Object
Hellenic Development Bank of Investments SA (“HDBI”), located at 3 Merlin Street, 10671, Athens, in its capacity as Data Controller, collects and further processes your personal data only if absolutely necessary for explicit and legitimate purposes, in accordance with Regulation (EU) 2016/679, Law No. 4624/2019 and Law No. 3471/2006, as applicable. This notice is intended to inform visitors of the www.hdbi.gr website on the collection of their data, as described on the Website.
Definitions
For the purposes of this Notice, the following terms shall have the following meanings:
•“Personal Data”: any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one whose identity can be verified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person
•“Special categories of personal data”: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as the processing of genetic data, biometric data for the purpose of positive identification, data concerning health or data concerning a natural person’s sex life or sexual orientation.
•“Processing”: means any operation or set of operations which is performed, whether or not by automated means, on personal data or on sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
•“Anonymisation”: means the processing of personal data in such a way that the data can no longer be attributed to a specific data subject.
•“Pseudonymisation”: means the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of supplementary information, provided that such supplementary information is kept separately and subject to technical and organisational measures to ensure that it cannot be attributed to an identified or identifiable natural person.
•“Controller”: means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, or the specific criteria for their appointment may be provided for by Union or Member State law. For the purposes of this Notice, HDBI shall act as a Data Controller.
•“Processor”: means the natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.
•“Data Subject”: the natural person whose personal data are processed.
•“Consent”: of the data subject: any freely given, specific, unambiguous and informed indication of the data subject’s wishes by which he or she signifies agreement, by a statement or by a clear affirmative action, to the processing of personal data relating to him or her.
•“Personal data breach”: means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of or access to personal data transmitted, stored or otherwise processed.
•“Existing Legislation”: Regulation (EU) 2016/679, Greek Law No. 4624/2019 and Greek Law No 3671/2006, the case law of the Court of Justice of the European Union (hereinafter referred to as “CJEU”) as well as the Decisions, Directives and Opinions of the European Data Protection Board (hereinafter referred to as “EDPS”) and the Hellenic Data Protection Authority (hereinafter referred to as “DPA”).
Collection of Personal Data
o Processing of personal data in the context of communication with HDBI
When you contact HDBI by e-mail, we collect your email, as well as any other personal data that may be included in the email, such as, identification data, other contact details, professional data, educational data etc.
The purpose of the above processing is exclusively the communication, as well as the processing of any requests.
The legal basis for the processing is the overriding legitimate interest of HDBI to communicate with people and potential customers, namely Article 6 par. 1(f) of the GDPR.
o Processing of personal data included CVs.
If you apply for an open job position, we collect all the data you provide us via email, which may include:
Identification Data (e.g. Full Name, Father’s Name, Date of Birth, Gender, Nationality, Image Data (e.g. photograph), Contact Data (e.g. Telephone, Email Address, Home Address), Skills Assessment Data (e.g. e.g. Education, Diplomas, Distinctions, Previous Work Experience, Foreign Languages, Computer Skills, Soft Skills, Interests, Membership in Associations, Letters of Recommendation, etc.)
Any interested person may include any personal data he/she wishes in his/her CV. This data will be processed by the company.
The purpose of the processing of the above-mentioned data by our company is the evaluation of the candidate associates, in order to ensure the optimal staffing of the Company.
The legal basis for the above processing is the conclusion of a contract with the candidate employee in question, i.e. Article 6 par. 1(b) of the GDPR.
o Processing of personal data in the context of proposals submission in response to a call for expressions of interest or to the Process of Submission and Evaluation of Investment Proposals for Indirect Investments.
Through the proposals submitted in response to the Calls for Expressions of Interest or to the Process of Submission and Evaluation of Investment Proposals for Indirect Investments, we collect personal data of stakeholders and management teams/investors or other persons included in the Expressions of Interest solely for the purpose of evaluating the proposal.
The purpose of processing the Data is to implement the terms of the respective call or the abovementioned process, namely to evaluate submitted proposals and interested financial intermediaries, Investment Schemes, Private Investors, that have submitted the Expression of Interest, in accordance with the provisions set out in the respective call or the abovementioned process, as well as to comply with any legal obligation of HDBI.
The legal basis for the above processing is compliance of HDBI with its statutory obligations and the conclusion of a contract with the interested party, as specified in each in each request for proposal or the abovementioned process.
For more details regarding your information on the processing of your personal data in the context of calls for expression of interest or the abovementioned process, please refer to the detailed privacy notice embedded in each request for proposal or the abovementioned process, respectively.
Data automatically collected
When you use our Website, we also collect information automatically, which may include personal data. This consists of information such as language settings, IP address, location, device settings, device settings, device operating system, activity data, time of use, redirect URL, status report, user information (information about browser version), operating system, browsing result (single visitor or registered user), browsing history, type of data viewed. We may also collect data through cookies. For further details on the use of cookies,click Cookies Policy .
Data Retention Time
HDBI collects, maintains and processes personal data for a specific period of time, depending on the purpose of processing, after which the data are securely deleted/destroyed.
In particular, as regards the communication, your data are kept for the statutory limitation periods provided for and in any case at least until the purpose of the communication has been fulfilled.
As regards the part of the processing of your personal data included CVs, iIn case a job application is not successful, we will keep your data for up to six (6) months in order to contact you should a vacancy arise.
As far as the part of the processing of personal data in the context of proposals submission in response to a call for expressions of interest or to the Process of Submission and Evaluation of Investment Proposals for Indirect Investments, your data are kept exclusively for the limitation periods as specifically set out in each request for proposal or to the abovementioned process, respectively .
Collection and processing of Personal Data of Minors
As a general rule, HDBI does not directly or indirectly collect and process data of minors (i.e. persons under the age of 18). However, since it is impossible to cross-check and verify the age of persons entering or using the website, parents and guardians, who are responsible for the minors, are recommended to contact HDBI directly if they detect any unauthorised disclosure of their data of or, in order to exercise their rights accordingly, such as the erasure of their data. If HDBI becomes aware that the company has collected personal data of a minor, it undertakes to immediately delete this data and to take all necessary measures to protect it.
No automated decision-making processes including profiling are carried out.
Transfer of Personal Data
HDBI may share your personal data with categories of persons or entities (recipients) in the context of carrying out its activities and in order to operate and serve you. The recipients have access only to as much of your personal data as are strictly necessary for the performance of their tasks or the provision of services to HDBI. The categories of recipients are as follows:
Microsoft as the software provider company of HDBI and the company provider the e-mail services of the HDBI.
Contractors to whom HDBI entrusts the performance of specific data processing operations operations (data processors).
In principle, HDBI does not transfer your personal data to third countries and/or International Organisations. In the event of a transfer of your personal data to a country outside the European Economic Area (EEA) or an International Organisation, HDBI will first ensure that one of the legal bases of Article 6 of the Regulation is met ; and :
(a)the Commission has issued an adequacy decision for the third country to which the transfer is to be made (Article 45 GDPR); or
(b) appropriate safeguards in accordance with the GDPR are in place for the transfer of such data (Article 46 GDPR); or
(c) For occasional processing, one of the exceptions provided for in Article 49 of the GDPR exists (e.g. the explicit consent of the user and his/her information about the risks involved in the transfer, the transfer is necessary for the performance of a contract at the request of the data subject, there are reasons of public interest, it is necessary to support legal claims and vital interests of the data subject, etc.).
Rights of Data Subjects
HDBI shall ensure its prompt response to requests from data subjects in order for them to be able to exercise their rights in accordance with the Existing Legislation.
In particular, each data subject shall have the following rights:
| Access | rectification |
And under certain conditions
| Restriction | Erasure |
In addition, you also have the right, subject to conditions, to object to the processing of your data by HDBI, where the lawful basis for the processing of your data is either a legitimate interest (Article 6(1)(f) GDPR) or the public interest (Article 6(1)(e) GDPR).
In case of exercise of any of the above-mentioned rights, HDBI will respond promptly and in any case within one month of the submission of the request, informing you in writing concerning the progress of the request.
For any of your complaints regarding this Notice or personal data protection issues, if we do not satisfy your request, you may contact the Hellenic Data Protection Authority via the following link: www.dpa.gr.
Data Protection Officer (DPO) details
To exercise all of the aforementioned rights, as well as for any issue concerning the processing of your personal data by HDBI, you can contact the DPO at the e-mail address dpo@hdbi.gr.
Disclaimer for Third Party Websites
HDBI has no control over, and is not responsible for, any subsequent processing of the personal data of data subjects carried out by Third Party Websites.
Disclaimer for social media hyperlinks
Furthermore, on this Website there are social media hyperlinks – Social media widgets (e.g. Facebook, LinkedIn) through which, after the user logs in to the social network, a special digital fingerprint is created, for which HDBI and the social media provider (?) are independently responsible for processing.
The lawful basis for processing personal data through HDBI’s social media accounts is the achievement of its legitimate interest in informing and communicating customers about its activities. HDBI does not control and is not responsible for any subsequent processing carried out by social media provider.
For more information on the data processing policy and the options for regulating these networks, please visit the following websites:
• https://www.facebook.com
• https://www.linkedin.com/
Updates to the Website Privacy Notice
This Website Privacy Notice may be amended/revised in the future, in the context of the regulatory compliance of HDBI as well as the optimization and upgrading of the Website’s services. We therefore recommend that you refer each time to the updated version of this Notice for adequate information.
February 2025
