2. DEFINITIONS OF PERSONAL DATA (Definitions follow Article 4 of the GDPR)

Personal Data: any information through which a natural person (“Data Subject”) is identified or can be identified.

Controller: the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. In this case, the Company acts as the Data Controller.

Processor: the natural or legal person, public authority, agency, or other body that processes personal data on behalf of the Controller.

Data Subject: the identifiable natural person whose identity can be ascertained, directly or indirectly, in particular by reference to an identifier such as a name, identity number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. In this case, Data Subjects are users of the Company’s website, members, associates, employees, and other parties transacting with the Company.

Recipient: the natural or legal person, public authority, agency, or other body to which the personal data are disclosed, whether a third party or not. Public authorities that may receive personal data in the context of a specific inquiry in accordance with Union or Member State law are not considered recipients.

4. COLLECTION OF PERSONAL DATA: PURPOSE AND LEGAL BASIS

When the user visits the Company’s website, personal data is collected. The purposes of the processing carried out in the context of the website’s operation, the data processed, and the corresponding legal bases are described below:

A) Communication of natural persons with the SEE via a standard page (form)
When you send a message to the Hellenic Statistical Authority via the electronic contact form available on the website, we process the following personal data: your full name, email address, any personal data included in your message.

The legal basis for processing depends on the nature—the subject matter—of your message and is, as applicable:

• If the communication concerns the submission of a proposal by a partner or any other natural person seeking cooperation with the Company, the legal basis for processing is the performance of a contract (Article 6(1)(b) of the GDPR).
• For any other natural person who wishes to contact the Company on any matter, the legal basis for processing is the legitimate interest pursued by the Data Controller, namely the smooth and effective service of website users (Article 6(1)(f) of the GDPR).
• If your request includes special categories of personal data, the legal basis for processing is your explicit consent (Article 9(2)(a) of the GDPR).

The relevant Company executives have access to your personal data in order to respond to your request. Your personal data is retained until the issue to which your message relates has been dealt with, unless further storage is required by law.

B) Job Opportunities Form (CV Submission)

When submitting a CV or job application, we process data such as: name, contact details (phone number, email), as well as the content of the CV and any attached documents.

The legal basis for the processing is the taking of pre-contractual measures at your request (Article 6(1)(b) GDPR). If your CV includes special categories of data (Article 9 of the GDPR), these will only be processed with your explicit consent or if permitted by labor and social security legislation.

The data is retained for as long as necessary to complete the personnel evaluation and selection process. If no recruitment takes place, the data is deleted after the end of the process, unless there is a legal basis or other legitimate reason for retaining it.

6. RIGHTS OF DATA SUBJECTS

If you have any questions regarding the processing of your personal data by “METALLIA THRAKIS MONOPROSOPI”, please contact us at ContactThrace@eldoradogold.com

The Company facilitates the exercise of your rights as data subjects.

You can exercise the following rights at the same address:

1. Right of access: You have the right to know whether we are processing your personal data and, if so, to receive a copy of it.
2. Right to rectification: You have the right to ask us to correct inaccurate data or to complete incomplete data.
3. Right to restriction: You have the right to ask us to restrict processing, for example, not to delete data that you consider necessary for the establishment, exercise, or defense of legal claims.
4. Right to object: You have the right to object to the processing.
5. Right to erasure: You have the right to request that we erase your data.
6. Right to withdraw consent: You also have the right to withdraw your consent (where processing is based on it).
7. Right to lodge a complaint with a supervisory authority: If you believe that one of your rights has not been satisfied, you can lodge a complaint with the Personal Data Protection Authority: https://www.dpa.gr/polites/katagelia_stin_arxi

The Company does not engage in automated decision-making.