Privacy Policy

1. Purpose and Scope

EOS PERSONNEL SOLUTIONS (hereinafter the “Company”), with registered address at 54 Michalakopoulou Avenue, Athens, 11528, Greece, telephone +30 210 7256 734, and email hire@eoswf.com, is committed to protecting personal data and ensuring that such data is processed lawfully, fairly, and securely.

This Policy applies to all employees, partners, consultants, external associates, suppliers, and any other persons acting on behalf of the Company who have access to personal data. Its purpose is to define the general framework of principles, obligations, and responsibilities governing the processing of personal data by the Company.

2. Content

2.1. Legal Framework

This Policy is established and implemented in accordance with:

• the General Data Protection Regulation (EU) 2016/679 (GDPR),
• Greek Law 4624/2019,
• any other applicable national and European legislation,
• as well as decisions, guidelines, and opinions issued by the Hellenic Data Protection Authority.

2.2. Definitions

Personal Data: any information relating to an identified or identifiable natural person.

Special Categories of Personal Data: data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, as well as genetic data, biometric data, data concerning health, or data concerning a person’s sex life or sexual orientation.

Data relating to criminal convictions and offences: personal data relating to criminal proceedings, convictions, or security measures.

Profiling: any form of automated processing of personal data consisting of the use of such data to evaluate certain personal aspects relating to a natural person.

Data Subject: the natural person to whom the personal data relates.

Processing: any operation or set of operations performed on personal data, such as collection, recording, organisation, structuring, storage, use, disclosure, transmission, restriction, erasure, or destruction.

Filing System: any structured set of personal data accessible according to specific criteria.

Transfer: any disclosure of or granting access to personal data to a third party.

Data Protection Impact Assessment (DPIA): a process for identifying, assessing, and documenting risks to the rights and freedoms of data subjects.

Controller: the natural or legal person that determines the purposes and means of processing personal data.

Processor: the natural or legal person that processes personal data on behalf of the Controller.

2.3. General Obligations When Processing Personal Data

2.3.1. Principles of Processing

Any person processing personal data on behalf of the Company must comply with the following principles:

2.3.1.1. Lawfulness, Fairness and Transparency

Personal data shall be processed lawfully, fairly, and in a transparent manner.

2.3.1.2. Purpose Limitation

Personal data shall be collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.

2.3.1.3. Data Minimisation

Personal data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed.

2.3.1.4. Accuracy

The Company takes reasonable steps to ensure that personal data is accurate and, where necessary, kept up to date.

2.3.1.5. Storage Limitation

Personal data shall be retained only for as long as necessary for the purposes of processing or as required by applicable law.

2.3.1.6. Integrity and Confidentiality

Personal data shall be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage.

2.3.1.7. Accountability

The Company is responsible for, and must be able to demonstrate, compliance with the above principles.

2.3.2. Lawfulness of Processing

The Company processes personal data only where at least one of the legal bases provided by the GDPR applies, including, for example:

• the consent of the data subject,
• the performance of a contract or steps taken prior to entering into a contract,
• compliance with a legal obligation,
• protection of vital interests,
• performance of a task carried out in the public interest,
• the legitimate interests pursued by the Company or a third party, provided these do not override the rights and freedoms of the data subject.

Where processing is based on consent, such consent must be freely given, specific, informed, and unambiguous, and may be withdrawn at any time.

2.3.3. Duty to Inform

The Company informs data subjects, at the time of collection or within the legally required timeframe, at least about:

• the identity and contact details of the Company,
• the contact details of the Data Protection Officer, where appointed,
• the purposes and legal basis of the processing,
• the categories of personal data processed,
• the recipients or categories of recipients,
• any transfers to third countries,
• the retention period,
• the rights of the data subject,
• the right to lodge a complaint with the competent supervisory authority,
• whether the provision of data is mandatory and the consequences of failure to provide it,
• the existence of automated decision-making, including profiling, where applicable.

2.3.4. Processing of Personal Data of Employees, Candidates, and Partners

In the context of its activities, the Company may process personal data of employees, job applicants, clients, partners, suppliers, and other natural persons only to the extent necessary for:

• the assessment of applications and candidacies,
• the provision of staffing, human resources support, and related services,
• the performance of contractual or pre-contractual obligations,
• compliance with employment, tax, social security, or other legal obligations,
• the management of professional and business relationships,
• the protection of the legitimate interests of the Company.

Personnel files and related information are treated as confidential.

2.3.5. Data Quality

The Company takes technical and organisational measures to ensure that personal data is accurate, complete, and, where necessary, up to date. Inaccurate or incomplete data is corrected or deleted without undue delay.

2.3.6. Data Protection Impact Assessment

Where a processing activity is likely to result in a high risk to the rights and freedoms of natural persons, the Company shall carry out, prior to the processing, a Data Protection Impact Assessment (DPIA), in accordance with Article 35 GDPR.

2.3.7. Disclosure to Third Parties

Personal data shall be disclosed to third parties only where such disclosure is necessary and lawful, and provided that appropriate safeguards are in place.

Where a third party acts as a processor on behalf of the Company, the relationship shall be governed by a written data processing agreement in accordance with Article 28 GDPR.

2.3.8. Transfers Outside the European Economic Area

Transfers of personal data to countries outside the European Economic Area shall only take place where the conditions of the GDPR are met and an adequate level of protection is ensured, such as through an adequacy decision, standard contractual clauses, or another appropriate safeguard.

2.3.9. Security of Processing

The Company implements appropriate technical and organisational measures to protect personal data, including, indicatively:

• access control,
• restriction of user permissions,
• secure storage and transmission of data,
• password protection and technical system safeguards,
• backups,
• procedures for the prevention and management of security incidents,
• staff training on data protection matters.

2.3.10. Storage and Retention of Data

Personal data shall be retained only for as long as necessary for the purpose of processing and/or as required by applicable law. Once the relevant retention period expires, the data shall be securely deleted or anonymised, unless further retention is required for the establishment, exercise, or defence of legal claims.

2.4. Rights of Data Subjects

Each data subject has, subject to the conditions of applicable law, the following rights:

• the right to be informed,
• the right of access,
• the right to rectification,
• the right to erasure,
• the right to restriction of processing,
• the right to data portability,
• the right to object,
• the right not to be subject to a decision based solely on automated processing, including profiling, where applicable.

To exercise their rights, data subjects may contact the Company at:

EOS PERSONNEL SOLUTIONS
54 Michalakopoulou Avenue, Athens, 11528, Greece
Tel.: +30 210 7256 734
Email: hire@eoswf.com

Data subjects also have the right to lodge a complaint with the Hellenic Data Protection Authority.

2.5. Personal Data Breach Management

Any incident involving a personal data breach must be reported immediately to the appropriate persons within the Company so that it can be assessed and addressed without undue delay.

The Company maintains a record of breaches and takes the necessary corrective and preventive measures. Where required under the GDPR, the Company shall notify the competent supervisory authority within 72 hours of becoming aware of the breach and, where necessary, inform the affected data subjects.

2.6. Documentation and Records of Processing Activities

The Company maintains, where required, records of processing activities, including at least:

• the details of the controller,
• the purposes of processing,
• the categories of data subjects and personal data,
• the categories of recipients,
• any transfers to third countries,
• retention periods,
• a general description of the technical and organisational security measures.

2.7. Data Protection by Design and by Default

The Company takes data protection into account when designing new services, systems, and processes, applying the principles of data protection by design and data protection by default, in accordance with Article 25 GDPR.

2.8. Training and Awareness

The Company ensures that its staff and associates receive appropriate information and training on personal data protection and information security, depending on their role and responsibilities.

2.9. Roles and Responsibilities

2.9.1. Controller

EOS PERSONNEL SOLUTIONS acts as Controller for the processing activities it determines and is responsible for compliance with applicable data protection law.

2.9.2. Processors

Third-party partners processing personal data on behalf of the Company must act only on documented instructions from the Company and must be contractually bound to protect such data.

2.9.3. Data Protection Officer (where appointed)

Where the Company has appointed a Data Protection Officer (DPO), the DPO monitors compliance, provides advice, and acts as a contact point for the supervisory authority and data subjects on data protection matters.

2.9.4. Management and Staff

The Company’s management is responsible for ensuring the implementation of this Policy and for providing the necessary resources. All staff members are required to comply with the requirements of this Policy.

2.10. Breach of this Policy

Failure to comply with this Policy may result in disciplinary, civil, administrative, and/or criminal consequences, in accordance with applicable law and the Company’s internal procedures.

Last Updated: 6 April 2026