PRIVACY POLICY

 

This Privacy Policy is made in accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “General Data Protection Regulation” or the “GDPR”)

In this Policy we will set out information about the processing of your personal data at VASS. Please, feel free to contact us if you need any further information or additional clarifications to the points, discussed below. You may contact us on the following e-mail: pdpo.eu@vasscompany.com.

 

1. Data Controller

Data controllers (as the case may be) is VASS IT Greece Services S.A., with address 17 Pericleus & 1 Persefonis Str, 15344 Gerakas (shortly “VASS”)

 

2. Purposes of and Legal Basis for Personal Data Processing:

We process personal data of individuals with whom VASS has signed contracts as well as with individuals with whom VASS does not have signed contract (candidates). Therefore, we will review the purposes and legal basis for each of those two categories separately.

2.1. Purposes and legal grounds for processing data of individuals, with whom VASS does not have signed contract:

  • We process the personal data, provided by the individuals (candidates) in their CVs, directly to us or through recruiters, for recruiting purposes, namely to analyse the profile of the candidates, when we have vacancy at VASS, in view of their education, knowledge, skills, experience etc.
  • The data provided in the CVs are processed initially for the vacancy in relation to the CV is presented. The data are further processed for evaluation of whether profiles match to new vacancies, as may be opened at VASS. In this relation, please, see the retentions periods in section 7 below.
  • The legal ground for the processing under sections 2.1.1. and 2.1.2. is legitimate interest. Please, see more details about the legitimate interests in section 3 below.

2.2. Purposes and legal grounds for processing data of individuals, with whom VASS has signed contract.

We process the personal data of all employees, consultants providing services to VASS directly (freelancers) or through companies, management staff etc., as follows:

  • Some of the personal data of our employees, consultants, freelancers and management staff are processed for payment purposes. The legal basis for this type of processing is our contract with the individual.
  • We process the personal data of the individuals with whom we have contract for the recruiting purposes set out in section above in case of openings for new positions. The legal ground for this processing is legitimate interest. Please, see more details about the legitimate interests in below.
  • We also process personal data as required by law for the purposes of social insurance, tax legislation, state compensation (e.g. in case of child birth children), pay-row and labour law purposes. The legal ground for this type of processing is the law regulating the relevant area and we are processing the data because it is our obligation by law.

2.3. Legitimate Interests

We have made legitimate interest assessment (“LIA”), which was positive that we may relay on the legal ground legitimate interests when processing personal data for recruiting purposes and for the purposes of filling vacancies at VASS. The LIA is made on the basis of a three-part test, namely:

  • Purpose test, which confirmed that we are pursuing a legitimate interest;
  • Necessity test, which confirmed that the processing is necessary for that purpose; and
  • Balancing test, which confirmed that the individuals’ interests do not override our legitimate interest.

LIA – summary: 

Our legitimate interests are the legal ground for processing personal data of both candidates and individuals with whom VASS has signed contract, for recruiting purposes and to fill vacancies at VASS. Our interests are legitimate and the processing of the personal data provided in the CVs of the candidates are necessary for the selection process (i.e. to assess the candidatures for each relevant vacancy).

We process personal data of candidates, received directly from individuals or, indirectly through recruiters, in relation to vacancies at VASS. In this scenario, the candidates clearly expect that their CVs (i.e. the personal data provided in the CVs) will be processed for recruiting purposes. That’s why our legitimate interests to fill the vacancy at VASS is not overridden by any interests or rights of the candidates. In fact, this legitimate interest is more likely to align with the interest of the candidate.

We also process the personal data of individuals with whom VASS has signed contract, for new work or services provision opportunities, as such may be opened at VASS. We are in contractual relations with those individual and we believe that it will not be surprising for them to analyse their personal data. 

We also think it is in their interest to be offered new opportunities while they are not under any obligation to accept it.

We are processing only the personal data that are necessary for the recruitment and selection process, which data are provided by the individuals themselves in their CVs. The processing is for limited period of time – the retention periods are as set out herein below). This processing has a low privacy impact and we think that it is more appropriate for the individuals as well instead bombarding them with unnecessary consent requests. All individuals, whose personal data are processed, are provided with opt-out in section 9 below.

 

3. Categories of Personal Data Obtained:

We obtain the following personal data directly from the individuals or from recruiters:

  • Name;
  • Contact details (address, phone, e-mail, skype-name, linked-in, websites etc.)
  • Date of birth;
  • EU citizen information;
  • Education details;
  • Professional experience details;
  • NATO or EU security clearance information (only when needed for the relevant position);
  • Bank account details;
  • Civil status;
  • Date of birth of children, if applicable.

 

4. To Whom we Disclose the Personal Data / Personal Data Processors

Most of the personal data are processed through Greenhouse and SalesForce cloud services. We have executed the standard EU clauses guarantying compliance with GDPR and high-level of personal data protection.

We disclose pseudonymised personal data provided in the CVs of the individuals (profile, education, professional experience etc.) to our customers and partners in consortium or teaming agreements, who need to check and approve the profile of the individual for the opened position. We mainly provide services to the EU institutions, directly or as member of consortium or as subcontractor in projects with end-customer EU institutions. Those are the recipients of the personal data.

In addition, we may disclose personal data to some the other companies from VASS Group of companies. Those companies maintain the same standards for personal data protection as we do.

 

5. Transfers of The Personal Data Outside EU

The cloud services could be in EU and also outside EU (in US). We have undertaken all steps required in this relation by the GDPR to make sure that even if not EU, the clouds meet the GDPR standard for personal data protection.

SalesForce and Greenhouse adhere to the principles of the EU–US Privacy Shield Frameworks. For ore information, you can visit https://www.privacyshield.gov/welcome. Otherwise, we do not transfer personal data outside the EU.

 

6. Retention Periods 

The retention periods for the personal data, processed by VASS are, as follows:

  • Personal data of individuals (employees or consultants) who work at or, provide services to, VASS – until their contract with VASS is in force and effect. We will store the personal data without any processing, for additional period of 5 years after the termination of the contract in case we need to comply with any legal requirements towards VASS (e.g. accounting, contracts guarantee etc.);
  • Personal data of unsuccessful candidates – 2 years after the CV submission;
  • Personal data of management staff are stored until the individual is member in the board and 5 years after his release or leave again for the purposes above;

After the retention periods set out above, the data are automatically deleted.

 

7. Your Rights under the GDPR

We have summarised below the rights that you have according to the GDPR. In order to exercise your rights, please, send us e-mail to the following e-mail address: pdpo.eu@vasscompany.com. You can also submit paper request in any of our offices depending on which office is most convenient for you. The addresses of our offices are published at our corporate website.

We will process your request at the soonest possible but in any case, not longer than 1 month after its submission.

Please, note that we need to verify the identity of your personality when making the request, using any reasonable means, including by asking you to present your ID when necessary.

If your requests are manifestly unfounded (for instance, if it is repetitive in nature), the GDPR gives us the right to charge you a reasonable fee. We will exercise this right only as exception for the cases where the request is indeed manifestly unfounded.

You will be duly informed on any development on your request. If we believe it is not our obligation to comply with your request, we will explain you our position and provide you with the grounds we have in order not to comply with your request. 

You will have the right to object our position before Hellenic Data Protection Authority in Greece (Aρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), www.dpa.gr. 

Right to be informed

You have the right to be informed about your personal data processing by VASS and through this noticed we aim to inform you accordingly. 

This Policy may be updated from time to time as we constantly work to improve our policy and standards. You will always have access to the most updated Policy.

Please, feel free to contact us by e-mail, to pdpo.eu@vasscompany.com, for any questions or further clarifications in this relation.

Right of access

You have the right to access the personal data that we process. Once we receive your request for access, we will send you your personal data that we process and any supplementary information, if applicable. 

We note that in order to secure best protection of the personal data we may ask you to properly identify yourself in order to confirm your identity, including requesting your ID before providing you the data.

Right to rectification

You have the right to have inaccurate personal data rectified. You may also be able to have incomplete personal data completed.

The personal data shall be considered inaccurate if it is incorrect or misleading as to any matter of fact.

If you submit such request, we will restrict the processing of your personal data, for which you seek rectification whilst we are verifying its accuracy, whether or not you exercise your right to restriction.

Right to erasure

According to the GDPR, you have the right to have your personal data erased provided that:

  • the personal data is no longer necessary for the purpose, which we originally collected or processed them for;
  • VASS is relying on consent as lawful basis for holding the data, and you would like withdraws your consent;
  • VASS is relying on legitimate interests as basis for processing, the individual objects to the processing of their data, and there is no overriding legitimate interest to continue this processing;
  • VASS is processing the personal data for direct marketing purposes and the individual objects to that processing;
  • VASS has processed the personal data unlawfully (i.e. in breach of the lawfulness requirement of the 1st principle);
  • If VASS has to erase the data in order to comply with a legal obligation.

Right to restrict processing

You have the right to restrict the processing of your personal data and limit the way we use them in the following circumstances:

  • When you contest the accuracy of your personal data and VASS is verifying the accuracy of the data;
  • When the data has been unlawfully processed (i.e. in breach of the lawfulness requirement of the first principle of the GDPR) and you request restriction instead erasure;
  • VASS no longer need your personal data but you need that we keep them to keep in order to establish, exercise or defend a legal claim; or
  • You have objected the processing of your data under Article 21(1) of the GDPR and VASS is considering whether our legitimate grounds override those of the individual and you would like that we restrict until we consider the case.

When VASS receives request for restriction, we will not process the restricted data in any way except to store it.

There are thought some exceptions, which we may apply, e.g. in case of exercise or defence of legal claims, if it is for the protection of the rights of another person (natural or legal) and if it is for reasons of important public interest. Those exceptions we will apply only to the extent necessary if necessary at all.

Right to data portability

You have right to data portability allowing you to obtain and reuse your personal data for your own purposes across different services.

The right to data portability only applies:

  • to personal data an individual has provided directly to VASS;
  • when the processing is based on the individual’s consent or for the performance of a contract; and
  • when processing is carried out by automated means.

Right to object

According to the GDPR, you have the right to object processing, on grounds relating to your situation, as follows:

  • processing based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling);
  • processing for direct marketing purposes (including profiling); and
  • processing for purposes of scientific/historical research and statistics.

As you will see in below, in addition to this right, VASS provides you the option to opt-out and request to cease the processing and erase your personal data without а reason. Rights in relation to automated decision making and profiling. At VASS we do not apply automated decision making and profiling.

 

8. Right тo Withdraw Consent аnd Opt Out

Because we respect your privacy and our processing is only done because we believe that we have mutual interest in this processing, we will respect you wish to opt-out without any reason. You are free at any time to inform us that you do not want VASS to process your data anymore. We will respect your request.

As said above, before entering into force of the GDPR, we collected and processed some of the personal data based on consent. Taking into account the new GDPR, we have determined the legitimate interest as most appropriate ground for us to collect and process the data.

As the main difference between the two legal grounds for you is the right to withdraw your consent (given before), please, note that by providing you with the option to opt-out, you will be again able to request from us to cease the processing of your data and we undertake the obligation to do so, as if you have withdrawn your consent.

 

9. Source of Personal Data

We obtain the personal data that we collect either from you directly or through recruitment agencies.

We do not buy data basis or do not have any access to any data basis containing personal data. We could takе data from public sources (such as linked-in, facebook etc.) which you have made available there and to which we have access.

 

10. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint before the Hellenic Data Protection Authority in Greece (Aρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), www.dpa.gr .