Privacy Policy

1.1. GSM PaperMill ΕΛΛΗΝΙΚΗ ΧΑΡΤΟΠΟΙΙΑ ΚΑΙ ΚΥΛΙΝΔΡΙΚΗ ΣΥΣΚΕΥΑΣΙΑ ΜΟΝΟΠΡΟΣΩΠΗ Α.Ε. (hereinafter the “Company” or the “Data Controller”) shall process the Personal Data that you have provided through the website (hereinafter referred to as the “Website”) in accordance with the applicable data protection and privacy legislation in force (General Data Protection Regulation (GDPR) 679/2016, Greek Law 4624/2019) and this privacy policy.

The Company, by determining the means and purposes of the processing, acts as Data Controller, in accordance with the definition set out in the GDPR. For matters relating to the protection of personal data, you may get in touch using the following email address: info@gsm-papermill.gr

Depending on the manner in which the Website is used, the Company may process the following categories of personal data:

A. Contact Data

When you contact the Company through the Website or through the contact details provided, we may process personal details and contact details such as: first name, surname, email address, telephone number and the content of the message you sent, as well as other Personal Data that you may have provided in the course of the communication. We shall process such Personal Data where you submit requests, request information or send us communications of any kind.

The processing of the data is necessary for the handling of and response to your requests, including enquiries regarding the products and activities of the Company.

The legal basis is, as the case may be, the legitimate interest of the Company in communicating with interested parties and business partners (Article 6(1)(f) GDPR) or the taking of steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR).

The provision of any further Personal Data by you is entirely optional. We advise you not to disclose sensitive personal data, while in any event the disclosure of personal data of third parties is prohibited, in particular without their knowledge and consent. In such a case, the Company bears no liability.

B. Browsing and Technical Operation Data

During your visit to the Website, certain technical data, such as the IP address, the date and time of access, browser information and technical log files, may be collected by the information technology systems and software procedures used for the operation and use of the Website, which are made available by the Company. The purpose of the processing is to ensure the operation, stability and security of the Website, as well as to address technical problems or security incidents.

This transmission is inherent in the use of internet communication protocols or is useful for the better management and optimisation of the data transmission system and of the email system.

The legal basis is the legitimate interest of the Company in the secure and effective operation of the Website (Article 6(1)(f) GDPR).

Where you express an interest in employment with the Company, the data contained in the curriculum vitae and/or in the related expression-of-interest message that you send us are processed.

We shall process the data that you submit to us in the context of expressing interest in filling a specific job position, in order to take steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).

The Company may process personal data for direct marketing purposes, in accordance with the GDPR (EU) 2016/679, Law 3471/2006 and the legislation in force from time to time. Article 11 of Law 3471/2006 applies to telephone calls with human intervention. Such calls are made in accordance with the applicable objection (opt-out) system and in compliance with the relevant registers and objections. For electronic communications (for example, email and SMS), the Company will obtain prior consent where this is required by the applicable legislation.

As a data subject, you have the right, pursuant to Article 21 GDPR, to object at any time and free of charge to the processing of your data for direct marketing purposes.

Where the option to subscribe to a newsletter is offered in the future, the Company will process the email address in order to send updates regarding its products and activities, on the basis of your consent (Article 6(1)(a) GDPR). You may withdraw your consent at any time, via the relevant link in the messages or by contacting the Company.

In order to achieve the purposes described above, the Company may need to disclose the Personal Data to third parties in Greece as well as abroad, in order to perform the Contract, to fulfil legal obligations or to carry out activities that are essential for the provision of the services requested.

Your Personal Data may be made available for the above purposes to:

• a) employees and contractors of the Company, as persons authorised to process personal data,
• b) external service providers, such as providers of hosting and technical support for the Website, where used, as well as competent public or judicial authorities where this is provided for by law.
• c) third-party companies or other entities or natural persons performing outsourced activities on behalf of the Data Controller, in their capacity as data processors, as well as their employees and associates who have been specifically designated as Authorised Persons.

Where external partners act as processors, they are bound by appropriate contractual obligations for the protection of personal data.

Your Personal Data will be processed within the European Union and will be stored on servers located within the European Union. The same Personal Data may be processed in countries outside the European Union only on condition that an adequate level of protection is ensured, e.g. by means of relevant adequacy decisions of the European Commission.

Any transfer of Personal Data to countries outside the EU, in the absence of an adequacy decision by the European Commission, shall be possible only if adequate contractual safeguards, including Binding Corporate Rules and standard contractual clauses, are provided by the data controllers and processors involved.

Where transfers of personal data outside the European Economic Area take place, the Company provides information on such transfers, their legal basis, the safeguards applied and the means of obtaining information on them or a copy thereof, in accordance with the GDPR.

Personal data are retained only for the period necessary to fulfil the purpose of the processing, in observance of the principles of proportionality and necessity and, in any event, until the purposes of the processing have been achieved and in accordance with any legal obligations that may apply.

Where you have a contractual relationship with the Data Controller, the Personal Data will be stored and processed for as long as such contractual relationship subsists and, in any event, for a period of 10 years from the termination of the contractual relationship, after which they will be deleted, without prejudice to their further storage where required for compliance with specific legal obligations, with provisions of the Authority, or for the collection of outstanding receivables and for the management of disputes, complaints and legal actions.

Your free and explicit consent is always required for the processing of your Personal Data and of your contact details, where such processing is based on your consent pursuant to the above. Your data will be processed until the consent given is withdrawn.

In accordance with Articles 15–22 GDPR, with respect to the Personal Data disclosed, you have the following rights:

• Access to your personal data.
• Rectification of inaccurate data.
• Erasure of your data.
• Restriction of processing.
• Objection to processing.
• Data portability.
• Withdrawal of consent, where the processing is based on it, without affecting the lawfulness of the prior processing.

To exercise your rights, you may contact us at the email address: info@gsm-papermill.gr

You also have the right not to be subject to a decision based solely on automated processing, unless the decision is necessary for entering into or performing a contract with the Data Controller, is authorised by law or is based on explicit consent. In the first two cases, you have the right to express your point of view, to contest the decision and to obtain human intervention on the part of the Data Controller.

Please be informed that you have the right to object at any time to the processing of Personal Data concerning you which may be carried out on the basis of the legitimate interest of the Company. In such a case, the Data Controller shall refrain from further processing of your Personal Data, unless it demonstrates that there are compelling legitimate grounds for continuing the processing, or for the establishment, exercise or defence of legal claims.

If you object to processing for marketing purposes (telephone calls / opt-out), your Data will no longer be processed for such purposes.

If you withdraw your consent, the processing of your data that is based on the consent you have given will cease.

For further information regarding your Personal Data, you may contact us using the contact details below:

GSM PaperMill ΕΛΛΗΝΙΚΗ ΧΑΡΤΟΠΟΙΙΑ ΚΑΙ ΚΥΛΙΝΔΡΙΚΗ ΣΥΣΚΕΥΑΣΙΑ ΜΟΝΟΠΡΟΣΩΠΗ Α.Ε.
10,5 ΧΛΜ ΕΟ ΚΙΛΚΙΣ-ΔΟΙΡΑΝΗΣ
Email: info@gsm-papermill.gr

Finally, we remind you that, if you believe that the processing of your data has been carried out in a manner incompatible with the provisions of European Regulation 679/2016 (GDPR), you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) / www.dpa.gr.

The Company may update this Policy, in particular in the event of changes to its processing activities or to the applicable legal framework. The version in force from time to time is published on the Website.