PPA has its headquarters in Patras, Port Services Building, South Port of Patras, P.O.C. 26333.As the successor legal form of the Patras Port Fund, as it emerged after the enactment of Law 2932/2001, it is a single shareholder company of the State, subject to the State Property Management Agency (2996/12-11-2012). The structure, management and general operation of the Organization is governed by the Statute of Law 2932/2001 as it has since been amended (Government Gazette 2828B/11-08-2017), and additionally by Law 2190/1920.

This statement covers the collection of personal data by PPA in the development of its business, including its presence on third party websites, platforms and applications under our Website Terms of Use.

Please note that during your visit to the PPA website, simple data related to your interaction with the website and the installation of cookies are collected (see relevant Cookies Policy). Third-party websites generally apply their own privacy statements and terms and conditions. We invite you to read them before using these websites.

We may collect personal data from various sources, i.e:

• Personal data given to PPA directly by the subjects, for one of the following reasons:

1. 1. Information that you provide to us at the conclusion, development and termination of the contractual relationship between us.
   2. Information you give us when you contact us or make a request.
   3. Information you give us when you subscribe to the PPA newsletter.

• We also receive personal information indirectly in the following cases:

1. Information we collect during the operation of closed circuit video surveillance (CCTV) at our organisation’s premises.

• We also receive and store certain types of personal data whenever anyone interacts with us online, i.e. when we use cookies and tracking technologies to obtain personal data and also when the web browser used by the internet user accesses our website or our listings, as well as other content displayed by or on behalf of PPA on other websites.

Personal Data means any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one whose identity can be established, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.

Due to the nature of our Organization’s activities, the Personal Data it collects mainly concerns the following categories of subjects:

• PPA employees: i.e. their personal data and data relating purely to their employment relationship with our Organization, which include, but are not limited to, identification and contact details, financial data and health data of the same or additional members related to our Organization’s compliance with labour and insurance legislation.
• Candidates for recruitment: i.e. personal data and information relating to their assessment as candidates and to their recruitment procedures by the Agency, including indicative identity and contact details, as well as information from the candidates’ professional CVs.
• PPA’s partners (suppliers and other partners in general): i.e. their personal data and data related to the contractual relationship between us, which include, but are not limited to, identification and contact details, transaction data and financial data related to our Organization’s compliance with its legal contractual obligations.
• PPA’s Interactors (generally persons who communicate with our Organization or we communicate with them): i.e. their personal data and data relating to the contractual relationship between us, if any, or used for their communication with our Organization, which include indicative identity and contact details, transactional data and financial data related to our Organization’s compliance with its legal contractual obligations.

Furthermore, Personal Data may be collected from natural persons entering PPA and its premises during the operation of the closed circuit video surveillance (CCTV), for reasons of security of persons and property.

Please note that we do not collect special categories of personal data, other than the health data mentioned herein, such as personal data concerning race, national origin, religion, sexual orientation or genetic biometric data, etc., which are categorized as special categories of data and receive additional protection under European personal data protection legislation.

Children’s personal data may be collected exclusively in the context of our employees’ employment relationship, i.e. on the one hand for the description of the employees’ family situation for matters of remuneration, employment rights, etc. and on the other hand for the inclusion of minors/additional members in the group insurance policy provided to the employees and for the purpose of servicing the insurance contract in question. It is understood that this information is provided with the consent of the person having parental responsibility for the child (see also below).

The purpose of the processing is proportionate to the function performed. In particular:

• The personal data of employees are provided to PPA for the purpose of concluding, executing or terminating the respective employment/co-operation contract. In addition, employees’ personal data relating to attendance, absences, hours of attendance, leaves, medical documentation for sick leave, are kept for the purpose of granting leaves, including sick leave, while personal data relating to employee performance are provided by the heads of the individual departments for the purpose of personnel evaluation by PPA.
• The personal data of the candidate employees, which they provide during the individual stages of selection and evaluation of candidates, are disclosed to the competent Department of the Agency and to the Management, for the purpose of informing PPA, evaluation, interviews, etc. for the recruitment of employees and the conclusion of cooperation.
• The personal data of our partners and generally of those who deal with PPA, which they provide to our Organization, are collected and processed for the purpose of the conclusion and development of the contractual relationship between us, our compliance with our legal contractual obligations and, where applicable, our communication with them at their request.
• Surveillance of the entrance and the rest of the facilities is also carried out byCCTV cameras . Anyone entering the premises (employee or visitor) is informed in an appropriate, visible and comprehensible manner (signs) of their entry into a closed-circuit television monitored area for security reasons and protection of persons, goods and critical infrastructure and of other legal requirements.

The collection and processing of personal data of the above subjects is based on:

(a) no. 6 par. 1 para. b GDPR: in the preparation and performance of a contract,

b) no. 6 par. 1 para. The processing is necessary for compliance with a legal obligation of the controller, where applicable with the legal framework of the operation of our Organization (Law 2932/2001, Government Gazette 2828B/2017, Law 2190/1920) and in general with all national and European legislation, where applicable.

c) no. 6 par. 1 para. f GDPR: processing is necessary for the purposes of the legitimate interests pursued by the controller, in this case for our communication with you

(d) no. 6 par. 1 para. e) GDPR: Processing necessary for the exercise of official authority vested in our Agency

(e) no. 9 par. 2 para. b GDPR: Processing necessary for the performance of the obligations of the controller and the exercise of specific rights of the controller or the data subject in the field of labour law and social security and social protection law (Art. 9(2)(b) GDPR)

(f) no. 6 par. 1 para. d) GDPR: The processing is necessary to safeguard the vital interest of the data subject or another natural person (in the case of CCTV surveillance of our Agency’s premises for the protection of persons moving within the port, in conjunction with our legitimate interest in this regard)

The Agency does not use personal data for profiling.

The period of retention of personal data depends primarily on the purpose of the processing, and the mere retention of personal data constitutes a processing operation, which is only allowed if it is governed by the processing principles. After the retention period has expired, the personal data are deleted. In particular:

• The personal data of candidate employees are kept electronically on a mailserver and fileserver, to which the H.R. department and the Management of the Agency have access, for a period of two years from the completion of the selection – recruitment process. Retention is due to possible re-evaluation of candidates by the Agency.
• The personal data of employees , i.e. those who have already drawn up an employment contract with PPA, are kept in a physical file and on a fileserver by the H.R. department, initially for as long as the employment relationship lasts. After the termination of the employment relationship, for whatever reason, the relevant data are kept for a maximum of twenty years (indicative limitation period for any resulting legal claims), during which period any legal case for processing them is likely to arise, such as, for example, in the event of a civil case or investigation of a criminal offence where an employee is likely to be involved, a tax audit, etc. The immediately above also applies with respect to data on corporate assets provided to employees, access to electronic and physical files and work areas and corporate mobile phones for the purpose of performing the employment contract. They also apply with regard to personal data concerning the granting of leave to employees (attendance, absences, hours of attendance, leave, medical documentation for sick leave) and the evaluation of staff.
• The personal data of PPA’s partners are kept in a physical file and on a fileserver by the H.R. department, in principle for as long as the contractual relationship between us lasts. After the termination of the contractual relationship, for whatever reason, the relevant data are kept for a maximum of twenty years (indicative limitation period for any resulting legal claims), during which period it is possible that any legal case of processing of such data may arise, such as, for example, in the event of a civil case or investigation of a criminal offence, a tax audit, etc.
• Personal data of employees and visitors derived from a closed circuit video surveillance systemoperating in the premises, including the entrance and selected work areas, shall be kept for fifteen (15) days on a CCTV recorder, subject to more specific provisions of the legislation applicable to specific categories of controllers. In the event of an incident relating to the purpose of processing, the controller shall be allowed to keep the recordings in which the incident in question has been recorded in a separate file for three (3) months. After this period, the controller may keep the data for a longer specified period only in exceptional cases where the event requires further investigation. In this case, the controller shall be obliged to inform the Authority of the necessary period of time to keep such downloads.

The processing of your personal data is also linked to your respective rights, which, subject to any provisions that may limit the exercise of these rights, are:

The processing of your personal data is also linked to your respective rights, which, subject to any provisions that may limit the exercise of these rights, are:

• Right to information: you have the right to receive clear, transparent and understandable information about how we use personal data and what your rights are. To this end, we provide you with the information in this Privacy Notice – Privacy Policy and encourage you to contact us to provide any clarifications.
• Right of access: you can ask us to correct or complete your data if it is incomplete or inaccurate.
• The right to rectification: you can ask us to correct or complete your data if it is incomplete or contains inaccuracies.
• The right to portability of your data: You may request that we provide or transfer to a third party provider in electronic format certain information you have provided to us.
• The right to erasure. In certain cases, you can request the deletion of all or part of your data (e.g. if the data is no longer necessary for the purposes for which it was collected, etc.).
• The right to restrict processing. You have the right to restrict the processing of your personal data.
• The right to withdraw consent. If you have given your consent to the processing of your personal data, you have the right to withdraw your consent at any time by contacting us at the details provided herein.
• The right to object: you can object to the processing of your data carried out in the pursuit of our legitimate interests as set out above.
• The right to lodge a complaint with the Personal Data Protection Authority. You have the right to complain directly to the local supervisory authority, the Personal Data Protection Authority, about how we process your personal data.
• Rights related to automated decision-making. You have the right not to be subject to a decision based solely on automated processing that has legal or other significant consequences for you. In particular, you have the right to:
  • interfere with human intervention,
  • to express your opinion,
  • get an explanation for the decision that resulted from an assessment, and
  • to challenge this decision.

In the event of the exercise of one of your above rights, we will take all possible measures to comply with your request within a reasonable period of time and at the latest within (1) month from the identification of your submitted request, informing you in writing about the compliance with your request, or the reasons that may prevent the exercise of the relevant right, or the compliance with one or more of your rights, in accordance with the General Data Protection Regulation. Please note that in certain cases it may not be possible to meet your relevant requests, such as where the fulfilment of the right would be contrary to a legal obligation or would conflict with a contractual legal basis for processing your data.

However, if you believe that any of your rights or legal obligations of PPA regarding the protection of Personal Data have been violated and you have previously contacted the Data Protection Officer (DPO) of the Agency on the relevant issue, i.e. you have exercised your rights to PPA and either you have not received a response within one month (extended to two months in case of a complex request), or you consider that the response you have received from the Agency is not satisfactory and your issue has not been resolved, you may submit a complaint to the competent supervisory authority, i.e. the Data Protection Authority (DPO), L. Kifissias 1-3, TK 115 23 Athens, email: complaints@dpa.gr, fax 2106475628.

We have taken appropriate organisational and technical measures to protect your personal data from misuse, interference, loss, unauthorised access, modification or disclosure. The measures we use include implementing appropriate measures in access control, technical security of information as well as ensuring that personal data is encrypted, pseudonymised and rendered anonymous where necessary and feasible.

Access to your personal data is allowed only to our competent employees and associates and only if necessary to support the activity of our Organization, and is subject to strict contractual confidentiality obligations when it is entrusted and processed by third parties.

You can contact us at our head office address in Patras, Patras, Port Services Building, South Port of Patras, P.O. Box 26333 or at the email address info@patrasport.gr or submit a request via the Contact form on our website.

This statement will be revised as necessary to adapt to legislative changes, to respond to the comments and needs of the data subjects and to changes in our products, services and internal processes. Any changes will be published with a simultaneous revision of the last update date at the top of this Statement – Privacy Policy.