Data protection notice

Updated: 03.10.2024

Contents

The company ” “THEMA” SOCIETE ANONYME SPECIAL PURPOSE COMPANY FOR THE OPERATION AND MAINTENANCE OF THESSALONIKI METRO NETWORK” located in Thessaloniki, at 43, Eleftheriou Venizelou Street, 546 24, Thessaloniki, Greece (hereinafter the “Company“, “we“, “us“, “our“) provides this website and is also responsible for its operation and management.

With this notice, the Company informs you about how it processes and protects your Personal Data (hereinafter the “Notice“), as the controller (within the meaning of the GDPR), when you browse and use the website www.thessmetro.gr/en (hereinafter the “Website“) and when you communicate with us. On the Website, you will find the Notice on the processing of Personal Data using trackers (hereinafter the “Notice on the use of trackers“). By using the Website, you acknowledge and unconditionally declare that you have reviewed, understood, and accepted all the terms contained in this Notice and the Notice on the use of trackers. If you do not agree to any of these terms, you must refrain from browsing and using the Website..

The words “you” or “your” in this Notice are references to the persons whose Personal Data we process, i.e. users (individuals who access, browse, and use the Website (e.g., for information, ticketing, communication, etc.).

In this Notice, “Personal Data” means information that enables you to be identified, directly or indirectly, as an individual, by reference to a certain identifier, such as your name, location data, an online identifier (e.g., IP address), etc.

We comply with the applicable legislation on the protection of Personal Data, including Regulation (EU) 2016/679 (General Data Protection Regulation – “GDPR“), Law 4624/2019, Law 3471/2006, as well as the directives and guidelines of the Hellenic Data Protection Authority (“HDPA“) and the European Data Protection Board.

We may update this Notice from time to time (e.g., to reflect a change in our applicable legal framework or practices) and we will revise the date at the beginning of this Notice to reflect the date on which such update was made. You should check back frequently for updates. By accessing the Website after the effective date of this Notice, you are deemed to have reviewed and accepted our then-current Notice.

1. Which Personal Data we process

When you visit and use the Website, we collect and further process certain Personal Data in order to be able to provide access to the Website and its functionalities.

The types of Personal Data we collect and further process about you are collected directly from you and depend on the context of your interaction with us and with the Website. We and the third-party analytics service providers we work with will use tracking technologies that collect and further process information from your device when you visit or interact with the Website. For more information, please see the Notice on the use of trackers.

Where applicable and depending on the purpose for which we process your Personal Data, we will process the following:

If you browse the Website, the Company will collect and further process the following Personal Data:

• data collected through trackers (for more information, read the Notice on the use of trackers).

If you contact the Company and make use of the functionalities offered by the Website, the Company will collect and further process the following Personal Data:

• data collected through trackers (for more information, read the Notice on the use of trackers),
• data collected through the Petitions – Comments form (full name, telephone number, e-mail address, physical address, country of residence, content of the question/ comment, acceptance of the terms of this Notice),
• data collected through the Lost Property form (full name, telephone number, e-mail address, physical address, country of residence, date and description of the incident, metro station and location where the incident took place, description of the lost property, acceptance of the terms of this Notice),
• data collected through the Compliant form (date of request, name, full name, telephone number, e-mail address, physical address, country of residence, date and description of the incident, acceptance of the terms of this Notice),
• data collected through the CV Submission form (full name, telephone number, e-mail address, physical address, country of residence, level of education, qualifications, work experience, desired job position, additional CV information, acceptance of the terms of this Notice),

2. Legal basis and purpose of processing

We process your Personal Data where there is a legal basis for such processing, only if and when at least one of the following conditions applies:

• processing is necessary for the performance of the contract to which you are a party or to take steps at your request prior to the entering into such contract (i.e., where you browse the Website, wish to submit your CV for evaluation) (Contract),
• processing is necessary for the purposes of legitimate interests pursued by us or a third-party, unless those interests are overridden by your interests or fundamental rights and freedoms that require the protection of your Personal Data; for example, such legitimate interests include a) monitoring of how you use the Website in order to ensure its efficient and secure operation, as well as for reasons of fraud and misuse detection and prevention, b) the improvements of the functions and services of the Website, c) the receipt and response to questions/requests/complaints when you communicate with us through the Website d) the receipt and evaluation of an unsolicited CV (Legitimate Interests), and/or
• you have provided your consent to the processing of your Personal Data, for example where certain cookies and tracking technologies are used or if you wish for your CV to be retained by the Company for a longer period after the position has been filled by another candidate (Consent).

3. Recipients of Personal Data

We engage external service providers, who act as processors on our behalf and in accordance with our instructions, for the provision of certain services, including IT and systems administration services, such as, but not limited to, data hosting services, marketing and communications services, and IT support services.

To the extent necessary, we may share Personal Data to law enforcement authorities, government authorities, competent regulatory/supervisory authorities, competent courts, and other judicial authorities, and our professional external advisors, including lawyers, auditors, accountants, and insurers who provide us with relevant services. In the event of a merger or acquisition, your Personal Data may be shared with third parties being involved in the merger or acquisition. We may also disclose information about you in connection with a commercial transaction, where are seeking financing, investment, support or funding.

4. International Personal Data Transfers

In the context of the cooperation with the aforesaid recipients, any transfer of your Personal Data outside the EU/EEA for the achievement of the above processing purposes, due to sharing of Personal Data with them, will be based on an adequacy decision issued by the European Commission or subject to appropriate and adequate safeguards and conditions to ensure an adequate level of data protection, e.g., data transfer agreements based on standard contractual clauses approved by the European Commission. For more information on how the Company protects Personal Data transferred outside the EU/EEA or to obtain a copy of the safeguards we implement for the protection of data transferred outside the EU/EEA, please contact us at the address shown below.

5. Retention of Personal Data

Personal Data processed for the previously mentioned purposes will generally be kept for as long as necessary to fulfill the purposes for which they were collected, e.g., for as long as it takes us to respond to your request. Once the purpose of the processing has been fulfilled, we will delete or anonymize your Personal Data.

If you apply for a specific position, we will retain your Personal Data until the position is filled. If another candidate is selected, the Company will delete your Personal Data unless you provide consent for it to be retained for a longer period. In that case, your Personal Data will be retained for one (1) year after the position has been filled. If you submit your CV unsolicited, we will retain your Personal Data for one (1) year from the date of submission.

Regarding the retention of the Personal Data, we collect through cookies and other trackers, please read our Notice on the use of trackers.

6. Security of your Personal Data

Considering the latest technological developments, the implementation costs, and the nature, scope, context, and purposes of the processing, as well as the risks of varying likelihood and severity to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure an appropriate level of security against processing risks.

7. Your rights

Subject to the conditions set out in the applicable legislation, you have the following rights regarding the protection of your Personal Data:

Right of access: You can contact us to obtain information and explanations about whether we process Personal Data concerning you, the categories of such Personal Data, and how we process them. You may also request a copy of your Personal Data that we process.

Right to rectification: If you believe that your Personal Data is inaccurate or incomplete, you have the right to request the rectification or the completion thereof.

Right to erasure: Under appropriate circumstances, such as, when the Personal Data is no longer necessary, you may ask us to delete the Personal Data.

Right to restriction of processing: If you believe that your Personal Data is inaccurate or that the processing is unlawful or that we no longer need the Personal Data or you object to the automated process (where applicable), you have the right to request the restriction of processing.

Right to object: You may object to the processing of your Personal Data on grounds relating to your particular situation, unless, inter alias, there are compelling legitimate grounds for the processing that override your interests, rights, and freedoms. You also have the right to object where a decision concerning you is based solely on automated processing, including profiling, and that decision produces legal effects or significantly affects you (statutory exceptions apply).

Right to data portability: You have the right to receive your Personal Data in a structured, commonly used and machine-readable format, as well as the right to transmit such Personal Data to another organization (controller) that you indicate to us.

Withdrawal of consent: You have the right to withdraw your consent at any time, without prejudice to the lawfulness of the processing based on your consent prior to its withdrawal.

Right to lodge a complaint with the HDPA: You have the right to lodge a complaint with the HDPA regarding issues concerning the processing of your Personal Data by the Company. The HDPA is located in Athens, Kifissias 1-3, P.C. 11523. More information about the responsibilities of the HDPA and how to file a complaint can be found at the website www.dpa.gr.

8. Contact us

If you have concerns or questions about this Notice or wish to exercise any of the rights set out in the “Your rights” section, please contact us at [email protected].