Scholarship Programme for Postgraduate Studies in Cyprus and Abroad
EKO CYPRUS LIMITED, with company registration number 454043 in the United Kingdom, which is registered as a foreign company with the Registrar of Companies in Cyprus under registration number AE109, and having its place of business in Nicosia, at 3 Ellispontou Street, 2015, Strovolos, Nicosia, Cyprus (hereinafter referred to as the “Company”), acts as the data controller of the personal data of applicants seeking inclusion in the Scholarship Programme for Postgraduate Studies in Cyprus and Abroad, in accordance with the terms of the scholarship programme announcement of EKO CYPRUS LIMITED. By means of the present form, the Company determines the purposes and the manner of processing of such data, which processing is carried out in accordance with Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), as well as in accordance with the provisions of the Cyprus Law on the Protection of Natural Persons with regard to the Processing of Personal Data and on the Free Movement of Such Data of 2018 (Law 125(I)/2018).
1. Sources of collection & Categories of personal data
The company collects the following categories of personal data from the data subject themselves, after they have read this document and confirmed that they have read it by filling in a special form:
| a. Identification Data | First name, last name, father's name, mother's name, gender, nationality, date of birth, police ID/passport number, tax identification number, marital status, occupation, Visa F1/J1 |
| b. Contact details | Email/postal address, telephone numbers |
| c. Education Data | Degrees, certificate of enrolment or final letter of acceptance to the postgraduate programme |
| d. Work Experience Data | Reference to previous work experience, letters of recommendation from university professors, certificate of previous employment, CV |
| e. Photo | Photograph of the candidate |
| f. Military status data | Certificate of military status |
| g. Social data | Unemployment card, tax assessment certificate |
| h. Health data | Disability certificate, medical certificate, if submitted at the discretion of the subject. |
2. Purposes of processing
The purposes for which the above personal data are processed are as follows:
A. to inform the company of the applicant's (data subject's) intention to participate in the Scholarship Programme for Postgraduate Studies in Cyprus and Abroad,
B. to assess the applicant's suitability for the scholarship,
C. to draw up the contract, if the applicant is selected, and monitoring the smooth progress and fulfilment of the obligations of both parties,
D. contacting and informing all scholarship applicants, whether they have been awarded a scholarship or not, about the Group's activities, provided they have given their consent to this,
E. the protection of its legal interests, the management of the company's business operations and IT infrastructure, in accordance with its internal policies and procedures.
F. Utilising data from participants in the current Scholarship Programme in order to reach a wider audience through a communication campaign on social media. In this way, the Company provides new individuals who may be interested in its activities with information about the new programmes it implements, encouraging them to participate. This process is carried out only if the scholarship recipients have given their consent for their data to be transferred to a partner of the Company, through a relevant consent form, which contains further information about the processing in question.
The provision of personal data by the data subject is necessary in order to apply for participation in the Scholarship Programme for Postgraduate Studies in Greece and abroad.
3. Legal basis for processing
In accordance with the applicable legislation on the protection of personal data, the legal bases on which the data processing is carried out are, as appropriate, the following:
- Article 6(1)(a) of the GDPR, i.e. the data subject's consent to the processing of personal data concerning them, if and to the extent that the data subject provides it by specifically consenting to the storage of their data in the company's database (e.g. image, targeted communication).
- Article 6(1)(b) of the GDPR, since processing is necessary for the evaluation of the suitability of candidates for their eligibility and subsequently for the conclusion and performance of the contract, of which the student as the data subject is a party (e.g. identification data, contact details, education data, work experience data, social data, military service data).
4. Transfer and categories of recipients
The Company may transfer such data to other legal entities of the Group (indicatively HELLENiQ ENERGY HOLDINGS S.A. and EKO – HELLENIC FUELS AND LUBRICANTS S.A.), within the European Union, for the same purposes as those referred to in paragraph 2 above. In addition, the Company may transfer the data to external partners of the Company.
The processing of personal data by the aforementioned collaborating entities is carried out under the control of the Company and is subject either to the same privacy protection policy or to a policy ensuring at least an equivalent level of protection.
5. Data security
The company, as the Data Controller, undertakes to implement the necessary technical and organisational measures. In particular, the file containing the profile details and applications of candidates is protected both electronically and physically. Personal data is stored on the company's servers, located in a data centre in Aspropyrgos, Attica. Measures are taken to protect them, i.e. access rights, encryption and anonymisation of older data. The server is protected by a password and a firewall. The company has security policies in place that aim to ensure the security and integrity of all information, including personal information.
6. Subject rights
6.1 Right of access, rectification, erasure, restriction of processing
The data subject has the right to submit a request to the company (as the data controller) for:
- access to personal data about them,
- rectification of inaccurate or outdated data about them or to complete any incomplete data,
- request the erasure of data about them if their processing is not necessary in relation to the purposes for which they were collected,
- request the restriction of the processing of personal data about them,
- portability of their data (e.g. directly to another employer).
More information about these rights, including the circumstances under which they are exercised and how they are exercised, is included in the PERSONAL DATA PROTECTION STATEMENT posted on the company's website https://www.helleniqenergy.gr/dilosi-prostasias-prosopikon-dedomenon.
6.2 Right to object
In addition, the data subject has the right to object, at any time and for reasons related to their particular situation, to the processing of their personal data based on Article 6(1)(e) or (f) of the GDPR, including profiling based on those provisions. In such a case, the company as the controller shall no longer process the personal data, unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
6.3 Right to withdraw consent
The applicant has the right to withdraw their consent at any time, without prejudice to the lawfulness of the processing based on consent before its withdrawal. In any case, the data subject is informed that the withdrawal of consent to the processing of data that is absolutely necessary for the performance of the contract may mean that the contract cannot be performed in some or all of its aspects.
6.4 The exercise of the above rights requires the data subject to submit, free of charge, a written request to the company's Data Protection Officer, whose details are provided below. The company reserves the right to respond within one month of receiving the request, but may extend this period by a maximum of two months with a reasoned response.
7. Communication between the data subject and the company
For any matter relating to the processing of their personal data, or if they wish to exercise their rights or receive a copy of the latest version of the Group's Personal Data Protection Policy, the data subject may contact the company's Data Protection Officer (DPO), Mrs Antigoni Papangelopoulou, using the following contact details:
- by e-mail: at dpo@helleniq.gr
- by post: to the company's address, to the attention of the Data Protection Officer.
In any case, the data subject retains the right to lodge a complaint with the Greek supervisory authority, the "HELLENIC DATA PROTECTION AUTHORITY" (http://www.dpa.gr).
8. Retention period for personal data
The company retains personal data for a period of up to five (5) years from the termination of the contract in any way and up to two (2) years from the submission of the application by the student in case the contract is not concluded. If a legal dispute is pending, beyond the above processing times, and until its conclusion with a final court decision.