PRIVACY AND PERSONAL DATA PROTECTION POLICY

Α. GENERAL PART INTRODUCTION

RECOM REPOWER S.A. places a great emphasis on the harmonization of its practices with the written legislation. In this context, it maintains and processes your personal data with confidentiality and respect for your privacy, always taking the necessary technical and organizational measures for their further protection, modifying their security and processing policy, in accordance with the General Regulation of the European Union on the Protection of Personal Data (GDPR).

This Privacy Policy (hereinafter "Policy") concerns the conditions for the collection, storage, preservation, processing and use of your personal information by RECOM REPOWER S.A. (hereinafter “RECOM REPOWER S.A.”).

TERMS / CONCEPTS

The basic definitions of the terms and concepts that will be used in this document, as referred to in Article 4 of the General Regulation on the Protection of Personal Data 2016/679/EU are as follows:

Personal Data: means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Personal Data of Special Categories (sensitive): Personal data which are by nature particularly sensitive in relation to fundamental rights and freedoms are considered sensitive and therefore need special protection, as the context of their processing could create significant risks to fundamental rights and freedoms. These personal data include personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

It is clarified that all personal data of minors under the age of 16 are sensitive by definition and are treated as such.

Processing: any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Controller: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

Processor: means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
Every organization, regardless of its type, legal form and size, that keeps and processes personal data, is called a controller.

Any natural or legal person in the public or private sector who processes data on behalf of a controller is called a processor.

(For example, an accounting firm to which the organization outsources the payroll of its employees).

Recipient: a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.

Profiling: any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Authority: The Personal Data Protection Authority.

RECOM REPOWER S.A. is designated as a controller and strictly adheres to the data protection principles set out in Article 5 of the General Data Protection Regulation.

Β. SPECIAL PART

1. WHAT IS THE PURPOSE OF THE UNDERTAKING?

The main purpose of RECOM REPOWER SA is, among other things, the production of electricity from photovoltaic systems.

2. WHAT DOES PERSONAL DATA MEAN?

The term "personal data" or "data", as used in this Policy, refers to information of natural persons (such as first name, father’s name, mother’s name, postal address, postal code, contact telephone number (landline/mobile), email address), hereinafter refereed to as "Personal Data or Data".

3. WHAT IS PERSONAL DATA PROCESSING?

Personal Data Processing is any act or series of acts carried out with or without the use of automated means, either in electronic form (soft copy) or in paper form (hard copy), on personal data, such as the collection, registration, organization, classification, structure, storage, adaptation, alteration, retrieval, information retrieval, use, transmission to third parties, dissemination, association, combination, restriction, deletion and destruction of Personal Data of natural persons.

4. WHAT DATA DO WE COLLECT ON YOU?

RECOM REPOWER SA collects all the necessary data of its counterparties (its clients) for the preparation and execution of the contract for the provision of its services or for the carrying out the communication between us following your express consent, and in particular:

(A) In the context of an upcoming or existing business relationship with RECOM REPOWER SA, the Company may process the following categories of personal data of its business partners:

(a) Identity and contact information, such as name, tax identification number, social security number, address, telephone number, mobile phone number, fax number, e-mail address provided to us by the counterparty or his/her representative for his/her identification and our communication with him/her.

(b) Specifically in the energy sector, details of the installation of photovoltaic equipment lease, title deed, copies of contracts, extracts of cadastral maps, copies of cadastral sheets, copy of mortgage deed, bills or previous supplier, electricity and natural gas consumption data received from customers and/or the relevant operators, bank account numbers that you provide to us, details of transactions and execution of payments carried out within the framework of a contractual relationship with the Company.

(c) Any credit and integrity information (information regarding court cases or other legal proceedings against business partners) collected from publicly available sources, databases and credit rating agencies in case of financing.

(B) When visiting and browsing the website https://re-power.com/en/

When you browse the website https://re-power.com/en/ we collect anonymous information such as your IP address, your geographic location (via GPS) and basic web log information such as the type of your browser and/or the operating system of your mobile device and the pages you browsed/navigated in on the website, the language of the browser, the date and time the service offered to a User, etc. We may identify the pages that led you to our software, although we do not associate this information with your personal information.

(C) Information from communications

You acknowledge that RECOM REPOWER SA may keep a record of the written letters, e-mails or other messages and generally any written communications you have exchanged with RECOM REPOWER SA for any reason and especially regarding your cooperation with it.

Furthermore, you agree that it shall record and keep them on file for security reasons and for the purpose of ensuring compliance with the Terms of Use of the Application and for reasons of quality of your communication as a User of the website.

(D) Information on transactions through the website https://re-power.com/en/

During your visit and navigation on the website of RECOM REPOWER SA apart from the above, we do NOT collect your Data, except what is collected by the cookies you have allowed through of your consent to be used and specifically, the only cookies used by the page are of the categories:

(i) Essential Cookies and

(ii) Functionality Cookies, which are both necessary for the website to function properly.

(iii) Advertising Cookies

(iv) Analysis Cookies

The information they collect is anonymous and does not track browsing activity on other websites.

5. FOR WHAT PURPOSE DO WE PROCESS YOUR DATA

We collect your Data exclusively and solely for the purposes of:

(a) the service provided by RECOM REPOWER SA for the purpose of either drawing up and executing the contract between us or for carrying out the communication between us, after of your express consent;

(b) sending informational messages via e-mail, SMS or other electronic means regarding general offers;

(c) sending you more special offers that are tailored to you;

(d) compliance of RECOM REPOWER SA with the obligations imposed by the applicable legislation, e.g. issuance of tax documents etc.

We may use your Personal Data to create anonymous information files and/or to provide third parties with benchmarking and aggregate statistics about our Services. Benchmarking and aggregate statistics are anonymous and do not contain personally identifiable information, nor are they transferred or sold to third parties in any way or form that identifies or makes you identifiable.

We use browsing data on our website to operate and improve it, to diagnose problems with our server and to manage the software, to gather demographic and statistical data, to better advertise and layout the website, to facilitate your recognition/identification during a specific session, etc. Your IP address does not contain any personal information about you.

We use User/Customer reviews to inform Customers about the quality of your work and the services you provide.

RECOM REPOWER SA does not use such data for purposes other than those related to the proper provision of our services and security, always with a view to providing high level services and ensuring our company's compliance with applicable legislation.

6. LINKS TO THIRD PARTY WEBSITES

The website https://re-power.com/en/ may provide links to other websites or applications (e.g. social media), maintained by third parties. Links to any such third party website or application are provided for your convenience only.

RECOM REPOWER SA bears no responsibility for the content of any linked website or application, nor is it responsible for the data that may be collected by them.

RECOM REPOWER SA does not endorse or make any representations about these linked websites or any information, software or other products, services or materials found there, or any results, which may arise from their use. If you decide to access any third party website linked to this website, you do so entirely at your own risk.

7. WHAT IS THE LEGAL BASIS OF DATA PROCESSING BY RECOM REPOWER SA

Data are processed with a view to performing any contract between us for the provision of our services, for informing you about activities of RECOM REPOWER SA to you, for the security of our transactions and customers, as well as for RECOM REPOWER SA to communicate with you, only after your express consent, in written or digital form.

8. ARE DATA USED FOR OTHER PURPOSES, FOR EXAMPLE, FOR PROMOTING PRODUCTS AND/OR SERVICES?

RECOM REPOWER SA does not use such data for purposes other than those mentioned above, which are related to the proper provision of our services, always with a view to providing high level services and ensuring our company's compliance with applicable legislation.

9. WHO ARE THE RECIPIENTS OF THE DATA

We collect and process your personal data only after your express consent and to the extent that this is absolutely necessary. Recipients of the Data are the absolutely necessary personnel of RECOM REPOWER SA (regardless of whether they are connected to it under a dependent employment contract of a fixed or indefinite term, part-time employment, project contract or other form of employment relationship), as well as its subsidiaries and the staff of its subsidiaries, its external partners, agents, assistants and counterparties, who have taken note of this protection policy and the Privacy Policy and are bound by them and have also been bound by a confidentiality agreement.

RECOM REPOWER SA is the recipient of the transmission of the personal data of visitors / users / customers / subscribers for safekeeping and further processing them.

Moreover, RECOM REPOWER SA may provide, with your consent, access to your contact details (mobile phone or e-mail) to external Partners as part of contracts for the purpose of creating personalized offers of products and works depending on the object of these Partners). Such notification shall only concern the above contact details (name, surname, mobile phone and e-mail) and not all of your personal data and shall be made exclusively for the purposes of promoting and advertising services and products with special personalized offers addressed to the subscribers of RECOM REPOWER SA.

Subject to the above, we will NEVER sell, rent, distribute, or otherwise disclose your personal date unless we are required to do so by Law.

10. HOW DO WE ENSURE THAT PROCESSORS RESPECT YOUR PERSONAL DATA?

Processors have agreed and contractually undertaken towards RECOM REPOWER SA:
• to keep confidentiality,

• not to share Data with third parties without the express permission of RECOM REPOWER SA,
• to take all appropriate security measures,
• to comply with the legislative framework for the protection of personal data and in particular with the GDPR Regulation.
• RECOM REPOWER SA takes all appropriate technical and organizational security measures so that the personal data processed are accurate and, when necessary, promptly updated.
• RECOM REPOWER SA takes all necessary steps so that any data that are inaccurate or incomplete be immediately deleted or corrected. The personal data that are processed are suitable, proportionate and relevant to the needs of the service provided to the customer, the fulfilment of the contractual obligations of both parties and are collected only for defined, clear and legal purposes, as stated above and in the relevant contracts.
• The processing of personal data by RECOM REPOWER SA is carried out in a way that ensures its privacy and follows rules and other procedures to protect personal data from any unauthorized access, misuse, alteration, prohibited dissemination, disclosure, loss or accidental/wrongful destruction and any other form of wrongful processing. RECOM REPOWER SA implements technical and organizational security policies and procedures in order to protect the personal data it collects from potential breach, loss, misuse, alteration or destruction.
• RECOM REPOWER SA conducts internal audits of the personal data processing procedures to review the effectiveness of the measures applied to protect personal data.
• Specifically authorized persons have access to the data processing systems through which personal data are processed or used only in accordance with the instructions of RECOM REPOWER SA. The data processing systems cannot be used by unauthorized persons, the persons authorized to use the data processing systems have access exclusively to the data for which they are authorized, the personal data cannot, during their processing or use, or after their registration, be read, copied, modified or moved by unauthorized persons of RECOM REPOWER SA.
• Access to personal data is limited to the persons authorized in the context of their duties to RECOM REPOWER SA on a need-to-know basis. Persons who have access to the data are required to maintain the confidentiality of that data.

11. HOW LONG IS YOUR DATA KEPT?

As a general rule, all of the subjects' personal data are deleted/destroyed upon termination of our contractual relationship, unless the subjects' express consent has been obtained for their retention for a certain or indefinite period of time.

The retention period of the Data is also determined by the retention obligation imposed by the current legislation governing the contractual and fiscal obligations of RECOM REPOWER SA.

By way of exception, it is possible to extend the duration of the retention of the Data for the purpose of proving the fulfilment of contractual obligations by the company before the courts or if required by a rule of law or compliance with the instructions of Public or Independent Authorities.

12. ARE YOUR DATA SECURE?

RECOM REPOWER SA is committed to safeguarding your Personal Data.
We have taken appropriate organizational and technical measures to keep Data secure and protected against any form of accidental or unlawful processing. The security measures are reviewed and modified every time it is deemed necessary to meet the conditions and specifications set by the current legislation.

The following rules, among others, describe how and where the data are kept. Data kept in paper records are stored in a place where they cannot be seen by unauthorized persons. The same applies to records that are kept electronically, but for some reason have been printed.

The following important points are noted:

• Folders and data in paper form are kept in a file cabinet, which is locked.
• Employees make sure that printouts are not left in place where they may be accessed by unauthorized persons, such as in or near the printer.
  • Printed data, which are not in use, are destroyed. In the event that data are stored electronically, they are protected from unauthorized access to them, from accidental destruction and interception attempts. More specifically:
• Data are protected by strong passwords, which are changed frequently and not disclosed to unauthorized employees.
• In the event that data are stored on portable media (such as CDs, etc.), these are stored securely when not in use.
• All servers and computers containing data are protected by an approved software and a firewall.
• Processing of your Data is permitted only to persons authorized by us, our employees and partners exclusively for the above mentioned purposes.
• RECOM REPOWER SA conducts regular audits and inspections to determine data security and the implementation of the Policy.

13. WHAT ARE YOUR RIGHTS?

You have a right to access your personal data.

This means that you have the right to be informed by us if we are processing your Data. If we are processing your Data, you can ask to be informed about the purpose of the processing, the type of your Data we keep, to whom we give them, how long we store them, whether automated decision-making takes place, but also about your other rights, such as correction, deletion of data, restriction of processing and filing a complaint with the Personal Data Protection Authority.

You have the right to rectify inaccurate personal data.

If you find that there is an error in your Data, you can submit a request to us to correct them (e.g. correct a name or update an address).

You have the right to deletion/right to be forgotten.

You can ask us to delete your data if they are no longer necessary for the aforementioned processing purposes.

You have a right to portability of your Data.

You can ask us to receive the Data you have provided in readable form or ask us to pass them on to another controller.

You have the right to restrict processing.

You can ask us to restrict the processing of your Data pending consideration of your objections to the processing.

You have a right to object to the processing of your Data.

You can object to the processing of your Data or withdraw your consent and we will stop processing your Data, unless there are other compelling and legitimate reasons that override your right.

14. HOW CAN YOU EXERCISE YOUR RIGHTS?

To exercise your rights, you can send us a relevant request, describing the right you want to exercise, either to the postal address of our Company that you will find on our website https://re-power.com/en/ with the indication "Exercise of the right of access/rectification/deletion/restriction/objection", or to the email address dpo@re-power.com with the subject “Exercise of the right of access/rectification/deletion/restriction/objection”, with a description of your request, and we will make sure to look into it and respond to you as soon as possible.

15. WHEN DO WE RESPOND TO YOUR REQUESTS?

We respond to your requests free of charge without delay, and in any case within (1) one month of receiving your request. However, if your request is complex or there are several requests, we will inform you within the month if we need to obtain an extension of another (2) two months, within which we will respond to you.

If your requests are manifestly unfounded or excessive in particular due to their repetitive nature, RECOM REPOWER SA may impose a reasonable fee, taking into account the administrative costs for providing the information or performing the requested action or refuse to act on the request.

16. WHERE CAN YOU CONTACT TO BE INFORMED OF THE PROGRESS IN YOUR REQUESTS?

For more information you can call +30 2107001640 or email dpo@re-power.com using the title: "Progress of Request”.

17. DO WE USE AUTOMATED DECISION MAKING/INCLUDING PROFILING WHEN PROCESSING YOUR DATA?

NO, we do not make decisions, nor perform profiling, based on automated processing of your Data.

18. WHAT IS THE APPLICABLE LAW WHEN YOUR DATA ARE PROCESSED BY RECOM REPOWER SA?

We process your Data in accordance with Regulation 2016/679/EU (the General Data Protection Regulation), and in general the applicable national and European legislative and regulatory framework for the protection of personal data.

19. WHERE CAN YOU GO IF WE BREACH THE APPLICABLE LAW ON DATA PROTECTION?

You have the right to file a complaint with the HELLENIC DATA PROTECTION AUTHORITY (Kifissias 1-3, Athens/www.dpa.gr), if you consider that the processing of your Personal Data violates the applicable national and regulatory legal framework for the protection of personal data.

20. HOW WILL YOU BE NOTIFIED OF ANY CHANGES TO THIS POLICY?

We will update this Policy whenever this is deemed necessary in order to respond to the current national and European legislative and regulatory framework for the protection of personal data. If there are any significant changes to the Policy or the way we use your Personal Data, we will post them in a prominent place on our site. 

We encourage you to regularly read this Policy to know how your Data are protected. RECOM REPOWER SA is the controller of the personal data of natural persons or personal businesses it receives.

If you wish to contact us about any issue related to the processing of your Data and the exercise of your rights, you can contact the email address dpo@re-power.com.