NOTIFICATION TO PROSPECTIVE EMPLOYEES REGARDING THE PROCESSING OF THEIR PERSONAL DATA

1. Introduction & General Terms

 

The company under the name “KOS HOTEL S.A.”, having its registered seat in the municipality of Kos (address Charmilou, no. 2, Postal Code 85300) (the “Company”) collects, stores and processes in general Personal Data (as defined below) of the prospective employees (the “Employees” and each one of them separately the “Employee”) in accordance with the General Data Protection Regulation (ΕΕ) 2016/679 (the “GDPR”) and the local data protection legislation (jointly “Data Protection Legislation”).

This Notification of the Company to the Employees according to the Articles 13 and 14 of the GDPR (the “Notification”) covers Personal Data which is held electronically and applies to paper-based filling systems as well.

This Notification describes the way by which the Company collects, uses and processes in general Personal Data that relate to the Employees. The Company is the Controller of your Personal Data.

 

2. Scope of application of this Notification

 

This Notification relates to all Personal Data (as defined below) of Employees, which the Company collects, uses, discloses or stores.

 

3. What is Personal Data?

 

For the purposes of this Notification, Personal Data means any information which relates to an identified or an identifiable person, or which may be used for the identification of a person (“Personal Data”).

The types of Personal Data that the Company may collect from you or relating to you include. as the case may be, inter alia:

(a) Personal and family information: name, surname, father’s name, mother’s name, name and surname of husband, where applicable, residential information (address and phone number), date and place of birth, gender, residence and work permit, nationality, fulfilment of military obligations (unless any reasons of discharge due to incapability or deferment apply), SSN (Social Security Registration Number), ID document, date of issue and issuing authority, passport number and date of issue/ expiry, mobile phone number, email address, VAT number and Tax Authority, bank account information and other financial information, marital status and dependents information, as well as data concerning heath contained in the health certificate which shall be provided by every person that is employed or is willing to be employed in health-regulated undertakings or/ and is in direct or indirect contact with food.

(b) Information relating to your education and your work experience: information about your prior employers and recommendations, other information relating to your previous occupation, namely work position or/ and description of your responsibilities/ duties, type of work (definite or indefinite duration), working schedule and shifts, location, period of service, contact details of your previous work (phone number, address, fax and email address), effective date and termination date (where applicable) of employment, name and contact details of supervisor, director or person in charge, information about throughput and relevant information, information about salary, information about attendance of trainings and relevant recommendations, academic career and education, vocational education, licenses and certifications, foreign languages, activities and researches, information about complaints and accusations and the reasoning of any redundancy and

(c) any other information which is included in your CV or which is provided to us, even if not requested.

 

4. Why does the Company collect, use, disclose or store Personal Data?

 

The Company collects, uses, discloses and stores Personal Data for the following purposes: (1) assessment in order to evaluate if you are suitable for employment, (2) general management, (3) establishment of the financial budget of the human resources department, (4) compliance with the requirements laid down in the legislation, (5) defense, preparation and response to any legal actions as well as to any regulatory investigations or investigations of other authorities and (6) amelioration of proceedings relating to employment, talent management and succession planning.  

 

5. Legal basis for the processing of Personal Data  

 

The legal basis for the collection, usage and processing in general of your Personal Data is based on the Article 6, para. 1 a), b), c) and f) and Article 9 para. 2 b), f) and i) of the GDPR. This means that we are processing your data (i) based on your consent, which is declared through your positive action of sending your CV or (ii) for the purpose of taking actions, on your request, prior to the conclusion of any agreement or (iii) in order for us to be able to comply with our legal obligations or (iv) for the legitimate interests of the Company or any third party, unless the interest or your fundamental rights and freedoms of the prospective Employee prevails over the Company’s interests or (v) for purposes of carrying out the obligations and exercising rights in the field of employment law or (vi) for the exercise or defence of legal claims or (vii) for reasons of public interest in the area of public health.

 

6. Does the Company disclose or transfer your Personal Data?

 

The Company may from time to time disclose your Personal Data to third parties for any of the aforementioned purposes. Examples of third parties to whom the Company may transfer your Personal Data include governmental and judicial authorities and third parties that provide services (inter alia) in relation to the assessment of the prospective Employees.

 

When we disclose your Personal Data to third parties that carry out services on our behalf, we take care so as these service providers to use the Personal Data only in accordance with our instructions and we authorise them to use or disclose the Personal Data only where it’s necessary in order for them to provide these services on our behalf or to comply with any obligations are laid down in the legislation.

 

The Company may disclose Personal Data to third parties:

• Where required by law or
• For the purposes or in relation to legal proceedings in which the Company is party, or for the purposes of supporting, exercising or defending its rights or
• Which are authorities of law enforcement or governmental authorities and which have submitted legal disclosure request or
• In case we consider that the disclosure is necessary for any investigation with regard to any suspicion or existence of illegal activity.

 

7. Overseas transfers of Personal Data

 

In case we disclose your Personal Data to other entities, including entities within the European Economic Area (EEA), except where the relevant country has been determined by the European Commission to provide an adequate level of protection (currently Andorra, Argentina, Canada, Switzerland, Faroe Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand and Uruguay), we require such recipients to comply with appropriate measures designed to protect the Personal Data.

 

8. Personal Data of third parties   

 

In case you provide the Company with Personal Data of third parties (e.g. husband’s data or/ and dependents data), you must notify these persons regarding the processing of their personal data from the Company and regarding their rights (e.g. by providing them with this Notification). Moreover, if required by law, you may need to obtain the consent of these persons. The Company, as long as you provide Personal Data of third parties, considers that the relevant consent of those parties has been obtained.

 

9. Consequences of non-providing Personal Data

 

If an Employee does not wish to disclose the minimum required Personal Data for its assessment, the Company with consider, based on the facts, whether such assessment may be possible.

 

10. Employees’ Rights

You have the right to request access to your Personal Data. You may receive a copy of your Personal Data which the Company is in possession of.

Furthermore, you have the right to:

• Request the correction or erasure of your Personal Data, or the restriction of their processing or
• Object to the processing of your Personal Data or
• Receive them in a structured format.

 

If you wish for clarifications or you want to exercise any of these rights, please use the contact details mentioned in the Section 13 below.

 

If you are not satisfied with the way that the Company processes your Personal Data, you have also the right to lodge a complaint with the Greek Data Protection Authority (www.dpa.gr).

 

11. Sources of your Personal Data

 

First of all, Personal Data are collected directly from you. The Company may obtain your Personal Data from other sources, including the following:

• Labor offices or recruitment agencies.
• Public Registries that include your Personal Data.
• In the course of our control prior to the employment, the Company may make use of search engines and publicly available units in social media, insofar as there is a relevancy with the work position of the Employee.
• Third parties (e.g. persons that give recommendations for you).

 

12. Retention period of your Personal Data

The retention period of the Personal Data (and in case of retention of your Personal Data where there is employment) is the period permitted or required by the applicable legislation/ regulation.

 

13. Contact us

If you have questions or concerns relating to this Notification, or you want to exercise any of your rights, please contact the Data Protection Officer (DPO) of the Company at [email protected]

 

14. Updates

The Company may occasionally publish updates of this Notification due to changes in the legal and regulatory framework, in the internal proceedings and the systems, and will notify you through its website. Any changes will have effect from the date of their publication, unless otherwise defined.