PRIVACY STATEMENT

PRIVACY AND PERSONAL DATA PROTECTION STATEMENT

Elbisco S.A. (“Company”, “we”, “us”, “our”, “Elbisco”) acknowledges that the protection and safety of the personal data is extremely important and is committed to showing respect to your privacy and to the protection of your personal data.

This Privacy and Personal Data Protection Statement (“Statement”) presents the way the Company uses your personal data, as well as the measures taken to protect and safely maintain these data. The Statement applies for you, if you buy products, receive services by us, if you participate in our events or promotions or if you interact in any other way with us, among others, by using any website or communicating with us through social media.

Take a moment to examine in detail this Statement. If you are already our customer or partner, further details regarding the way we use your personal data may be mentioned in your contract with the Company. Additional information pointing out further use of your personal data, as well as your right to choose or deny the, may be also provided during the collection of your personal data.

1. Who we are

The purpose of this Statement is to inform you regarding the type of personal data collected by the Company, the purpose and method of their processing (collection, storage, use, transmission), the adopted technical and organisation measures of protection and safety taken, as well as the right the data subjects have against this processing, which in any case is carried out in credible and transparent method. Given the personal data collection and processing, the Company is strongly committed to their processing in accordance with the General Data Protection Regulation (GDPR), the Greek laws regarding the personal data protection and any other relevant law and code of conduct regarding the data protection (hereinafter collectively referred to as “laws regarding the Personal Data protection – PD”).

Elbisco S.A. operates as a modern industrial and commercial food company in Greece, selling its products both in Greek and international market. The Company, with VAT number 094207902, has its registered office at the 21st km. of Marathonos Avenue and is supervised by the Personal Data Protection Authority (PDPA).

2. Data collected and their use

We collect and process the personal data that provide to us within the framework of the following legal bases:

• Execution of contract, the data subject of which is a contracting party Legal Obligation for our compliance with applicable laws and regulations
• Your consent, where necessary, which you may withdraw within the framework of your rights, about which we inform you below

We do not process any personal data without your consent or without being our customers or partners or without your data being granted to the Company by you. By filling out the consent form on the Contact or

CV Submission pages of the website www.elbisco.gr we consider that an agreement to the processing of the personal data submitted.

We collect only the personal data that are necessary for the correct and integrated provision of products and services, such as, among others, your surname, VAT number, telephone number, e-mail address, address, social media account name, business practices data, etc. At this point it is indicated that you are responsible for the accuracy of the personal data you provide us.

We use your personal data to improve the services we provide you and to create products adapted to your needs. In particular, we use your personal data to improve our marketing practices and methods and the promotion of our products and services, adapted to your interests.

The following are some examples of use of your PD carried out by the Company:

• We collect, process and store your data as our legal obligation for reasons of respect of legal obligations resulting from the applicable tax
• We collect, process and store your data within the framework of pursuing our legitimate interest for the analysis of our business
• We collect, process and store your data for your complaints’
• We collect, process and store your data to deliver gift resulting from your participation in

3. Means of collection of PD

As shown above, we collect data about you only with your full knowledge. In particular, we collect personal data:

• When you register in the Contact form of our website, we collect data, such as name, surname, e- mail address and telephone number
• When you send and submit your CV through our website, we collect data, such as your name, surname, e-mail address, telephone number and your professional and academic record
• When you collaborate and trade with us, we collect the data required for our commercial transactions, such as name, surname, VAT number, bank account
• When you participate in promotions, contests and market researches, we collect the minimum required data in order to better understand your needs and preferences
• When you send an e-mail to the company, we collect the e-mail address in order to inform and contact you.

In any case, we inform you about the processing purposes before the personal data collection and all information collected are governed by this Privacy and Personal Data Protection Statement.

4. Transmission and disclosure of your personal data

We do not trade and transmit your personal data to third parties, except as provided in this Privacy Statement, as well as under legal requirements. In particular, in order to provide our services, we may disclose your personal data to other companies, acting on our behalf (as processors) with a view to provide the best possible service to you (such as transport companies, communication and marketing service providers, accounting firms, businesses providing consulting or auditing services etc.). During the data transfer, we always take all suitable measures to ensure that the data transferred are the minimum required for the purpose of the intended processing and that the conditions for legitimate and valid processing are always met. The partners of the Company to whom the personal data may be transferred, have signed the necessary PD processing agreements or have provided specific guarantees regarding the personal data transfer, by applying standard contractual terms in their agreements,

We do not transmit your personal data to third countries and/ or non-EU countries.

Our website (www.elbisco.gr) (hereinafter referred to as “Website”) collects but it does not transmit to third parties any information describing your smooth navigation, such as your files. In particular, we use cookies for various reasons, solely to create a more friendly-user environment, as well as to provide advertisements adapted to their interests and needs. Furthermore, we use cookies in order to understand the way our visitors browse the website www.elbisco.gr in order to improve its structure and contents.

What cookies are and why they are used by the Company: Cookies are pieces of information that in the form of very small text, usually consisting of letters and numbers, are stored in the browser used each time by the User/ Customer (Chrome, Mozilla Firefox, etc.) assisting the efficient operation of the Website. Cookies in no case do not cause harm to the users’ computers nor to the files kept on them. The information stored in cookies are used for identification purposes. In this way, we manage to operate our Website efficiently. The Website uses Cookies in order to provide information to the Users/ Customers, to carry out the services provided through it, as well as to improve the level of the provided services.

In no case shall cookies contain personal information or information that could allow anybody contact the visitor of the website, via telephone, e-mail etc. Moreover, the use of cookies does not provide access to the documents or files of your computer.

If you do not wish to use cookies, you may activate, disable or completely erase cookies used by the Company from the settings of the browser you use. For instance, in Chrome, you may select the menu of Chrome, then choose Settings/ Privacy/ Content Settings and change the cookies settings in accordance with your preferences. If you choose to disable cookies, certain parts of the Website or the application may not operate sufficiently.

You may also visit the website www.allaboutcookies.org/manage-cookies /index.html for information regarding the most frequently used browsers. Please take into consideration that if cookies are not activated or disabled, it is possible the Website’s functions not to operate as they are intended to

The Website Software is designed to ensure the highest level of security and confidence. All information included in the applications submitted through the Website are equally safe and confidential. Only authorised employees, suitably trained to handle the Users’ / Customers’ personal data, shall have access to this information and only when this is necessary to meet your demands and to execute each contract.

5. Protective measures

Elbisco S.A. takes all necessary information protection and security measures. In particular, we have developed and applied optimal technical and organisational security and information protection mechanisms, in order to protect their integrity, availability and confidentiality.

Furthermore, the Company applies throughout the data processing process the appropriate technical, physical and administrative security measures for the data protection from loss, misuse, damage or modification, unauthorised access and disclosure, in accordance with article 32 of the General Data Protection Regulation (EU) 679/2016, in order to ensure appropriate security levels against these risks. Among them are included, as the case may be: a) the application of encryption protocols, b) the ability to ensure confidentiality (article 90 of the General Data Protection Regulation (EU) 679/2016, the integrity and resistance of processing systems and services on an ongoing basis, c) the ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident, d) a process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures to ensure the security of processing. Moreover, the Company takes steps to ensure that any natural person acting under the authority of the controller, who has access to personal data, does not process them except on instructions of the Data Controller and that they will limit access to your personal information only to authorised employees.

6. Duration of data retention

The period of retention of personal data depends on the legitimizing base, as defined in detail below:

• In case the legitimizing basis of the processing is the exercise of legitimate interest, the personal data processing and retention shall be carried out for as long as it is considered necessary for the achievement of the aim pursued by the Company, as well as for the additional period it is required so as the prescription time of any related claims to expire (article 6(f) of the GDPR)
• In case the personal data of the Customers’ information are provided with their own consent (for example when filling out the contact form on the website), we shall retain their data until the consent given is withdrawn by the data subject. In case this is interrupted for any reason, we shall retain them for as long as it is required until the prescription time of any related claims expires (article 6(a) of the GDPR)
• In case the legitimizing basis of the processing is the execution of the contract, we shall retain your data for as long as you have the contractual relationship with us, both in hard copy and in electronic form or for as long as it is required until the prescription time of any related claims expires (article 6(b) of the GDPR)
• In case the legitimizing basis of the processing is to take the necessary steps upon request of the data subject before the conclusion of a contract (as in the case of curriculum vitae of employment candidates – (article 6(b) of the GDPR), we shall retain the related personal data until the contracting parties agree to collaborate by signing an employer- employee In case of failure to conclude an employment agreement, the data provided in the curriculum vitae shall be deleted from the Company’s databases, unless you consent to retain them in our file.

In cases the personal data processing is carried out on the legitimizing basis of a legal obligation (article 6(c) of the GDPR), the period of their retention shall be specified on the basis of the legal requirements and for as long as checks may be performed by competent authorities.

7. Your rights

Elbisco S.A. acknowledges and safeguard your following rights:

• Right of transparent information to exercise your rights (article 12, 13, 14 GDPR),
• Right of access (article 15 GDPR) to the personal data collected by you
• Right to rectification (article 16 GDPR) of inaccurate personal data concerning you
• Right to erasure (“right to be forgotten”) (article 17 GDPR) of a Member – User account and the information about We shall note that the exercise of the right to erasure of an active subscriber entails the inability to continue to provide the services you may have requested
• Right to restriction of processing of your personal data (article 18 GDPR) where possible
• Right to object (article 21 GDPR) to personal data processing, applying for specific personal data processing activities.
• Right to revoke your already granted consent (article 7 GDPR), namely, to withdraw your consent at any time for any processing made based on consent. The lawfulness of the processing of your data shall not be affected by the withdrawal of your consent until you requested the
• Right to lodge a complaint before the competent supervisory authority, Personal Data Protection Authority, (1-3, Kifisias Avenue, Athens, P.C. 115 23, +30 210 6475600, [email protected])

You are entitled to exercise your rights by sending an e-mail to the data protection officer ([email protected]) or by letter sent to the 21st km. Marathonos Ave. 190 09 Pikermi Attica. You are kindly requested to accompany your relevant requests with the appropriate proof of identification, with the express reservation of the Company to request the provision of additional information in order to identify and confirm your data.

However, in case the above rights are improperly exercised and without reasonable cause, thus entailing administrative charge, we may charge you with the cost related to the exercise of the respective right.

In case you exercise any of your rights, we will take all appropriate measures to satisfy your request within thirty (30) days of receipt of your respective request. We will inform you about the acceptance of your request or about any objective reason that prevents the processing of your request.

7. Submission of requests and/ or complaints

Elbisco S.A. collects and processes your data, in compliance with the provisions of this Statement and the applicable law. However, if you wish to express any complaint, you reserve the right to file your complaints before the Personal Data Protection Authority (PDPA).

USEFUL CONTACT INFORMATION

Supervising Authority

Personal Data Protection Authority (PDPA)

1-3, Kifisias Avenue
115 23 Athens
[email protected]

This Policy may be renewed from time to time, due to amendments to the related legislation or change of the corporate structure of the Company. Therefore, we encourage the Customers and/ or visitors of the Website to regularly visit this website to be updated about the latest information regarding personal data protection practices. In all cases, the customer may be informed by e-mail or notification to our Website regarding any amendments of this Policy.

See Also: Request for Exercising Data Subjects Rights Form