|
Privacy Policy
We would like to assure you that the Gas Distribution Company Thessaloniki - Thessalia S.A., based in Thessaloniki, 256 Monastiriou and 7 Glinou Street, with TIN 099771679 and telephone numbers 2310-584000 & 2410-582300 (EDA THESS), attaches particular importance to the protection of personal data of natural persons involved in any way with the company. For this reason, we take appropriate measures to protect the personal data we process and to ensure that the processing of personal data is always carried out in accordance with the obligations set by the legal framework, both by the company itself and by any third parties processing personal data on our behalf. EDA THESS, therefore, implements the appropriate technical and organizational measures aimed at the safe processing of personal data and the prevention of accidental loss or destruction, unauthorized and/or illegal access, use, modification or disclosure.
For EDA THESS, the privacy and security of our website Users and Visitors, as well as End Customers and External Partners, is considered of the utmost importance. EDA THESS is committed to protecting the personal data you share with us. This privacy policy includes the ways in which EDA THESS processes information that can be used to directly or indirectly identify an individual ("Personal Data"), collected when using the EDA THESS website and its platform.
Our website is in compliance with the General Regulation 2016/679 of the European Parliament and of the Council of April 27, 2016, for the protection of natural persons against the Processing of personal data and for the free movement of such data ("GDPR Regulation "), which is a directly binding legislative act.
The terms of this policy apply to:
The "Users" or "Visitors", i.e. the persons who visit our website (www.edathess.gr), the "End Customers" or "Customers" i.e. the persons who contract with EDA THESS for their connection to the Natural Gas Distribution Network, as well as its External Partners, i.e. those collaborating with EDA THESS, contractors, engineers, boiler installers, etc.
Any processing of personal data by EDA THESS is performed in such a way as to ensure their confidentiality. All information is stored securely and access to it is allowed only to authorized personnel. EDA THESS implements and develops the necessary technical and organizational measures to protect the Personal Data of Users/Visitors, End Customers, as well as External Partners (all designated as "Subjects" of personal data) against unauthorized or illegal processing and use, as well as against possible loss, destruction, damage, theft or illegal access.
EDA THESS collects only personal data that are necessary to meet your requests. Whenever additional or optional information is sought, you shall be informed at the time of data collection and your prior consent to processing may be required.
The current legislative framework allows personal data processing only if we have the legal grounds for such a procedure. We shall also inform you of the reasons for processing. Thus, when processing your personal data, we rely on one of the following legal grounds:
Consent: Your consent may be required in order some of your personal data to be processed. Your personal data shall be processed in this way only if you explicitly agree to this (Article 6(1a) of GDPR Regulation).
Contract: When your personal data processing is necessary for performance of a contract between us (Article 6(1b) of GDPR Regulation).
Legal obligation: In case we are compelled to process your personal data in order to comply with a legal obligation, such as, without being limited to: (a) record keeping for tax purposes; (b) data provision to a public body; (c) complying with the requirements of a legislative or regulatory provision (Article 6(1c) of GDPR Regulation).
Vital interests: In case your personal data processing is necessary to protect your vital interests (Article 6(1d) of GDPR Regulation).
Public interest or authority: In cases when your personal data processing is necessary to fulfil an official function or perform a task carried out in the public interest (Article 6(1e) of GDPR Regulation).
Legitimate interest: Your personal data may be processed in cases when such processing constitutes a legitimate interest of our company in performing a legitimate activity in order to ensure the continuity of such an activity. This processing, of course, shall not go beyond any of your interests, freedoms and fundamental rights (Article 6(1f) of GDPR Regulation).
EDA THESS collects special personal data as defined in Article 9 of GDPR Regulation when the individuals themselves, without being requested, provide us with such data or when the data are required or their collection is permitted by law.
“Special Personal Data” include those relating to an individual’s race, nationality, political beliefs, participation in trade unions, religious and philosophical beliefs, physical or mental health, sexual orientation, as well as any criminal record data.
EDA THESS collects the Subjects’ personal data through Customer service line, Emergency line, Customer Service Offices, Distribution Users, and the Company’s website.
The following sections cover the Subjects whose personal data are collected.
EDA THESS may collect and process personal data of Website Visitors, Customers, Candidate Employees, Suppliers, Engineers, Construction Contractors, and Combustion Installers.
If required by the current legal framework, we shall ask for your explicit consent to your personal data processing as collected by EDA THESS.
It should be noted that your consent is absolutely optional. However, if you do not give the consent required for your Personal Data processing, you may not be able to use these services.
Your personal data processed by EDA THESS is the following:
User’s/ Visitor’s Personal Data: Full name, fixed or mobile phone number, IP address, e-mail, and Electronic Delivery Point Identification Code.
Candidate’s Employee Personal Data: Full name, fixed or mobile phone number, e-mail, Curriculum Vitae.
Customer’s Personal Data: Full name, home address, ID card number, TIN number, Tax Office, Electronic Delivery Point Identification Code, bank account number, fixed and mobile phone number and e-mail.
Engineer’s / Combustion Installer’s Personal Data: Full name, address, fixed and mobile phone number, e-mail.
Supplier’s Personal Data: Full name, address, fixed and mobile phone number, e-mail.
Sensitive Customer’s Data: Indication Disabled, health and disease data based on priority and extension requests.
EDA THESS shall not retain Subjects’ Personal Data beyond the term necessary to fulfill the purposes for which it was collected or as required by the current legal framework.
EDA THESS does not disclose your personal data to any third parties outside the European Union, in countries without a proper data protection regime. However, if such data transfer is required, EDA THESS shall take any possible action to ensure your data is safe, as within the EU/ EEA and in compliance herewith and any applicable law. Furthermore, EDA THESS shall update hereof to cover cross-border data transfer and all respective privacy safeguards for its Platform Users.
EDA THESS collects aggregated traffic data on its website, including the number of visitors and visits, geographic location data, time on website, and number of clicks on its links.
i) For Website Visitors – personal data are collected through the contact form to serve your network connection request, to inform you of any EDA THESS offers and news, as well as to improve the Company website and facilitate Visitor access. Thus, in order to provide such data, Website Visitors consent to their data registration; failure to provide such data shall affect or hinder the outcome of any request as no EDA THESS offers and news shall be communicated. As regards website improvement and facilitation of Visitor browse, please refer to our Cookies Policy. For the above mentioned purposes, EDA THESS, in its role as Processor, processes the following personal data: Full Name, Fixed or Mobile Number, IP Address, e-mail, and e-EIC.
The EDA THESS website features a special field where Visitors give their explicit consent to receive the relevant Company’s Newsletter.
Without your consent for the above mentioned purpose, no Newsletter shall be sent to you. Furthermore, you should be aware of that you may revoke your consent at any time free of charge.
ii) For Candidate Customers – personal data are collected through the expression of interest to conclude a Natural Gas Connection Contract. Thus, in order to provide such data, the legitimate basis is the execution of the contract; failure to provide such data shall affect or hinder the outcome of Natural Gas Connection Contract. For the above-mentioned purposes, EDA THESS, in its role as Processor, processes the following personal data: Full name, address, ID card number, TIN number, Tax Office, bank account number, fixed and mobile phone number, e-mail. The above mentioned data is processed by the EDA THESS for the following tasks:
It should also be noted that in case of such supporting documents comprising sensitive personal data to serve any extension and priority requests collected by the Company, your explicit consent is required in order to have such data processed (sensitive data).
Without your consent, we may not be able either to serve your needs or perform some of the tasks necessary for the above-mentioned services. Furthermore, you should keep in mind that you may revoke such consent at any time free of charge.
In addition, you should be aware of that your personal data are processed to update your subscription fees only on your consent, which can be revoked at any time free of charge. I the event that your consent is not given, neither your data shall be processed for this reason nor your request met.
Additionally, EDA THESS may process personal data from the CCTV system, externally installed to the Company’s headquarters and Customer Service Offices. Such process constitutes a legitimate interest of EDA THESS to monitor its premises for security purposes.
ii) For Customers – personal data provision for the purposes of signing a Natural Gas Connection Contract is a contractual obligation, and failure to provide such data shall affect or hinder proper implementation of such an Agreement. For the above-mentioned purposes, EDA THESS, in its role as Processor, processes the following personal data: Full name, address, ID card number, TIN number, Tax Office, e-EIC, bank account number, fixed and mobile phone number, e-mail. The above-mentioned data is processed by the EDA THESS for the following tasks:
In addition, provision of the above-mentioned personal data is compulsory for EDA THESS compliance with its legal obligations regarding its legislative and regulatory framework (“Natural Gas Network Code”), as well as any Judicial or other Public Authority and Service for the following tasks:
EDA THESS may process personal data when “processing is necessary for the purposes of the legitimate interests pursued by [the Company], except for when such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require personal data protection.”
The following cases constitute a non-exhaustive list of legitimate interests sought in relation to the processing of Customer’s personal data, so that to successfully accomplish corporate operational purposes:
iii) For Candidate Employees – personal data provision for candidates’ recruitment assessment/evaluation and hiring procedure. Such process legitimate basis has the execution of the contract and is implemented to achieve the best possible staffing of the Company. EDA THESS, in its role Processor, processes the following personal data: Full name, fixed or mobile phone number, e-mail, Curriculum Vitae, any CV supporting documents (e.g. diplomas, etc.).
iv) For Suppliers – personal data provision for suppliers’ payment for providing goods/services and management of suppliers’ contracts, constitutes a contractual obligation, and failure to provide such data shall affect and hinder proper contract performance. EDA THESS, in its role as a Processor, processes the following personal data: Full name, address, ID card number, TIN number, Tax Office, fixed and mobile phone number, e-mail.
Furthermore, EDA THESS may process personal data when “processing is necessary for the purposes of the legitimate interests pursued by the Company, except for when such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require personal data protection.”
The following cases are indicative of the legitimate interests pursued in relation to the processing of supplier personal data to achieve the corporate purposes below:
For the above-mentioned purposes, EDA THESS, in its role as Processor, processes the following personal data: Full name, address, ID card number, TIN number, Tax Office, bank account number, fixed and mobile phone number, e-mail.
v) For Gas Installations Supervisors, Engineers, Technicians and Combustion Installers – personal data provision for the execution of works under the Natural Gas Network Connection Contract, constitutes a contractual obligation, and failure to provide such data shall affect and hinder proper contract performance. For the above-mentioned purpose, EDA THESS, in its role as Processor, processes the following personal data: Full name, address, ID card number, TIN number, Tax Office, bank account number, fixed and mobile phone number, e-mail. The above-mentioned data is processed by EDA THESS for the following tasks:
In addition, provision of the above mentioned personal data is compulsory for EDA THESS compliance towards its legal obligations that stem from the legislative and regulatory framework (“Natural Gas Distribution Network Operation Code”), as well as towards any Judicial or other Public Authorities and Services, for the following activities:
Furthermore, EDA THESS may process personal data when “processing is necessary for the purposes of the legitimate interests pursued by the Company, except for when such interests are overridden by the interests or fundamental rights and freedoms of the data subject, which require personal data protection.”
The following cases are indicative of the legitimate interests pursued in relation to the processing of supplier personal data to achieve the corporate purposes below:
By visiting the EDA THESS website you give your consent to your Personal Data collection and use as described herein.
If you do not agree with the terms herein, please do not continue browsing on our website.
EDA THESS has the right to collect, record and process its website visitor data. We may record your IP address and use cookies as mentioned below.
EDA THESS has the right to collect additional categories of information through Website activity. In addition, EDA THESS may collect and process any Personal Data that you voluntarily provide to our website forms, such as signing up for updates and newsletters.
Cookies are small text files stored in the browser while browsing to the Web, aiming to notify the website of the visitor’s previous activity. Cookies are not used to run programs or install viruses on your computer.
By continuing your visit to EDA THESS’ website, you agree to have cookies enabled on your device. If you choose not to accept our cookies, we cannot guarantee that you shall be satisfied by the navigation experience to our website.
We may also enable third-party cookies for operating and marketing purposes. Cookies are widely used and benefit the Visitor. For more information, please refer to the EDA THESS’s Cookies Policy.
An IP address is a unique number used by devices to identify and communicate with each other on a computer network using the Internet Protocol Standard. In other words, an IP address is a number assigned to your computer each time you access the internet. It allows computers and servers to identify and communicate with each other. Visitor IP addresses can be logged for data security and system diagnostics. Such aggregate data can also be used to analyze trends and website performance.
It should be kept in mind that when you visit our website you can follow links to other websites which are beyond our influence. EDA THESS bears no responsibility for the content or Privacy Policy of such websites.
User’s data collection surveys make data available to relevant businesses, organizations, and individuals. EDA THESS is responsible to ensure that data is collected and processed in compliance with applicable legislation. EDA THESS shall not process any Personal Data for other purposes or by any means other than those under the Users’ consent.
Surveys or questionnaires concern individuals whose data have been downloaded, transferred, or manually entered by EDA THESS Users themselves in their account, to improve User Services. Personal data may include personal contact information such as name, address, fixed or mobile number, e-mail, information regarding family, lifestyle and social life information, age, date of birth, marital status, number of children, qualifications, business contact information, gender, religion, race, health information and other sensitive personal data.
Special note for Minors: Minors under fifteen (15) years of age are prohibited from disclosing to EDA THESS through its website their personal data without their guardian’s prior consent. We ask those persons not to submit/enter any data towards the Company. If website Users fall under the above-mentioned category and continue to disclose personal data to the Company through our website, it shall be considered by EDA THESS that such individuals have obtained their guardian’s prior consent.
All Personal Data collected by EDA THESS are stored and processed at the Company headquarters in Menemeni (Thessaloniki), at 256 Monastiriou and 7 D. Glynou Str., as well as at Microsoft Azure IT Hosting Services provider, on the servers of which, data collected from the EDA THESS website and MyPortal registration platform, are transmitted only for storage purposes. Furthermore, relevant platforms are used by Newsletter Service Providers.
EDA THESS shall not retain any data longer than necessary in order to fulfill the purposes for which it were collected, or as required by the applicable legislation. User data shall be retained for at least five (5) years after the termination of legal contractual relationship between EDA THESS and the End Customer. In some cases, certain personal data may be retained fora longer period, due to EDA THESS legal obligations, legitimate interests, etc., such as, for reasons related to any legal aspect (tax, civil, criminal, etc.), as well as for the security of Natural Gas Distribution Network.
It is considered as a fact that all EDA THESS website Visitors have carefully read the present Privacy Policy and agreed with its content. If anyone does not agree with the terms and content of that policy, then no use of the Company’s website and platform should continue. EDA THESS reserves the right to modify its Privacy Policy as required and according to its needs.
The new GDPR Regulation gives you the following rights towards your personal data processing:
Right of Access: You can request access to your personal data. Thus, you can have copy/ies of your personal data retained by EDA THESS.
Right of Rectification: You can request rectification of inaccurate personal data. Thus, you can correct any incomplete or inaccurate data you have submitted to EDA THESS. In such case, the accuracy of the new data provided should be verified by the Company.
Right to Erasure (“Right to be forgotten”): You can request the deletion of your personal data. Thus, you can ask us to delete or remove your personal data if there is no reason to continue processing them. It should be noted however that in certain circumstances, such a right may be unattainable for specific legal reasons, which are to be communicated to you, as appropriate, at the time of request.
Right to Restriction of Processing: You may request restriction of your personal data processing. More specifically, you may ask us to stop processing your personal data in the following cases:
Right to Object: You may object towards your personal data processing at any time in case such processing is based on the performance of a duty that serves public interest or during the exercise of Public Authority duties (Article 6(1) of the Regulation); or if such processing fulfills EDA THESS’s or third party’s legitimate interests (Article 6(1f) of the Regulation). However, EDA THESS may not satisfy this right of yours by demonstrating imperative and legitimate processing purposes which override your interests, rights, and freedoms, or for the establishment, exercise or support of any legal claims.
Right to Data Portability: You may request the transfer of your personal data to you or to a third party. We shall provide your personal data to you or your third party in a widely used, computer-readable format. It should be noted that such right applies only to automated data that you originally provided us with your consent to use or whenever we used such data to perform a contract with you.
Right to Consent Revocation: You may revoke your consent at any time in case you have already given your consent to your personal data processing. However, this shall not affect the legitimacy of any processing performed before such revocation of your consent. If you revoke your consent, EDA THESS may not be able to offer you specific products or services. You shall be informed accordingly at the time of request.
Right to Non-automated Decision Making: Automatic decision making takes place when an electronic system uses personal data to decide without human intervention. In such case you have the right to object to automated processing or profiling that produces legal effects on you or significantly affects you in a similar way, without your prior consent, or unless it is necessary for the conclusion or performance of a contract between you and the Company, or otherwise permitted by law. You also have the right to contest any decisions concerning you,made through the above mentioned procedure.
If you wish to exercise any of the above-mentioned rights, please fill in the Personal Data Rights Exercise Form available at EDA THESS Customer Service Offices. To find the nearest EDA THESS Customer Service Office, to exercise your rights, please click on: https://www.edathess.gr/customer-service-office/.
Furthermore, you should know that you have the right to submit a Complaint to the Personal Data Protection Authority if you believe that your rights, regarding your personal data processing by EDA THESS, have been violated.
We may disclose the Users’ personal data without their prior consent, only when there are reasons to believe that the disclosure of such data is required to identify, communicate, or bring actions against an individual/ (-s) suspected of violation or asset risk that belongs to EDA THESS or third party who might be harmed by such User activities or by individuals who could (either deliberately or not) commit similar acts. It is clear that any disclosure shall comply with the criteria and provisions of the law.
EDA THESS shall provide you with access to your personal data, and in case such data are incorrect, we shall facilitate you to promptly update or delete them. If EDA THESS should retain part of or all these data for legitimate business purposes, or if it has the legal obligation to do so, the data shall not be deleted for as long as it serves the above-mentioned purpose.
Our aim is to provide you with our services and at the same time to protect your personal data from any accidental or malicious destruction.
Personal data processing is conducted so as to ensure confidentiality. More specifically, it is carried out exclusively by dedicated authorized personnel and all appropriate organizational and technical measures are implemented to ensure data security and protection against any accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, as well as any other form of unlawful processing.
Confidentiality
All staff members are subject to confidentiality; all EDA THESS Data Processors are required to sign a Confidentiality Agreement and a GDPR Compliance Agreement.
All authorized personnel have access to personal data only through an encrypted connection. In addition, only authorized IP addresses can access the data stored in a database.
Any devices used for temporary storage of personal data are always safely locked, unless used or transferred. Personal data is never stored on portable media like USB sticks, CDs and DVDs.
Integrity
To ensure integrity, all data paths are encrypted to align with best practices, and to protect confidentiality and data integrity. Data is encrypted through the applicable Secure Socket Layer, and then are kept in EDA THESS’ database, being accessible only by authorized personnel, who is required to keep such data confidential.
Availability
Information systems are designed to support the availability of the high-level services provided to the Subjects by EDA THESS. High availability (HA) is a feature of a system that aims to ensure a high level of business performance. Availability refers to the user ability to be provided with a service or have good quality of access to the system, submit new data, update or change existing variables, or retrieve the results of previous actions.
Transparency
EDA THESS shall inform you at any time about changes to privacy and security procedures, including company practices and policies. You can always ask EDA THESS about where and how your data is used, stored, and secured.
Intervention
EDA THESS provides rights of access, rectification, deletion, objection and restriction.
EDA THESS Data Protection Officer (DPO) is held responsible for data security; DPO trains and informs all Company personnel about the data security measures outlined herein.
Clearance
Access to personal data is blocked by default, applying a zero-privilege policy. Access to personal data is allowed to authorized personnel only. EDA THESS’ DPO issues authorizations and keeps a register of licensees.
Tracking
EDA THESS monitors access patterns and identifies and limits any possible threats through security reports. All administrative functions, including system access, are recorded to ensure the necessary control of any unauthorized or accidental changes.
System performance and availability are monitored by both internal and external monitoring services.
Notification on personal data violation
In case your data is violated, EDA THESS shall notify you and the competent SRA within 72 hours and, by e-mail or other applicable means, provide you with information on the extent of violation and about the affected data. Furthermore, it should be stated that EDA THESS shall take any action necessary to limit any harmful consequences for data Subjects.
The personal data collected by the Company, e.g. during Natural Gas Distribution Network inspections, may be transferred to third parties, provided that such transfer is applied legitimately.
Furthermore, provided that such transfer is applied legitimately, your personal data may be shared with the following recipient categories:
Α. EDA THESS Contractors for the following tasks:
i) Natural Gas Distribution Network construction and extension works;
ii) Natural Gas Distribution Network operation and maintenance works;
iii) Meter Readings;
iv) External facilities security services provision;
v) Emergency services provision;
vi) Execution of tasks and provision of information systems services,
vii) Telecommunications providers with the possibility of mass information of recipients by electronic means (including SMS and Viber messages).
viii) Conduct satisfaction surveys in order to understand your experience as a customer of EDA THESS, the management of the customer relationships and the provision of our services with the sole aim of improving their quality (excluding market research or promotional content).
Β. Any competent supervisory, public, or judicial authority if provided for by the applicable legal framework or a judgment.
C. Distribution Network Users, in accordance with the provisions of the Metering Regulation, the Operation Code of Natural Gas Distribution Network and the other relevant legislative framework
We seek to review and keep up-to-date our Privacy Policy to comply with all legal and regulatory requirements, while at the same time to provide optimal protection for your personal data. Any updates shall be communicated to you through our website.
EDA THESS has defined a “Data Protection Officer”, who is responsible for issues related to Subject privacy protection, as well as safe and proper processing of Personal Data. For any further information or clarifications required regarding the data collected by EDA THESS or its processing methodology, please contact phone number: +30 2310 584-000; email: DPO@edathess.gr (DPO);
