1What personal data we process
When the Website is visited and used, the Company may process personal data that are necessary for its operation, for communicating with visitors, for displaying news content and available job vacancies, and for ensuring the security of its individual functions.
In particular, the categories of personal data that may be processed include:
a) Identification and contact details: When a request is submitted through the Website’s contact form, the Company collects the first name, surname, email address, telephone number and the content of the message submitted by the person concerned. Data submitted through the form are stored in the Website’s WordPress content management system and are accessible only to authorised persons, to the extent required to handle and respond to the request.
b) Data included in contact requests: The Company may process the information included in the message of the person concerned, to the extent necessary to understand, examine and respond to their request. Persons submitting a request are asked to avoid entering special categories of data, such as health data, or other information that is not necessary for the purpose of the communication.
c) Technical data for the security of the contact form: The Google reCAPTCHA service is used on the contact page to protect the Website against automated or malicious use. In the course of the operation of this service, technical information may be collected or processed, such as the IP address, information about the browser and the device, as well as interaction data used to assess activity and detect possible automated access, depending on the technical implementation and settings of the service.
d) Data when viewing the embedded map: The “Contact” page offers the option of viewing an embedded map through the Google Maps service. When the map loads, technical information may be transmitted to Google, such as the visitor’s IP address and details of their device and browser. The map is loaded after the visitor has made the relevant consent choice.
e) Data related to embedded content from LinkedIn: A feed of content from LinkedIn is embedded on the home page and in the news section of the Website through the Tagembed service. When this content is viewed or interacted with, technical data may be processed, such as the IP address, information about the device and the browser, as well as other usage data or identifiers associated with the loading and operation of the embedded content, depending on the technical implementation and settings of the service.
f) Data related to the display of job vacancies: Available job vacancies are displayed in the “Careers” section of the Website through the Workable service. When the relevant content is accessed or interacted with, technical data relating to the use of the service may be processed. If the person concerned chooses to apply for a specific position through the Workable platform, data they provide as part of their application may be processed, such as identification and contact details, CV, and information on professional experience, education and qualifications. Specific information on the processing of applicants’ data is provided during the application process.
g) Technical data on the operation of the Website: While browsing the Website, technical data necessary for its secure and proper operation may be recorded, such as IP addresses, event logs, information about the device and the browser, as well as data on the date and time of access, to the extent that these are collected through the technical infrastructure and the services used.
2Purposes and legal basis of the processing
The Company processes personal data for specified, explicit and legitimate purposes connected with the operation and security of the Website, the handling of and response to contact requests, and the display of news content and available job vacancies.
In particular:
a) Handling contact requests: The data provided through the contact form are processed for the purpose of receiving, assessing, handling and responding to the requests of the persons concerned, as well as for further communication with them, where this is required to deal with the request in question.
The legal basis for the processing is, in principle, Article 6(1)(f) GDPR, namely the Company’s legitimate interest in communicating with interested persons, handling and responding to requests submitted on their own initiative through the Website, and pursuing its lawful business activity.
Where the communication concerns taking steps at the request of the person concerned prior to the possible conclusion of a contract to which they will be a party, the processing may be based on Article 6(1)(b) GDPR.
Providing the details marked as mandatory in the contact form is necessary to submit and handle the request. Failure to complete them may make it impossible to submit the request or to provide a response. Submitting a request through the form does not create any obligation to conclude a contract.
b) Security of the contact form – Google reCAPTCHA: The Company uses the Google reCAPTCHA service on the contact page in order to protect the form against automated submissions, unwanted activity and abusive use, and to ensure the security and proper operation of the Website.
The processing of data necessary for the above purposes may be based on Article 6(1)(f) GDPR, namely the Company’s legitimate interest in protecting the Website and its information systems against malicious acts, following the required balancing of interests.
The use of any cookies or similar technologies in the context of this service is subject to the specific requirements of the legislation on privacy in electronic communications, as set out in the Website’s Cookie Policy.
c) Display of news content – LinkedIn / Tagembed and Google Maps: The Company embeds a feed of content from LinkedIn on the home page and in the news section of the Website through the Tagembed service, in order to display corporate posts and inform visitors about its activities and news. In addition, the Google Maps service is used on the Website’s contact page to help visitors locate the Company and access its premises.
To the extent that the operation of the above services involves the processing of personal data, the relevant legal basis is determined according to the purpose, the manner of implementation and the individual processing operations. Where the processing is necessary to display the relevant content and the relevant conditions are met, it may be based on the Company’s legitimate interest, in accordance with Article 6(1)(f) GDPR.
The embedded content and the map are loaded only after the visitor has given prior consent through the Website’s cookie management mechanism, since these functions may involve storing information or accessing information on the visitor’s device through non-essential technologies. Where the related processing of personal data is based on consent, Article 6(1)(a) GDPR applies.
d) Display of job vacancies – Workable: The Company uses the Workable service to display available job vacancies in the “Careers” section of the Website, in order to inform interested persons about available career opportunities.
If the person concerned chooses to apply for a specific position through the Workable platform, the processing of the personal data included in their application is aimed at assessing their candidacy and managing the recruitment process. This processing may be based on Article 6(1)(b) GDPR, to the extent necessary to take pre-contractual steps at the applicant’s request.
More detailed information on the purposes, legal bases, recipients, retention periods and other conditions for the processing of applicants’ data is provided through the specific privacy notice that applies during the application process.
e) Technical operation and security of the Website: The Company may process technical data, such as IP addresses, event logs and information about the device or browser, to the extent that these are collected through the Website’s technical infrastructure.
The processing aims to ensure the availability, integrity and security of the Website and its information systems, and to prevent and investigate security incidents and unauthorised access.
The legal basis for the processing is Article 6(1)(f) GDPR, namely the Company’s legitimate interest in ensuring the secure and uninterrupted operation of its Website, following the required balancing of interests.
The Company ensures that personal data are processed only for the specified purposes and in accordance with the principles of lawfulness, transparency, purpose limitation, data minimisation and storage limitation, as laid down in the GDPR.
3Automated decision-making and profiling
The Company does not, through the Website, carry out automated decision-making, including profiling, which produces legal effects concerning the user or similarly significantly affects them, within the meaning of Article 22 GDPR.
4Recipients of personal data
Access to the personal data processed through the Website is granted to the Company’s competent and authorised staff, to the extent required for the performance of their duties and the purposes of the processing.
To provide and support the Website’s functions, the Company works with selected technology service providers, such as providers of hosting, technical support and maintenance of the Website, as well as providers of security services, embedding of news content and display of job vacancies.
In this context, personal data may be made accessible to technology service providers and, in particular, to Microsoft, in connection with the hosting of the Website on the Microsoft Azure service; to Google, in connection with the operation of the Google reCAPTCHA and Google Maps services; to Tagembed, for embedding news content from LinkedIn; to LinkedIn, in connection with loading and displaying the relevant content; and to Workable, for displaying available job vacancies, depending on the nature, mode of operation and technical settings of the respective services.
The above providers act, as the case may be, as processors on behalf of the Company or as independent controllers, depending on their role and the specific processing operations. Where they act as processors, the requirements of Article 28 GDPR apply.
Personal data may also be disclosed to competent public, administrative or judicial authorities, where required by applicable law or necessary for the Company to comply with a legal obligation or for the establishment, exercise or defence of legal claims.
5Transfers of data outside the European Economic Area
The Website is hosted on infrastructure within the European Economic Area (EEA).
Third-party services are also used for the operation of the Website. When these services are used, personal data may be processed by the respective providers in accordance with their applicable privacy policies.
To the extent that the use of the above services involves a transfer of personal data outside the EEA for which the Company bears responsibility, the requirements of Chapter V of Regulation (EU) 2016/679 (GDPR) apply.
6Data retention period
The Company retains personal data only for as long as is necessary to fulfil the purposes for which they were collected, taking into account the nature of the data, the purpose of the processing and any applicable legal obligations.
In particular, data submitted through the contact form are retained for as long as is required to examine, handle and complete the relevant request or communication and, where there is a specific legal reason, for an additional period necessary to comply with legal obligations or for the establishment, exercise or defence of legal claims.
Technical data and event logs are retained for the period necessary to ensure the operation and security of the Website, in accordance with the applicable retention policies and the relevant technical settings.
Data submitted as part of job applications are retained in accordance with the specific time limits and criteria communicated to applicants during the application process.
Once the applicable retention period has expired, the data are securely deleted or anonymised, unless there is a lawful reason for their further retention.
7Data security
The Company applies appropriate technical and organisational security measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, and against any other form of unauthorised processing.
These measures are reviewed and updated periodically, taking into account technological developments, the nature of the data processed and the risks that may arise for the rights and freedoms of natural persons.
8Rights of data subjects
Under the GDPR, every data subject is entitled, subject to the conditions laid down by applicable law, to request access to the personal data concerning them, the rectification of inaccurate or incomplete data, their erasure, the restriction of processing and their portability under the conditions set by the GDPR, as well as the right to object to the processing where it is based on Article 6(1)(f) GDPR.
To exercise the above rights, you may contact the Company at dpo@iknowhow.com.
The Company examines each request without undue delay and, in principle, within one (1) month of its receipt, which may be extended by two (2) further months in the cases provided for by the GDPR, after informing the requester accordingly.
If you consider that the processing of personal data concerning you infringes applicable law, you have the right to lodge a complaint with the competent supervisory authority. In Greece, the competent authority is the Hellenic Data Protection Authority (HDPA), 1–3 Kifisias Avenue, 115 23 Athens, website: www.dpa.gr, email: contact@dpa.gr.
9Updates to this Privacy Notice
The Company may update this Privacy Notice when necessary due to changes in the operation of the Website, the technologies used, applicable legislation or the guidelines of the competent supervisory authorities.
The current version will be available on the Website and will state the date of its last update.