Deloitte Greece Website Privacy Notice

1.  What is the purpose of this document?

Deloitte Greece Entities (hereinafter referred to as “Data Controller” or “we” or “us”) are committed to protect your privacy and processing your data in a clear and transparent manner.

This privacy notice is intended for the Deloitte Greece website, designated as “Greek” in the upper right-hand corner with a URL commencing “http://www.deloitte.com/gr” (“Deloitte Site” or “this Site”), whilst it does not apply to other websites that could potentially be accessed by clicking from external URLs. We encourage visitors to review the privacy notice on each of these other websites before disclosing any personal data.

Specifically, this privacy notice applies to each of the Greek legal entities belonging to the Deloitte network (the Deloitte network being Deloitte Touche Tohmatsu Limited, a UK private company limited by guarantee (“DTTL”), together with its member firms and their respective subsidiaries, affiliates and other firms with which it constitutes a network called the “DTTL network”), as described in detail in the next section.

Each Greek Deloitte entity is a separate and independent legal entity, and this privacy notice applies to each separately. None of the GreekDeloitte entities have any liability for the other entities’ acts or omissions.

This privacy notice describes how we process personal data about you while browsing Deloitte Site, in accordance with (a) the General Data Protection Regulation (GDPR); (b) national law 4624/2019, as applicable, and any other applicable data protection laws and regulations. It provides information on the nature of the personal data collected by the Data Controller, the purposes of the processing and indicates your rights in relation to the data processed and who to contact for further information or to send any requests. 

In particular, this privacy notice sets out how we will collect, handle, store and protect information about you when:

• Providing services to you or our clients;
• You use our website; 
• Performing any other activities that form part of the operation of our business, as described in further detail below.

We may also prepare a specific privacy notice that we shall invite you to refer to, in relation to certain services or in the context of personal data collection forms (e.g., when sending applications for job positions).

Protecting the privacy of minors is extremely important for us. Please be aware, however, that this Site and our services are not directed to minors. It is not our policy to collect or retain such data. 

2.  What is the identity and contact details of the Data Controller?

The Data Controller is each Greek Deloitte entity, and more specifically:

1. “Deloitte Business Solutions Societe Anonyme of Business Consultants” with the distinctive title “DELOITTE BUSINESS SOLUTIONS S.A.”,
2. “Deloitte Certified Public Accountants Societe Anonyme” with the distinctive title “DELOITTE.”, and
3. “Deloitte Alexander Competence Center Single-Member Societe Anonyme of Business Consultants” with the distinctive title “DACC S.A.”

DELOITTE BUSINESS SOLUTIONS S.A. and DELOITTE. are based in 3a Fragkokklisias & Granikou str., Marousi, Athens, P.O. 151 25.   DACC S.A. is based in Pempti and Triti 6th Industrial Area Block of Technopolis Thessaloniki, Municipality of Pylaia Chortiatis, D.E. Pylaia, P.E. Thessaloniki.

3.  What are the contact details of the Data Protection Officer?

The Data Protection Officer can be contacted at the following e-mail address: DataPrivacyOfficer@deloitte.gr.

4.  Which data do we collect about you and for which purposes?

We may collect personal data from users while browsing this Site or when requesting the activation of certain services through the appropriate forms / data collection forms.

The personal data collected by the Data Controller could include: 

• Name, surname, age, date of birth, gender, telephone number, e-mail address, residential address, country of residence; 
• Job position, company / organization for which you work, professional title; 
• IP address browser type and language, access time, complaint details;
• Details of how you like to interact with us, and other similar information relevant to our relationship;
• Any other personal information which you may provide to us for the purpose of receiving our services and/or using our products;
• Your postings on any blogs, forums, wikis and any other social media applications and services that we provide;

We may also acquire information about users by obtaining it from the interaction patterns carried out on the Site. For example, to improve the experience of using this Site and ensure its proper functioning, we (or our service providers) may use cookies (small text files installed in the user's browser) and a web beacon that collects personal data. Further information on how we use cookies, and how to manage them can be found in the Cookie Notice at the following link.

In exceptional cases, we could also process special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs). However, if this should occur, we will request the user's explicit consent to collect and use such information.

Personal data provided to us could be used for the following purposes:

a)    To enable the navigation of this Site, customize or improve the Website and the related services offered to you;

b)   For the performance of services requested and the management of activities instrumentally related to such services;

c)   To send insights, opinions, updates, reports on topical issues or details of our products and services that we think might be of interest to you, to contact you to invite you to events, seminars, briefings, and business development purposes. You can find more information about the processing of personal data in the context of our marketing activities in our “Privacy Notice for Marketing & Communications”;

d)   To fulfil legal obligations and/or to comply with requests from Authorities, public entities, and organizations.

e)   To exercise rights, including those of third parties, in court and, where applicable, in administrative proceedings or arbitration or conciliation procedures.

In relation to the above-mentioned purposes, please refer to paragraph 10 to find out which rights you can exercise.

5.  What is the legal basis on which we process your personal data?

We will use your personal data for the purposes indicated above on the assumption of the following conditions of legitimacy (legal basis): 

• With reference to the purpose (a) of par. 4, our legitimate interests in ensuring the proper function and management of this Site, including the optimal performance of the Site and the related services offered to you;
• With reference to the purpose (b) of par. 4, our legitimate interests in the effective delivery of our services to our clients;
• With reference to the purpose (c) of par. 4, the user's consent to receive this kind of information. In cases where the requirements of Law 3471/2006, as in force, are met the legal basis is our legitimate interest to promote our services. For detailed information please refer to our “Privacy Notice for Marketing & Communications”, which is always available on this Site; 
• With reference to the purpose (d) of par. 4, our compliance with legal obligations to which we are subject;
• With reference to the purpose (e) of par. 4, our legitimate interests in the exercise or defence of our legal rights.

As for the purpose (c), the communication of personal data is optional, and its refusal will have no consequence on the services requested.  

6.  Who has access to your personal data and to whom is it disclosed?

Your personal data will not be published, exposed, or made available and / or consulted by indeterminate subjects. 

In connection with one or more of the purposes set out in the paragraph 4, we may disclose information about you to:

• Companies belonging to the Deloitte Network for the performance of internal administration activities;
• Third parties delegated and/or appointed by us and/or the Deloitte Network for the performance of activities or part of the activities related to the provision of the services requested or to the navigation of this Site (e.g., companies that provide IT services, management, and maintenance of this Site); 
• Competent authorities (including courts), for the performance of their institutional functions within the limits established by laws or regulations;
• Third parties for the installation of cookies as described in the Cookie Notice of this Site.

Your data will be communicated to these third parties after being appointed as Data Processors or recognized as autonomous Data Controllers and will be processed by collaborators and/or employees of Deloitte in the context of their respective functions and in accordance with the instructions given by Deloitte itself. 

7.  Are your data transferred abroad?

If necessary for the purposes stated above, the data collected may be transmitted or made accessible to other companies in the Deloitte       Network, to entities that provide services to us and/or the Deloitte Network (e.g., vendors, suppliers), to competent authorities (e.g., courts, tax authorities, regulatory authorities) including those based in third countries, outside the European Economic Area (EEA). Third parties to whom your personal data are transferred, are bound by specific agreement and are required to keep your data securely. 

In such cases, we guarantee that the transfer will take place in accordance with the provisions of Chapter V of the GDPR through the adoption of appropriate safeguards that ensure a level of data protection in accordance with the obligations to which we are legally bound, such as, Standard Contractual Clauses, Binding Corporate Rules, other applicable legal basis or based on a statutory exemption (e.g. if you have given your consent to the transfer, if the transfer is directly connected with the conclusion or performance of a contract with you or if the transfer is necessary for the establishment, exercise or enforcement of legal claims before a foreign authority).

If you have any questions about this, please contact us at DataPrivacyOfficer@deloitte.gr.

8.  What is the data retention period, or if not possible, the criteria used to determine it?

The information systems and computer programs used by us are configured in such a way as to minimize the use of personal data. 

We will retain personal data on the basis of the following criteria: 

•  With reference to the purposes (a), (b) and (e) of par. 4, for the period necessary to fulfill the purpose of processing, and more specifically to allow navigation of this Site and perform any required customization and improvement therein, to provide the requested service(s) and to exercise or defend our legal rights;
• With reference to purpose (c) of par. 4, until the consent is withdrawn or the right to object to processing for marketing purposes is exercised;
• With reference to the purpose (d) of par. 4, for the duration established by legal provisions, including those provided for the protection of our rights or third parties in the event of litigation or defensive investigations.

9.  How do we protect and safeguard your personal data?

We will process your data with the utmost care and respect. 

Your personal data are processed with the aid of electronic tools, ensuring the use of appropriate measures for the security of the processed data and guaranteeing their confidentiality, in accordance with the principles applicable to the processing of personal data pursuant to Article 5 of the GDPR, such as lawfulness, fairness and transparency, purpose limitation, data minimization, accuracy, storage limitation, integrity and confidentiality. These measures can include:

• The training and updating activities of its staff ensuring that they are informed about privacy obligations if they have access to and process personal data;
• Administrative and technical controls in order to limit access only to personal data that need to be known in relation to the purposes of the processing; 
• Technical security measures (e.g., firewalls, cryptography, antivirus software); 
• Physical security measures. 

In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality. 

We have put in place procedures to deal with any possible data breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so. Third parties will only process your personal data where they have agreed to treat the data confidentially and to keep it secure in compliance with the applicable law.

10.   What are your rights and how can you exercise them?

In relation to the processing of your personal data, you have specific rights [Art. 15 to 21 of the GDPR]:

• Access: you can ask for confirmation as to whether or not a certain processing of data concerning you is in place, as well as further clarifications about the information referred to in this privacy notice; 
• Rectification: you can ask to rectify or supplement the data you have provided to us, if inaccurate;
• Erasure: you can request that your data be deleted, if they are no longer necessary for our purposes, in case of withdrawal of consent or your opposition to the processing, in case of unlawful processing, or there is a legal obligation to erase them;
• Restriction: you can request that your data be processed only for the purpose of storage, with the exclusion of other processing activities, for the period necessary for the correction of your data, in case of unlawful processing for which you oppose the cancellation, if you have to exercise your rights in court and the data stored by us may be useful to you and,  finally, in the event of opposition to the processing and a review is in progress on the prevalence of our legitimate reasons over yours;
• Object: you can object at any time to the processing of your data, unless there are our legitimate reasons to proceed with the processing that prevail over yours, for example for the exercise or our defence in court;
• Withdrawal: you may revoke your consent at any time, in all cases where consent is the legal basis for processing, by sending an email to our DPO at: DataPrivacyOfficer@deloitte.gr. Withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.
• Portability: you can ask to receive your data, or to have them transmitted to another Data Controller indicated by you, in a structured format, commonly used and readable by automatic device.

Processing activities are carefully evaluated to ensure a fair balance between your rights, which are assessed on a case-by-case basis (e.g., by considering the respective legal basis in each case and the purposes of the processing) and our interests. To exercise these rights, you can contact our Data Protection Officer by sending an e-mail to DataPrivacyOfficer@deloitte.gr.The time limit for Deloitte Greece Entities to address your request is 1 month, which may be extended up to 2 further months in cases of particular complexity. 

We also inform you that you have the right to lodge a complaint with the Hellenic Data Protection Authority, by following the instructions found on the HDPA’s website.

11.   Changes to this Privacy Notice

We may modify or amend this Privacy Notice from time to time at our discretion. When we make changes to this notice, we will amend the revision date at the top of this page, and such modified or amended Privacy Notice will be effective from that revision date. We therefore invite you to regularly consult our Privacy Notice in order to stay up to date with any changes made since your last consultation.