Supplier and Partner Privacy Notice
NOTICE TO THE SUPPLIERS / PARTNERS OF THE COMPANY REGISTERED AS “ΤΕΚΜΕΛΛΟΝ Α.Ε.”, TRADING AS “TECHMELLON”, ON THE PROCESSING OF THEIR PERSONAL DATA IN ACCORDANCE WITH REGULATION (EU) 2016/679 AND THE RELEVANT GREEK LEGISLATION
The company registered as “ΤΕΚΜΕΛΛΟΝ Α.Ε.”, trading as “TECHMELLON”, with its registered office at 1 Lalechou Street, Psychiko, Attica, 15451, Greece (the “Company”), recognises the particular importance of its suppliers’ and partners’ personal data. In its capacity as controller, the Company hereby informs you, in accordance with Regulation (EU) 2016/679 and the relevant provisions of applicable Greek personal data protection legislation, about the types of personal data it collects, the purposes and legal bases of processing, the recipients, the retention periods and your rights as suppliers / partners of the Company.
1. Who is considered a supplier / partner?
For the purposes of this notice, suppliers / partners are those who provide products and/or services to the Company under a supply agreement, a contract for work and/or an agreement for independent services, as well as the employees of those suppliers / partners.
2. Collection of personal data
The Company collects and processes only the personal data strictly necessary to achieve each intended processing purpose. Personal data is collected directly from you at the start of your cooperation with the Company or within the existing contractual relationship and the provision of your services or products. For example, we collect the following categories of data:
- Basic information about a natural person (such as first name, surname, telephone number, email address and tax office).
- Financial data (such as invoice amounts and bank account details).
- Unique identifiers (such as a tax identification number).
In particular, data is collected through:
electronic communication, such as corporate email accounts (Gmail), file-sharing and storage platforms (OneDrive), or other information systems used in the course of our cooperation;
third-party providers’ information systems, such as the Independent Authority for Public Revenue (AADE) myDATA platform, for invoicing and payments.
In every case, the Company collects only the data necessary to manage our cooperation, fulfil its contractual and legal obligations and ensure the proper operation of its services.
Purpose of data processing
The personal data collected by the Company is processed exclusively to manage cooperation with suppliers / partners (for example, evaluating and selecting partnerships, performing contracts and managing orders, deliverables, schedules and obligations).
Data is also processed to investigate any personal data breach, notify you if you are affected and record the incident in the Company’s relevant internal register (“breach incident documentation register”). In this case, your personal data is processed to fulfil the Company’s legal obligations under Articles 33 and 34 of the GDPR.
Legal basis for data processing
Processing your data is necessary to evaluate and select partnerships, perform the contract between us and fulfil the Company’s legal obligations under Articles 33 and 34 of the GDPR concerning the investigation of personal data breaches, notification of data subjects where required and recording incidents in the internal breach documentation register.
Recipients of personal data
The recipients of your data are the Company personnel necessary in each case, who have received appropriate information about the secure processing of your personal data.
Additional recipients of your data are:
Natural and legal persons to whom the Company assigns specific tasks on its behalf, such as email service providers, including Google Ireland Ltd. as a provider of email and related cloud services, and providers of IT, system support and maintenance services. These partners, acting as personal data processors, have been informed in advance and have committed to maintaining the confidentiality of your data. They know and follow our instructions on processing personal data and take all appropriate measures to protect it.
The banking institution where deposits are made to execute payments and process the related transactions.
Supervisory, audit, independent, judicial, public and/or other authorities and bodies acting within their statutory responsibilities, duties and powers (such as AADE for electronic transmission of invoices and tax compliance through the myDATA platform), where disclosure is required or provided for by law; also statutory auditors or audit firms, lawyers, bailiffs and notaries where disclosure is necessary to fulfil the Company’s contractual obligations, exercise its rights or defend its interests, or is required by legislation, court decisions or regulatory decisions of the Hellenic Data Protection Authority or other independent authorities.
Any other recipient to whom the Company has a legal obligation to transfer the data, or who has a statutory right to receive it.
Transfers of data to countries outside the European Economic Area (EEA) or to an international organisation
For the processing purposes described above, the Company does not transfer your data outside the EEA. Only exceptionally may your data be transferred to countries outside the EEA through the use of specific information systems and software services, such as the United States of America, Israel and the United Kingdom, due to the use of email services (Gmail – Google Ireland), storage and collaboration services (OneDrive – Microsoft), and other information systems used to manage cooperation and execute payments.
The legal basis for transferring your data outside the EEA for the above purposes is that processing is necessary to perform the contract between us, comply with the Company’s statutory obligations and safeguard its legitimate interests, in accordance with Articles 6 and 45–46 of the GDPR. Transfers also rely either on a European Commission adequacy decision (such as the EU–US Data Privacy Framework for transfers to the United States, and adequacy decisions for Israel and the United Kingdom) or on the Standard Contractual Clauses under Article 46(1)(c) of the GDPR for countries not included in the list of approved countries, including the Standard Contractual Clauses implemented by the respective service providers.
Data retention period
The Company has established and applies the following retention periods when processing your personal data. Your data is retained only for the time strictly necessary to achieve each individual purpose.
Data relating to invoices and other tax documents is retained for six (6) years, in accordance with Article 84(1) of Law 2238/1994 and Law 4174/2013 (Tax Procedure Code).
Other supplier / partner data, such as contact details, contractual information and other data not subject to specific tax obligations, is retained for five (5) years from the completion of the contract or cooperation between us, on the basis of the general provisions on limitation periods for civil claims and the principles of the GDPR.
In the event of litigation, your personal data will in every case be retained until a final, unappealable court decision is issued.
Rights of the personal data subject
Under the GDPR, as a data subject you have the following rights, which may be exercised as applicable:
Right of access to your personal data
You have the right to obtain confirmation from the Company, as controller, as to whether personal data concerning you is being processed, to access information about how your personal data is processed (such as processing purposes, data categories, recipients and retention period), and to receive a copy of your data.
Right to rectify / complete your data
You have the right to ask the Company to rectify inaccurate data without undue delay or to require incomplete personal data to be completed, including by providing a supplementary statement.
Right to erasure / right to be forgotten
You have the right to ask the Company to erase data concerning you where its processing is unlawful or is no longer required to achieve the above purposes.
Right to restriction of processing
You have the right to obtain from the Company restriction of the processing of your data to storage alone, under the conditions laid down in the General Data Protection Regulation (EU) 2016/679.
Right to object to the processing of your data
You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you where processing is based on the Company’s legitimate interests.
Right to data portability
You have the right to receive the personal data concerning you that you have provided to the Company in a structured, commonly used and machine-readable format, and the right to transmit that data to another controller without objection from the controller to whom the personal data was originally provided.
Right to withdraw your consent
Where the processing of your data for a specific purpose is based on your prior consent, you have the right to withdraw that consent, so that processing will not continue in the future.
The Company may be unable to fulfil the above rights to the extent that the legal conditions for exercising them are not met, or an exception provided for by the General Data Protection Regulation (EU) 2016/679 applies.
Exercising your rights
If you wish to receive further information about the processing of your personal data or exercise any of the above rights, you may contact the Company:
by post at its offices:
1 Lalechou Street, Psychiko, Attica, 15451, Greece
For the attention of: the Data Protection Officer (DPO)
by email to the Company’s Data Protection Officer (DPO) at dpo@techmellon.com.
We will respond to your request within one (1) month of receiving it, at no cost to you. This period may be extended by a further two (2) months because of the complexity or number of requests. In that case, you will be informed of the extension and its reasons as soon as possible and no later than one month after receipt of the request.
Lodging complaints
If you consider that (a) a request has not been adequately and lawfully fulfilled, or (b) your right to personal data protection is infringed by processing we carry out, you have the right to lodge a complaint with the Hellenic Data Protection Authority (https://www.dpa.gr/el/polites/katagelia_stin_arxi).
Personal data security
The Company implements an information security management system to ensure confidentiality and the security of data processing, and to protect data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, and any other form of unlawful processing.
We are committed to having appropriate organisational and technical measures in place to secure and protect your data against any form of accidental or unlawful processing. Our specifically authorised personnel who process your personal data have received appropriate training, guidance and information.
The measures we take are reviewed and amended regularly or whenever necessary in light of new needs and technological developments.
The supplier / partner must maintain strict confidentiality regarding all information received or obtained in the course of this cooperation and comply fully with all of the Company’s information security policies, procedures and requirements as in force from time to time. This obligation includes, without limitation, implementing appropriate technical and organisational protection measures, restricting access to authorised personnel only, promptly notifying any security incidents and ensuring that any subcontractors are bound by equivalent obligations. These obligations remain in force after the contract ends.
This notice replaces all previous notices provided to you about the processing of your personal data.