Notice regarding the processing of personal data in the context of call center

The company with corporate name “THEMA” SOCIETE ANONYME SPECIAL PURPOSE COMPANY FOR THE OPERATION AND MAINTENANCE OF THESSALONIKI METRO NETWORK, based in Thessaloniki at 43 Eleftheriou Venizelou Street, Postal Code 546 24, acting as the controller (hereinafter referred to as the “Company,” “we,” “us,” or “our“), provides you with this data protection notice regarding the processing of your personal data (hereinafter “you,” “your“) in the context of the operation of its call center and call recordings (hereinafter the “Notice”).

A. WHAT PERSONAL DATA WE PROCESS

The Company, through its call center, collects and further processes your data (Name, surname, phone number (landline/mobile), reason for the call, voice, and content of reports, requests, complaints, and general communications) (hereinafter collectively the “Personal Data“).

B. FOR WHAT PURPOSE DO WE PROCESS YOUR PERSONAL DATA

Calls are recorded for the purpose of providing evidence of commercial transactions or other professional communications.

C. WHAT IS THE LEGAL BASIS FOR THE PROCESSING

The processing is necessary for the purposes of the legitimate interests pursued by us as the controller (Article 6(1)(f) of the GDPR). Our legitimate interest lies in the need to provide evidence of commercial transactions or other professional communications.

We collect only the personal data that is necessary for the above purpose and to prove that the conversation took place.

D. TO WHOM WE WILL DISCLOSE YOUR PERSONAL DATA

Access to Personal Data is granted to company ICAP OUTSOURCING SOLUTIONS ANONYMI ETAIREIA PAROCHIS YPIRESION, which provides the call center service to the Company and has undertaken the management of the call center, acting as a processor on behalf of the Company. In certain cases, we are legally obliged to transfer your personal data (strictly to the extent required) to public, judicial, prosecutorial, investigative, and regulatory authorities, for example, in execution of a court decision. In order to exercise and support our legal claims or to defend ourselves legally, we will transfer your personal data to our advisors (including legal advisors) and judicial/investigative authorities. Therefore, the Company may also transfer your data to government services and regulatory authorities, courts, law enforcement authorities, and government authorities, always in accordance with applicable law, based on Article 6(1)(c) of the GDPR, as well as to external advisors (e.g., lawyers, accountants, auditors) based on Article 6(1)(f) of the GDPR.

E. FOR HOW LONG WE WILL KEEP YOUR PERSONAL DATA

Your personal data processed for the purposes mentioned in this Notice will be stored only to the extent necessary or permitted by applicable law, including for as long as may be necessary to satisfy or counter claims that have not been prescribed.

F. WHAT YOUR RIGHTS ARE

Under the conditions provided by the relevant legislation, you have the following rights regarding the protection of your personal data:

Right of access: You can contact the Company to inform you and explain whether and what data we hold about you, as well as how we process it. You may also request a copy of your personal data that the Company holds.
Right to rectification: If you believe your data are inaccurate or need to be updated, you have the right to request the rectification of inaccurate personal data and the supplementation of incomplete data.
Right to erasure: Under certain conditions, such as when the data is no longer necessary, or the data has been unlawfully processed, you can request the Company to delete them.
Right to restriction: If you believe that your data is inaccurate, or that its processing is unlawful, or you consider that the data is no longer needed by the Company, or you have objections regarding automated processing, you have the right to request a restriction on the processing.
Right to object: You can object to the processing of your personal data by the Company for reasons that pertain to your specific situation, unless there are compelling and legitimate grounds for processing that override your interests, rights, and freedoms. You also have the right to raise objections when a decision concerning you is based solely on automated processing, including profiling, and that decision has legal effects on you or significantly affects you (legal exceptions apply).

You can further and more thoroughly inform yourself about your rights by visiting the website of the Data Protection Authority (www.dpa.gr).

G. HOW TO CONTACT THE COMPANY

To exercise the above rights, or if you have any related questions or concerns, please contact us by sending an email to [email protected] or by mailing us at our postal address: 43 Eleftheriou Venizelou Street, Thessaloniki, Postal Code 546 24.

H. HOW TO LODGE A COMPLAINT

You have the right to lodge a complaint before the Data Protection Authority regarding issues related to the processing of your personal data by the Company. The Data Protection Authority is based in Athens (Kifisias 1-3, Postal Code 115 23). For more information about the authority of the Data Protection Authority and how to file a complaint, you can visit the website www.dpa.gr.