Scholarship Programme for Postgraduate Studies in the Republic of North Macedonia and Abroad
OKTA AD – Skopje (hereinafter: The Company), with its registered office at str. 1 no. 25 in Miladinovci, Ilinden, 1000 Skopje, with TIN 4030980254845, as the controller of the personal data of the applicants for the scholarship program of OKTA AD – Skopje, member of HELLENiQ ENERGY determines the purpose and manner of processing such data in accordance with the General Data Protection Regulation (hereinafter: GDPR) and other applicable regulations.
- Sources of collection & Categories of personal data
The specific categories of personal data processed depend on the information provided by the candidate as part of the scholarship application.
The company collects the following categories of personal data from the data subject themselves, after they have read this document and confirmed that they have read it by filling in a special form:
| a. Identification Data | First name, last name, father's name, mother's name, gender, nationality, date of birth, police ID/passport number, EMBG, marital status, occupation. |
| b. Contact details | Email/postal address, telephone numbers |
| c. Education Data | Degrees, certificate of enrolment or final letter of acceptance to the postgraduate programme |
| d. Work Experience Data | Reference to previous work experience, letters of recommendation from university professors, certificate of previous employment, CV |
| e. Photo | Photograph of the candidate |
| g. Social data | Unemployment card |
| h. Health data | Disability certificate, medical certificate, if submitted at the discretion of the subject. |
2. Purposes of processing
The purposes for which the above personal data are processed are as follows:
A. to inform the company of the applicant's (data subject's) intention to participate in the Scholarship Programme for Postgraduate Studies in the Republic of North Macedonia and abroad,
B. to assess the applicant's suitability for the scholarship,
C. to draw up the contract, if the applicant is selected, and monitoring the smooth progress and fulfilment of the obligations of both parties,
D. contacting and informing all scholarship applicants, whether they have been awarded a scholarship or not, about the Company's activities, provided they have given their consent to this,
E. the protection of its legal interests, the management of the company's business operations and IT infrastructure, in accordance with its internal policies and procedures.
F. Utilising data from participants in the current Scholarship Programme in order to reach a wider audience through a communication campaign on social media. In this way, the Company provides new individuals who may be interested in its activities with information about the new programmes it implements, encouraging them to participate. This process is carried out only if the scholarship recipients have given their consent for their data to be transferred to a partner of the Company, through a relevant consent form, which contains further information about the processing in question.
The provision of personal data by the data subject is necessary in order to apply for participation in the Scholarship Programme for Postgraduate Studies in the Republic of North Macedonia and abroad.
3. Legal basis for processing
Processing related to the submission and evaluation of scholarship applications is carried out as part of the application process, while consent is requested only for additional, optional processing activities where relevant.
In accordance with the applicable legislation on the protection of personal data, the legal bases on which the data processing is carried out are, as appropriate, the following:
-Article 10 paragraph 1 line 1 of the General Data Protection Regulation, i.e. the consent of the candidate to the processing of his personal data, provided that the said subject has given his consent to the retention of the data in the company's database (communication of information material about the Company's activities).
- Article 10 paragraph 1 line 2 of the General Data Protection Regulation, since the processing is necessary primarily for the conclusion of a contract, and then for the implementation of the contract, to which the student is a contracting party as the subject of the personal data.
4. Transfer and categories of recipients
The company may transfer the data to other legal entities of the Group (HELLENiQ ENERGY), within the European Union, for the same purposes as those mentioned in paragraph 2 above. In addition, it may transfer the data to external partners of the company, e.g. for the purpose of carrying out communication activities and generally serving the purposes of the Scholarship Programme. The processing of personal data by the above entities collaborating with the company is carried out under the control of the company and is subject to the same privacy policy or a policy of at least the same level of protection.
It may also transfer data to judicial, prosecutorial, administrative or police authorities in the context of the judicial protection of their legitimate interests or if required by law.
5. Data security
The company, as the Data Controller, undertakes to implement the necessary technical and organisational measures. In particular, the file containing the profile details and applications of candidates is protected both electronically and physically. Personal data is stored on the company's servers, located in a data centre in OKTA AD – Skopje and in a data centre in Aspropyrgos, Attica. Measures are taken to protect them, i.e. access rights, encryption and anonymisation of older data. The server is protected by a password and a firewall. The company has security policies in place that aim to ensure the security and integrity of all information, including personal information.
6. Subject rights
6.1 Right of access, rectification, erasure, restriction of processing
The data subject has the right to submit a request to the company (as the data controller) for:
- access to personal data about them,
- rectification of inaccurate or outdated data about them or to complete any incomplete data,
- request the erasure of data about them if their processing is not necessary in relation to the purposes for which they were collected,
- request the restriction of the processing of personal data about them,
- portability of their data (e.g. directly to another employer).
More information about these rights, including the circumstances under which they are exercised and how they are exercised, is included in the PERSONAL DATA PROTECTION STATEMENT posted on the company's website https://www.okta-elpe.com/privacy-statement-3/
6.2 Right to object
In addition, the data subject has the right to object, at any time and for reasons related to their particular situation, to the processing of their personal data based on Article 10, paragraph 1, lines 5 or 6 of the GDPR, including profiling based on those provisions. In such a case, the company as the controller shall no longer process the personal data, unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
6.3 Right to withdraw consent
The applicant has the right to withdraw their consent at any time, without prejudice to the lawfulness of the processing based on consent before its withdrawal. In any case, the data subject is informed that the withdrawal of consent to the processing of data that is absolutely necessary for the performance of the contract may mean that the contract cannot be performed in some or all of its aspects.
6.4 The exercise of the above rights requires the data subject to submit, free of charge, a written request to the company's Data Protection Officer, whose details are provided below. The company reserves the right to respond within one month of receiving the request, but may extend this period by a maximum of two months with a reasoned response.
7. Communication between the data subject and the company
For any matter relating to the processing of their personal data, or if they wish to exercise their rights or receive a copy of the latest version of the Company's Personal Data Protection Policy, the data subject may contact the company's Data Protection Officer (DPO), Marija Peshevska Stanishikj, using the following contact details:
- by e-mail: at MPeshevskaStanishikj@helpe.gr
- by post: to the company's address okta.info@helpe.gr, to the attention of the Data Protection Officer.
In any case, the data subject retains the right to lodge a complaint with to the Personal Data Protection Agency (tel: 00389 (2)3230 635 – e-mail: info@privacy.mk).
8. Retention period for personal data
The company retains personal data for a period of up to five (5) years from the termination of the contract in any way and up to two (2) years from the submission of the application by the student in case the contract is not concluded. If a legal dispute is pending, beyond the above processing times, and until its conclusion with a final court decision.