1. Data Processing

Data Processing is the sole proprietorship with the name “GOUDAKIS ATHANASIOS” based in N. Michaniona, Thessaloniki and legally represented, with a call center 2392035793 and contact email [email protected].

2. General principles regarding transparent information

2.1. Any information we provide to you under this Policy as well as any information you may request in the future is provided free of charge, provided that the request is not repeated, exaggerated or manifestly unjustified.

2.2. For each of the rights, which will be mentioned in detail below and which you can exercise, the Company will respond to you within one (1) month from the receipt of the request or in case of objective difficulty, complexity of the request or the number of requests, the Company will respond within a maximum period of three (3) months, regarding your request, either upon termination or with a reasoned refusal to execute what you requested for legal reasons, which are explicitly specified in the General Regulation on Data Protection ( EU) 2016/679 – GDPR, (“Regulation”).

2.3. In case the Company deems that one of your rights is exercised manifestly unfounded or the request is excessive or has a recurring nature, it is entitled on the one hand to impose your charge with a reasonable fee on the provision of further information (which is in principle free) and on the other refuse to follow up on the request.

2.4. In case the Company delays beyond the justified period of time to respond to your request as well as in any case where you consider that your rights are violated or the Company is not consistent with the obligations of safe storage of your data, you have the right to file a complaint to competent supervisory authority, (Personal Data Protection Authority, “APDPH”, Athens 1-3 Kifissias, PC 115 23, Athens, [email protected], + 30-210 6475600).

2.5. You reserve the right to revoke your consent at any time for the future as well as the right to submit all of your requests for the exercise of your rights below by completing the “Special Subject Request Form” provided by the Company to as part of the relevant procedure for managing the requests of the subjects, at the email address [email protected] or by phone at 2392035793.

3. Your Rights in relation to the Personal Data you have provided to us

3.1. Right to Information

You reserve the right to request information about the personal data we receive from you and hold for one or more purposes as described below under 4. This Policy is in its entirety a handbook of basic information and understanding of the regulatory philosophy protection of your personal data.

3.2. Right of Access

You reserve the right to request from the Company access to your data which we maintain and confirmation in relation to whether they are processed and more specifically information about the purposes of processing, the categories of personal data, the categories of recipients, the period of their retention and processing , the existence of a right of complaint to the APDPH, any available information on the origin of the data when it has not been made available by you, the existence or non-automated decision-making including profiling and the relevant methodology as well as a copy of the personal data kept and are processed.

3.3. Right of Correction

You reserve the right to request from the Company correction of your data in case any of the items for which we have the right to edit has changed or has been incorrectly registered.

3.4. Right of Deletion

You reserve the right to request from the Company complete or partial deletion of your data in which we have the right to keep and process either because they are no longer necessary to fulfill the purposes for which they were collected, or because you withdraw your consent, or because the data were collected for a purpose you deem illegal. The Company, in a reasonable time will respond to you confirming the total or partial deletion of your data or the impossibility of deleting specific data if a law or the fulfillment of a duty in the public interest, or the right to freedom of expression and information or the exercise or the support of a legal claim requires their retention. In this case, on the one hand, you have the possibility of appealing to the APDPH, and on the other hand, filing a court appeal.

3.5. Right of Restriction

You reserve the right to request from the Company a restriction on the processing of your data, amount

temporally or in relation to the purpose of their processing and more specifically (a) either because you question the accuracy of your data and for how long it takes the Company to confirm their accuracy, (b) or because you consider the processing illegal but instead you choose a restriction (c) either because it is no longer necessary for the Company to use them but you do not wish to delete them as their retention will serve you for a legal claim, (d) or in the event that you have objections to the processing of the data and until it is verified whether your rights as a Subject prevail over the legal processing reasons of the Company. 3.6. Right to Portability You reserve the right to receive the personal data you have made available to the Company in a structured commonly used and machine-readable format as well as the right to transmit it further without objection, as the processing of your data is done on the basis of consent. In the context of the exercise of this right, you also have the opportunity to request immediate transfer from the Company to the third party without your mediation. This right is exercised without prejudice to the restrictions on the right of deletion and its exercise may not adversely affect the rights and freedoms of others.

3.7. Right of Objection You reserve the right to object to the use of your processed data, unless the Company demonstrates compelling and legitimate reasons for processing it that outweigh your interests or are necessary to establish, exercise or support legal claims.

4. Categories of Subjects (A) CUSTOMER – SUPPLIER – ASSOCIATE & CANDIDATE CUSTOMER – SUPPLIER

A’1. Nature of Data – Purpose of processing – Legal basis a) Your data (name, email address, telephone, home or business address, capacity, professional activity and / or our products / services that interest you, etc.), which are collected pre-contractually, by sending an email and / or telephone communication, are processed for the purpose of investigating the possibility of a transaction with our Company, in order to pursue our commercial purposes and the purposes of the requested communication. b) Your data [personal identification data (name, VAT number, ID number, AMKA), home or business address, contact details (telephone, e-mail address), bank account number, full invoicing information, product / service shipping address , choice of payment method, payment execution information, etc.] which you provide yourself, by phone, by e-mail and / or in writing, in the context of our transaction, are processed for the purpose of implementing the commercial cooperation relationship between us and of our obligation to comply with labor, insurance and tax legislation. c) Legal basis for the processing of the above data (under A.1.a) is the service of the legal interests of the Company for commercial purposes, (art. 6 par. 1 item (f) of Regulation (EU) 2016/679 on the Protection of Personal Data), while the legal basis for data processing (under A.1.b) is the execution of the contract between us as well as our compliance with the legislation (art. 6 par. 1 item (b) and par. 1 point (c) of the above Regulation). d) The Company does not collect and process, in principle, special categories of personal data (sensitive), ie data related to your racial or ethnic origin, your political views, your religious or philosophical beliefs or your participation in a trade union organization, data relating to your sexual life or sexual orientation, your genetic or biometric data and health data, for the purpose of identifying you as the subject of the processing,

A’2. Data Transmission a) Your data (provided to serve the purposes described above under A.1.a & b) is not intended (as required by the purpose for which it is collected) to be transmitted to any organization outside the Company. As the controller we have taken all the necessary security measures in order not to allow access to your personal data to anyone other than the appropriate authorized persons for this purpose and only for the purposes of processing provided herein. In the context of our business activity, service and pursuit of our legal interests, we may disclose your data in a legal and legitimate manner to external partners of the Company, such as the provider of support systems for the electronic systems, networks and computerization of the Company.  ίας κ.α. These persons receive only the data that are absolutely necessary for the fulfillment of the work they undertake, they process them only under our explicit mandate and authorization and exclusively for the purposes stated in this “Privacy and Privacy Policy”. We ensure that these persons are aware of this, as well as that they respect and implement all European and national legislation on the Protection of Personal Data, even signing the relevant contractual terms. b) Your data (made available for the purposes described under A.1.a & b) in addition to the above under A.2.a) transmissions may also be forwarded to public bodies and services, competent tax authorities or / and insurance funds, judicial and independent authorities, in the context of our compliance with the relevant legislation. c) The Company generally maintains your personal data within the European Union. In the event that data is to be transmitted to third countries outside the European Union, for which there is no exceptional adequacy decision of the European Commission or to International Organizations, all appropriate guarantees under current data protection legislation will be taken. on transfers to third countries.

A.3. Data Retention Time a) We will keep the above (under A.1.a) your data for the period of five (5) years to serve our commercial purposes and then we will proceed to delete them. b) We will keep your above data (under A.1.b) which have financial, insurance and tax dimensions for as long as the tax and / or insurance legislation stipulates. c) All your remaining (under A.1.b) data (for which it is not required by law to keep them for a specific time) are deleted within five (5) years from the expiration of the contract or partnership. d) After the expiration of the respective (legal) retention period of the Data we will proceed to their deletion at our own risk.

(B). WEBSITE / USER OF THE WEBSITE – ESHOP

B.1. Nature of Data – Purpose of processing a) Your data (name, email, telephone, home or business address, capacity, professional activity and / or our products / services that interest you, etc.), which are collected through the creation / connection of an account on the Company’s website, are processed for the purpose of processing the electronic order and execution of the electronic purchase.

B 2. Legal basis – Data Retention Time The legal basis for the processing of the above data is the execution of the contract between us (distance) as well as our compliance with the legislation (art. 6 par. 1 item (b) and par. 1 item (c) of the Regulation) while are kept for as long as the tax and / or insurance legislation stipulates. For the data that do not have a tax dimension are deleted within five (5) years from the expiration of the contract. After the expiration of the respective (legal) retention period of the data, we will delete them at our own risk.

5. Violation of Personal Data We will report any illegal and proven violation of our Company’s database to all those directly concerned as well as to the competent supervisory Authority (“APDPX”), within seventy-two (72) hours of the violation, provided that the data of the employees, associates, suppliers that are stored in a recognizable form, have become a product of theft.

6. Guarantees We assure you that our Company will exhaust all technical and organizational measures for the protection of your Data and will make the optimal, minimum and absolutely necessary use and processing of the Data as defined by law and strictly and exclusively for the purpose for which you have provided them to us