Personal Data Protection Policy for Candidate Employees

Γενικές πληροφGeneral Information

At Archeiothiki, we respect the privacy of each person, data subject, and our primary concern is to protect the confidentiality and privacy of the information we collect and process when you express your interest and apply to work with us. Our company “ARCHEIOTHIKI S.A.” has established this Privacy Policy for Candidate Employees (hereinafter referred to as the “Candidate Policy” or “Policy”) in order to inform candidate employees in our company on how we collect and process their personal data.

We hereby provide you with the following information regarding the type of personal data we collect about you, the means and purposes for which we collect them, the third parties with whom we share these data, as well as the rights you have, in compliance with the EU General Data Protection Regulation 2016/679 (GDPR), Greek Law 4624/2019, as well as the instructions and decisions of the Personal Data Protection Authority and the competent European institutions.

Περιεχόμενα

1. Who does this Candidate Policy concern?

The text of this Personal Data Protection Policy for Candidate Employees is intended to inform you, who are expressing your interest in working with us as a candidate employee in our company (hereinafter “you” or the “Candidate Employee”), in the event that you fall under the following categories:

Candidate Employee having submitted your curriculum vitae (CV)/résumé and other information related to finding a job in Headhunting/Recruiting companies, following a listing/call from Archeiothiki for a specific job.
Candidate Employee having submitted your CV/résumé as well as your necessary additional information to meet the needs of a specific job for which there is a specific listing or call from our company on job search websites.

Candidate Employee having read about the call for a specific position on our website and was thereby informed about sending their CV/résumé at the email hr@archeiothiki.gr.

Candidate Employee sending us their CVs at the hr@archeiothiki.gr email, following a recommendation from a person already employed in our company.

2. Who are we?

The public limited company named “ARCHEIOTHIKI LOGISTICS & ARCHIVES MANAGEMENT COMPANY” General Commercial Register No. (GEMI) 006886601000, Tax ID No. 998771988, Tax Office Commercial Companies’ Athens Office (FAE Athinon), info@archeiothiki.gr, 210 5570410, based in Athens, 1 Loukianou St. (hereinafter “Archeiothiki” or “We” or the “Company”) is the Controller of the personal data we collect and process when screening for a suitable Candidate for the specific job position (hereinafter the “Personal Data”) in the context expressing your interest in working with us (hereinafter the “Application”).

3. What Personal Data of yours do we process during the recruiting process in our company?

We collect and process your Personal Data which are necessary for the recruiting process in our company, as well as for the assessment of the CV/résumé and relevant information that is necessary during screening for the appropriate employee for our company, such as your professional skills, your education and expertise for the specific position. Your Personal Data are collected and further processed by a competent team of Archeiothiki that is authorised for this purpose and responsible for carrying out tasks related to human resources management. Recipients of your Personal Data may also be other competent departments within the company, which are related to the listed position for which you have applied as well as Archeiothiki’s management team.
Personal Data are the information related to you as a natural person and Candidate Employee and which may identify you directly or indirectly in combination with other information to which we have access. Archeiothiki shall ensure that only the necessary Personal Data for your application are collected and processed.
In the context of the assessment of your application following a call of our Company, we process the Personal Data below which we collect as follows:
- From you:

We collect from you and process specific data which are necessary for the assessment of your application and which relate to your professional and personal information which you wish to disclose to us by sending an email at hr@archeiothiki.gr, following the publication of a listing from our Company or a call for a specific position on our website, on job search websites.

The Personal Data we process in this context are:

Identity Data: your name, age, nationality,
Communication data: postal address, email address, mobile and/or landline phone number,
CV/résumé data: Information regarding your previous employment, your education, your skills and any certifications or other professional qualifications you have and which you include in your CV/résumé and are related to the job vacancy that has been published and additional information you wish to disclose to us,
Prerequisite data: Information on the fulfilment or non-fulfilment of any compulsory military service,
Data regarding your ability to drive as well as the license category you may have (for commercial or private use),
Data contained in letters of recommendation in your CV/résumé,
Additional data that you may provide to us during our phone call or through your application or other communications with you.
Data during the Short-listing process
Data during the application assessment process
- From third parties

Headhunting/Recruiting: We collect and process Personal Data from the Headhunting/Recruiting companies with which we collaborate in the context of your application, which you provided through your CV/résumé and cover letter, as well as data collected from other public sources with a related subject. These data are transmitted to us after you have provided the Headhunting/Recruiting companies with your consent for this purpose. Archeiothiki can contact you directly or through the Headhunting/Recruiting company. In addition, we may ask companies to make a first assessment of your CV/résumé and send us an initial report on your Application. Headhunting/Recruiting companies may act either as Joint Controllers together with Archeiothiki, in which case your personal data will be processed in accordance with both our and their Private Policy for Candidate Employees, or as Processors with the mandate to process personal data on our behalf, for specific purposes and in accordance with our instructions.
Former employers: In addition, if necessary, we may verify information about your previous professional experience which is only relevant to the job for which you are applying and to the field of your expertise from former employers following your consent before contacting them.

Publicly accessible sources: Finally, we may use certain publicly accessible professional resources, business websites and/or related social media to verify information related to your work experience with regard to the job (e.g., to verify the information we received from you).

The Personal Data we process in this context are:

Identity Data: your name, age, nationality,
Communication data: postal address, email address, mobile and/or landline phone number,
CV/résumé data: Information regarding your previous employment, your education, your skills and any certifications or other professional qualifications you have and which you include in your CV/résumé and are related to the job vacancy that has been published,
Data contained in letters of recommendation in your CV/résumé.
- You may express your interest in working at Archeiothiki without a call from our Company, following the recommendation from a person who is already employed by us or works with us. In this case, we collect the CV/résumé and the information you wish to send us via email at hr@archeiothiki.gr.
- Personal Data that you provide to us during the Short-listing process

We process your Personal Data to carry out the short-listing of Candidate applications in order to separate the Candidate Employees according to their basic characteristics (e.g., years of professional experience, expertise that may be in line with the requirements of the call for the specific position).

Personal Data that you provide to us during the Candidate assessment process

In order to assess your suitability for the job by conducting interviews, taking notes, your answers to case studies which you may be asked to answer according to the listed position. During the assessment process, we process data that we collect during the interview, the discussion about the needs of the position together with our Company’s HR Department and data that we may collect from third parties (e.g., lawful publicly accessible sources).

Contact

We process your data with a view to contacting you to inform you about your application process, your assessment as a Candidate Employee, to call you for an interview or to inform you about the outcome of your assessment and/or to ask you for your consent to contact a former employer of yours or for any other reason related to your Application process.

Record keeping for future assessment and evidentiary purposes

We store your Personal Data for a short period of time for specific purposes:

When we keep the file with your CV/résumé and the data we collected during the assessment process of your application in order to:
- re-evaluate it in the future if a new position opens
- keep a record of your CV/résumé and Personal Data that we collected when you submitted your Application in the event that you have a grievance or exercise any of your rights regarding the assessment process of your application.

Notes:

i) At Archeiothiki, in the context of your Application, we will only ask you for the data that are absolutely necessary for serving the purpose for which they were provided and are used exclusively for the purposes for which they have been collected. We strongly advise you not to include sensitive personal data in your Application (such as health information, information about religious beliefs, etc.). In addition, we do not use data and do not draw conclusions using automated means during the Application process.

ii) We carefully select the people who are going to work with us, based on merit criteria and ensuring that they have the appropriate educational and professional qualifications, depending on the jobs listed each time.

iii) We will not use your data to make automated decisions based on your assessment and your answers.

iv) If we need to process your personal data for any purpose other than those mentioned herein, we will inform you accordingly and in advance and will request your consent, if required.

4. Purpose and legal reason for processing data of Candidate Employees

As a Controller, Archeiothiki processes your Personal Data based on a legitimate reason and shall keep them up-to-date in its records. For this reason, you must provide us with accurate and up-to-date data.

The purpose of their processing and the legitimate reason (legal basis) are analysed in the following table:

Purpose of processing

Personal Data

Legal basis of processing

Collection

Data we collect from you after a specific call, as these are analysed above.

Performing a contract at a pre-contractual stage:

We process your data included in the application you submit to us, in your CV/résumé and relevant information, when you provide them to us on your own initiative after a specific job posting (call) in order to proceed to the next steps during your Application and to conclude the employment contract with you.

Data we collect from third parties:

1. Headhunting/Recruiting during your application process:

a) for the evaluation of your data by the companies cooperating with us

b) the transfer of your data to Archeiothiki

a) Archeiothiki’s legitimate interest:

Archeiothiki relies on its legitimate interest to work with companies in order to find the appropriate candidates for the call and to assess your CV/résumé and other job-related information, which is not transmitted to us at this point.

b) Your consent:

We collect and process your data on the basis of your consent which you have provided to the Headhunting/Recruiting companies. You are entitled to withdraw your consent at any time by sending an email using the contact details of our company and our DPO and, in doing so, we will no longer proceed with the next stages of your application.

2. Former Employers

Your consent:

We rely on your consent to contact your former employers in order to collect information about your professional competencies related to the job to be filled. You may revoke your consent at any time by sending an email using the contact details of our company and our DPO. If you exercise this right, we will not contact your employer and we will assess the remaining data for your Application.

3. Publicly accessible sources

Archeiothiki’s legitimate interest:

After fairly weighing Archeiothiki’s legitimate interest against your privacy, we process your Personal Data posted on publicly accessible sources in order to find the suitable candidates for the sound operation of our Company, without compromising your fundamental rights and freedoms.

Short-listing

Data we assess during short-listing, when such a process takes place.

Archeiothiki’s legitimate interest:

Archeiothiki has a legitimate interest in conducting a pre-shortlisting in order to determine which Candidates meet the requirements for the position for which a call has been made and to contact you for an interview or further assessment.

Assessment

Data we collect from you during your Application assessment process

Performing the contract at a pre-contractual stage:

We process your Personal Data during your Application at the assessment stage as a pre-contractual stage of concluding an employment contract with you, after you submit your application and other details.

Additional Personal Data we collect from third parties during the process as mentioned above

Archeiothiki’s legitimate interest:

With a view to verifying your professional skills to find the most suitable Candidate for the job according to our company’s staffing needs, we assess any additional Personal Data we collect during this process.

Contact you

Your contact details so that we may contact you

a) to invite you to an interview,

b) to inform you about the outcome of your application

c) to ask you for any additional information

d) to request your consent when necessary e.g., to contact a former employer of yours

e) to inform you about a new job vacancy as well as to ask you to update the information you have provided to us

a, b, c & d) Performing a contract at a pre-contractual stage:

During your Application procedure, we process your Contact Data in order to collect the necessary information needed for each step.

e) Legitimate interest

Archeiothiki relies on its legitimate interest to keep your CV/résumé and other information collected during your application for future use in order to assess it in the future in the event of a new job opening, unless you object to it (see right of objection below).

Record keeping for future assessment and evidentiary purposes

We keep a record of your CV/résumé and related information for the following purposes

a) Assessment for future employment

b) Evidentiary purposes

Legitimate interest

We retain your Personal Data for a short period of time based on our legitimate interest to keep them in our records in order to inform you about future position openings, to reassess them in the future for a new position, to keep evidence in case of grievances. Our legitimate interest has been fairly balanced against your privacy and does not compromise your fundamental rights and freedoms.

Please Note: If the legal basis of processing is the legitimate interest, we shall fairly balance it against your privacy. If, for any reason, you consider your rights to have been infringed, you have the right to object in accordance with the procedure set out below in point 9.

5. Recipients

Recipients of your data may also be external partners and Archeiothiki’s partners, such as:

Providers of information systems and/or applications, consultants or cloud storage companies, such as Microsoft (see Privacy Policy), who have been instructed to process personal data on our behalf for specific purposes and only according to our instructions,
Headhunting/recruiting companies – providing recruitment services, to which you have provided your CV/résumé and accompanying details and to whom we may refer for their opinion and assessment regarding your suitability as a Candidate Employee for the job vacancy.

6. Transfers outside the EU

Archeiothiki takes the appropriate measures in order to comply with the entire process of processing your Personal Data within the EEA during your Application and is cooperating with Greek Headhunting/recruiting companies for this reason. In the course of operation of these companies, your data may be transmitted to a Third country and outside the European Area, e.g., to the USA, provided that appropriate safeguards are available. For example, in the event that there is no adequacy decision between Greece and a third country, but our partners transfer data thereto, you will be properly informed about the reasons, possible risks and consequences of such a transfer and you are entitled to decline to provide your consent to the proposed transfer of Personal Data.

7. For how long do we retain your Personal Data

8.1. The data from your expression of interest collected for the purpose of assessing your Application, as well as the relevant outcomes of the assessment, are retained by us, in the event that the application does not result in your working with us, for as long as required to fulfil this purpose, and we also keep them for a short period of time, while you are entitled to object to the Personal Data retention policy by contacting us using the details listed below in point 11 hereof.

8.2. When you send us your CV/résumé and your Personal Data following a call for a specific position during the process of your Application on your own initiative, Archeiothiki will retain them for an additional (1) year based on its legitimate interest for its re-evaluation for a future position, unless you object to their retention.

8.3. If we have assessed your Personal Data during your application, we will keep them for (1) one year for the following purposes:

i) To re-evaluate your Application,

ii) To maintain them for evidence purposes.

8.4. In the event that we received your details through a social networking platform, the latter may apply its own Privacy Policy, independently and alongside our own, which, inter alia, may provide for a different period of retention of your details in their own, independent systems. In this case, we urge you to learn more about the Privacy Policy that applies to the relevant job search platforms.

8.5. In the event that we hereby wish to retain the information you have provided to us for a longer period of time, we will ask for your consent.

8.6. If your application results in the conclusion of a contract with Archeiothiki, the personal data collected before your recruitment will be part of your personal employee file with us, they will be processed in accordance with the Employee’s Personal Data Processing Policy which is communicated to all our employees, and will be retained throughout your employment in Archeiothiki as well as for a number of additional years after the end of our cooperation, in accordance with the legislation in force.

8. Personal Data Security

At Archeiothiki, we use appropriate protection measures as required by applicable law in order to ensure the integrity and security of personal data concerning you. We implement a Single Information Security Management and Privacy Assurance System and use appropriate technical protection measures. We also operate on the basis of a Single System of Policies and Procedures, certified according to internationally recognised Security Standards, by authorised Certification Bodies, which is updated whenever required, in order to achieve a high level of protection of the privacy of individuals. The technical and organisational security measures we have taken keep your data safe in the event of a technical error or natural event while supporting the exercise of your rights. We reserve our rights regarding the occurrence of a security incident beyond our sphere of control and which may be based on special circumstances or force majeure or network failure.

9. What are your rights and how do you exercise them with regard to the Protection of Personal Data?

In accordance with the applicable law and in the context of your Application, you have the rights provided for by the GDPR and you can exercise them in the following ways:

RIGHT	WHAT IS IT?
of Access (art. 15)	You can request access to your personal data and receive relevant information on their processing, such as: what data do we keep, why do we use them, where did we collect them, if we did not collect them from you but via a third party, to whom do we transfer them, whether they are transferred to a third country.
Rectification (art.16)	You can ask us to rectify or update any false or inaccurate data of yours. In this context, our company reserves the right to verify the data’s accuracy before rectifying them and is under an obligation to inform the recipient to whom your personal data was disclosed, unless this proves impossible or if it entails a disproportionate effort.
Erasure (article 17)	You can request the erasure of your data when a) they are no longer needed for the purposes for which they were collected, b) you have withdrawn your consent on which the processing is based, or c) you find that they are otherwise or illegally processed, d) you are opposed to the processing. Our company reserves the right to refuse the exercise of the above right if the processing of data is necessary a) for the purpose for which they have been collected, b) for compliance with a legal obligation, c) for the establishment, exercise or defence of legal claims. Deletion, when conditions are met, will be universal and complete.
To the restriction of processing (article 18)	You may request that we retain your data but not use them if their accuracy is in doubt, if the processing of your data is no longer necessary for the purposes for which they were collected, when you have objected to the processing and await the verification whether our legitimate reasons prevail over your own legitimate reasons.
To data portability (article 20)	You may ask for your personal data to be provided in a structured form or you may request that they be transferred directly to another controller. It is a condition that the data have been given with consent or in the context of a contract execution and also that the data are kept by automated means and not in printed form. The right to portability refers to the data provided by you and not by Archeiothiki on the basis of the data you have provided to our Company.
To object (article 21)	You may object at any time to any processing of your personal data which has as a legal basis a) the legitimate interest, b) the fulfilment of a duty, c) profiling. If you exercise this right, our company may not satisfy it if it demonstrates compelling and legitimate processing purposes which override your interests, rights, and freedoms, or for the establishment, exercise or support of any legal claims to continue this processing.
Right to human intervention (article 22).	In the context of the processing included in this Policy, we do use technical means to make a decision which evaluates personal aspects relating to you and which is based solely on automated processing and produces legal effects concerning you or similarly significantly affects you. Moreover, we do not create profiles through automated personal data processing.
Withdrawal of consent	You have the right to withdraw any consent you have given, where this is stipulated above as a basis for processing. You may withdraw your consent freely and at any time upon your request to the DPO using their contact details or with any other means we have been informed upon receipt of your consent. Withdrawal of your consent shall apply to the future.
Supervisory authority/Alternative forms of dispute resolution	If you consider that we have not adequately met your request and that the protection of your personal data is in any way undermined, you may contact the Personal Data Protection Authority, using the following contact details: Website: www.dpa.gr \| Postal Address: 1-3 Kifisias Avenue, Postcode 115 23, Athens \| Call centre: +30 210 6475600 \| Fax: +30 210 6475628 \| Email: contact@dpa.gr Since our company’s top priority is to protect your privacy, you may contact our company or the DPO for any issue or grievance you may have regarding the processing of your personal data. In any case, this policy is governed by Greek law and comes under the jurisdiction of the Greek courts.

You may exercise any of the above rights by submitting a written request to the Archeiothiki Data Protection Officer. You can expect a response to such a request within one (1) month following reception thereof and, in any case, within two (2) additional months, if this is required by the complexity of the request or the total number of requests received.

As a data subject, you should not pay for exercising your rights in relation to personal data, unless otherwise provided for by law or if the request for access to information is unfounded or excessive.
Archeiothiki will ask you to identify yourself so that you can further exercise your rights.

10. Archeiothiki’s Data Protection Officer (DPO)

You may address any questions or requests regarding the protection of your personal data processed by Archeiothiki, in accordance with this Policy, and you may also exercise any of your rights, withdraw your consent, at any time, using the following contact details:

Data Protection Officer:

Email address: dpo@archeiothiki.gr

Post: Rikia area, Postcode 193 00, Aspropyrgos – Greece (For the attention of the DPO)

Contact number: 210 5570410

11. Amendments to the Personal Data Protection Policy

We strive to review and keep this Privacy Policy up-to-date in order to comply with all legal and regulatory requirements, while providing optimal protection for your personal data and properly informing you. Any update relating to this Policy will be posted on Archeiothiki’s website (www.archeiothiki.gr) or in any other appropriate manner at our discretion. Any amendments shall apply from the time specified in the relevant amending act.

Last Updated: 02/08/2022