1. INTRODUCTION
This Privacy Policy (hereinafter the "Policy") concerns the company "Ergo Alarm Defense Systems L.P.>" trading as ErgoAlarm Defense (hereinafter "ErgoAlarm Defense") and the personal data it holds about natural persons.
Our company is committed to protecting the confidentiality and privacy of Personal Data and complies with the relevant provisions of the "General Data Protection Regulation", hereinafter the "GDPR".
2. DEFINITIONS
* Personal data: any information that refers to and describes an individual, such as: identification details (full name, age, residence, occupation, marital status, etc.), physical characteristics, education, employment (work experience, conduct at work, etc.), financial situation (income, assets, financial behaviour), interests, activities and habits. The individual (natural person) to whom the data refer is called the data subject.
* Personal data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.
* Controller: the natural or legal person which determines the purposes and means of the processing of personal data.
* Processor: the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
* Processing of personal data: any operation or set of operations performed on personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
* Third party: any natural or legal person other than the data subject, the controller, the processor and the persons who, under the direct authority of the controller or the processor, are authorised to process personal data.
3. WHO IS THE CONTROLLER
Ergo Alarm Defense is the controller of the personal data that it processes in the course of providing its services or selling its products. It holds and processes your personal data confidentially and with respect for your private life, taking the necessary technical and organisational measures to protect it further.
4. THE PRINCIPLES WE FOLLOW
We are committed to observing the following principles for the processing of personal data under Article 5 of the GDPR:
* Lawfulness, fairness and transparency – Personal data are processed lawfully and fairly and in a transparent manner in relation to the data subject.
* Purpose limitation – We collect personal data for specified, explicit and legitimate purposes and do not process them further in a manner that is incompatible with those purposes.
* Data minimisation – Personal data are limited to what is necessary in relation to the purposes for which we process them.
* Accuracy / data quality – We take care to ensure that personal data are accurate and, where necessary, we update them promptly.
* Storage limitation – We keep personal data for no longer than is necessary or than is required by law.
* Integrity and confidentiality – We are committed to processing personal data securely, in particular against unauthorised or unlawful processing and against accidental destruction or damage, using appropriate technical or organisational measures.
* We are committed to, and observe, the principle of accountability.
5. COLLECTION OF PERSONAL DATA
We collect information about you, among other cases, in the following circumstances:
When you contact us directly, through our switchboard or our website, to request information about the products or services we offer, or to subscribe to our newsletter.
If you purchase a product or a service from us.
If your personal data are passed to us by Dealers, partners or other third parties.
At the pre-sale or pre-service stage, so that we can contact you and propose the best possible solution.
We also collect data occasionally from third parties who may lawfully pass on to us information about our customers, or whose records we may lawfully access, such as our external partners, credit reference and fraud prevention agencies, lawyers, public bodies (administrative, tax, judicial, regulatory authorities, social security funds) or other public-law or private-law legal entities.
We process personal data for the purposes set out in more detail below.
Please help us keep your information up to date by informing us of any changes to your personal data.
6. WHAT TYPES OF PERSONAL DATA WE COLLECT ABOUT YOU
The following categories of data about you may be collected and further processed as described in this Policy:
* Contact information (e.g. full name, address, telephone number, email)
* Professional status information (e.g. occupation)
* Payment information (e.g. IBAN / account number, preferred method of payment)
* Identification data (e.g. contract code)
* Customer history (e.g. satisfaction rating, offers received, purchase data, order dates, purchase prices, spare parts purchase details, complaints)
* Application / website / social media data (e.g. cookies)
Annex 2: "Indicative Categories of Data" lists examples of the personal data we process.
7. CATEGORIES OF DATA SUBJECTS
The categories of data subjects include:
* Customers
* Prospective customers
* Suppliers
* Natural persons in their capacity as employees, managers or partners of a legal entity.
* Third parties involved in events relating to the sale or provision of our services.
8. PURPOSES OF PROCESSING AND LEGAL BASIS FOR PROCESSING THE DATA
The processing of personal data is based on one of the "legal bases" referred to in Article 6 §1 of the GDPR. An explanation of the legal bases for processing is available in Annex 1 hereto. The legal basis on which the processing of each use of your data is based is stated for each purpose of processing.
Sales & Management of sales contracts – to process the sale, configure the appropriate solution and manage the Contract. [Article 6§1(a), 6§1(b) and 6§1(f) GDPR]
The provision of personal data in the context of sales of our products or the provision of services is a contractual obligation, and failure to provide it will affect the proper performance of the contract or make it impossible.
Customer Support – to answer queries and provide technical support relating to our products and services. [Article 6§1(a), 6§1(b) and 6§1(f) GDPR]
Promotion and Marketing activities – to answer queries and to inform you about our news and our products [Article 6§1(a) and 6§1(f) GDPR]
Consent to marketing may be withdrawn at any time, with effect for the future.
For existing customers, consent is not required, as they are clearly and prominently given the option to object (Law 3471/2006, Article 11 §3)
Pursuit of our Legitimate Interests – e.g. to improve our products and services, and to prevent and detect fraud against us [Article 6§1(f) GDPR]
Compliance with our Legal Obligations – to comply with our legal obligations towards police, regulatory, tax, accounting, certified auditor, judicial authorities and services [Article 6§1(c) GDPR]
The provision of personal data as above is a legal obligation which depends on the specific request.
Processing of Special Categories of Data: Under Article 9 §1 and 2 of the GDPR, the processing of special categories of data is permitted only in the specific cases laid down by law, among which is the giving of consent, Art. 9§2(a).
9. HOW WE ENSURE THE SECURITY OF PERSONAL DATA
We ensure that personal data are processed in accordance with policies and procedures consistent with the purposes of processing. For example, the following security measures are used to protect personal data against unlawful use or any other form of unauthorised processing:
* Access to personal data is restricted to a limited number of authorised persons for the specific purposes.
* Staff of the relevant departments responsible for managing your contract are bound by confidentiality clauses and have graded, restricted access, only to what is necessary to complete the provision of the service.
* Sensitive data are stored on computers with authorised access. Hard copies are also locked in cabinets to which only authorised persons have access.
* We select reliable partners, who are bound in writing, in accordance with Article 28 §4 of the GDPR, by the same obligations regarding the protection of personal data. We also retain the right to audit them under Article 28 §3 point (h).
* The IT systems used to process the data are technically isolated from other systems in order to prevent unauthorised access, for example through illegal access (hacking).
* In addition, access to those IT systems is monitored on a permanent basis, in order to detect and prevent unlawful use at an early stage.
Finally, we are certified with a Quality Management System to ISO 9001:2015
10. HOW LONG WE KEEP THE DATA
We store personal data for as long as is required for the relevant purpose of processing and for any other permitted related purpose. The data are kept throughout the term of our contract and, after it expires, for as long as is provided for by the applicable legislation. If a claim is brought, they are kept until any dispute is irrevocably resolved.
Information that is no longer necessary is securely destroyed.
In particular, data that we process on the basis of your consent (e.g. for marketing purposes) are kept from the receipt of the relevant consent until it is withdrawn.
We will also keep your personal data for up to 5 years in the event that our offer is rejected.
We restrict access to your data to those persons who need to use it for the specific purpose.
11. WHO THE RECIPIENTS OF THE DATA ARE
The personal data we collect may be transmitted to third parties, provided that the lawfulness of the transmission is justified.
Furthermore, where the lawfulness of the transmission is justified, personal data may be disclosed to the following categories of recipients:
* Our employees or partners who may process your personal data under our instructions.
* Transport or Courier companies
* Our branch and/or cooperating companies, within the scope of their responsibilities.
* Dealers and External partners, who are bound in writing, in accordance with Article 28 §4 of the GDPR, by the same obligations regarding the protection of personal data.
* Any supervisory authority, as required by the applicable supervisory framework from time to time.
* Any public or judicial authority, where this is required by law or by a court decision.
ERGOALARM DEFENSE uses a number of service providers who cooperate in the provision of its services.
Although the transmission of data over the internet or a website cannot be guaranteed to be protected from cyberattacks, both we and our partners work to maintain physical, electronic and procedural safeguards to protect your data.
12. WHERE THE PROCESSING TAKES PLACE
The personal data of our customers are processed within the European Economic Area (EEA).
Where research needs to be carried out for the provision of services outside the EEA as well, this takes place only with your explicit consent. Article 49, §4 (a).
13. PERSONAL DATA BREACH
In the event of a breach of the security and integrity of the data at our disposal that concern personal data, ERGOALARM DEFENSE will take the following measures (in accordance with Articles 33 and 34 of the GDPR):
* It will examine and assess the procedures required to contain the breach
* It will assess the risk and its impact on the rights and freedoms of the data subjects.
* It will seek to reduce, as far as possible, the damage that has been or may be caused.
* It will give notification within 72 hours of becoming aware of the breach, if required
* It will assess the impact on privacy and take appropriate measures to prevent the breach from recurring.
14. YOUR RIGHTS AS A DATA SUBJECT AND HOW YOU CAN EXERCISE THEM
You have the right to request access to the personal data concerning you, rectification/erasure of your personal data, restriction of processing, the right to object to processing and/or to exercise your right to data portability.
If the data processing is based on your consent, you may withdraw your consent at any time, with effect for the future.
In more detail, you have the right to:
a. Access: The right to be informed about our processing of the Data, and the right of access to the data.
b. Rectification: The right to request rectification or completion of your data, if they are inaccurate or incomplete.
c. Erasure: The right to request erasure of your data. We can comply with this right if:
* The data are no longer necessary for the purposes for which they were collected
* There is no legal basis for processing other than consent.
* You exercise the right to object (see f below)
* The data have been processed contrary to the applicable legal provisions
* The data must be erased in order to comply with a legal obligation
We reserve the right to refuse to comply with the above right if the processing of the data is necessary for compliance with a legal obligation of ours, for reasons of public interest, or for the establishment, exercise or defence of legal claims (Article 17 §3)
d. Restriction of processing: The right to have the data flagged, with the aim of restricting their processing. For example, where you have contested the accuracy of your personal data, for the period required for verification.
e. Portability: The right to receive your data in a structured, commonly used and machine-readable format and to request their transmission, both to you and to another person who will process them.
f. Objection: The right to object at any time to the processing of your data, including profiling, also where the reason for processing relates to direct marketing.
Our company will consider your request and reply to you within one month of receiving it, either to comply with it or to explain the objective reasons that prevent it from being complied with or, taking into account the complexity of the request and the number of requests, within a further period of two months. (Article 12 §3)
You may exercise the above rights free of charge, by sending a relevant application/letter/email to the Data Protection Officer. Abusive exercise of the above rights (Article 12 §5) may result in a reasonable fee being charged.
If you are not satisfied with our use of your data or with our response to the exercise of your rights above, you are entitled to lodge a complaint with the Hellenic Data Protection Authority.
You may exercise the above rights using the contact details given below.
15. CONTACT DETAILS OF THE CONTROLLER
For any matter concerning the processing of your personal data and to exercise your rights above, you can contact ErgoAlarm Defense by telephone on +30 2310 936 750 (Monday – Friday :00 – 16:00), by email at dpo@ergoalarm.gr, or by post at: 13 Stournara St., PC 546 32
16. CONTACT DETAILS OF THE DATA PROTECTION AUTHORITY
Telephone: +30 21064.75.600, email: contact@dpa.gr and postal address: 1-3 Kifissias Avenue, PC 115 23, Athens.
17. COOKIES
Cookies are important for the effective operation of the ErgoAlarm Defense site www.ergoalarm.gr and for improving your online experience.
What are cookies?
Cookies are small text files containing information that is stored in your computer's web browser while you browse www.ergoalarm.gr. These cookies can be removed at any time, as you can change your browser settings to reject some or all cookies. The help function in most browsers provides information on how to accept cookies, disable cookies or be notified when you receive a new cookie.
The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on its servers.
If you do not accept cookies, you may not be able to use some features of our Service, and we recommend that you leave them enabled.
The cookies used by our company are: Aspsessionid: Visit identifier – expires as soon as the browser is closed. Lang: So that the site remembers the language the customer has chosen – expires five months later. Sessionid: unique number for the customer's visit – expires 20 minutes after leaving the site. Google Analytics cookies are also used, and we suggest that you read Google's privacy policies.
18. LOG DATA & REMARKETING
We may collect information that your browser sends whenever you visit our website. This log data may include information such as your computer's IP address, browser type, browser version, the pages you visit, the time and date of your visit, the time spent on those pages and other statistics.
In addition, we may use third-party services, such as Google Analytics, that collect, monitor and analyse this type of information in order to improve the functionality of our website and our services. These third-party service providers have their own privacy policies regarding how they use this information, and we suggest that you read them.
ErgoAlarm Defense uses remarketing services to advertise on third-party websites after you visit our website.
The Google AdWords remarketing service is provided by Google Inc.
Google also recommends that you install the Google Analytics opt-out browser add-on – https://tools.google.com/dlpage/gaoptout – for your web browser. The Google Analytics opt-out browser add-on gives visitors the ability to prevent their data from being collected and used by Google Analytics
For more information on Google's privacy practices, please visit Google's website at http://www.google.com/intl/el/policies/privacy.
19. COMMERCIAL COMMUNICATION – NEWSLETTER
The visitor/user may visit the website www. ergoalarm.gr, which is maintained and managed by our Company, without revealing his or her identity and without providing any personal data, subject to acceptance of the relevant cookies (see above).
In general, you are not required to submit personal data to ErgoAlarm Defense online, but we may ask you to provide certain personal data in order to receive additional information about our services and our events. Our company may also ask for your permission for certain uses of your personal data, and you may either consent to or refuse these uses.
However, in order for the visitor/user to receive electronic informational material (e.g. Newsletters) sent by the Company, so as to be kept informed about matters in the security systems market, and to benefit in future from privileges offered by the Company, he or she may give explicit consent to registering for the services of the Website and to providing the Company with the details entered in the relevant contact form. You will be able to unsubscribe from the relevant mailing list at any time by following the instructions contained in every communication. If you decide to unsubscribe from a service or communication, we will try to delete your data as soon as possible, although we may need some time and/or information before we can process your request.
The personal data collected are stored on restricted-access servers controlled by passwords, and the Company uses special technologies and procedures to strengthen the protection of this information against loss or misuse and to protect it from unauthorised access, disclosure, alteration or destruction. However, although the Company makes every possible effort to protect the above data, it cannot guarantee that the above technologies and procedures will never be compromised in any way.
To this end, if any visitor/user becomes aware of any unlawful, malicious, inappropriate or unfair use of personal data in any way connected with the use of the Website, he or she undertakes to notify ErgoAlarm Defense immediately
20. ACCESS CODES
If we give you (or you have chosen) a password to access certain parts of our website or any other online portal, applications or services we offer, you are responsible for keeping that password confidential and for complying with any security procedure of which we have informed you. We ask that you do not disclose the password to any person.
21. LINKS TO OTHER WEBSITES
Our Service may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party's website. We advise you to review the Privacy Policy of every website you visit. We have no control over, and assume no responsibility for, the content, privacy policies or practices of any third-party sites or services.
22. UPDATING THE PRIVACY POLICY
This policy is revised whenever there is a significant change. The revision will be available on our website www.ergoalarm.com.
ANNEX 1: LEGAL BASIS FOR PROCESSING PERSONAL DATA.
Under Article 6 of the GDPR:
Processing is lawful only if and to the extent that at least one of the following applies:
(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes,
(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract,
(c) processing is necessary for compliance with a legal obligation to which the controller is subject,
(d) processing is necessary in order to protect the vital interests of the data subject or of another natural person,
(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,
(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Sensitive Personal Data:
Under Article 9 §1 & 2 of the GDPR, the processing of special categories of Data is permitted only in the specific cases laid down by law, among which is the giving of consent.
ANNEX 2: INDICATIVE CATEGORIES OF DATA
Identification Information:
* Full name
* Title (Mr/Ms)
* Date of birth
* VAT No.
* Identity Card Number
Contact information:
* Address
* Email
* Landline / mobile telephone number
* Fax
Professional Status Information:
* Occupation
* Income (for staff)
* Financial behaviour details
Payment Information:
* Bank Account Number / IBAN
* Preferred method of payment
* Credit/Debit Card Number
Identification data (Indicative):
* Customer number / code
* Contract number
Additional personal information / preferences (Indicative):
* Driving licence (category) (for staff)
* Insurance company that a customer may specify
* Preferred communication channel
Special Categories of Personal Data (Indicative):
* Medical History (for staff)
* Health Data (e.g. sick leave for staff)
Customer history (Indicative):
* Customer satisfaction rating (and further information from a satisfaction survey)
* Offers received
* Warranty information
* Complaints history
Application / website / social media data:
* If the customer has registered or logged in, the following data may be used:
* Website traffic
* Cookie data (subject to acceptance of the cookie policy)