Personal Data Processing Notice for suppliers, service providers and affiliates of doValue Greece

The controller of your personal data is doValue Greece, a special purpose Société Anonyme for the servicing of receivables deriving from loans and credits pursuant to the provisions of Greek law 4354/2015, duly authorised and supervised by the Bank of Greece (Decision no. 220/2017 of the Credit and Insurance Committee of the Bank of Greece, published in the Government Gazette’s Issue Β’ 880/16.3.2017).

This Notice is addressed to suppliers, service providers and affiliates of doValue Greece, as well as third parties related to the aforesaid persons, indicatively the personnel, partners, representatives, managers, executives, sub-contractors, assignees, vicarious agents etc., provided that their personal data are subject to processing for the purposes set out herein.

It is noted that, in case a supplier and/or service provider and/or affiliate is a legal person or entity, the current Notice is addressed to its representatives, agents, employees, partners and management bodies, whose personal data are subject to processing on behalf of doValue Greece in the context and for the purposes of the relevant agreement with doValue Greece.

This Notice may be supplemented by more specific notices and policies of doValue Greece, such as, indicatively, the Policy for the Protection of Personal Data of doValue Greece.

Α. Categories of personal data processed by doValue Greece

In view of the above, the personal data that doValue Greece collects and processes may indicatively be the following and not all of them necessarily concern you:

a. Identification data: name and surname, father’s name, mother’s name, identity card and identity card number (ID) or passport and passport number, tax identification number, competent tax authority, social security number, date and place of birth, citizenship, sex, photo, electronic identification data such as username, signature data, etc.

b. Communication data: postal address / registration seat details, e-mail address, telephone number (home and mobile), etc.

c. Occupation and professional skills: such as, indicatively, information included in submitted CVs and/or offers you submit, in documents and supporting documents, such as professional certifications, recommendations and/or contact information for the receipt of recommendations or their confirmation by third parties, as well as professional experience or activity data, data provided in your professional card, etc.

d. Data of financial behavior, in special cases where doValue Greece recognizes a high risk of fraud depending on the nature of the contract and the object of the services provided, and as provided by the applicable legal and regulatory framework.

e. Financial and invoicing data, including your bank account details.

f. Financial status and insurance data: indicatively, in cases where there is a legal representative of a general partnership or an individual business, income tax declarations and tax statements, insurance and tax clearance, non-bankruptcy and non-insolvency certificate, non-filing of insolvency petition on certificate, non-filing of application for suspension of payments certificate, debt data, etc., as provided by the current legal and regulatory framework and the policies of doValue Greece.

g. Data arising throughout the duration of your relationship with doValue Greece: indicatively communications/correspondence with doValue Greece or third parties in the context of your duties/activities, data concerning benefits/expenses, data concerning access to premises, systems, archives and any other related electronic equipment of doValue Greece etc.

h. Data collected through closed-circuit television from the premises of doValue Greece as well as data concerning access to premises, systems, archives and any other related electronic equipment (such as portable storage media) of doValue Greece or other companies of the Group to which doValue Greece belongs.

Β. Sources from which doValue Greece collects your personal data

doValue Greece collects your above personal data from the following sources:  

a. Directly from you or from third parties acting on your behalf (e.g. agents, authorized representatives etc.) or related to you. doValue Greece is not responsible for any illegal processing of your personal data by the above third parties.

b. From our employees, as well as from third-party service providers, suppliers and partners/affiliates of doValue Greece.

c. From publicly accessible sources.

It is noted that the above data can also be collected or verified from companies of the Group to which doValue Greece belongs or from third parties which provide or verify recommendations about you.

According to the GDPR, personal data should be updated and accurate. Consequently, you are obliged to inform doValue Greece about any change of the aforementioned personal data which have been transmitted to doValue Greece by you.

Furthermore, if you provide us with personal data of third parties, you are obliged to fully inform them in advance, including by reference to this Notice, and obtain their relevant consent, where required.

doValue Greece processes your personal data in the context and for the purposes of the execution of your agreement. In particular, doValue Greece processes your data for the purposes mentioned below:

A. For the execution of the agreement and the measures taken following your request prior to the conclusion of the agreement

The aforementioned processing of your personal data serves purposes, such as:

i. Your identification, the verification of your details and communication with you, including during both the pre-contractual and contractual stage.

ii. The management of the agreement with doValue Greece, as well as the execution, management and in general the smooth operation of the agreement with doValue Greece and the fulfillment of the mutual obligations thereunder.

B. For the compliance of doValue Greece with its legal obligations

doValue Greece processes your personal data to the extent necessary, in order to comply with the obligations imposed by the relevant legal, regulatory and supervisory framework, as well as the decisions of authorities (public, supervisory, independent, prosecutorial, etc.) or courts (regular or arbitral) and for the protection of persons and goods.

C. For legitimate interest purposes pursued by doValue Greece or third parties (indicatively, companies of the Group, affiliates etc.)

The processing of your personal data also serves purposes such as, indicatively:

• the establishment, exercise and defense of legal claims,
• the compliance with the policies of doValue Greece,
• the compliance with terms of contracts of doValue Greece with third parties,
• the security of IT systems and, in general, assets of doValue Greece and/or a third party,
• record keeping,
• protection of reputation,
• the prevention and deterrence of criminal acts or fraud against doValue Greece or a third party, etc.

This processing is subject to a balancing exercise that the interests and your fundamental rights and freedoms that require the protection of your personal data do not prevail over the legal interests of doValue Greece or those of the respective receivables entity.

In the context of processing your personal data, doValue Greece may transmit such data to the following recipients:

a. to the authorised employees, members of management/committees of doValue Greece in the context of their duties and to companies of the Group to which doValue Greece belongs.

b. to lawyers, law firms, court bailiffs, notaries, experts, accountants/auditors and providers of counselling services etc.

c. Companies for storage, archiving, management and destruction of files and data, providers of IT and maintenance services, providers of teleconference services, providers of electronic communications services, cloud computing, information society and postal services.

d. To supervisory, independent, judicial, prosecutorial, police, tax, public and/or other authorities or bodies, accredited intermediaries and centers of mediation services, arbitration courts and alternative dispute resolution bodies.

doValue Greece will not transfer your personal data directly to third countries or international organisations, unless such transfer is required by the applicable regulatory or legal framework.

If applicable, doValue Greece may transfer your personal data to third countries under the following circumstances:

i) Where the European Commission has decided that the third country, a territory or one or more specified sectors within that third country or international organisation ensure an adequate level of protection, or
ii) If appropriate safeguards have been provided from the recipient, in accordance with the national and European legislation.

In the absence of the abovementioned circumstances a transfer may take place if:

i) You have provided your express consent to doValue Greece; or
ii) the transfer is necessary for the performance of a contract between you and doValue Greece, such as for the execution of your orders, or
iii) the transfer is necessary for the establishment or exercise or defense of legal claims and rights of doValue Greece, or
iv) there is a relevant obligation arising from a legal provision or an international convention to which doValue Greece is subject. In order to fulfill such obligation, doValue Greece may transfer your personal data to competent national authorities so that such data are delivered through them to the respective authorities of third countries.

Your personal data shall be kept throughout your contractual relationship and your cooperation with doValue Greece and for the time period which is deemed necessary under the relevant legal and/or regulatory framework and in any case, your personal data shall be kept until the fulfillment of the general limitation period set by the law, i.e. until the lapse of twenty (20) years from the -by any means- termination of your cooperation with doValue Greece.  

If there is ongoing litigation with doValue Greece, the maintenance period of the personal data shall be extended until the issuance of an irrevocable court decision.

Also, very few necessary personal data of yours (indicatively, identification data, data included in the minutes of the management bodies of doValue Greece etc.) may form part of the historical archive of doValue Greece and therefore shall be kept throughout the time period of maintenance of such archive.

i) Right of access to your personal data that are retained and processed by us, as well as to information concerning the processing thereof (origin of the data, purposes of processing, categories of recipients, storage period).

ii) Right to rectification of your personal data, in the event of inaccurate data or for the purposes of completing incomplete personal data by providing any necessary document justifying the need for rectification or supplementation.

iii) Right to object on grounds relating to your particular situation unless the processing is necessary for the purposes of the legitimate grounds of doValue Greece or a third party.

iv) Right to restriction of processing of your personal data where the accuracy of the personal data is contested by you or the processing is unlawful or doValue Greece no longer needs your personal data for the purposes of processing, or you have objected to the processing and the verification whether the legitimate grounds of doValue Greece override yours, is pending.

v) Right to erasure of your personal data from doValue Greece’s records.

Please note indicatively the following in relation with your above rights:

• doValue Greece has in any case the right to reject your request for restriction of processing or erasure of your personal data if the processing or storage thereof is necessary for the exercise of doValue Greece’s rights or the fulfillment of the obligations of doValue Greece towards you as well as the establishment, exercise or defence of legal claims of doValue Greece or the compliance of doValue Greece with its legal obligations.
• doValue Greece also has in any case the right to refuse the erasure of your personal data, where such data cannot be erased for record keeping and filing purposes.
• The exercise of the rights above is valid for the future and does not affect the processing already performed on your personal data

For the exercise of your rights, you may address your relevant requests in writing, to the Customer Service and Complaints Management Unit of doValue Greece, 27 Kyprou & Archimidous Streets, 18346 Moschato, Greece or via email at [email protected].

doValue Greece shall use its best endeavors to address your request within thirty (30) days from its submission. The above mentioned period may be extended by two (2) further months, if deemed necessary at reasonable discretion of doValue Greece, taking into account the complexity and number of requests. doValue Greece shall inform you in case of such extension within one month from the receipt of the request.

The above mentioned service is provided by doValue Greece free of charge. However, where requests are manifestly unfounded, excessive or repetitive, doValue Greece may, after informing the person who has submitted the request, either charge a reasonable fee or refuse to act on the request/requests.

You may contact the Data Protection Officer of doValue Greece for any matter regarding the processing of your personal data, in writing at 27 Kyprou & Archimidous Streets, 18346 Moschato, Greece or via email at [email protected].

You have the right to lodge a complaint before the Hellenic Data Protection Authority for any matter regarding the processing of your personal data.

For the respective competence of the Authority and the procedure to be followed for filing a complaint, you may visit the Hellenic Data Protection Authority website (Citizen Rights > Complaint to the Hellenic DPA), where detailed information is available.

doValue Greece implements appropriate technical and organisational measures to ensure the lawful protection and processing, as well as the effective protection of your personal data from unauthorised access to, disclosure of, processing, loss, alteration, accidental or unlawful destruction or corruption, prohibited transmission by third parties as well as any other form of unlawful processing.

p>doValue Greece may in accordance with its applicable policy on the protection of personal data and pursuant to the applicable legal and regulatory framework, modify or amend this Notice, the updated version of which will always be posted on the  doValue Greece website at www.dovaluegreece.gr.

Last update: 10 July 2021