Privacy Policy

I. INTRODUCTION

The General Data Protection Regulation (hereinafter referred to as the “GDPR,” EU 2016/679) has been in effect in the European Union since May 25, 2018. For the text of the Regulation, you may refer to the provided URL.

This Privacy Policy (hereinafter the “Data Policy” or “PPPD”) concerns the association named “Greek Bioeconomy Council” with the distinctive title “Greek Bioeconomy Council (GBC),” based in Thessaloniki, 31 Giannitson Str., P.C. 54627. The GBC is the owner, creator, and beneficiary of all rights to the domain name gbc.gr (hereinafter the “website”) and the services provided therein, as well as the Data Controller for any data declared by visitors/users of this website.

The GBC attaches particular importance to the protection of the personal data of users, executives, and any third parties who visit the Association’s websites. For this reason, it has compiled this Privacy Policy to inform the aforementioned persons about how their personal data is collected, used, and shared.

This website may include links to other websites under the responsibility of third parties (natural or legal persons). Additional websites may be added in the future, for which the GBC is in no way responsible regarding their terms of personal data protection and management.

II. PERSONAL DATA PROTECTION POLICY

1. DEFINITION OF PERSONAL DATA

According to Article 4 of the GDPR:

“Personal Data”: any information through which a natural person (“Data Subject”) is identifiable or can be identified.

“Data Controller”: the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

“Processor”: the natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.

“Data Subject”: the natural persons for whom the controller collects and processes personal data (in this Data Policy, Data Subjects are users of GBC’s websites: representatives and executives of GBC members, GBC executives, social partners, individuals participating in various events organized by the GBC, and all interested parties and third parties – visitors to the websites).

“Recipient”: the natural or legal person, public authority, agency, or other body to which the personal data is disclosed, whether a third party or not.12

2. COLLECTION OF PERSONAL DATA

When a visitor/user visits GBC’s websites and interacts with them, completes communication forms, submits an application for an event, or subscribes to the newsletter, certain information may be automatically collected, such as:

• Name, surname, telephone (work and mobile), position in the company
• IP address
• Browser type and operating system
• Websites and links selected (“clicked”) within the page
• Basic server connection information
• Information collected through software such as HTML cookies, Flash cookies, web beacons, and other similar technologies.
  
  The IP address is determined by the connection provider through which the visitor/user accesses the internet and subsequently the Website. The IP address is maintained for legal and technical reasons, as well as to address issues related to the security of the page systems (server, database, network, etc.).
  
  The GBC does not knowingly collect personal information from minors under 18 years of age. If it discovers that any personal information has been collected from a minor under 18 without verifiable parental consent, it undertakes to delete the information from the database as soon as possible.
  
  The GBC does not collect special categories of personal data (Article 9 § 1 and Article 10 of the GDPR).

3. PURPOSE OF PERSONAL DATA PROCESSING

The personal data collected is used exclusively for reasons concerning the fulfillment of the GBC’s operational purpose, communication with Data Subjects, as well as for statistical reasons and the improvement of provided services and information. It is not permitted to be used by any third party.

Specifically, the Personal Data collected from the Data Controller’s websites and stored in the respective database is intended to be used for the purposes mentioned herein, namely:

• To personalize the websites for users to provide an optimal user experience and faster access to provided services.
• To enable the provision of anonymized statistical data to third parties, in a way that they cannot identify the data subject.
• To manage the websites and all forms of communication.
• To send updates or notifications (newsletter) following the user’s prior choice. The GBC ensures that such sending meets the consent conditions within the framework of GDPR and anti-spam legislation, and that users can freely revoke their consent at any time.
• To enable the submission of participation applications for the Association’s events by those who wish to attend.
• To enable the sending of material related to an event to those who participated in it.
  
  Data of users who have communicated with the GBC is maintained on the Association’s servers for a period of two years.

4. RECIPIENTS OF DATA AND PURPOSE OF TRANSMISSION

The personal data of users of GBC websites is transmitted to partners and/or subcontractors of the Association, but always under conditions that fully ensure that the personal data of the Data Subjects does not undergo any illegal processing, i.e., other than for the purpose of transmission. The main recipients of the users’ personal data are:

1. The company ELORUS, 13 Theofilopoulou, Athens, P.C. 11743, Tax ID (AFM) 800585687, which provides the GBC with member and partner data management software (CRM), as well as maintenance and support services for this software.
2. The company GOOGLE, Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, insofar as it provides the GBC with the Google Forms service, through which website visitors/users register for events organized by the GBC.
3. The company SiteGround Spain S.L., CIF: B-87194171, VAT: ESB87194171, registered address: Calle de Prim 19, 28004 Madrid, Spain, insofar as it provides the GBC with website maintenance and hosting services.
   
   These recipients are third-party partners providing event organization services for the Organization. The above categories of recipients are Processors who have contractually committed in accordance with Article 28§3 of the GDPR and, as such, do not perform any processing beyond the aforementioned purposes of transmission.
   
   Competent GBC executives have been designated to access users’ personal data and are bound to maintain secrecy and confidentiality; unauthorized access is prohibited. Processors acting on behalf of the GBC have agreed and committed contractually to maintain secrecy, not to send personal data to third parties without GBC permission, to take appropriate security measures, and to comply with the legal framework for the protection of personal data.
   
   The GBC will not sell, otherwise transmit, or disclose personal data of its website visitors/users to third parties, except for the aforementioned recipients, without the visitor/user’s consent, with the exception of the implementation of relevant legal mandates and only to the competent Authorities.
   
   The held personal data may be communicated to competent judicial, police, and other administrative Authorities upon their legal request and in accordance with the applicable legislative provisions. Furthermore, in case of a legal order, service command, or official preliminary investigation, the GBC has the right, without further ado, to make the relevant data available to the corresponding service.
   
   The GBC will not transmit users’ personal data to a third country or international organization.
   
   The websites may offer the possibility of sharing on Social Networks and other related tools that allow the sharing of user actions within the Website/Application with other applications, websites, or mass media, and vice versa. The use of such features allows for the exchange of information with users’ friends or the general public, depending on the settings they have defined in their personal profile. Users/visitors are requested to refer to the privacy policies of these social networking services for more information regarding how they handle their data.34567

5. USER CONSENT

By accepting this Personal Data Protection Policy, users acknowledge that:

• Especially regarding the communication of the GBC with visitors/users of its websites with the aim of informing the latter about the actions it performs and providing any information related to its fields of action, the GBC is entitled to send newsletters to the users’ email addresses, provided they have chosen to do so and have given explicit electronic consent (opt-in) by stating their email in the relevant “Subscribe to newsletter” field. Also, a clear and distinct possibility is provided for every User to object at any time (opt-out / unsubscribe), easily and without any charge through each relevant message, in case the User no longer wishes to receive newsletters.
• Processing related to fraudulent acts: The Data Subject has been informed and consents that, in case of sufficient indications and if the specific situation requires it, the GBC will have the right to collect, process, and use personal data necessary for the detection of fraudulent acts, as well as data of any other illegal or non-contractual use of its websites.
• Transmission by law: The Data Subject has been informed and consents to the potential transmission of their personal data to law enforcement and supervisory Authorities for the necessary protection against risks concerning state and public security as well as for the prosecution of criminal acts.

6. TRANSFER AND STORAGE OF PERSONAL DATA

The transfer of Data Subjects’ personal data is done via email, and the data is transferred encrypted.

Data is stored on GBC servers located at the Association’s premises.

7. RIGHTS OF DATA SUBJECTS

The GBC, as a Data Controller, in full compliance with the provisions of the GDPR, satisfies and facilitates the satisfaction of the following provided rights of the Data Subjects:

a) Right of access

Data Subjects have the right to receive, at any time, information from the Data Controller as to whether their personal data is being processed and, in the affirmative case, to request information about the purpose of the processing, the type of data being processed, to whom it is transmitted, how long it is stored, and if automated decision-making occurs. Furthermore, Data Subjects will be given access to such personal data without undue delay.

b) Right to rectification

The Data Subject has the right to require the Data Controller to rectify inaccurate or outdated personal data concerning them. They also have the right to require the completion of incomplete personal data, including by means of a supplementary statement. Furthermore, the GBC undertakes the obligation to announce every rectification of personal data to every recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort. The GBC undertakes to inform the Data Subject about such recipients upon request.

c) Right to erasure (“right to be forgotten”)

The Data Subject has the right to request the Data Controller to erase personal data concerning them if it is no longer necessary for the aforementioned purposes of processing and under the conditions of Article 17 of the GDPR.

d) Right to restriction of processing

The Data Subject is entitled to request the Data Controller to restrict the processing of personal data concerning them. If the processing of personal data is restricted, such personal data, apart from storage, is processed exclusively only if specific exceptions apply.

e) Right to data portability

The Data Subject has the right to receive the personal data concerning them which they have provided to a Data Controller in a structured, commonly used, and machine-readable format.

f) Right to object

The Data Subject is entitled to object at any time and for reasons related to their particular situation to the processing of personal data concerning them, when this is necessary for the fulfillment of a task performed in the public interest or in the exercise of public authority vested in the Data Controller, or when processing is necessary for the purposes of the legitimate interests pursued by the Data Controller. Once the right to object is exercised, personal data must no longer be processed unless there are proven legitimate and compelling grounds for the processing which override the interests, rights, and freedoms of the Data Subject, or for the establishment, exercise, or support of legal claims. The GBC guarantees that if the Data Subject objects to the processing of data concerning them, it no longer processes such data unless it proves that there are compelling and legitimate grounds for the processing which override the interests and rights of the Data Subject.

g) Automated individual decision-making, including profiling

The Data Subject has the right to object to a decision taken solely on the basis of automated processing, including profiling, when that decision produces legal effects concerning them or significantly affects them. The GBC does not currently perform automated individual decision-making. In any case, and if it decides to proceed with automated individual decision-making in the future, it will satisfy this right.

Overall, the GBC ensures that:

1. Procedures exist that allow for the easy exercise of Data Subjects’ rights so that all required actions are taken immediately.
2. The Data Controller is obliged to respond to a request submitted by the Data Subject without undue delay and in any case no later than thirty (30) calendar days. In case it cannot satisfy an exercised right of the Data Subject, the GBC will ensure that a specific, sufficient, and full justification is provided.
3. Except for exceptional circumstances, all actions concerning the satisfaction of Data Subjects’ rights will be free of charge for the Subjects.
   
   If Data Subjects believe that the processing of their Personal data violates the applicable regulatory framework for the protection of personal data, they have the right to file a complaint with the Personal Data Protection Authority (postal address: 1-3 Kifissias Ave., P.C. 115 23, Athens, tel. 210. 6475600, email: contact@dpa.gr).
   
   The GBC reserves the right, when it deems it appropriate, to modify this Policy, either in whole or in part, at its absolute discretion and to post this modification on its websites. Any modification hereto shall apply immediately upon the modified Policy being posted on the websites. In any case, if the user continues to use the GBC websites after the modifications, it means they accept them. Otherwise, the user must stop using the GBC websites or notify any objections. Users must take note of the Policy at regular intervals to be sure they are aware of the most recent version.

III. COOKIES POLICY

1. General

The Organization’s websites use “Cookies” software in compliance with the applicable legislation. “Cookies” are small pieces of information (files) in the form of plain text, stored on the user’s computer (or other devices with internet access, such as a smartphone or tablet) when they visit any page on the internet. “Cookies” do not cause any harm to the user’s computer or to the files stored on it. Without them, the user’s personal preferences could not be stored.

“Cookies” help collect information necessary to measure the effectiveness of websites, improve and upgrade their content, adapt them to the demand and needs of users, and measure the effectiveness of the website’s presentation and display on third-party websites. The “Cookie” files used on GBC’s websites do not collect information that personally identifies users and do not gain access to any document or file from the users’ computer.

The information collected by “Cookies” may include the type of browser the user uses, the type of computer, its operating system, internet service providers, and other information of this kind. Furthermore, the website’s information system automatically collects information about the locations the user visits and the links to third-party sites that may be found on the GBC websites.

2. Which “Cookies” are used by the GBC

GBC’s websites, like all websites, use “cookies” to function smoothly and serve the user optimally. Below, the four categories used are analyzed:

Transient and persistent

“Transient Cookies” are stored on the computer or electronic device during a user’s visit to the GBC’s websites and are deleted upon exiting.

“Persistent Cookies” remain on the user’s computer or electronic device for a longer period until deleted by the user themselves.

B) Necessary, functional, and performance cookies

The strictly necessary “Cookies” are essential for the proper functioning of the websites. These “Cookies” allow the user to browse and use the website’s features, such as access to secure areas or completing web forms. These “cookies” do not identify the user, and without them, the smooth operation of the website is not possible.

“Functional Cookies” allow the website to keep in memory the visitor’s choices, such as username, login password, etc., in order to provide improved and personalized features. They can also be used to provide services requested by the user, such as video viewing or social media use. In case the user rejects these “cookies,” the performance and functionality of the GBC website may be affected, and access to its content may be limited.

“Performance Cookies” – analytics: The GBC uses “Cookies” to collect information about the use of its websites by visitors, with the aim of satisfying more visitor-user needs and improving the content of its websites and facilitating their use by visitors. These cookies take advantage of how visitors use the website and are used for statistical reasons and for monitoring and improving a website’s performance.

C) “Third-Party Cookies” and embedded content

The GBC allows Google and other third-party companies with which it cooperates to install the “Cookies” it uses. In the event that through the GBC’s websites the user enters third-party websites or connects to social networking entities (twitter, facebook, youtube), they should know that these third-party websites or entities may install “Cookies” as soon as they navigate to the relevant link. These “Cookies” are outside the GBC’s control and are governed by the cookie policy of each third party that installs them. In order for the user to know how to manage them, they should be informed of the respective policies of the relevant websites.

3. How to manage and delete “Cookies”

The menus of most browsers provide options regarding how to manage “Cookies.” Depending on the options the browser gives users, the user can allow the installation of “Cookies,” disable/delete existing “Cookies,” or be notified every time they receive “Cookies.” Instructions for managing and deleting Cookies are usually found within the “Help,” “Tools,” or “Edit” menu of each browser. Also, the user can find more detailed guidance at www.youronlinechoices.com/gr, where the method of controlling and deleting “Cookie” files in most browsers is explained in detail.

The user must keep in mind that if they reject or disable the cookies of the GBC websites, the functionality of the websites may be partially lost. Also, disabling a “Cookie” or a category of “Cookies” does not delete the corresponding file from the browser. Such an action should be performed by the user themselves, by modifying the internal operations of the browser they use.

4. Changes in the use of Cookies by the Organization

The GBC reserves the right, when it deems it appropriate, to modify this Policy, either in whole or in part, at its absolute discretion and to post this modification on its websites. Any modification hereto shall apply immediately upon the modified Policy being posted on the websites. In any case, if the user continues to use the GBC websites after the modifications, the GBC will not bear any responsibility. Users must take note of the Policy at regular intervals to ensure they are aware of its most recent version.

GBC Contact and Identification Details

For any issue related to the processing of their data and the exercise of their rights, visitors/users can contact the GBC (info@gbc.gr). Organization Details: Tax ID (AFM): 996400948, Tax Office (DOU): E’ Thessaloniki.

Communication

For any question regarding this Policy, users can contact the GBC at the email address info@gbc.gr.

This policy will be renewed and updated at intervals based on applicable national and European legislation.