restriction of processing
You have the right to request restriction of the processing of your personal data in the following cases: (a) when you contest the accuracy of the personal data and until verification is completed, (b) when you object to the erasure of personal data and request the restriction of their use instead of erasure, (c) when the personal data are no longer needed for the purposes of processing, but are necessary for you to establish, exercise, or defend legal claims, and (d) when you object to the processing and until it is verified that there are legitimate reasons that concern us and override the reasons for which you object to the processing. - Right to object to processing
You have the right to object at any time to the processing of your personal data when it is based on the legal basis (Article 6 (1) (e) or (f) of the General Regulation), which will be satisfied unless the Company demonstrates compelling and legitimate grounds for their processing. - Right to portability
You have the right to receive your personal data in a structured, commonly used and machine-readable format free of charge or to request, where technically feasible, that we transfer the data directly to another controller. - Right to object to automated decision-making
You have the right to request to be excluded from decisions based on automated processing, including profiling.
Data Controller
The Data Controller is “KSM HUMAN RESOURCES S.A.”, with registered office at 78 G. Papandreou Street, 15773 Zografou.
The Company provides support for all questions, comments, concerns, or complaints related to the protection of personal data or if you wish to exercise any right regarding the protection of your data. You can contact the Data Protection Officer by email at [email protected] or by post at:
KSM HUMAN RESOURCES S.A.
Attn: DPO
78 G. Papandreou Street
TK 15773 Zografou
Right to appeal to the Authority
The competent authority is the Hellenic Data Protection Authority. You have the right to appeal to the Personal Data Protection Authority for issues relating to the processing of your personal data. You must first attempt to exercise your rights with the Company before appealing to the competent Authority. For information on the Authority’s jurisdiction and how to file a complaint, please visit its website (www.dpa.gr > My rights > Filing a complaint), where detailed information is available.