Website and Candidates · Version 2.0 · Last updated: 14 September 2026 · Scope: etme.gr
Data Controller: ETME S.A., Kritis 2, 154 51 Neo Psychiko, Athens, Greece. Tel: +30 210 7751608. Email: [email protected]. G.E.MI.: 121732403000.
This Privacy Policy explains how ETME S.A., which operates the website etme.gr and determines the purposes and means of the relevant processing (the “Data Controller”, “we”, “us”), collects, uses, discloses and protects personal data when you visit the website, contact us, or submit a job application.
Processing is carried out in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – “GDPR”), Greek Law 4624/2019, as in force, and the applicable legislation on electronic communications and cookies.
1. Scope and role
This Policy covers the processing of personal data connected with: (a) the technical operation and security of the website, (b) the use of the contact form or other communication channels, (c) the submission and evaluation of job applications, and (d) the management of choices for cookies and similar technologies.
The Data Controller determines why and how the above processing takes place. Providers that process data solely on our behalf act as processors. Where a third party determines its own purposes and means of processing, it acts as a separate or, as the case may be, joint controller.
This Policy does not cover third-party websites or services to which links may lead. Those services are governed by their own privacy notices.
2. What data we collect and from where
2.1 Website visit and technical operation
During your visit, the following may be processed:
- IP address, date and time of access, requested URL and basic request/response data;
- browser type and version, operating system, device type and language settings;
- technical logs, security events, failed attempts or indications of abuse;
- cookie identifiers, consent choices and the version of the relevant notice;
- navigation and interaction data only where optional analytics or other non-essential technologies are used and you have previously consented.
Certain technical data, such as the IP address and basic server logs, are necessary for the transmission of the communication, the display of the website and its security, regardless of the use of optional cookies.
2.2 Communication
When you contact us via form, email, telephone or any other available channel, we may collect:
- full name and professional contact details;
- organisation, role or department, where you provide them or they are relevant to your request;
- subject, message content, attachments and information you choose to disclose;
- communication metadata and the history of the relevant correspondence.
2.3 Job applications
When you submit an application or CV, we may collect:
- full name and contact details;
- CV, education, professional experience, skills, certifications and languages;
- position of interest, availability and other information relevant to the application;
- interview notes, assessments and communications created during the selection process;
- relevant information from professional sources or references, only where permitted and necessary.
At the initial stage you should not include date of birth, identification numbers, a photograph or other unnecessary data, unless specifically requested for a specific, lawful and documented reason.
2.4 Data sources
We receive data primarily directly from you. Technical data is generated automatically by your device, browser and our servers and, where you have consented, by analytics tools. In a recruitment context, we may receive relevant information from staffing partners, persons who refer you, or publicly available professional sources. Where Article 14 GDPR applies, we will provide you with the relevant information within the legal deadline.
2.5 Special categories of data and criminal convictions
Please do not send data concerning health, biometric data, information on racial or ethnic origin, political, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, unless strictly necessary and previously agreed.
If such data is received or exceptionally required, it is processed only where an appropriate condition of Article 9(2) GDPR applies and enhanced access restrictions are in place. Data on criminal convictions and offences is processed only under the conditions of Article 10 GDPR.
3. Purposes and legal bases of processing
The table below sets out the main processing activities. Where we rely on a legitimate interest, we assess necessity and balance that interest against your rights and reasonable expectations.
| Activity / Purpose | Data | Legal basis and legitimate interest |
| Basic operation, technical administration and security of the website | IP, access time, requests, device/browser details, technical and security logs | Art. 6(1)(f) GDPR: secure, reliable and efficient operation, prevention of abuse and investigation of incidents. |
| Recording and applying cookie choices | Choice, timestamp, consent identifier and notice version | Art. 6(1)(f) GDPR: operation of the choice mechanism and documentation of your choice, together with the applicable cookie legislation. |
| Optional analytics or other non-essential technologies, where used | Identifiers, page events, technical and approximate location data | Consent – Art. 6(1)(a) GDPR and applicable electronic communications rules. Activated only after an affirmative choice. |
| Responding to a request for a quote or other pre-contractual request | Contact details, organisation/role, request content and correspondence | Art. 6(1)(b) GDPR: taking steps at your request prior to entering into a contract. |
| Responding to a general, corporate, supplier or informational enquiry | Contact details, message and related correspondence | Art. 6(1)(f) GDPR: reasonable interest in communicating, managing requests and professional relationships. |
| Evaluating an application for a specific position | CV, qualifications, experience, communications, interviews and assessments | Art. 6(1)(b) GDPR: measures prior to a possible employment contract. Art. 6(1)(c) where required by applicable law. |
| Retaining an application for future positions | Contact details, CV and relevant information | Separate, optional consent – Art. 6(1)(a) GDPR. Refusal or withdrawal does not affect the current application. |
| Compliance with legal obligations or binding requests from authorities | Only the data required for the specific obligation or request | Art. 6(1)(c) GDPR. |
| Establishing, exercising or defending legal claims and preventing fraud or abuse | Relevant communication, security, request and application records | Art. 6(1)(f) GDPR: protection of rights, evidence, systems and legitimate interests. |
Consent and notice are not the same. Reading or acknowledging that you have received this Policy does not constitute consent to processing that is necessary to respond to your request or evaluate your current application. Where consent is required – in particular for optional cookies or additional retention of a CV – it is requested separately, with a clear and optional choice, and can be withdrawn just as easily.
4. Mandatory and optional data
Fields necessary to handle a request are marked as mandatory. If you do not provide a mandatory item – for example, a working email address so we can reply, or sufficient CV information to evaluate the application – we may be unable to complete the relevant action.
Additional items, such as telephone number, organisation, communication preferences or consent for future positions, are optional unless stated otherwise and the reason is explained. We do not request more data than is necessary for the specific purpose.
Confirmation text in forms. Any checkbox accompanying the Policy must be used as confirmation that the user has received the notice, and not as a mandatory “consent to the Policy”. Any actual consent must be separate, specific, informed, freely given and not pre-selected.
5. Cookies and similar technologies
The website may use cookies, pixels, local storage, identifiers or other technologies that store information on your device or access information already stored. These technologies fall, as applicable, under Article 5(3) of Directive 2002/58/EC, as in force, and applicable national law.
The categories used on the website are:
- Functional (always active): required for the transmission of the communication, security, operation of the website, or storage of your privacy choices.
- Preferences: remember choices you have requested, where not already strictly necessary.
- Statistics: measure website use and performance. Our statistics are collected in anonymous form on our own infrastructure; any non-anonymous statistics are activated only after consent.
- Marketing: used only if such technologies are actually installed, specifically described, and you have previously consented.
You can accept or reject the non-essential categories and change your choice at any time via the “Cookie Settings” option. Rejection is as easy as acceptance. Non-essential technologies are not activated before your consent.
The separate Cookie Policy states, for each technology, the name, provider, purpose, category, whether it is first- or third-party, the duration and any relevant international transfer. Cookie identifiers, IP addresses and device data may constitute personal data and are not automatically considered anonymous.
6. Recipients and service providers
Only those who need it for the corresponding purpose have access to the data. These may include:
- authorised staff or partners with IT, security, communications, administration, legal support or human resources duties;
- providers of hosting, cloud, email, technical support, website maintenance, cybersecurity and consent management;
- providers of analytics or other optional technologies, only in accordance with your choices;
- staffing or candidate-assessment service providers, where used and necessary;
- professional advisers, auditors, insurers or legal counsel, to the extent necessary;
- judicial, administrative, supervisory or other public authorities, where disclosure is required or permitted by law.
Where a provider acts as a processor, it is bound by a contract under Article 28 GDPR, receives documented instructions, applies appropriate security measures and does not use the data for its own purposes. Where the recipient acts as an independent controller, it must provide its own notice.
We do not sell personal data and do not share it with third parties for their own independent marketing.
7. Transfers outside the European Economic Area
The website is delivered through Cloudflare, Inc. (USA), which acts as a processor for content delivery network (CDN), optimisation and security services (e.g. protection against malicious traffic and attacks). In this context, technical data of each visitor – in particular the IP address, basic request/response data and security data – is routed through Cloudflare’s network and may become accessible from the USA.
This transfer relies on the European Commission adequacy decision of 10 July 2023 for the EU-US Data Privacy Framework (Article 45 GDPR), under which Cloudflare, Inc. is certified, and additionally on Standard Contractual Clauses (Article 46(2) GDPR) included in the data processing agreement with Cloudflare. The legal basis of the processing is Article 6(1)(f) GDPR (legitimate interest in the secure and reliable operation of the website).
Where any other transfer outside the European Economic Area (“EEA”) occurs, an appropriate mechanism under Chapter V GDPR is used (adequacy decision under Art. 45, appropriate safeguards under Art. 46 with a transfer assessment and supplementary measures where required, or another valid mechanism). The derogations of Article 49 GDPR are used only for specific and exceptional cases and not as a routine mechanism for repeated transfers. You may request information on the applicable mechanism and a copy or description of the relevant safeguards through the rights channel.
8. Retention periods
We retain data only for as long as necessary for the corresponding purpose, taking into account the nature of the data, the duration of the relationship or process, security requirements, legal obligations and applicable limitation periods.
| Category | Typical period or criterion |
| Technical and security logs | As a rule up to 30 days, unless longer retention is required to investigate an incident, prevent abuse or document a legal claim. |
| Cookie choices and evidence | For as long as necessary to apply and, where required, prove your choice, in accordance with the Cookie Policy and applicable periods. |
| Messages and general requests | For the duration of the communication and up to 24 months after the last substantive contact, unless the request develops into a contract, dispute or other relationship justifying a different period. |
| Unsuccessful applications | Up to 6 months from completion of the selection process, unless a shorter or longer period is required by applicable law or for a specific legal claim. |
| Future positions / talent pool | Up to 12 months from consent, unless you withdraw it earlier. Any extension requires a new notice and, where based on consent, a new valid choice. |
| Statistics and other non-essential technologies | In accordance with the duration of each cookie or technology stated in the Cookie Policy and until consent is withdrawn, where that is the legal basis. |
| Legal obligations and claims | For the period required by applicable law or until the final resolution of the relevant claim, process or audit. |
After the applicable period, data is securely deleted or anonymised. If a security incident, complaint, or judicial or administrative process is pending, retention may be extended only for the relevant data and for as long as necessary.
9. Your rights
Subject to the conditions of the GDPR, you may exercise the following rights. Some rights are not absolute and may be restricted where a lawful exception applies.
| Right | What it means |
| Access – Art. 15 | Obtain confirmation of whether we process your data, related information and a copy of the data. |
| Rectification – Art. 16 | Request correction of inaccurate data or completion of incomplete data. |
| Erasure – Art. 17 | Request erasure where a lawful ground applies, subject to retention obligations and other exceptions. |
| Restriction – Art. 18 | Request temporary restriction of processing in the cases provided by the GDPR. |
| Portability – Art. 20 | Receive data you provided in a structured, commonly used and machine-readable format, where processing is automated and based on consent or contract. |
| Objection – Art. 21 | Object, on grounds relating to your particular situation, to processing based on Art. 6(1)(f). For direct marketing, the objection is unconditional. |
| Withdrawal of consent – Art. 7 | Withdraw consent at any time, without affecting the lawfulness of prior processing. |
| Automated decisions – Art. 22 | Not be subject, under the conditions of Art. 22, to a decision based solely on automated processing producing legal or similarly significant effects. |
Special note on the right to object. Where processing is based on legitimate interest, you have the right to object on grounds relating to your particular situation. We will stop the processing unless we demonstrate compelling legitimate grounds that override, or the processing is necessary for legal claims.
10. How to exercise your rights
You may submit a request via the website contact form, stating “Data Protection” in the subject or body of the request. Describe your request with sufficient clarity and do not send a copy of your ID or other sensitive document unless specifically requested and necessary for secure verification.
We will respond without undue delay and, as a rule, within one month. The deadline may be extended by up to two further months where the complexity or number of requests requires it; in that case we will inform you within the first month of the extension and its reasons.
Requests are handled free of charge. A reasonable fee may be charged, or a request refused, only where it is manifestly unfounded or excessive, in particular due to its repetitive character. Where there are reasonable doubts about the identity of the applicant, only the additional information necessary for verification may be requested.
11. Automated decision-making and profiling
Within the processing described in this Policy, we do not apply decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.
If such a function is introduced in the future – for example automated ranking of candidates with a material effect – a specific legality and risk assessment will be carried out in advance and clear information will be provided on the logic, significance, envisaged consequences and available safeguards.
12. Security of personal data
We apply appropriate technical and organisational measures proportionate to the nature, context and risks of the processing, in accordance with Article 32 GDPR. Measures may include, as applicable:
- role-based access control and restriction, confidentiality obligations and staff training;
- encryption or pseudonymisation where appropriate;
- software updates, secure backups, event logging and recovery testing;
- incident and personal data breach management procedures;
- provider assessment, contractual safeguards and periodic review of measures.
No method of transmission or storage is absolutely secure. For this reason, please do not include in plain forms or messages information that is not necessary for your request.
13. Changes to this Policy
We may update this Policy when processing activities, technologies, providers or the applicable legal framework change. The current version and the date of last update are posted on the website. For material changes we will use an appropriate means of notification before they take effect, where required.
14. Contact and complaints
For questions about this Policy, for rights requests or for information on international transfers, use the contact form and select or state “Data Protection”, or write to [email protected].
You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA). Information and online services are available at www.dpa.gr. The possibility of complaint does not limit your right to seek judicial remedy.
End of Policy – Version 2.0.