PRIVACY POLICY
The Company under the name "EPIROTIC BOTTLING INDUSTRY S.A.", headquartered in Ioannina, Hatzi Pellerin 2, P.C. 45221, tel. +302651061951, as well as its Group member companies, ensures the confidentiality and security of your personal data and adopts the General Data Protection Regulation 679/2016 of the European Union & Law 4624/2019 in all processes and communication stages with you.
Purpose of this Policy
This policy provides every individual and every visitor/user of the Company's website/microsite with concise and transparent information regarding the practices followed for the management and protection of personal data.
It concerns every action or series of actions performed with or without the use of automated means on personal data or sets of personal data, such as collection, registration, organization, structuring, storage, adaptation or modification, retrieval, information search, use, disclosure by transmission, dissemination, or any other form of availability, correlation, or combination, restriction, erasure, or destruction.
This Policy is updated periodically and may be modified whenever necessary, without prior notice, always within the applicable legal framework and in accordance with any changes in the current data protection legislation. We recommend checking this Policy regularly to stay informed of any updates.
What are personal data?
Personal data is any information that relates to a specific natural person or a person whose identity can be determined (e.g., full name, ID number, address, date of birth, mobile phone number, etc.). Data concerning health (physical or mental condition, receipt of medical services, etc.) is included in the general term personal data but constitutes a special category of data.
How are your personal data collected?
Your personal data (full name, ID number, address, date of birth, email address, gender, and contact phone number) are collected in the following ways:
(a) When you submit a job application to the Company or send your resume. Providing your personal data within the context of submitting a resume for job consideration in our Company is done voluntarily, as otherwise, it would not be possible to assess the your employment potential. Processing is necessary to take steps at the request of the data subject prior to entering a contract, in accordance with Article 6.1 (b) of the Regulation. For more information, please refer to the Resume Processing Policy.
(b) You provide them to us when you complete forms and consent statements for the use and processing of your data within the framework of the Company’s promotion and participation in marketing activities (newsletters, offers, advertisements), campaigns, prize draws, and competitions. By participating in the competitions on our website, you agree to receive newsletters, as the option to receive them (“opt-in”) is pre-selected in the participation form. If you do not wish to receive newsletters, you can withdraw your consent by unchecking the relevant field before submitting your participation. Additionally, you can unsubscribe at any time via the ‘Unsubscribe’ link included in each newsletter.
The Company will not process your personal data without your consent. However, the Company reserves the right, in exceptional cases, to process your personal data to the extent permitted or required by law and/or by court decisions or prosecutorial orders/instructions. The submission of your data is voluntary, and its processing is carried out in accordance with Articles 6.1(a) and 6.1(b) of the Regulation.
(c) You provide them within the context of participating in the Company's voluntary activities (e.g., blood donation). Submission of your data is at your discretion, and processing is conducted under Article 9.2(a) of the Regulation.
(d) You provide them as part of our transaction for the fulfillment of contractual obligations and compliance with the Company’s legal obligations. Processing of personal data received is conducted under Articles 6.1(b) and 6.1(c) of the Regulation.
(e) You provide them when filling out online forms or sending emails to receive information about the Company’s products as displayed on our website www.vikos.com. The submission of your basic data is voluntary, and processing is based on your consent for the sole purpose of informing you about our products under Article 6.1(a) and Article 6.1(b) of the Regulation for contract execution.
(f) Automatically through the browser or mobile device you use to access our website. More details about the technologies used on our website are provided in the Cookie Policy..
What personal data is collected and for what purpose?
The personal data collected and further processed includes:
(a) Identification data, such as name, address, and general contact details (including email address and phone number). The purpose of collection is the execution of our contractual agreement under Article 6.1(b) of the Regulation.
(b) Identification data related to resumes, education, professional qualifications, work experience, photos, etc. Collection, processing, and storage of this data aim solely at evaluating and selecting job applicants for potential employment at the Company, in accordance with Article 6.1(b) of the Regulation. Your data is stored only for this purpose and processed by the relevant departments of the Company, including authorized personnel in Accounting, HR, IT, etc.
(c) Health data, such as your blood type. The purpose of collection and processing is your participation in the Company’s voluntary activities, and the lawful basis for processing is your consent under Article 9.2(a) of the Regulation.
(d) Identification, financial, tax, and contact data, such as VAT number, tax office, contact details, address, etc. Collection, processing, and retention of your data in these categories are necessary for the Company's compliance with its legal obligations under Article 6.1(c) of the Regulation.
(e) Identification data, such as geographic location and full name. Processing of this data is conducted under Article 6.1(f) of the Regulation for the Company’s legitimate interests and improvement of services.
The Company will not process your personal data without your consent. However, in exceptional cases, the Company reserves the right to process your personal data to the extent permitted or required by law, or in compliance with court orders or prosecutorial directives.
The Company will search in the files of default of obligations, mortgages & mortgage notes and company data from the Official Gazette and the General Register of Companies of TEIRESIA S.A., 2 Alamanas Street, 15125, Maroussi, tel. 210-3676700 (Controller) through the checking system, any data concerning the Customer, in order to assess or reassess the assumed transaction risk in the context of the relevant transaction or, in the case of a fixed or indefinite term contract, for as long as it is in force, at the option of the Company. You can find the detailed information of TIRESIA S.A. regarding the data, the sources of their extraction and the rights of the Customer in the following link, as well as on the website of TIRESIA S.A. (www.tiresias.gr)
Disclosure to third parties
We may disclose your personal information (in whole or in part, as each time it appears) to the following entities, including but not limited to:
a) All authorized personnel of our Company, such as legal advisors, business consultants, external accountants, insurance companies, safety technicians, occupational physicians, etc.
b) Specific employees of our Company essential for the candidate selection process, such as Human Resources (HR) Department, Management, IT Manager, etc.
c) External partners (advertising agencies, media agencies for commercial promotion and research purposes, logistics companies, transportation providers, etc.) necessary for the execution of our contractual agreement.
d) Third- party affiliated companies (e.g., credit rating agencies) to safeguard the Company’s legitimate interest in transactional security, financial freedom, and access to information.
(e) Subsidiaries or affiliated companies of our Company for the fulfillment of our contractual obligations and compliance with the Company’s legal obligations.
(f) Providers of support systems for the processing of these data.
(g) Judicial, supervisory, or regulatory authorities within the scope of their jurisdiction.
(h) Third parties with a legitimate interest for the establishment, exercise, or defense of legal claims.
In cases where your consent is required for the disclosure of your data to third parties (when such disclosure is not mandated by law), it will be explicitly requested from you, and you have the right to withdraw your consent at any time. In such cases the Company ensures that it remains vigilant and takes all necessary security measures to ensure that personal data transfers are carried out in the safest possible manner.
The Company is committed not to commercialize your personal data by selling, renting, transferring, disclosing, or sharing them with third parties, nor to use them in any other way that could jeopardize your privacy, rights, or freedom, unless required by law, court order, administrative decision, or if it is a contractual obligation necessary for the proper operation of the Company’s website and the execution of its functions.
Personal data may be transferred to partners or third parties who comply with the terms of this Policy and are bound by confidentiality agreements, acting on behalf of the Company for further processing, including service provision, contract execution, data management, and technical support. These third parties are contractually bound to the Company to use personal data solely for the aforementioned purposes and not to disclose or transfer them to other parties unless required by law.
Data Retention
The retention period may vary significantly depending on the type of data and how it is used. The determination of the data retention period is based on criteria such as legal retention deadlines, pending or potential disputes, intellectual or property rights, contractual requirements, business guidelines, or archival needs.
(a) The Company is committed to retaining your resumes for three (3) years after the job positions has been filled.
(b) Your sensitive data will be deleted two (2) months after your participation in the Company’s volunteer activities (e.g., blood donation).
(c) Tax-relaed records are retained in accordance with applicable tax legislation.
(d) The Company is committed to storing your data for as long as you maintain an account on our website. You may delete your account at any time. In this case, your data will no longer be stored by us, unless otherwise required by applicable law.
(e) All data regarding your participation in campaigns, prize draws, and competitions will be retained for a maximum period of six (6) months after the end of each competition, unless otherwise stated in the specific competition terms.
(f) Personal data processed within this framework are deleted or anonymized within a maximum of fourteen (14) months, or until you withdraw your consent, whichever occurs first.
(g) Data collected through the video surveillance system are retained for up to fifteen (15) days, after which they are automatically deleted. If an incident is detected within this period, a portion of the footage will be isolated and retained for up to one (1) additional month for investigation and legal proceedings to protect our legitimate interests. If the incident concerns a third party, the footage may be retained for up to three (3) additional months.
(h) For processing purposes related to contract execution and informing you about our activities and products, the reasonable retention period for your data is determined based on the duration of the Company’s relevant commercial operations, in accordance with applicable laws governing the Company’s operations, tax obligations, and Personal Data Protection Legislation.
CCTV – Data Processing
We use a surveillance system for the protection of individuals and property. This processing is necessary for purposes of legitimate interests pursued in our capacity as the Data Controller, in accordance with Article 6.1(f) of the General Data Protection Regulation (GDPR).
Our legitimate interest lies in the need to protect our premises and the assets within them from illegal activities, such as theft. The same applies to ensuring the safety of life, physical integrity, health, and property of our staff and third parties who lawfully enter the monitored area.
We only collect image data and limit recording to areas where there is an increased likelihood of unlawful acts, such as at the entrance, without focusing on spaces where privacy may be excessively restricted, including individuals’ rights to personal data protection.
The recorded material is accessible only to authorized personnel responsible for the security of the premises. This material is not shared with third parties, except the following cases: a) To the competent judicial, prosecutorial, and law enforcement authorities when it contains information necessary for investigating a criminal offense involving persons or assets belonging to the Data Controller. b) To the competent judicial, prosecutorial, and law enforcement authorities when they lawfully request data in the course of their duties. c) To the victim or perpetrator of a criminal offense, when the data may serve as evidence of the act.
Personal Data Subject’s Rights
You have the right to request at any time:
(a) Access to your personal data.
(b) Correction of your personal data if it is inaccurate or incomplete.
(c) Deletion of your personal data, unless its processing is necessary for the exercise of the Company’s or third parties’ legal rights, compliance with a legal obligation, reasons of public interest, or the defense of our legal rights before judicial or other authorities.
(d) Restriction of the processing of your personal data for specific purposes only.
To exercise any of the above rights, please use the “Rights Request Form” and send it either, by mail to the Company’s headquarters (Ioannina, Hatzi Pellerin 2, P.C. 45221, tel. +302651061951) or by email to [email protected], always including your full details and the reason for your request.
If you exercise one of the above rights, the Company will take all possible measures to fulfill your request within one (1) month of receiving it. You will be informed in writing about whether your request has been granted, the reasons preventing its fulfillment (if applicable), and any delays beyond the one-month period, which will not exceed three (3) months. Additionally, the Company will inform you about your further rights in case of an inadequate response.
This information is generally provided free of charge, unless the request is excessive, repetitive, or clearly unfounded.
If you believe that the Company is violating data protection laws in any way, you have the right to file a complaint with the Hellenic Data Protection Authority (DPA): www.dpa.gr, Kifisias 1-3, P.C. 115 23, Athens, tel. +30 210 6475600, email: [email protected].
In such a case, we would highly appreciate prior contact with the Company, either by mail at our headquarters or by email ([email protected]), including your full details and the reason for your communication.