Privacy and Personal Data Protection Policy

1. Who is the Data Controller?

The Data Controller responsible for processing your personal data is Farmers & Traders – Vasiliki Panagopoulou & Co, with registered office and contact details at:

Lappa, Achaia
Branch: Kougeika, Varda, Ilia

hereinafter referred to as the “Company.”

2. Who are the Data Processors?

The following parties process personal data on behalf of the Company:

Dimitrios Oikonomou & SIA OE, with registered office at Mitropoleos 54, Aigio, telephone: +30 26910 62292, email: info@foodcare.gr, legally represented by its managing partner, Theodoros Arvanitis.
The Accountant / Accounting Firm DIMITROPOULOS PANAGIOTIS, with registered office at …………………………………., telephone: …………………………………., legally represented by DIMITROPOULOS PANAGIOTIS.

The above parties are hereinafter collectively referred to as the “Data Processors.”

For any matter relating to this Privacy Policy or the processing of your personal data, you may contact us through the following channels:

A. By telephone, using the contact numbers of Farmers & Traders – Vasiliki Panagopoulou & Co

B. By telephone, through Dimitrios Oikonomou & SIA OE at +30 698 453 1313 or +30 698 453 1363, Monday to Friday, 09:00-16:00

C. By email at info@foodcare.gr

3. Who is responsible for personal data protection?

According to the present policy, responsibility for personal data protection lies with both the Company and the Data Processors, using the contact details listed above.

4. What data are processed and under what conditions?

Purpose of processing

Personal data may be processed for the provision of services relating to the design, configuration and implementation of Quality Management Systems concerning Food Hygiene and Safety, including IFS, BRC, SEDEX, GRASP and other systems relating to Social Practices.

Data may also be processed for payroll administration and for fulfilling social security and other employment-related obligations toward employees.

Data processed for these purposes

The data may exist in both printed and electronic form.

For certain services, the Company may act as a Data Processor on behalf of its client.

The data may include employee passport information, employment contracts and other employee-related records.

Certain information may reveal ethnic origin and may therefore fall within special categories of personal data.

Employee health certificates relating to businesses subject to health regulations may also constitute special-category personal data.

Where such certificates are reviewed, the Processor checks only whether a valid certificate exists for each employee and whether it is within its validity period, without otherwise processing the medical information contained therein.

WE DO NOT PROCESS INFORMATION RELATING TO EMPLOYEES’ TRADE UNION ACTIVITIES OR MEMBERSHIP.

Disclosure of data to third parties

The Company may provide data to Dimitrios Oikonomou & SIA OE and to the Accounting Firm for purposes relating to the relevant services and payroll administration.

The Privacy Policy of Dimitrios Oikonomou & SIA OE is available at:

http://www.foodcare.gr/απόρρητο_gdpr/

The Accounting Firm is also bound by the provisions of this policy.

Level of identification

Processing may involve:

identification of employees
identification of producers / clients acting as natural persons

Data retention period

Personal data in printed and electronic form are retained for 24 months after termination of the relevant contract, unless the contract is renewed.

Legal basis for processing

Signing the relevant assignment of duties also constitutes acceptance of the present Policy.

Where commercial communications are concerned, you may choose the communication channel through which you wish to receive such communications and provide separate consent for each or all of the relevant processing purposes.

If you provide consent to receive communications without specifying a particular communication channel, we may use the contact details you provided when registering or otherwise communicating with us.

Where processing is based on consent, you may withdraw your consent at any time by contacting the Company using the contact details provided above.

5. How long are my personal data retained?

Your personal data are retained for 24 months from the signing of the relevant document, provided that you continue to work for the Company.

The same retention period applies to data maintained by the Data Processors.

6. What are my rights regarding the processing of my personal data, and how can I exercise them?

You may exercise your rights by contacting Farmers & Traders – Vasiliki Panagopoulou & Co through the following channels:

A. Telephone:
+30 698 453 1313
+30 698 453 1363
Monday to Friday, 09:00-16:00

B. Email:
info@foodcare.gr

C. Postal address:
Agiou Athanasiou 35, Aigio, 25100, Greece

Under the General Data Protection Regulation (EU) 2016/679 – GDPR, your rights include:

Right of access – Article 15
Right to rectification – Article 16
Right to erasure – Article 17
Right to restriction of processing – Article 18
Right to data portability, where processing is based on consent or the performance of a contract – Article 20
Right to object, where processing is based on legitimate interests or the performance of a task carried out in the public interest – Article 21
Right not to be subject to a decision based solely on automated processing, including profiling – Article 22

Our aim is to respond to valid requests no later than one month after receipt.

If your request is particularly complex or if you have submitted several requests, additional time may be required. In such cases, you will be informed accordingly and may be asked to provide additional information or clarification.

You also have the right to lodge a complaint with the competent supervisory authority:

Hellenic Data Protection Authority – HDPA
www.dpa.gr

7. How is the security of your personal data ensured?

The Company and the Data Processors implement appropriate technical and organisational security measures to protect personal data and ensure confidentiality.

These measures may include:

firewalls
protection against Denial-of-Service attacks
PCI DSS-compliant environments, where applicable
controlled access to personal data
restricted access to authorised personnel only

Personal data submitted to the Company are handled only by specifically authorised personnel acting under the Company’s instructions and supervision, and by authorised recipients where necessary.

8. What procedures are followed in the event of a personal data breach?

In the event of a personal data breach, information relating to the incident is collected and assessed.

Technical measures are taken to stop or contain the breach.

Where required, the relevant authorities and affected parties are notified.

The nature, extent and potential impact of the breach are assessed so that the incident can be properly reported to all parties having a legitimate interest.

The Company also provides all assistance required by the competent authorities under applicable law for the investigation of incidents involving breaches of the confidentiality of communications or personal data.

9. From which third parties do we receive personal data?

We receive personal data from third parties only where permitted or required by applicable legislation.

10. Automated decision-making and profiling

We do not carry out automated decision-making or profiling.

11. Requirements for disclosure of personal data

Where required by applicable legislation, competent police or public authorities, an official court order or a decision issued by an independent authority, the Company may be legally required to disclose personal data.

For the Company

For the Accounting Firm

For Dimitrios Oikonomou & SIA OE