General Personal Data Protection Policy - Privacy Notice
The present General Personal Data Protection Policy (hereinafter “Personal Data Protection Policy” or “PDPP”) concerns the processing of personal data carried out by the Public Benefit Foundation under the name “Bodossaki Foundation” (“the Foundation”), a private-law legal person.
General Personal Data Protection Policy - Privacy Notice
1. INTRODUCTION
The present General Personal Data Protection Policy (hereinafter “Personal Data Protection Policy” or “PDPP”) concerns the processing of personal data carried out by the Public Benefit Foundation under the name “Bodossaki Foundation” (“the Foundation”), a private-law legal person.
ΤThe Foundation attaches great importance to the protection of personal data. Therefore, it has developed the present General Personal Data Protection Privacy Policy, for the purpose of informing the visitors to its website about the processing of the personal data that the Foundation collects and further processes in the course of its activities. [as per articles 13 and 14 of Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR), hereinafter “GDPR”].
2. DEFINITIONS FOR PERSONAL DATA
(N.B.: The definitions are in accordance with art. 4 of the GDPR)
“Personal Data” means any information by reference to which a natural person (“data subject”) is identified or identifiable.
“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. In the context of the present Policy, the Foundation acts as Controller.
“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller.
“Personal data subject”: an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
“Recipient” means a natural or legal person, public authority, agency or other body to which the personal data are disclosed, whether a third party or not. Public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients.
3. COLLECTION OF PERSONAL DATA
The types of processing performed in the framework of the Foundations operation have the following characteristics:
|
Α/Α |
PROCEDURE |
CATEGORIES OF DATA SUBJECTS |
PERSONAL DATA |
PURPOSE |
SOURCES |
RECIPIENTS (external to the Foundation) |
RETENTION PERIOD |
|
1. |
EEA GRANTS Collection and evaluation of applications For more detailed information on the conditions of the specific processing (including its legal basis), see also the special privacy notice as well on the website of the programme |
(A) Person submitting the application on behalf of the applicant organisation (B) Legal representatives (C) Persons who are related to the applicant organisation and are to be employed in the project |
For category (A): (a) first name, (b) surname, (c) username (for creating an account on the platform), (d) e-mail address, (e) phone number, (f) relations of the person with the organisation applying for funding. For category (B): (a) first name, (b) surname, (c) father's name, (d) Tax Registration Number (AFM), (e) professional capacity, (f) position and duties in the project, (g) relation with the applicant organisation - form of employment, (h) mail address, (i) passport details, (j) any data, including special categories of personal data, included by the data subjects themselves in their CVs. For category (C): (a) first name, (b) surname, (c) father's name, (d) Tax Registration Number (AFM), (e) professional capacity, (f) position and duties in the project, (g) relation with the applicant organisation - form of employment, (h) mail address, (i) passport details, (j) any data, including special categories of personal data, included by the data subjects themselves in their CVs. |
Collection of the candidate organisations’ applications for the implementation of projects under the EEA GRANTS programme, Evaluation of the applications for the identification of eligible candidates, initial selection, assessment of objections, final selection and announcement of the organisations to be funded.. |
For the data regarding data subjects under category (A): The data subjects themselves. For the data regarding data subjects under categories (B) and (C): i) The legal representative or any person so authorised, ii) the General Commercial Register. |
(A) The provider of the information system – platform for the submission of applications and the management of projects (B) The Association “SolidarityNow” as Fund Operator consortium member (C) FM Office (D) Independent evaluators of the applications submitted (E) Financial auditors (F)Evaluators of the programme (G) Email provider |
3 years from the date of approval by the FM Office of the programme’s final report. The retention period might be extended where data are necessary for the establishment, exercise, or defence of legal claims or towards fulfilling legal obligations. |
|
2. |
EEA GRANTS Conclusion of Project Contract For more detailed information on the conditions of the specific processing (including its legal basis), see also the special privacy notice on the website of the programme |
Legal representative of the funded organisation |
(a) first name, (b) surname, (c) father's name, (d) Tax Registration Number (AFM), (e) professional capacity, (f) Identity Card number, (g) contact phone number, (h) e-mail address, (i) postal address for correspondence. |
Conclusion of a contract between the Foundation and the selected project promoter. |
The data subject Contact persons-persons in charge of monitoring the conclusion and execution of the contract The General Commercial Register. |
(A) The provider of the information system – platform for the submission of applications and the management of projects (B) The Association “SolidarityNow” as Fund Operator consortium member (C) FM Office (D) Independent evaluators of the applications submitted (E) Financial auditors (F)Evaluators of the programme (G) Email provider (H) Contract management and e- signature provider |
3 years from the date of approval by the FM Office of the programmes final report. The retention period might be extended where data are necessary for the establishment, exercise, or defence of legal claims or towards fulfilling legal obligations. |
|
3. |
EEA GRANTS Project monitoring For more detailed information on the conditions of the specific processing (including its legal basis), see also the special privacy notice on the website of the programme |
(A) Members of the project teams (B) Legal representatives of the funded organisations and of their partners (C) Beneficiaries of the projects’ actions |
For category (A): (a) first name, (b) surname, (c) father's name, (d) Tax Registration Number (AFM), (e) position and duties in the project, (f) form of employment - relation with the funded organisation, (g) other data that may be included in the detailed periodic report, (h) other data that may be included in submitted tax documents, (i) other data resulting from lists of expenses of any form (e.g. travel tickets, tax documents regarding accommodation services, catering services, etc.), (j) in general, any personal data included in the material collected and submitted as evidence of the implemented in the context of the project (image data - photos, audio-visual data). For category (B): (a) first name, (b) surname, (c) father's name, (d) contact phone number, (e) e-mail address, (f) Identity Card number, (g) any other data included in, or resulting from, the certificate of representation submitted by the funded organisation. For category (C): (j) in general, any personal data included in the material collected and submitted as evidence of the implemented in the context of the project (image data - photos, audio-visual data). |
Verification of the implementation of the physical and economic scope of the project. |
The data subject |
(A) The provider of the information system – platform for the submission of applications and the management of projects (B) The Association “SolidarityNow” as Fund Operator consortium member (C) FM Office (D) Independent evaluators of the applications submitted (E) Financial auditors (F)Evaluators of the programme (G) The email provider (H) The contract management and e- signature provider |
3 years from the date of approval by the FM Office of the programme’s final report. The retention period might be extended where data are necessary for the establishment, exercise, or defence of legal claims or towards fulfilling legal obligations. |
|
4. |
EEA GRANTS Promotion and communication For more detailed information on the conditions of the specific processing (including its legal basis), see also the special privacy notice on the website of the programme |
(A) Members of the project teams (B) Legal representatives of the funded organisations and of their partners (C) Beneficiaries of the projects’ actions |
(a) image data, (b) sound data, (c) any data made publicly available during the production of the audiovisual material |
Promotion and communication of the project |
The Data Subject |
(A) Photographers, videographers, providers of audio-visual services (B) The Association “SolidarityNow” as Fund Operator consortium member (C) The Provider of website services (D) Social media platforms (E) Users visiting the Foundation’s websites (F) Social media platforms users |
The audiovisual material is retained for 70 years (subject to exercise of data subjects’ rights). |
|
5. |
Bodossaki Foundation Scholarships Submission and evaluation of candidates’ applications *For more detailed information on the conditions of the specific processing (including its legal basis), see also the special privacy notice in the relevant call. |
(A) Candidates (B) Professors (C) Parents of the candidates (D) Siblings of the candidates |
For category (A): (a) full name, (b) place of birth, (c) home address, (d) fixed phone number, (e) mobile phone number, (f) e-mail address, (g) citizenship - nationality, (h) military service status, (i) upper secondary school diploma, (j) photocopy of Identity Card, (k) photograph (passport-type) of the candidate, (l) certificate of detailed grades for all years of study, (m) degree or diploma, if the candidate is a graduate, (n) certificate of marital status, (o) foreign language diploma, GMAT/GRE results, if also required by the applicant's programme, (p) other data resulting from the application or from the correspondence with the universities where the candidate wishes to pursue studies, (q) data included in the certificate of enrolment in a programme of studies (where the candidate’s programme of studies has already begun), (r) other data resulting from letters of reference from university professors, (s) data resulting from the certification of prior work experience (only for candidates wishing to obtain an MBA diploma), (t) tax forms E1, E3 and E9 and other income tax clearance statements of the candidate, (u) certification confirming that the candidate holds a PhD diploma, (v) other data which may be included in the statement of the proposed research centre. For category (B): (a) first name, (b) surname, (c) contact phone number, (d) professor’s capacity, (e) e-mail address. For category (C): (A) full name, (b) occupation, (c) home address, (d) contact phone number, (e) tax forms E1, E3 and E9 and other income tax clearance statements of the candidate and of the candidate’s parents. For category (D): (a) full name, (b) age, (c) university institution attended, (d) declaration of whether a scholarship has been awarded. |
Collection of applications, evaluation of candidates. |
For category (A): The data subject For categories (B), (C) and (D): The candidate |
(A) The provider of the information system – platform for the submission of applications and the management of projects (B) Members of the scientific committee (C) Sponsors (natural or legal persons) of scholarships for accountability purposes of the Foundation. (D) Financial auditors |
20 years from the date of submission of the application and the conclusion of a scholarship agreement. After 20 years data are archived following implementation of appropriate data protection measures. |
|
6. |
Bodossaki Foundation Scholarships Conclusion of a scholarship contract *For more detailed information on the conditions of the specific processing (including its legal basis), see also the special privacy notice in the relevant call. |
Scholars |
(a) first name, (b) last name, c) bank account number (IBAN), (d) other data included in solemn declaration. |
Finalisation of the scholarship with the conclusion of a contract between the Foundation and the scholar. |
The data subject |
(A) The provider of the information system – platform for the submission of applications and the management of projects (B) Sponsors (natural or legal persons) of scholarships for accountability purposes of the Foundation. (C) Financial auditors |
20 years from the date of submission of the application and the conclusion of a scholarship contract. After 20 years data are archived following implementation of appropriate data protection measures. |
|
7. |
Bodossaki Foundation Scholarships Monitoring – Supervision of the scholarship *For more detailed information on the conditions of the specific processing (including its legal basis), see also the special privacy notice information in the relevant call. |
Scholars |
Data regarding postgraduate-level scholarships: (a) data that may be included in the progress report, (b) data that may be included in the certificate of detailed grades, (c) copy of postgraduate studies diploma, (d) data that may be included in the summary report on scientific activity, (e) data that may be included in the work programme for the years to follow. Data regarding scholarships at the level of doctoral studies: (a) data that may be included in the progress report, (b) other data that may be included in the letter of reference, (c) other data that may be included in the copy of the PhD diploma, (d) other data that may be included in the copy of the PhD thesis, (e) data that may be included in a summary report on the scientific and professional work programme for the years to follow. Data concerning scholarships at the level of post-doctoral studies: (a) data resulting from the progress report, (b) data resulting from the final report of activities, (c) data resulting from a certification from the supervising professor, (d) any paid job as assistant or other kind of sponsorship or income from any source and if so, accompanied by the relevant amounts and periods of time during which they have been received. |
Execution of the scholarship contract and confirmation by the Foundation of the adherence to the terms agreed. |
The data subject |
(A) The provider of the information system – platform for the submission of applications and the management of projects. (B) Sponsors (natural or legal persons) of scholarships for accountability purposes of the Foundation. (C) Financial auditors (D) The contract management and e- signature provider |
20 years from the date of submission of the application and the conclusion of a scholarship contract. After 20 years data are archived following implementation of appropriate data protection measures. |
|
8. |
Bodossaki Foundation Scholarships Mentoring Programme |
Scholars (mentors, mentees) |
For the mentees: a) name, b) surname, c) email address, d) place of residence (country, city), e) year and university of scholarship, f) capacity and field of expertise, g) organization and field of work, h) Linkedin profile, i) any data included by the Data Subject itself in the application, g) any data included in the programme evaluation forms. For the mentors: a) name, b) surname, c) email address, d) capacity, e) organization and field of work, f) mentoring background/previous experience, g) any data included by the Data Subject itself in the application, h) any data included in the programme evaluation forms. |
Selection of mentors and mentees, implementation and evaluation of the Mentoring Programme |
The Data Subject |
A) The provider of the applications software B) Third party providing consulting services -supporting the Mentoring Programme C) The email provider |
The data included in the applications are deleted 1 month after the completion of the Mentoring Programme. The data included in the evaluation forms are deleted 6 months after the completion of the Mentoring Programme. The retention period might be extended where data are necessary for the establishment, exercise, or defence of legal claims or towards fulfilling legal obligations. |
|
9. |
Bodossaki Distinguished Young Scientist Awards *For more detailed information on the conditions of the specific processing (including its legal basis), see also the special privacy notice in the relevant call. |
(A) Scientists applying to be considered for the award (Β) Nominators (C) Referees |
For category (A): Data from the completion of the electronic application (application for grant): (a) full name, (b) father's name, (c) date of birth, (d) Tax Registration Number (AFM), (e) Identity Card number, (f) home address, (g) work address, (h) phone number, (i) information about the applicant’s academic career, (j) information about the applicant’s professional career, (k) other data included in the applicant’s CV, (i) details of dependent family members resulting from birth certificates of children and/or family status certificates, (m) credentials entered in the account when signing up in the online platform. Documents in support of the nomination: (a) information on scientific achievements, (b) information on publications, (c) information on the nominated candidate’s personality (as provided by the referees), (d) any personal or other data included in the documents to be submitted by the nominator and the referees. For categories (B) and (C): (a) first name, (b) surname, (c) professional-academic position, (d) contact details. |
The nomination of the award recipients. The award of the Bodossaki Distinguished Young Scientist Awards to distinguished young Greek scientists. |
The data subject |
(A) The provider of the information system – platform for the submission of applications and the management of projects (B) The Special Selection Committees (C) The Bodossaki Distinguished Scientist Awards Committee |
20 years from the date of submission of the application and the award of the Bodossaki Distinguished Young Scientist Awards. After 20 years data are archived following implementation of appropriate data protection measures. |
|
10. |
Bodossaki Excellence Awards |
(A) Nominators (Β) Proposed Scientists to be considered for the awards |
For category (A): (a) Name, (b) Surname, (c) information about the applicant’s academic and professional career, (d) contact details (phone, email, address), (e) credentials entered in the account when signing up in the online platform For category (B): Data from the completion of the electronic application (application for grant): (a) full name, (b) father's name, (c) professional – academic position, (d) phone number, (e) nationality. Where appropriate, in the nomination letter prepared by the nominator: a) information on scientific achievements, b) information on publications, c) information on personality (as provided by the nominators), d) any other personal data included in the nomination letter to be submitted by the nominator. |
The nomination of the recipients of the awards. The award of the Bodossaki Excellence Awards to distinguished Greek scientists. |
The Nominator who nominates the candidate for the award. |
A) The provider of the information system – platform for the submission of applications and the management of projects. (B) The Special Selection Committees. (C) The Bodossaki Excellence Award Committee. |
20 years from the date of submission of the application and the award of the Bodossaki Excellence Awards. After 20 years data are archived following implementation of appropriate data protection measures. |
|
11. |
Bodossaki Foundation Grants Open Grants Programme & Thematic Grants Programme et cetera. |
(A) Person submitting the application on behalf of the applicant organisation (B) Legal representative |
For category (A): (a) first name, (b) surname, (c) username (for creating an account on the platform), (d) e-mail address, (e) phone number, (f) relation of the person with the organisation applying for funding. For category (B): (a) first name, (b) surname, (c) mother's name, (d) father's name, (e) date of birth, (f) place of birth, (g) Identity Card number, (h)phone number, (i) e-mail address, (j) home address. |
The collection of applications for the selection of grants to be funded. |
The data subject |
The provider of the information system – platform for the submission of applications and the management of projects. |
20 years from the date of submission of the application and the conclusion of a grant agreement. |
|
12. |
Bodossaki Foundation Grants Open Grants Programme & Thematic Grants Programme et cetera. |
Legal representative of the grant recipient organisation |
(a) first name, (b) surname, (c) contact phone number, (d) professor’s capacity, (e) e-mail address. |
The conclusion of a grant agreement with the selected non-profit entities for the funding of their eligible expenses. |
The data subject |
The provider of the information system – platform for the submission of applications and the management of projects |
20 years from the date of submission of the application and the conclusion of a grant agreement. |
|
13. |
Management of third-party grants / programmes in partnership with third parties / donors from EU/EEA countries (“special-purpose grants”, as applicable) Collection and evaluation of applications |
(A) Persons submitting the application on behalf of the applicant organisation, representatives of the applicant organisation, members of the applicant organisation. (B) Persons who are related to the applicant organisation and are to be employed in the project. (C) Candidate beneficiary persons. |
For category (A): (a) first name, (b) surname, (c) username (for creating an account on the platform), (d) e-mail address, (e) phone number, (f) relation of the person with the organisation applying for funding. For categories (B) and (C): (a) first name, (b) surname, (c) father’s name, (d) Tax Registration Number (AFM), (e) professional capacity, (f) position and duties in the project, (g) relation with the organisation applying for funding – form of employment, (h) home address, (i) Passport / Identity card details, (j) any data included by the data subjects themselves in their CVs. |
Collection of applications for the selection of projects / actions to be funded and evaluation of the applications collected. |
i. The legal representative of the organisation submitting an application in the framework of the Programmes. ii. The data subjects themselves. iii. The General Commercial Registry (GEMI). |
(Α) The provider of the information system – platform for the submission of applications and the management of projects. Β) Original donors (foundations, companies etc., as the case may be). |
20 years from the date of submission of the application and the conclusion of a grant agreement. |
|
14. |
Management of third-party grants / programmes in partnership with third parties / original donors from EU/EEA countries (“special-purpose grants”, as applicable) Conclusion of grant agreements and monitoring of their implementation |
(A) Persons submitting the application on behalf of the applicant organisation, representatives of the applicant organisation, members of the applicant organisation. (B) Persons who are related to the applicant organisation and are to be employed in the project. (C) Candidate beneficiary persons. |
For category (A): (a) first name, (b) surname, (c) username (for creating an account on the platform), (d) e-mail address, (e) phone number, (f) relation of the person with the organisation applying for funding. For categories (B) and (C): (a) first name, (b) surname, (c) father’s name, (d) Tax Registration Number (AFM), (e) professional capacity, (f) position and duties in the project, (g) relation with the organisation applying for funding – form of employment, (h) home address, (i) Passport / Identity card details, (j) any data included by the data subjects themselves in their CVs. |
Conclusion of a grant agreement with the selected non-profit entities for funding their eligible expenses or with the beneficiary natural persons. Monitoring of the implementation of the grant agreement concluded and reporting to the original donors. |
i. The legal representative of the organisation submitting an application in the framework of the Programmes. ii. The data subjects themselves. iii. The General Commercial Registry (GEMI). |
(Α) The provider of the information system – platform for the submission of applications and the management of projects. Β) Original donors (foundations, companies etc., as the case may be). |
20 years from the date of submission of the application and the conclusion of a grant agreement |
|
15. |
“POINTS OF SUPPORT” Programme Selection of organisations to be funded *For more details of the terms of this particular processing (including its legal basis), which is performed jointly with other Foundations, see also the special privacy notice available on: https://www.socialdynamo.gr/ |
(A) Persons submitting the application on behalf of the applicant organisation, representatives of the applicant organisation, members of the applicant organisation. (B) Persons who are related to the applicant organisation and are to be employed in the project. |
For category (A): (a) first name, (b) surname, (c) username (for creating an account on the platform), (d) e-mail address, (e) phone number, (f) relation of the person with the organisation applying for funding. For categories (B) and (C): (a) first name, (b) surname, (c) father’s name, (d) Tax Registration Number (AFM), (e) professional capacity, (f) position and duties in the project, (g) relation with the organisation applying for funding – form of employment, (h) home address, (i) Passport / Identity card details, (j) any data included by the data subjects themselves in their CVs. Additionally, the personal data of members of the Board of Directors or of other statutory bodies of the organisations involved may be obtained from GEMI and processed. |
Collection and evaluation of applications, followed by the announcement of the evaluation results. |
i. The data subjects themselves. The contact persons designated as such by the applicant / funded organisations. |
The provider of the information system – platform for the submission of applications and the management of projects |
20 years from the date of the completion οf the respective Programme’s cycle. |
|
16. |
“POINTS OF SUPPORT” Programme Conclusion of grant agreements with the organisations selected for funding *For more details of the terms of this particular processing (including its legal basis), which is performed jointly with other Foundations, see also the special privacy notice available on: https://www.socialdynamo.gr/ |
(Α) Contact persons (if the legal representatives of the funded organisations do not function as such) (Β) Legal representatives of the funded organisations. |
For category (A): (a) contact details. For category (B): (a) first name, (b) surname, (c) father’s name, (d) Identity card / Passport details, (e) contact details, (f) any other data included in, or resulting from, the representation certificate submitted by the funded organisation. |
Conclusion of grant agreements and one-off payment of funds for the implementation of the actions. |
i. The data subjects themselves. The contact persons designated as such by the applicant / funded organisations. |
The provider of the information system – platform for the submission of applications and the management of projects |
20 years from the date of the completion οf the respective Programme’s cycle. |
|
17. |
“POINTS OF SUPPORT” Programme Monitoring the projects’ implementation and preparation of reports *For more details of the terms of this particular processing (including its legal basis), which is performed jointly with other Foundations, see also the special privacy notice available on: https://www.socialdynamo.gr/ |
(A) Members of the project teams (B) Legal representatives of the funded organisations and of their partners (if any) (C) Beneficiaries of the projects’ actions |
For category (A): (a) first name, (b) surname, (c) father's name, (d) Tax Registration Number (AFM), (e) professional capacity, (f) position and duties in the project, (g) form of employment - relation with the funded organisation, (h) other data that may be included in the detailed periodic report submitted by the funded organisation, (h) other data that may be included in submitted tax documents, (i) other data resulting from lists of expenses of any form (e.g. travel tickets, tax documents regarding accommodation services, catering services, etc.), (j) in general, any personal data included in the material collected and submitted as evidence of the actions implemented in the framework of the project (image data - photos, audio-visual data). For category (B): (a) first name, (b) surname, (c) father's name, (d) contact phone number, (e) e-mail address, (f) Identity Card details, (g) any other data included in, or resulting from, the certificate of representation submitted by the funded organisation. For category (C): any personal data included in the material collected and submitted as evidence of the actions implemented in the framework of the project (image data - photos, audio-visual data). |
Monitoring the projects’ implementation and carrying out related communication / promotion activities |
i. The data subjects themselves. The contact persons designated as such by the applicant / funded organisations. |
(A) The provider of the information system – platform for the submission of applications and the management of projects. (B) The users of social networks / websites, if the collected material is posted (with the data subjects’ consent) |
20 years from the date of the completion οf the respective Programme’s cycle. |
|
18. |
“POINTS OF SUPPORT” Programme Promotion and communication *For more details of the terms of this particular processing (including its legal basis), which is performed jointly with other Foundations, see also the special privacy notice available on: https://www.socialdynamo.gr/ |
(A) Members of the project teams (B) Legal representatives of the funded organisations and of their partners (C) Beneficiaries of the projects’ actions |
(a) image data, (b) sound data, (c) any data made publicly available during the production of the audiovisual material |
Promotion and communication of the project |
The Data Subject |
(A) Photographers, videographers, providers of audio-visual services (B) The Provider of website services (C) Social media platforms (D) Users visiting the Foundation’s websites (E) Social media platforms users |
The audiovisual material is retained for 70 years (subject to exercise of data subjects’ rights). |
|
19. |
“POINTS OF SUPPORT” Programme Provision of capacity-building services *For more details of the terms of this particular processing (including its legal basis), which is performed jointly with other Foundations, see also the special privacy notice available on: https://www.socialdynamo.gr/ |
(A) Trainees – members / staff pf the funded organisations (B): Trainers |
For category (A): (a) full name, (b) contact phone number, (c) capacity / position in the funded organisation, (d) image and sound data (if the training/support is provided online using a videoconferencing platform), (e) any data which may be revealed during the training/support (if the training/support us provided online using a videoconferencing platform). For category (B): (a) full name, (b) data resulting from the summary CV, (c) image and sound data (if the training/support is provided online using a videoconferencing platform). |
Provision of learning, professional support and networking services to the members of the funded organisations. |
The data subjects themselves. |
(Α) The provider of the information system – platform for the submission of applications and the management of projects. (Β) The provider of development and maintenance services for the platform using which the capacity-building services provided. |
20 years from the date of the completion οf the respective Programme’s cycle. |
|
20. |
SOCIAL DYNAMO REGISTRY OF BENEFICIARY ORGANIZATIONS |
(A) Legal representative of each organisation (B) Point of contact/representative of each organisation |
(a) full name, (b) contact phone number, (c) email address, (d) capacity/position in the organization |
Keeping record of the beneficiary organizations, communication with the beneficiary organizations – provision of information on new activities. |
I. The data subject. II. The organization’s representative/point of contact |
A) The email provider |
20 years from the collection of the personal data. After 20 years data are archived following implementation of appropriate data protection measures. |
|
21. |
CAPACITY MAP |
(A) Legal representative of each organisation (B) Point of contact/representative of each organisation |
(a) full name, (b)email address, (c) name of the organization represented, (d) credentials |
Assessing capacity of organizations via Questionnaires |
I. The Data Subject |
A) The platform/website provider |
5 years from the submission of each Questionnaire. After 5 years, Questionnaires are anonymized and remain accessible to each organization for filing purposes. |
|
22. |
NGODYNAMO: E-learning platform |
Learners |
(a) full name, (b) address (city/country), (c) platform credentials, d) details on the courses provided (list of courses, data collected in the context of e-learning) |
Platform register, provision of e-learning services (synchronous and asynchronous) |
I. The Data Subject |
A) The platform/website provider, B) The provider of the e-learning platform |
5 years from the completion of the last course/after the learner account becomes deactivated. |
|
23. |
PM4NGOs Training Partnership (DPro) Implementation of the DPro Training Programme *For more details of the terms of this particular processing (including its legal basis), see also the special privacy notice available on: https://www.socialdynamo.gr/social-dynamo-enarxi-ekpaideftikou-programmatos-diethnous-pistopoiisis-sti-diacheirisi-ergon-gia-mko-se-synergasia-pm4ngos/ |
Α) Person submitting the application on behalf of the applicant organisation Β) (Applicants) Trainees C) Trainers |
For category Α: (a) first name, (b) surname, (c) occupation, (d) organization and job position, (e) phone number, (f) email address. For category (B): Applicants: (a) first name, (b) surname, (c) occupation, (d) organization and job position, (e) field of expertise, (f) experience, (g) any data included in the applications. (Selected) Trainees: further to the above-described data: (h) date of birth and (i) results of the certification exams. For category (C): (a) first name, (b) surname, (c) occupation, (d) image data, (e) sound-video data collected during the recording of the presentations/training. |
Selection of trainees, provision of training, creation of the candidates’ profiles at the exams platform, payment of the exams fees, delivery of the certifications |
I. The data subject. II. Person submitting the application on behalf of the applicant organisation. III. Training Partner (PM4NGOs): as regards the data related to the exams and certification. |
A) PM4NGOs B) The Provider of the applications software C) The email provider |
6 months after delivering the certifications. The full name, job details (organization and position) and proof of the exams are retained for 5 years following the delivery of the certification for the purpose of the fulfilment of tax obligations as well as for the purposes of the legitimate interests pursued by the Foundation (legal claims). The retention period might be extended where data are necessary for the establishment, exercise, or defence of legal claims. |
|
24. |
Blod |
Α) Speakers Β) Organisers (natural persons) |
For category A: a) full name, b) professional capacity, c) data included in the CV (where applicable), d) image data (professional photo), e) video data (recorded during each lecture/event) For category Β: a) full name, b) organization c) image data (professional photo) |
Lecture recording and posting |
I. The Data Subject |
Α) The website provider, Β) Contractors undertaking the recording of each lecture/event, C) The personal data collected become available to the visitors/users of the website (blod) |
Upon consent withdrawal |
|
25. |
Blod: Newsletter |
NL recipients |
a) Email address |
Provision of information/updated on a daily/monthly basis regarding lectures posted |
I. The Data Subject |
Α) Email Service Provider, Β) The provider of the NL platform |
Upon consent withdrawal |
|
26. |
CERV Programmes (CERV Build, CERV Daphne etc.) Collection of applications * For more details of the terms of this particular processing (including its legal basis), which may in some cases be carried out jointly with a partner, see also the special privacy notice available on the respective Programme’s website. |
(A) Persons submitting the application on behalf of the applicant organisation, representatives of the applicant organisation, members of the applicant organisation. (B) Persons who are related to the applicant organisation and are to be employed in the project. |
For category (A): (a) first name, (b) surname, (c) username (for creating an account on the platform), (d) e-mail address, (e) phone number, (f) relation of the person with the organisation applying for funding. For category (B): (a) first name, (b) surname, (c) father’s name, (d) Tax Registration Number (AFM), (e) professional capacity, (f) position and duties in the project, (g) relation with the organisation applying for funding – form of employment, (h) home address, (i) Passport / Identity card details, (j) any data included by the data subjects themselves in their CVs. |
Collection of the applications submitted by applicant organisations for the implementation projects in the framework of the respective CERV Programme. |
i. The legal representative of the organisation submitting an application in the framework of the respective Programme. ii. The data subjects themselves |
(A) The provider of the information system – platform for the submission of applications and the management of the Foundation’s projects. (B) The competent EU institutions, bodies, and agencies responsible for the respective CERV Programme. |
Five (5) years from the date of approval of the respective CERV Programme’s completion. |
|
27. |
CERV Programmes (CERV Build, CERV Daphne etc.) Evaluation of applications * For more details of the terms of this particular processing (including its legal basis), which may in some cases be carried out jointly with a partner, see also the special privacy notice available on the respective Programme’s website. |
(A) Persons submitting the application on behalf of the applicant organisation, representatives of the applicant organisation, members of the applicant organisation. (B) Persons who are related to the applicant organisation and are to be employed in the project. |
For category (A): (a) first name, (b) surname, (c) username (for creating an account on the platform), (d) e-mail address, (e) phone number, (f) relation of the person with the organisation applying for funding. For category (B): (a) first name, (b) surname, (c) father’s name, (d) Tax Registration Number (AFM), (e) professional capacity, (f) position and duties in the project, (g) relation with the organisation applying for funding – form of employment, (h) home address, (i) Passport / Identity card details, (j) any data included by the data subjects themselves in their CVs. Additionally, the personal data of members of the Board of Directors or of other statutory bodies of the organisations involved may be obtained from GEMI and processed. |
Evaluation of the applications for identifying eligible applicants, initial selection, evaluation of objections, nomination of the organisations to be funded. |
i. The legal representative of the organisation submitting an application in the framework of the respective Programme. ii. The data subjects themselves. iii. The General Commercial Registry (GEMI). |
(A) The provider of the information system – platform for the submission of applications and the management of the Foundation’s projects. (B) The competent EU institutions, bodies, and agencies responsible for the respective CERV Programme. |
Five (5) years from the date of approval of the respective CERV Programme’s completion. |
|
28. |
CERV Programmes (CERV Build, CERV Daphne etc.) Conclusion of funding agreement * For more details of the terms of this particular processing (including its legal basis), which may in some cases be carried out jointly with a partner, see also the special privacy notice available on the Programme’s website. |
The legal representative of the funded organisation |
(a) first name, (b) surname, (c) father’s name, (d) Tax Registration Number (AFM), (e) professional capacity, (f) Identity card details, (g) contact phone number, (h) email address, (h) address for correspondence. |
Conclusion of funding agreement between the Foundation and the organisation selected for funding and one-off payment of funds for the implementation of the actions. |
i. The legal representative of the organisation submitting an application in the framework of the respective Programme. ii. The data subjects themselves. iii. The General Commercial Registry (GEMI). |
(A) The provider of the information system – platform for the submission of applications and the management of the Foundation’s projects. (B) The competent EU institutions, bodies, and agencies responsible for the respective CERV Programme. |
Five (5) years from the date of approval of the respective CERV Programme’s completion. |
|
29. |
CERV Programmes (CERV Build, CERV Daphne etc.) Monitoring, reporting, promotion and publicity of the projects funded by the Programme * For more details of the terms of this particular processing (including its legal basis), which may in some cases be carried out jointly with a partner, see also the special privacy notice available on the Programme’s website. |
(A) Members of the project teams (B) Legal representatives of the funded organisations and of their partners (if any) (C) Beneficiaries of the projects’ actions |
For category (A): (a) first name, (b) surname, (c) father's name, (d) Tax Registration Number (AFM), (e) professional capacity, (f) position and duties in the project, (g) form of employment - relation with the funded organisation, (h) other data that may be included in the detailed periodic report submitted by the funded organisation, (h) other data that may be included in submitted tax documents, (i) other data resulting from lists of expenses of any form (e.g. travel tickets, tax documents regarding accommodation services, catering services, etc.), (j) in general, any personal data included in the material collected and submitted as evidence of the actions implemented in the framework of the project (image data - photos, audio-visual data). For category (B): (a) first name, (b) surname, (c) father's name, (d) contact phone number, (e) e-mail address, (f) Identity Card details, (g) any other data included in, or resulting from, the certificate of representation submitted by the funded organisation. For category (C): any personal data included in the material collected and submitted as evidence of the actions implemented in the framework of the project (image data - photos, audio-visual data). |
Verification of the implementation of the physical and economic scope of the projects. Project promotion and publicity. Reporting to the competent EU institutions, bodies, and agencies responsible for the respective CERV Programme. |
i. The legal representative of the organisation submitting an application in the framework of the respective Programme. ii. The data subjects themselves. iii. The General Commercial Registry (GEMI). |
(A) The provider of the information system – platform for the submission of applications and the management of the Foundation’s projects. (B) The competent EU institutions, bodies and agencies responsible for the respective CERV Programme. |
Five (5) years from the date of approval of the respective CERV Programme’s completion. |
|
30. |
Provision of capacity-building services, inter alia, within the context of the CERV Programmes. * For more details of the terms of this particular processing (including its legal basis), which may in some cases be carried out jointly with a partner, see also the special privacy notice available on the Programme’s website. |
(A) Trainees – members / staff of the funded organisations (B): Trainers |
For category (A): (a) full name, (b) contact phone number, (c) capacity / position in the funded organisation, (d) image and sound data (if the training/support is provided online using a videoconferencing platform), (e) any data which may be revealed during the training/support (if the training/support us provided online using a videoconferencing platform). For category (B): (a) full name, (b) data resulting from the summary CV, (c) image and sound data (if the training/support is provided online using a videoconferencing platform). |
Provision of learning, professional support and networking services to the members of the funded organisations. |
The data subjects themselves. |
(Α) The provider of the information system – platform for the submission of applications and the management of projects. (Β) The provider of development and maintenance services for the platform using which the capacity-building services provided. C) Financial Auditors |
20 years from the date of the completion οf the respective Programme’s cycle. |
|
31. |
Management of reports/complaints |
(A) Reporting persons (B) Any person involved in the incident reported |
For category (A): (a) first name, (b) surname, (c) e-mail address, (d) any other data included in the report or collected during the investigation of the report submitted. For category (B): (a) first name, (b) surname, (d) any other data included in the report or collected during the investigation of the report submitted. |
Collecting and handling, including, but not limited to, the investigation of, all reports submitted in connection with a Programme/project or the purposes of the Foundation, in general. |
i. The Data Subject ii. The Reporting Person |
A) The Email Provider |
5 years from the date of filing/resolution of the report submitted, unless – depending on the nature of the incident reported- data should be further retained towards compliance with a legal obligation or for establishment, exercise or defence of a legal claim. |
|
32. |
Newsletter Invitations to sign-up |
Natural persons/stakeholders interacting with the Foundation |
a) Email address, b) First name, c) Surname, d) Name of the employing institution/organisation – relationship with the Foundation, e) Job position |
Sending invitations for signing-up to the Foundation’s Newsletter |
The Data Subject |
A) The Email Provider |
For as long as the data subject remains registered on our list of the NL recipients (when invitation is accepted). If the recipient of the invitation does not sign-up to the Foundation’s Newsletter, his/her contact details are not further processed/retained. |
|
33. |
Newsletter |
Natural persons on the newsletter list |
a) Email address, b) First name, c) Surname, d) Name of the employing institution/organisation, e) Job position |
Promotion and publicity of the Foundation's public benefit work and activities. |
The Data Subject himself/herself |
A) The Email Provider B) The Provider of the Newsletter software |
For as long as the data subject remains registered on our list of recipients. Deletion in case of withdrawal of consent. |
|
34. |
CVs Selection procedure |
Job Applicants |
a) Personal details (full name, age, etc.) b) Contact details (mail address, phone number, email address, etc). c) Details on education and working experience. d) Any other categories of personal data included in the CV. |
Collection of CVs and implementation of the selection procedure |
The Data Subject |
A) Third parties providing selection services |
3 years after the submission of the CV |
4. OBSERVANCE OF CONFIDENTIALITY
The Processors that perform the processing on behalf of the Foundation have agreed and contractually undertaken to observe confidentiality, not to make personal data accessible to third parties without the Foundation’s permission, to take appropriate security measures and, in general, to comply with the legal framework for the protection of personal data.
The Foundation does not, in principle, transfer personal data of the data subjects to a third country or to an international organisation. However, where this is deemed necessary, such transfer shall take place in accordance with the provisions of articles 44 et seq. of the GDPR.
Regarding ACTIVE CITIZENS FUND (ACF) - EEA GRANTS programme: The Foundation may transfer personal data solely within the European Economic Area and, in particular, to the FMO and/or other EFTA agencies, in line with its duty of accountability as Fund Operator, always in accordance with the data protection laws and regulations in force and taking appropriate technical and organizational measures to protect such personal data.
Regarding CERV Programme: The Foundation may transfer personal data exclusively within the EU in the context of its accountability as a Beneficiary of the Programme, always in accordance with applicable data protection laws and regulations and taking appropriate technical and organisational measures to protect personal data.
Regarding Points of Support Programme: The Foundation may share personal data with entities within the EU and/or Canada and Jersey (jurisdictions covered by an adequacy decision) and in particular with participating foundations in the context of the operation of the Programme, always in accordance with applicable data protection laws and regulations and taking appropriate technical and organisational measures to protect personal data.
5. TRANSFER AND STORAGE OF PERSONAL DATA
Any transfer or transmission of the personal data of the data subjects shall take place via suitable electronic systems securing the integrity and prevention of unauthorized access.
6. RIGHTS OF THE DATA SUBJECTS
In its capacity as Controller, the Foundation, in full compliance with the provisions of the legislation on the protection of personal data, shall satisfy and facilitate the exercise of the following rights of the data subjects, as such rights are provided for by the law:
6.1. Right of access
The data subjects have the right to receive from the Foundation, at any time, information as to whether or not it processes their personal data and, if it does, they may request to be informed of the purpose of the processing, the type of data that are subject to processing, their recipients, the period during which they shall be stored, the existence of their right to submit a request for the rectification or erasure of personal data or for the restriction of the processing or to object to such processing, and of their right to lodge a complaint with a supervisory authority, if automated decision-making is taking place. In addition, the data subjects shall be provided with a copy of the said personal data without undue delay.
6.2. Right to rectification
The data subject has the right to require the Foundation to rectify inaccurate or out-of-date personal data that concern them. It also has the right to require the completion of incomplete personal data, including, among other means, by an additional declaration. Furthermore, the Foundation undertakes to communicate any rectification of personal data to any recipient to whom the said personal data have been disclosed, unless this proves impossible or would entail a disproportionate effort. The Foundation undertakes the obligation to inform the data subject about such recipients upon request.
6.3. Right to erasure
The data subject has the right to request the Foundation to erase personal data that concern them, under the conditions of art. 18 of the GDPR and art. 34 of Law 4624/2019.
6.4. Right to restriction of the processing
The data subject has the right to request the Foundation to restrict the processing the personal data that concern them, under the conditions of art. 18 of the GDPR. If the processing of personal data is restricted, such personal data shall, with the exception of storage, only be processed if specific exemptions apply, in accordance with Art. 18 GDPR.
6.5. Right to the portability of the data
The data subject has the right, under the conditions of art. 20 of GDPR, to receive the personal data that concern them and which they have provided to the Foundation in a structured, commonly used and machine-readable format, as well as the right to transfer such data to another controller without objection from the Foundation to which the personal data had been provided as Controller.
6.6. Right to objection
The data subject has the right to object at any time and for reasons related to his/her particular situation to the processing of personal data that concern them, under the conditions of art. 21 of the GDPR. If the data subject objects to the processing of data that concern them, the Foundation shall no longer process such data unless it demonstrates compelling legitimate grounds for the processing which override the interests and rights of the data subject or for the establishment, exercise or defence of legal claims.
6.7. Automated individual decision-making, including profiling
The Foundation does not make use of automated individual decision-making. However, if in the future it adopts automated individual decision-making, the data subject shall in any case have the right to object to a decision based solely on automated processing, including profiling, where such decision produces legal effects that concern or significantly affect the data subject.
7. Satisfaction of the rights
Overall, the Foundation ensures that:
- Procedures are in place to allow the easy exercise of the rights of the data subjects, so that all necessary actions can be initiated immediately.
- It shall respond to a request made by the data subject without undue delay and in any event within thirty (30) calendar days at the latest. In the event that it cannot satisfy any right exercised by the data subject, the Foundation shall ensure that a specific, adequate and complete justification is provided.
- Except in cases of manifestly unfounded or excessive requests, all actions relating to the satisfaction of the rights of the data subjects shall be carried out free of charge for the data subjects.
Για την άσκηση των δικαιωμάτων που προβλέπονται από τη νομοθεσία, τη διατύπωση ερωτημάτων ή για οποιονδήποτε άλλο ζήτημα σχετικά με την επεξεργασία προσωπικών δεδομένων που περιγράφεται στην παρούσα ενημέρωση, μπορείτε να χρησιμοποιείτε τη διεύθυνση ηλεκτρονικού ταχυδρομείου: dpo@bodossaki.gr.
Σε περίπτωση που τα Υποκείμενα θεωρούν ότι η επεξεργασία των προσωπικών τους δεδομένων παραβιάζει το ισχύον κανονιστικό πλαίσιο για την προστασία των προσωπικών δεδομένων, έχουν δικαίωμα να υποβάλουν καταγγελία στην Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (ταχυδρομική διεύθυνση Λεωφ. Κηφισίας 1-3, Τ.Κ. 115 23, Αθήνα, τηλ. 210. 6475600, διεύθυνση ηλεκτρονικού ταχυδρομείου (e-mail): contact@dpa.gr).
8. Amendment of this policy (issue: July 2025)
The Foundation reserves the right to amend the present Policy, either in whole or in part, when it so deems necessary. Any amendment hereto shall take immediate effect as of its posting on the Foundation’s website. Users are advised to consult the present document at regular intervals, to make sure that they are aware of its most recent issue