This Policy for the Protection of Personal Data of Candidate Employees at the MITSIS Group (hereinafter referred to for the sake of brevity as the “Policy”) explains and provides information on how the MITSIS Group companies process the personal data of candidate employees of the MITSIS Group companies, and sets out the conditions for processing the personal data we collect in this context. Please read carefully what is laid down below, in order to understand our stance and practices regarding our processing of your personal data.
The definitions used in this Policy have the meaning assigned to them in accordance with Regulation EU 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), which in combination and together with the applicable Greek laws and the decisions and other acts of the Data Protection Authority, form the laws on the protection of personal data (hereinafter collectively called for the sake of brevity the “Personal Data Laws”).
The following companies (members of the MITSIS Group) shall be data controllers:
1) GREECE HOTELS - MITSIS COMPANY S.A., Kiotari, 85109, Gennadi, Rhodes, Greece;
2) K. MITSIS HOTEL & TOURISM ENTERPRISES S.A., 12 Filotheis St, 11147, Galatsi, Athens, Greece;
3) FALIRAKI HOTEL S.A., Faliraki, 85100, Rhodes, Dodecanese, Greece;
4) THOLARI SA, 12 Filotheis St, 11147, Galatsi, Athens, Greece;
5) DIAGORAS HOTEL S.A., Faliraki, 85100, Rhodes, Dodecanese, Greece;
6) PANEUROPA HOTEL S.A., Panagia Anissaras, 70014, Anisaras, Chersonisos, Heraklion, Crete, Greece;
7) HOTEL & TOURISM ENTERPRISES KORALLI S.A., 28 G. Papanikolaou St, 85100, Rhodes, Dodecanese, Greece;
8) GRAND HOTEL SUMMER PALACE S.A., 1 Akti Miaouli & Papanikolaou St, 85100, Rhodes, Dodecanese, Greece,
9) GALINI HOTEL & TOURISM ENTERPRISES S.A., 5 G. Vasileiadi St, 35008, Kamena Vourla, Fthiotida, Greece,
10) CRETAN HOTELS MITSIS COMPANY S.A., 12 Filotheis St, 11147, Galatsi, Athens, Greece; and
11) K. MITSIS FILOXENIA S.A., 12 Filotheis St, 11147, Galatsi, Athens, Greece.
All the above companies shall be hereinafter referred to collectively and for the sake of brevity as the “Companies” and each of them separately as the “Company”.
In particular, the company K. MITSIS FILOXENIA S.A., 12 Filotheis St, 11147, Galatsi, Athens, Greece is also the data processor for all the foregoing 10 Companies, and shall be hereinafter called for the sake of brevity “Filoxenia” or the “Data Processor”.
We undertake to respect the confidentiality and privacy of the personal data of all visitors and users of the website (site) “www.mitsis.com”, and to protect your personal data that you may provide to us through it.
With this Policy, we help you understand the different uses of your personal data. Personal data concern an identified or identifiable natural person, as defined in the Personal Data Laws, including but not limited to full name, telephone number, email address, and other relevant information. If you opt to provide your personal data to us, it is presumed that you consent to the collection, use, and processing of your personal data in accordance with this Policy. If you do not agree with this notice and our Policy, please do not disclose or send to us any of your personal data.
The Companies undertake to protect the personal data of candidate employees submitted through our website, the career page, Workable, and all channels we use in the recruitment process, and to generally comply with the Personal Data Laws during such processing.
1. Information and Personal Data we collect
1.1. We collect and store personal data in electronic or printed form. We do not collect specific categories of personal data, unless the data are provided by you, and collection is required by law or regulation.
1.2. When you submit a job application, we may collect the following personal data:
- CV information: application for participation, reference letters, educational background, work experience, photographs, letters from the recruitment procedure.
- Identity Details: first name, surname, date and place of birth, gender, marital status, information about minor children, address, telephone number, email address, identity details, nationality, social security number, occupation, professional title, salary level, benefits, contact details, etc.
- Educational Qualifications: degrees, diplomas, certificates.
- Other data you provide voluntarily
- Military service data: Data concerning fulfilment or non-fulfilment of the military obligations of men.
- Criminal records details (under certain conditions): Data relating to any criminal convictions and offences, if required by law or in view of the job post.
- Image and sound data: Photos and videos in case of an interview through an Online Interview platform.
- Social Media Data: Information that is publicly posted on social media profiles that you have disclosed to us (e.g. LinkedIn).
2. Collection and processing purposes
2.1. We use your Personal Data, in order to manage and process your job application in the best manner, and to inform you about any future job opportunities in companies of the MITSIS Group.
2.2. The collection of your personal data is necessary for the evaluation of your application and the proper record keeping for a potential future cooperation. If you object to the processing of your personal data, we will not be able to use your data and examine your job application or other communications you may send us. The processing of your personal data does not include any automated individual decision-making or profiling, within the meaning of Article 22, paragraphs 1 and 4 of the GDPR.
3. Where are your personal data stored
3.1. In principle, your personal data we collect is not transferred or stored in territories outside the European Economic Area (EEA).
3.2. In certain cases, your personal data may be transferred to our service providers, our suppliers or our partners, who may be seated in another country of the world, outside Greece, even in countries whose legal framework does not provide equal protection in the processing of personal data, as is the case in Greece. The Company complies with the Personal Data Laws by entering into data protection contracts with all the above persons, in order to ensure your personal data and an adequate level of protection from them, as far as this is technically and practically possible. In any case, the Company will transfer your personal data to third parties only on a need to know basis, and pursuant to expressly agreed restrictions (such as the EU Standard Contract Clauses).
3.3. All information provided to us is stored on secure servers, where encryption is used.
4. Protection of your personal data
Our Company has established a strict and highly sophisticated security system, it adopts security procedures and measures, and takes appropriate technical and organisational measures, in accordance with the applicable laws and the market standards, to protect your personal data, to prevent, to the extent technically feasible, any breach of security or personal data, or any security incident, and to prevent the unlawful or accidental destruction, alteration or loss, misuse, unauthorised access, modification or disclosure of any personal data stored and processed in our systems. However, the transmission of information over the Internet is not entirely safe. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our website or through third-party websites. Any such transmission on your part shall be at your own risk. Once we receive your information and personal data, we implement strict procedures and security features, to prevent any unauthorised access and use, including but not limited to physical security, technical measures, firewalls, organisational measures, password systems, and any other reasonable protective measures.
5. Transfers of your personal data
5.1. We transfer your personal data only in accordance with this Policy.
5.2. We may transfer your personal data to other companies of the MITSIS Group, our hotels, and our affiliates. However, all the above undertake that any processing of your personal data will be carried out in accordance with this Policy. Your personal data are disclosed to the recruitment officers and the management members involved in the recruitment process.
5.3. In some cases, we receive third-party services for the purposes referred to in this Policy, and we may need to transfer your personal data to them, so that they can provide their services to us for the assessment of our candidate employees. All the above are bound by relevant data protection contracts with our Companies, and are not permitted to use, process or transfer your personal data and information, except within the framework of the contract between us, and the law. In any case, such third parties are prohibited from processing your personal data outside the purpose of performing the services or projects they have undertaken on our behalf.
5.4. We have every right to process, use, and transfer your personal data to third parties, provided that this is necessary for our compliance with the applicable laws, for the protection of our rights, interests, and safety, or from breaches of our Policy.
6. How long do we keep your Personal Data
We keep your personal data for the period necessary for fulfilment of the objectives described in this Policy. Your personal data are kept for up to two (2) years from the date on which your job application was received, unless you withdraw your consent during that period.
7. Your rights
7.1. Pursuant to the Personal Data Laws, you have the right to request access to the personal data we hold about you, including to be informed, upon request, whether your personal data is being processed and to receive further information about that processing, including information about any transfers of personal data outside the European Union and the appropriate or expedient safeguards we adopt for such a transfer. Provided that the requirements under the Personal Data Laws are met, you may also request rectification of any inaccurate information we hold about you, or erasure thereof, or restriction of processing in relation to your personal data. If such a request could result in us or our affiliated companies breaching our obligations arising from any applicable laws, regulations or codes of practice and ethics, then we may be unable to fulfil your request. In such a case, you may be able to request that we block the use and further processing of your personal data and information. You may also have the right to data portability to another data controller, under certain conditions, and provided that this is technically and economically feasible. You can withdraw your consent at any time. Withdrawal of your consent will not affect the lawfulness of the processing relying on your consent prior to its withdrawal. You can also file a complaint with the Data Protection Authority (www.dpa.gr), if you believe that the processing violates the Personal Data Laws.
7.2. If you wish to further exercise your above rights or if you have any questions about this Policy, you can contact the Data Protection Officer at the following email address: [email protected].
8. Contact
8.1. To ensure the confidentiality and privacy of the personal data kept by our Companies, when you contact us you will be asked for information and data that identify you before your request is responded. In particular, where we have reasonable doubt about your true identity, we may ask you to provide us with a copy of your police identity card, or passport, or any other useful information for your identification. If you do not provide us with the information we have requested from you, we may refuse to respond to your questions.
8.2 If you wish to contact us about this Policy or the exercise of your rights, please send an email at the following email address: [email protected]
9. Updates to our Policy
This Policy shall enter into force as of the date indicated at the end thereof. We may change this Policy from time to time. In that case, we will post the new version of our Policy on this website, and change the indication at the end thereof. You should often visit this link, where our Policy is posted, to keep up to date with its content.
Galatsi, 1 July 2024