The Company under the trade name PUBLIC POWER CORPORATION SOCIETE ANONYME (and the distinctive title PPC), having its registered seat in Athens (30 Chalkokondyli st., GR-104 32, tel. 800-900-1000), (hereinafter referred to as the “Company”) hereby informs you, in its capacity as Personal Data Controller, in accordance with the Regulation (EU) 2016/679 (hereinafter the “GDPR”) and the relevant provisions of the Greek legislation on the protection of personal data, as in force, about the processing of personal data through the PPC Virtual Assistant, which is an artificial intelligence application available via the PPC website as well as through the PPC’s accounts on Facebook Messenger, Whatsapp and Viber.
1. Data Categories and Source of Origin
The Company collects the following data categories from you:
|
DATA CATEGORIES |
EXAMPLES |
|
Identification data
|
|
|
Contact details
|
|
|
Conversation data |
|
|
Cookies & similar technologies data |
|
|
Log files / User identifiers |
|
2. Purpose of Processing & Legal Basis
|
PURPOSE |
DATA CATEGORIES |
LEGAL BASIS FOR DATA PROCESSING |
| Virtual Assistant user identification |
Identification data |
Performance of contract (Article 6(1)(b) of the GDPR |
|
Provision of general information on PPC products and services |
Conversation data |
Legitimate interest (Article 6(1)(f) of the GDPR) |
|
Handling customer requests |
Identification data |
Performance of contract (Article 6(1)(b) of the GDPR) |
|
Ensuring the smooth and secure operation of the service |
Log files |
Legitimate interest (Article 6(1)(f) of the GDPR) |
|
Training and improving the functionality of the Virtual Assistant |
Conversation data (in pseudonymised form) |
Legitimate interest (Article 6(1)(f) of the GDPR) |
|
Analysing the Virtual Assistant traffic through performance cookies |
Cookies / similar technologies data |
Consent |
3. Data retention period
Conversations with the Virtual Assistant (which may contain identification data and/or contact details) are retained for a period of three (3) years, following the application of pseudonymisation techniques to the identification data and/or contact details you have provided.
Log files are retained for a period of one (1) year.
Recipients of data:
i. IT support service providers,
ii. Hosting and cloud providers,
iii. The private company “Helvia Technologies”, which provides the Conversational AI Platform,
iv. Customer service providers
Furthermore, depending on the communication channel you choose to use with the Virtual Assistant, recipients may also be:
v. Meta Platforms, Inc. – for use via Facebook Messenger and WhatsApp
vi. Rakuten Group, Inc. – for use via Viber
Please note that the use of communication channels via third-party platforms (for example, Facebook Messenger, WhatsApp, Viber) is also subject to the terms of use and privacy policies of the providers concerned, which act as Independent Personal Data Controllers (for example, Meta Platforms, Inc., Rakuten Group, Inc.). The data processing is carried out through PPC’s business accounts, in accordance with the platforms’ terms (WhatsApp, Facebook Messenger, Rakuten Viber). We encourage you to consult these policies in order to understand how your data is processed by these third-party providers. The Company bears no responsibility for how your data is processed by these third-party providers.
4. Transfer of Personal Data outside the EU
The Company does not transfer your personal data to third countries outside the EU.
In the event that the Company or its authorised partners transfer personal data they have collected or processed to personal data controllers or processors, such as cloud providers, in third countries outside the European Union, such data transfers are subject to the requirements and conditions of Articles 44-49 of the GDPR. In such a case, the Company ensures that appropriate safeguards are in place for the processing of personal data outside the European Union.
5. What are the rights in relation to your data
|
Right of Access |
You have the right to be informed about the processing of your data and receive copies thereof. |
|
Right to Rectification |
You have the right to request the rectification of any inaccurate personal data and the completion of any missing data. |
|
Right to Erasure |
You have the right to request the erasure of your personal data if these are no longer necessary in relation to the purposes for which they were processed or if you have withdrawn the consent on which the data processing and collection were based. |
|
Right to Restriction of Processing |
You have the right to request the restriction of processing for a specific purpose. |
|
Right to Data Portability |
You have the right to receive your personal data, which you have provided to the Company, in a structured, commonly used and machine-readable format. |
|
Right to Object |
You have the right to object to the processing of your personal data in cases where you do not wish your personal data to be processed, provided that the processing is based on legitimate interest and/or includes profiling. |
6. Contact details for exercising your rights and DPO contact details
Exercise of rights: customercare@dei.gr or via the contact form.
Contacting the Data Protection Officer: dpo.office@dei.gr
Detailed information about the cookies used in each category can be found in the Cookie Settings on our website.
Our website has detected that you are using an outdated browser that will prevent you from accessing certain features.
In order to improve your browsing experience we strongly recommend you use the links below to update to one of the following modern browsers.
