Customer Confidentiality Policy

Introduction

This document, called the Privacy Policy, explains in simple terms how we process the personal data we collect from you or that you voluntarily provide to us in the context of your transactions or communications with our business.

Data Controller 

The controller of personal data is the company under the name “DOG PAYMENT FUNDING INSTITUTION MONOPORING S.A.”, located at 19 Panormou Street, 11524, Athens, Athens, Greece, tel. no. 210 3005800 with e-mail address ταχυδρομείουdpo@dog-pi.gr and which is legally represented.

Our priority is the lawful processing of these data and the full and transparent information about it. For any questions please do not hesitate to contact us.

Contents of the Privacy Policy

Section One: General Information

1. What personal data is?
2. What is Processing of Personal Data
3. Is the processing of your personal data mandatory?
4. When and how do we collect your data?
5. What principles do we follow when processing data?

Section Two: Analysis of processing

1. Categories of data we process
2. Purposes of processing – lawful bases for processing
3. Time – Place of retention of data
4. Your rights

Third Section: Other information

SECTION ONE: General Information

1. What personal data is?

The term “personal data” (hereinafter referred to as “personal data” or “data”) refers to any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one whose identity can be directly or indirectly identified, in particular by reference to an identifier, such as a name, an identification number, an address, a telephone number, but also by reference to one or more factors specific to the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.

In a nutshell, it is any information relating to and concerning a natural person that either immediately reveals his or her identity or may reveal it to us.

2. What is Processing of Personal Data?

Any operation or set of operations performed, with or without the use of automated means, on personal data or on sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or any other form of making available, alignment or combination, restriction, erasure or destruction.

That is, almost any action, from the moment a dbh is created to the moment it is destroyed (or completely anonymized), constitutes an act of processing.

The processing of dpx is a lawful act if it is performed within the framework set by the relevant legislation, i.e. the national law 4624/2019 and the European General Data Protection Regulation (GDPR) 679/2016/EU. 

3. Is the processing of your personal data compulsory?

Providing some of your data to our business is necessary when you make transactions or communicate with us. 

This policy informs you of the processing rules we follow.

If you do not provide us with the data listed below, we will probably not be able to complete the transactions you request and generally provide you with our products and services or respond to your contact request or any other request you make to us.

4. When and how we collect your data

We collect your data at the following times:

• When you contact us 
• When you request to receive electronic updates on our news, offers and events, i.e. by subscribing to our newsletter mailing list
• When you visit our website to receive our news, offers, promotions, news, events, offers and promotions

5. Which principles we adhere to when processing data

When processing your data, we accept, adopt and apply the processing principles according to Art.5 GDPR, i.e. your data :

• are processed lawfully and fairly in a transparent manner in relation to the data subject (“lawfulness, objectivity and transparency”), 
• collected for specified, explicit and legitimate purposes and not further processed in a way incompatible with those purposes (“purpose limitation”), 
• are adequate, relevant and limited to what is necessary for the purposes for which they are processed (‘data minimisation’), 
• accurate and, where necessary, kept up to date; all reasonable steps shall be taken to ensure the immediate deletion or rectification of personal data which are inaccurate in relation to the purposes of the processing (‘accuracy’),
• kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed (‘storage period limitation’), 
• processed in a way that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and accidental loss, destruction or deterioration, using appropriate technical or organisational measures (‘integrity and confidentiality’). 

SECTION TWO: Analysis of processing 

1. Categories of data we process

Our company collects and subsequently processes (stores, etc.) basically the following categories of personal data (PDPs):

     2. Name, surname, patronymic, date of birth, occupation, signature, VAT number, ID number or passport number (or other identification document), home address/area, telephone number (landline/mobile), email address

     3. Account number/IBAN, invoicing details (services, value, quantity), historical transactions

     4. Browsing data and the internet protocol (IP) address of your terminal device when browsing our site

     5. Purposes of processing – lawful basis of processing

We collect and process the above categories of data for the following purposes:

1. Provision of services, invoicing-credits,  
2. Customer service (product-service information, customer record keeping), 
3. Defending legal claims
4. Compliance with legislation (tax etc.)
5. Sending newsletter

Legal processing bases

We inform you that the processing for the above purposes is carried out:

• on the legal basis of Article 6(1)(b) of GDPR 679/2016/EU (i.e. the processing is necessary for the performance of a contract to which the data subject is a party); and 
• on the legal basis of Article 6(1)(c) of GDPR 679/2016/EU (i.e. processing is necessary for compliance with a legal obligation of the controller).

With regard to the sending of newsletters, we inform you that this only takes place if a service has been previously provided between us or only if you have voluntarily subscribed to our company’s newsletter mailing list, i.e. with your consent.

In each newsletter message you receive, we provide you with the option to stop sending them by selecting the unsubscribe option at any time you wish.

The newsletter is sent only to promote similar and related products or services of our company. 

Your email address is not shared with third parties, subject to the company’s obligations under law.

• Time – Place of retention dpx

The processing of dpi must be limited in time, for the time strictly necessary for the purposes of the processing. 

The personal data we process in accordance with the above are retained for the period of time necessary to comply with the law (mainly tax law) and to safeguard our legal claims.   

Your other data is kept at our business premises in physical or, where applicable, digital form.

• Your rights

We process the above data in accordance with the above-mentioned protection policy and of course we support and ensure the exercise of your rights with a corresponding procedure. 

Our response to your requests (whether it concerns the exercise of rights or the submission of complaints) is free of charge and without delay, and in any case within (1) one (1) month from the time we receive your request and confirm your identity. However, if your request is complex or a large number of requests are submitted to our business at the same time, we will inform you within this month whether we need to obtain an extension of another (2) two months, within which we will respond to you. The quoted times of one (1) plus two (2) months (if required) are the statutory and prescribed times in the GDPR.

If your requests are manifestly unfounded or excessive, our firm may impose a reasonable fee, taking into account the administrative costs of providing the information or performing the requested action, or finally refuse to respond to your abusively repeated request.

In particular you have the following Rights:

1. The right to be informed of all the above-mentioned matters and any other matter relating to the processing of your data
2. The right of access, i.e. the right to receive a copy of the data you have provided to us
3. The right to update/correct, in case any data is or becomes inaccurate so that we can correct it. Updating will be done within 7 working days from the date of your written request and confirmation of your identity.
4. The right of deletion. This right may be subject to relevant restrictions due to the need to retain some data due to legal obligations.
5. The right to restrict processing when:

• The accuracy of the personal data is contested by you and for a period of time that allows us to verify the accuracy of the personal data, 
• the processing is unlawful and you object to the erasure of the personal data and request instead the restriction of its use
• we no longer need the personal data for the aforementioned purposes of the processing, but the data are required by you for the establishment, exercise or maintenance of legal claims and in related cases

    6.The right of portability i.e. the right to receive your personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, format as well as the right to transmit such data to another controller without any objection from us.

    7. The right to withdraw your consent to receive our newsletter, i.e. the right to request not to receive future newsletters from our company by email, by means of the unsubscribe option in any such email you have received. 

    8. The right to complain to the Data Protection Authority (dpa.gr) if you believe that we are in breach of the relevant data protection legislation regarding your data

SECTION THREE: Other information

Our company uses modern and up-to-date organizational and technical measures to prevent unlawful intrusion, access or dissemination of your personal data.

We inform you that we do not engage in automated individual decision-making or profiling.

Our website uses cookies to facilitate your connection to it, to collect traffic statistics or for marketing purposes. For more please visit our Cookies Policy.

Contact form

• Through the contact form you can send us a contact message and receive information about our services. We encourage you not to send us messages that contain sensitive information about you or third parties. If you send us a message of this nature, we state that we will delete it immediately and will not process or respond to it further.

Sending Newsletter

• To subscribe to our company’s newsletter mailing list, we only ask for your full name and email address. Your email will be used exclusively to send you information about our news, services and any special offers. We do not sell, assign or share your email with third parties. You have the right to withdraw your consent at any time by updating the “unsubscribe” comments in the emails you receive or by emailing us at dpo@dog-pi.gr.  

Privacy Policy revisions

• Our company reserves the right to modify or revise this Privacy Policy periodically at its sole discretion. If changes are made, our business will record the date of the modification or revision in the new Privacy Policy and the updated Policy will apply to you as of that date. We encourage you to review this Privacy Policy from time to time to consider whether there are any changes to the way we handle your personal data. 

Contact – Requests – Complaints

• If you have any questions, comments or complaints about our handling or protection of your personal data, or if you wish to exercise any of your rights, please contact us using the contact details above.

To submit a complaint or a complaint regarding a personal data breach, you can contact the Personal Data Protection Authority (Kifissia 1-3, P.K. 115 23, Athens, Athens, Phone: 210 6475600, Fax: 210 6475628, e-mail for notification of a personal data breach: databreach@dpa.gr, general e-mail: contact@dpa.gr