Security & Personal Data Protection Policy

1. What constitutes your personal data

Personal data is any information, in printed or electronic form, that can directly or in combination with other data lead to the unique identification or location of you as a natural person.

This category includes, as applicable:

• Full name
• Addresses (physical and electronic / email)
• Landline and mobile telephone numbers
• SMS/MMS recipient details
• Device or terminal identifiers
• Computer, smartphone, or tablet identifiers
• Internet browsing history (log files, cookies, etc.)
• Any other information that enables your unique identification under GDPR, Greek legislation, and decisions of the Hellenic Data Protection Authority.

2. What personal data we collect

We process and protect your personal data in the context of a lawful working relationship and in accordance with applicable legal and regulatory requirements, including:

• Collaborative activities
• Creation of advertising content
• Campaigns and events
• Logos
• New products
• Conferences
• Consultancy
• Marketing activities
• Communication, support, and updates
• Any other Company activity

3. Processing based on your explicit consent

The Company uses your information for the following lawful purposes:

• Managing your data within our services
• Support and updates relating to services or projects
• Responding to enquiries, suggestions, and feedback
• Internal quality assurance
• Website traffic analysis and improvement of user experience
• Internal operations, including administration, fraud prevention, MIS usage, invoicing, accounting, billing, and auditing

You may change your preferences at any time using the unsubscribe link included in every email you receive from us.

4. Principles of collection and processing

The Company applies the ten principles of GDPR:

1. Lawfulness
2. Fairness
3. Transparency
4. Purpose limitation
5. Data minimisation
6. Accuracy
7. Storage limitation
8. Integrity
9. Confidentiality
10. Accountability

The Company upholds the eight rights of data subjects:

1. The right to be informed
2. The right of access
3. The right to rectification
4. The right to erasure
5. The right to restrict processing
6. The right to data portability
7. The right to object
8. Rights related to automated decision-making and profiling

These rights apply without distinction to all processing activities and services provided.

5. Methods of collection

Personal data may be collected:

• When you call our telephone numbers
• When you send us emails
• When you submit applications for participation, updates, or services
• During the delivery of our projects
• When you provide billing or delivery details
• When you voluntarily subscribe to print, electronic, or SMS mailing lists
• Through website visits and cookies that collect essential device and browser information

6. Minimisation, retention, and deletion

The Company always requests only the minimum personal data required by law.

The Company retains personal data only for as long as required under contractual terms, tax, telecommunications, or other applicable legislation and regulations, depending on the purpose of processing, after which it anonymises or destroys the data.

You may enquire about what data we hold and request correction or deletion, unless retention is required by law for tax, evidentiary, judicial, or law enforcement purposes.

7. Sharing your data with third parties

As a general principle, the Company does not transfer personal data to third parties, unless explicitly required by law or when acting as an intermediary to complete a service.

Third parties may include, for example:

• Official public authorities
• Government ministries or public bodies
• Trusted partners

The Company imposes contractual obligations on third parties who receive personal data, to ensure compliance with this Policy and applicable European and international data protection legislation.

For the processing of your data, information may be transferred to countries within the European Economic Area in accordance with EU adequacy decisions.

8. Security of your personal data

The Company implements appropriate technical and organisational measures to ensure that personal data is transmitted, stored, and processed in accordance with recognised security standards.

Security measures include:

• Trained and accountable staff
• A Data Protection Officer (DPO)
• Anonymisation
• Pseudonymisation
• Encryption
• Firewalls
• Access controls
• Authorised personnel only
• Staff training
• Regular audits
• Compliance with international security standards and business continuity requirements

Partners with access may only use the information for the permitted purposes described herein.

9. Policy validity

This Policy was published on 16/02/2026 and is subject to periodic improvement and review.

Changes take effect from the date the revised version is published, including in relation to information already held.

Continued use of the website following the publication of changes constitutes acceptance of those changes.

10. Audit readiness enhancements

Additionally:

• This Policy supports the obligations of the data controller and data processor.
• This Policy supports the privacy commitments of ISO/IEC 27701:2019.
• This Policy supports the information security commitments of ISO/IEC 27001:2022.
• This Policy is reviewed at least annually or following any significant change.