Information and Consent Notice for the Processing of Personal Data of Special Categories

doValue Greece collects directly from you or through your legal representatives or your authorized persons, personal data of special categories related to your health (such as physical and mental condition, disabilities, medical history, other health data) and/or your dependent family members.

doValue Greece collects and processes the above personal data of special categories within the framework and for the purposes of application of the procedures of the Bank of Greece Code of Ethics (Decision no. 195/1/29.07.2016 of the Bank of Greece Credit and Insurance Committee, as applicable and in force), processing and evaluation of requests submitted by you for settlement of debts and addressing complaints, as well as in the context of examination and regulation of the frequency of your telephone calls to inform you about your debt.

doValue Greece processes this personal data of yours after you have previously given your explicit consent to the intended processing, by signing the Consent Statement for the Processing of Personal Data of Special Categories.

We note that, in any case, you have the right to withdraw your consent at any time. The withdrawal of your consent shall not affect the lawfulness of processing based on your consent provided before its withdrawal.

Recipients of all or part of the above personal data of special categories may be in addition to you and/or your legal representatives and the persons authorized by you, as the case may be, the following:

i. The respective receivables entities (other controllers), i.e. the credit or financial institutions and/or the receivables acquiring entities of article 1 par. 1 (b) of L.4354 / 2015, as in force, and/or special purpose entities in the context of receivables securitization according to article 10 and 14 of Law 3156/2003 (SPVs).

ii. The (natural or legal) persons to whom doValue Greece entrusts the execution of specific works on its behalf and who act as processors of the personal data. In this context, your personal data may be transferred, indicatively and not restrictively:

1.  To service providers (affiliated companies and third parties) who carry out personal data processing operations, such as data storage providers, archiving, file management and destruction service providers, providers of IT products and/or services and/or all kinds of IT, electronic systems and networks support, including online systems and platforms, as well as providers of other supporting functions for the activities of doValue Greece (cooperating service networks, receiving and processing requests, providing internal support services, etc.).
2. To security companies.

iii. Lawyers, law firms, bailiffs.

iv. The Bank of Greece and other supervisory, governmental, administrative, independent, judicial, prosecutorial, public and/or other authorities or bodies or parties, which have been entrusted with the control or supervision of the activities of doValue Greece within the scope of their responsibilities as well as third parties, if the transmission or notification is required by law or a court decision.

v. The specially authorized employees of doValue Greece, who are responsible for the processing of your personal data within the exercise of their duties as well as the members of the administration of doValue Greece in the context of their duties.

vi. Other servicing companies of article 1 par. 1 (a) of L.4354/2015, as applicable and in force, either at the suggestion of the respective receivables entities or in the context of managing a settlement request.

doValue Greece keeps the above personal data for six (6) years after the end of your relationship with doValue Greece, unless otherwise provided by the applicable legal and regulatory framework for the observance of the legal obligations or for the establishment, exercise or support of legal claims of doValue Greece and/or the receivables entity.

Especially in case of legal dispute with doValue Greece and/or the respective receivables entity or administrative dispute, the aforesaid retention period will be extended until the issuance of an irrevocable court decision.

According to the provisions of GPDR, you have the following rights:

i. Right of access of your personal data kept and processed by doValue Greece, as well as to information related to their processing (origin of data, purposes of their processing, categories of their recipients, the time of their storage).

ii. Right of rectification of your personal data, in case of any inaccurate data or in case of need to complete incomplete data, submitting any necessary document from which the need for correction or completion arises.

iii. Right of objection for reasons related to your particular situation, in case the processing is necessary for the purposes of the legal interests pursued by doValue Greece or a third party.

iv. Right to restrict the processing of your personal data, if you dispute their accuracy or the processing is illegal or doValue Greece does not need your personal data for processing purposes or you have exercised a right of objection and the verification of the legal reasons of doValue Greece is pending prevail over your reasons.

v. Right to erasure of your personal data from the files we keep.

vi. Right to the portability of your personal data to any other controller, provided that the processing is based on your consent or contract and is carried out by automated means.

Please note the following in relation to your above rights:

i. The right of access may not be satisfied in whole or in part, as the disclosure of the data would jeopardize national defense, national security and public safety, they may not be deleted due to legal or regulatory provisions, they serve only purposes data protection, the provision of information would require a disproportionate effort and the necessary technical and organizational measures would make it impossible to process for other purposes.

ii. Your rights of objection, restriction of processing and erasure (above iii, iv and v, respectively) may not be satisfied in whole or in part, as they relate to data necessary for the continuation of the contract regardless of the source of collection.

iii. doValue Greece has in any case the right to refuse your request for restriction of processing or deletion of your personal data (above under iv and v, respectively), if the processing or storage of data is necessary for the establishment, exercise or support rights of doValue Greece or the respective bodies of claims or for the fulfillment of obligations of doValue Greece. In particular, your right to erasure your data may not be satisfied if your data is processed without automated means, since due to the special nature of storage it is not possible to delete or it is only possible with a disproportionately large effort, taking into account that your interest in erasure is not considered significant or if the erasure is in conflict with compliance periods set by law or contract.

iv. The exercise of the right to portability (above under vi) does not imply the erasure of the data from the files of doValue Greece, which (erasure) is under the terms of the immediately preceding paragraph.

v. The exercise of the above rights acts for the future and does not affect the processing of data that has already been performed.

To exercise your rights, you can contact the Customer Service and Complaints Management Unit of doValue Greece, 27 Kyprou 27 and Archimedes, 18346 Moschato, or by e-mail at [email protected].

You may contact the Data Protection Officer of doValue Greece for any matter regarding the processing of your personal data, in writing at 27 Kyprou & Archimidous Streets, 18346 Moschato, Greece or via email at: [email protected].

You have the right to lodge a complaint before the Hellenic Data Protection Authority for any matter regarding the processing of your personal data.

For the respective competence of the Authority and the procedure to be followed for filing a complaint, you may visit the Hellenic Data Protection Authority website: www.dpa.gr (My Rights > Complaint to the Hellenic DPA), where detailed information is available.

doValue Greece implements appropriate technical and organizational measures for the legal collection and processing, as well as for the effective protection of your personal data from unauthorized or illegal processing, loss, alteration, accidental or unlawful destruction or damage, prohibited dissemination or access of third parties to these and any other form of unfair treatment.

To provide your consent to the processing of your personal data of special categories, you can fill in the relevant Consent Statement for the processing of Personal Data of special categories.