Personal Data Protection Policy

GENERAL INFORMATION REGARDING THE PROCESSING OF YOUR PERSONAL DATA BY OTEACADEMY

(General Data Privacy Notice)

OTE ACADEMY places great importance on the protection of your personal data and adheres to the principle of transparency regarding its processing.

With this document, we aim to inform you about the processing of your personal data during your access to the company’s website and/or the provision of educational services, and/or the provision of participation(s) in certification exams, and/or your subscription to the Company’s newsletter, and/or submission of a CV for a job vacancy at the Company.

1. What is the identity and contact information of the Data Controller?

The Data Controller is the company named “OTE EDUCATIONAL SINGLE MEMBER S.A.”, and distinctive title “OTEACADEMY”, at 1, Spartis & Pelika street in Maroussi, , Postal Code 15122, hereinafter referred to as OTEACADEMY or the Company.

2.  Whom can you contact regarding the protection of your personal data?

For information regarding the protection of your personal data, you may contact us via email at privacy@oteacademy.gr or send a letter to the postal address: 1, Spartis & Pelika street, Postal Code 15122, Maroussi.

3. What categories of personal data do we process, for what purpose, and what is their retention period?

(A) Data submitted through the contact form on the OTE ACADEMY website, for the purpose of submitting requests/inquiries.

In this case, we process the following data:

• Full name
• Email
• Phone number
• Description of the request or inquiry

Legal Basis: This processing is carried out under Article 6(1)(b) of the GDPR.
Retention Period: Personal data is retained for as long as necessary to respond to the requests/inquiries.

(B) Data processed for subscription to the Company’s newsletter.
In this case, we use your email address to send newsletters.
Legal Basis: This processing is carried out under Article 6(1)(a) of the GDPR.
Retention Period: We retain personal data for as long as you remain subscribed to our mailing list and delete it upon withdrawal of your consent.

(C) Data processed for the participation of employees from Group companies, upon request, in educational programs organized by the Company.
In this case, we process the following data:

• Full name
• Email
• Department/Service Address
• Contact number (mobile or landline)

for the following purposes:

• Sending to partners/instructors for distribution of electronic materials, links for online training via platform, attendance certificates
• Registration of participants in exams with another organization or in open training sessions
• Full names for name tags

Legal Basis: This processing is carried out under Article 6(1)(a) of the GDPR.
Retention Period: Personal data is retained throughout the duration of the educational program.

(D) Data processed for the implementation and execution of educational programs by the Company
Specifically, we process personal data of instructors/trainers employed by the Company to conduct the aforementioned educational programs as follows:

• New instructors: CVs submitted to us.
• Instructors issuing invoices: Through the vendors form, which is completed to register a supplier in the SAP system, we process the following instructors’ data: bank account number, name, profession, Tax Identification Number (TIN), Tax Office, residential address, IBAN, bank name.
• Instructors paid via acquisition titles: Personal data of the instructor and their parents, Social Security Number (AMKA), Insurance Registry
• Number (AMA), IKA registration number, TIN, Tax Office, bank account number.

Purposes of processing:
•    Interviews with potential new partners/instructors
•    Entry into the SAP accounting system as new suppliers
•    Entry into the learning partners database and CV folder
•    Entry of data into budget and contracts
•    Payment of invoices and acquisition titles
Legal Basis: Article 6(1)(b) of the GDPR
Retention Period: Personal data is retained for the duration of the employment contract.

(E) Data processed for participation in certification exams organized by the Company
Upon submission of a relevant application, we process the following data of certification candidates:

• Full name
• Phone number
• Email
• Father’s name
• Mother’s name
• Address
• Photograph

Legal Basis: Article 6(1)(a) of the GDPR
Retention Period: Personal data is retained for the duration of the certification exams and the results thereof.

(F) Data processed upon submission of CVs by job applicants for job vacancies at the Company

CVs are submitted to the email address info@oteacademy.gr. We process the personal data included in the CV for the following purposes:

1. Evaluation of qualifications and skills in relation to the requirements of the job position for which the application is submitted.
   Legal Basis: Article 6(1)(b) of the GDPR
2. Reassessment of the application at a later time to consider the possibility of future collaboration and to contact the applicant if they are not selected for the specific position, they applied for.
   Legal Basis: Article 6(1)(f) of the GDPR – legitimate interest
   Retention Period: Personal data is retained for 6 months from the date of CV submission to consider the CV for future job openings.
3. Retention of the CV for an additional 24 months, to allow us to refer to it and consider it for future job positions that match your profile, with your consent.
   Legal Basis: Article 6(1)(a) of the GDPR – consent

We reiterate that your personal data is retained only for as long as necessary to fulfill the purpose for which it was collected, or for the period required by applicable law. Once the retention period expires, your personal data will be deleted.

4. Will OTE ACADEMY process your personal data for other purposes?

OTE ACADEMY will not process your personal data for purposes other than those mentioned above. In case OTE ACADEMY wishes to use your personal data for other purposes, it will do so only after informing you and obtaining your explicit consent.

5. Who are the recipients and for what purpose is personal data shared with them?

In addition to OTE ACADEMY, your personal data may be processed by our partners or third-party companies. However, OTE ACADEMY remains solely responsible for the security of your personal data and takes all necessary measures:

• Our partners are always selected based on the high level of technological and organizational security they offer.
• Before collaborating with any company—especially if the collaboration involves processing your personal data—we contractually bind them to ensure a high level of protection for your personal data.

In such cases, these third-party companies act as data processors on behalf of OTE ACADEMY. They are OTE ACADEMY partners who undertake specific tasks following our instructions and applying the strict procedures of the OTE Group regarding the processing of your personal data.
In these cases, OTE ACADEMY retains full responsibility for the processing of your personal data.

Processing by our partners is carried out primarily within Greece and the European Union (EU).
If we collaborate with companies outside the EU, they will process your data only under our instructions, and only if there is an adequacy decision by the European Commission or if appropriate safeguards are agreed upon to ensure a high level of data protection.

OTE ACADEMY does not process or disclose your personal data to third parties, except where disclosure is required by applicable law.

6. What are your rights regarding the processing of your personal data?

You have the following rights:

• Right of Access: You have the right to be informed about the personal data we process (e.g., purposes, types of data, recipients, retention period) and to receive copies of this data.
• Right to Rectification: You may request correction of your data (e.g., address, contact details, ID number).
• Right to Erasure: You may request deletion of your personal data if it is no longer necessary for the purposes for which it was collected or if you withdraw your consent.
• Right to Restriction of Processing: You may request that processing be restricted for specific purposes (e.g., opting out of marketing emails).
• Right to Data Portability: You may request to receive your personal data in a structured, commonly used, and machine-readable format (e.g., data stored in the cloud).
• Right to Object: You may object to the processing of your personal data in cases where you do not wish it to be processed.

Additionally, OTE ACADEMY has appointed a Data Protection Officer (DPO) in accordance with applicable law.
To contact the DPO, you may send an email to: privacy@oteacademy.gr

To exercise your rights, you can:

• send an e-mail to privacy@oteacademy.gr  or
• letter to the address OTE ACADEMY, 1, Spartis and Pelika str., 15122, Maroussi with the subject "Exercise of personal data rights" stating your full name.

If you believe your request has not been adequately satisfied and your personal data protection is in any way compromised,

you may file a complaint through the dedicated online portal of the Hellenic Data Protection Authority (Athens, 1-3 Kifisias Avenue, Postal Code 115 23 | Tel: +30 210 6475600).
Detailed instructions for submitting a complaint are available on the Authority’s website.

OTE ACADEMY will respond to your requests free of charge and without delay, within one month from the date of receipt.
In exceptional cases, this deadline may be extended by two (2) additional months if necessary due to the complexity of your request.
In any case, you will be informed of the extension and the reason for the delay.

If we determine that your request is manifestly unfounded or excessive, we reserve the right to request the payment of a reasonable fee to process it, taking into account the administrative costs involved, or even to refuse to act on your request.

7. What measures are applied to protect your personal data?

OTE ACADEMY implements appropriate organizational and technical measures to ensure the security of your data and protect it from accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure or access, and any other form of unlawful processing.

Last updated 25/01/2024