Privacy Policy

WEBSITE PERSONAL DATA PROCESSING POLICY

This Website Personal Data Processing Policy (hereinafter the “Policy“) applies to the website at hellenicammunition.com (the “Website”) of the Greek legal entity under corporate name “HELLENIC AMMUNITION SOCIETE ANONYME” (in Greek «ΕΛΛΗΝΙΚΑ ΠΥΡΟΜΑΧΙΚΑ ΑΝΩΝΥΜΗ ΕΤΑΙΡΕΙΑ») having its registered seat at the Municipality of Lavrio, Attica, Greece, with GEMI registration number 190955201000 and T.I.N. 803158370 (hereinafter “HELLENIC AMMUNITION” or the “Company” or “We” or “Us”) and contains information about the basic circumstances of the processing of personal data of visitors to and users of the Website.

We process personal data, including personal data of data subjects located outside the European Union/European Economic Area (hereinafter the “EEA“), in accordance with applicable EU and Greek laws, in particular the General Data Protection Regulation (EU) 2016/679 (“GDPR“), Greek Law 4624/2019, any related implementing regulation, along with the decisions and guidelines of the Hellenic Data Protection Authority (“HDPA“) (collectively the “Applicable Laws”).

In the event of specific requirements for the processing of personal data in jurisdictions outside the EEA, if these impose obligations on Us as data controller beyond the scope of the Applicable Laws, We also respect these local specifics when processing personal data.

This Policy contains the following information:

1. IDENTIFICATION OF THE DATA CONTROLLER
2. PURPOSE, SCOPE AND LEGAL BASIS OF THE PERSONAL DATA PROCESSED
3. CLIENT
4. BUSINESS PARTNER
5. JOB APPLICANT
6. WEBSITE VISITOR
7. LINKS TO THIRD PARTIES
8. PROCESSING OF PERSONAL DATA ON THE BASIS OF CONSENT
9. RECIPIENTS OF PERSONAL DATA & INTERNATIONAL TRANSFERS OF PERSONAL DATA
10. SECURITY OF PERSONAL DATA
11. RETENTION PERIOD OF PERSONAL DATA
12. RIGHTS OF DATA SUBJECTS & EXERCISE THEREOF
13. AMENDMENTS
14. LANGUAGE

1. IDENTIFICATION OF THE DATA CONTROLLER

HELLENIC AMMUNITION is the controller of your personal data collected through the Website in accordance with this Policy and the Applicable Laws, i.e. it determines the purposes and means of such processing, and it also carries out the processing itself.

You can contact Us, in Our capacity as your personal data controller, in the following ways:

Delivery address: Municipality of Lavrio, 1 Ano Oria Lavriou, Attica, P.C. 19500
Contact e-mail: dataprotection@hellenicammo.com

2. PURPOSE, SCOPE AND LEGAL BASIS OF THE PERSONAL DATA PROCESSED

Υour personal data are processed for the following purposes:

1. responding to requests, enquiries and expressions of interest submitted through the Website, including taking steps at the request of the data subject prior to the potential conclusion of a contract; and processing job applications submitted in relation to open positions advertised on the Website;
2. compliance with legal obligations, to which the Company is subject, including, without limitation, obligations relating to the operation of the Website, the handling of requests submitted through the Website and cooperation with competent public authorities in accordance with applicable laws;
3. protection of Our legitimate rights and interests (e.g. protection of Our Website and network against misuse, unauthorized access, cyberthreats or cyberattacks);
4. effective communication with visitors and users of the Website, including responding to enquiries, requests and messages submitted through the Website or via email, facilitating the establishment of business communications and negotiations, and preserving your preferences;
5. improving the user experience on the Company’s Website; and
6. operation, security and improvement of the Website, including the use of cookies and similar technologies to remember user preferences, and analyze Website traffic and usage.

All personal data is processed in a lawful and transparent manner and only personal data that is adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed is collected and processed.

3. CLIENT

If you are a potential customer or contacts Us through the Website in connection with Our products or services, We may process your personal data as follows:

Purpose of processing

• Pre-contractual measures, including responding to requests, enquiries and expressions of interest relating to our products or services submitted through the Website;
•  Compliance with legal obligations to which the Company is subject in connection with processing activities described in the present Policy;
• Settlement of questions, suggestions, comments and other requests or communications submitted through the Website; and
• Protection of the Company’s rights and legitimate interests, including the establishment, exercise or defense of legal claims and the prevention of misuse or fraudulent activity.

Scope of personal data

• Identification data (in particular, name and surname);
• Contact details (in particular telephone number); and
• Other personal data voluntarily included by the data subject in the free-text requests, questions or expression of interest in the Company’s products or services, to the extent relevant and necessary for handling the relevant request or communication.

Legal basis for processing

• Taking steps at your request prior to entering into a contract, pursuant to article 6(1)(b) of GDPR;
• Compliance with legal obligations to which We are subject under article 6(1)(c) of GDPR; and
• Protection of Our rights and legitimate interests under article 6(1)(f) of GDPR.  

4. BUSINESS PARTNER

If you are Our business partner (supplier) or contacts Us through the Website in connection with a potential business relationship, We may process your personal data as follows:

Purpose of processing

• Taking pre-contractual measures, including responding to requests, enquiries and expressions of interest relating to a potential business relationship submitted through the Website;
• Compliance with legal obligations to which the Company is subject in connection with processing activities described in the present Policy;
• Handling and responding to questions, requests and other communications submitted through the Website;
• Protection of the Company’s rights and legitimate interests, including the establishment, exercise or defense of legal claims;

Scope of personal data

• Identification data (in particular name and surname);
• Contact details (in particular telephone number);
• Οther personal data voluntarily included by the data subject in the free-text requests or other communications effected through the Website, to the extent relevant and necessary for handling the relevant request or communication.

Legal basis for processing

• Taking steps at your request prior to entering into a contract pursuant to article 6(1)(b) of GDPR;
• Compliance with legal obligations to which We are subject under article 6(1)(c) of GDPR; and
• Protection of Our rights and legitimate interests under article 6(1)(f) of GDPR.

5. JOB APPLICANT

If you apply for an open position advertised on the Website, We may process your personal data as follows:

Purpose of processing

• Taking pre-contractual measures before entering into an employment relationship, including processing and assessing your job application and taking steps in connection with the recruitment and selection process;
• Maintaining a database of job applicants for potential future employment opportunities, subject to your consent.

Scope of personal data

• Identification data (in particular name and surname);
• Contact details (in particular e-mail address and telephone number); and
• Other information (in particular, information provided in your CV and, where applicable, cover letter, submitted through the job application form which may include, without limitation, date of birth, information relating to your education, qualifications, professional experience and skills and other information relevant to the selection process).

Legal basis for processing

• Taking steps at your request prior to entering into an employment contract, pursuant to article 6(1)(b) of GDPR;
• Protection of Our rights and legitimate interests under Article 6(1)(f) of GDPR; and
• Your consent pursuant to Article 6(1)(a) of GDPR, where processing is based on your consent.

6. WEBSITE VISITOR

When you visit the Website, cookies, which are small text files containing short data that may be stored on your device when you visit the Website, and similar technologies, are used to ensure the proper operation and security of the Website. Until you accept all cookies, reject them, or configure your preferences through the “Cookies Preference Settings” section available on the Website, only cookies strictly necessary for the proper and safe operation of the Website are stored. Subject to your prior consent, the Website may also use cookies and similar technologies so as to enhance your browsing experience, analyze Website traffic and usage in order to improve the Website’s performance, remember your preferences and personalize online content and advertising.

The Website currently uses Google Analytics 4 (“GA4”), implemented through Google Tag Manager, for the measurement and analysis of Website traffic and usage. The Google Tag Manager container used on the Website contains only the GA4 tag. GA4 cookies, namely webikon_cookies_consent and ga and _ga_E94G7Q89W6, are placed only after the user has provided the required consent through the Website’s cookie consent mechanism. The pll_language cookie, which remembers the user’s language selection, is stored without consent as it is strictly necessary for the Website’s technical operation.

When you access and use the Website, certain technical data may be collected automatically by the hosting provider in server logs, namely your IP address, user agent (browser and device information), and timestamps of access. A backup copy of the Website database is also retained. Such information is not generally collected for the purpose of directly identifying individual users, but it may constitute personal data where it can be used to identify an individual, directly or indirectly, in particular when combined with other information.

Personal data processed in connection with the operation and security of the Website are processed on the basis of the Company’s legitimate interests pursuant to Article 6(1)(f) GDPR, including its legitimate interest in ensuring the proper, secure and effective operation of the Website. Where the use of cookies or similar technologies requires your consent under applicable law, the relevant processing is carried out on the basis of your consent pursuant to Article 6(1)(a) GDPR.

7. LINKS TO THIRD PARTY WEBSITES

Links to websites of other entities may be included on Our Website. You will only be redirected to the relevant third-party website if you actively click on the relevant link. In this case, your web browser will open the corresponding page. Please note that any processing of personal data carried out through such third-party websites is governed by the policies of the respective websites, which are beyond Our control.

8. PROCESSING OF PERSONAL DATA ON THE BASIS OF CONSENT

Where the processing of your personal data is based on your consent in accordance with the present Policy, your consent is given voluntarily and may be withdrawn at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

9. RECIPIENTS OF PERSONAL DATA & ΙΝΤΕRNATIONAL TRANSFERS OF PERSONAL DATA

Data Processors. Where HELLENIC AMMUNITION engages a processor to process personal data collected through the Website on its behalf (e.g. an IT service provider, hosting provider or other technical service provider, an affiliate or a third party service provider engaged in the recruitment and hiring process), it shall ensure that such processor is appointed pursuant to a written agreement that complies with Article 28 GDPR and provides appropriate safeguards for the protection of personal data. Any such processor shall be authorized to process personal data only on Our documented instructions (in Our capacity as data controller) and shall be required to implement appropriate technical and organizational measures, maintain confidentiality, and upon termination of the services return or securely delete the personal data as instructed by the Company.

Other Recipients. We may also disclose your personal data, only to the extent necessary for the relevant purpose described in the Policy, to:

1. service providers, such as IT service providers, website hosting and support providers, recruitment service providers, marketing service providers and other suppliers engaged by the Company in connection with the operation and functionality of the Website and affiliated entities, subject to appropriate contractual and confidentiality obligations;
2. customers, suppliers, business partners and other counterparties, where disclosure is necessary in connection with requests, enquiries or other communication submitted through the Website;
3. public, judicial, regulatory, supervisory, law enforcement or other competent authorities, where disclosure is required or authorized by applicable law; and
4. professional advisers, including lawyers, auditors, accountants, notaries, and other advisers engaged by the Company, subject to confidentiality obligations.

The Company shall ensure that any disclosure of personal data is limited to what is necessary for the relevant purpose and carried out in accordance with applicable data protection legislation.

For the purposes set out in this Policy, we may also transfer personal data to recipients and processors based outside the EEA. Where personal data is transferred outside the EEA, We ensure that an adequate level of protection is provided in accordance with applicable data protection legislation, including through an adequacy decision of the European Commission, appropriate safeguards, or another lawful transfer mechanism recognized under the GDPR.

10. Security of Personal Data

The Company recognizes the importance of privacy and is committed to safeguarding personal data in accordance with its obligations under the GDPR. The Company implements appropriate technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access.

Such technical and organizational security measures adopted by the Company include, without limitation encryption of personal data in transit and at rest; pseudonymization of personal data where feasible; measures ensuring the ongoing confidentiality, integrity, availability and resilience of systems and services processing personal data; procedures for the timely restoration of availability and access to personal data following a physical or technical incident; regular testing, assessment and evaluation of the effectiveness of security measures; and physical security controls at Company premises.

Access to personal data is restricted to authorized personnel, contractors and third parties on a strict need-to-know basis and subject to confidentiality obligations and documented instructions.

11. RETENTION PERIOD OF PERSONAL DATA

The Company shall retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by applicable law.

Personal data processed in connection with requests, enquiries, pre-contractual communications or job applications submitted through the Website shall be retained for as long as necessary for the handling of the relevant request, communication, application or selection process, as applicable.

It is explicitly provided that where a job applicant has consented to the retention of its application for future employment opportunities, the relevant personal data may be retained for a period of up to twelve (12) months, unless such consent is withdrawn earlier or otherwise ceases to be valid. Following withdrawal of consent, the Company shall cease processing the relevant personal data for such purpose, without prejudice to any further retention that may be necessary for compliance with applicable law or for the establishment, exercise or defense of legal claims.

Personal data processed in connection with the operation, security and improvement of the Website, including data collected through cookies and similar technologies, shall be retained for as long as necessary for the relevant purpose. In particular, entries submitted through the Website’s job application forms are automatically deleted from the Website database twelve (12) months after submission; server logs maintained by the hosting provider (IP address, user agent and timestamps) are retained for fourteen (14) days; and database backups are retained for thirty (30) days. GA4 analytics data is retained for two (2) months (event data) and fourteen (14) months (user data).

In certain cases, the Company may retain personal data for a longer period where required or permitted by applicable law or where necessary for the establishment, exercise or defence of legal claims.

Upon expiry of the applicable retention period, personal data shall be securely deleted or irreversibly anonymized in accordance with the Company’s internal procedures.

12. RIGHTS OF DATA SUBJECTS & EXERCISE THEREOF

12.1 Rights available to data subjects  

You have the following rights in relation to your personal data:

Right of Access:

You have the right to obtain confirmation as to whether or not the Company processes your personal data and, where this is the case, access to such data and relevant information regarding the processing.

Right to Rectification:

You have the right to request the rectification of inaccurate personal data and the completion of incomplete data without undue delay.

Right to Erasure:

You have the right to request the erasure of your personal data where one of the grounds set out in Article 17(1) GDPR applies. This right does not apply where processing is necessary for compliance with a legal obligation, the performance of a task carried out in the public interest, or the establishment, exercise or defense of legal claims.

Right to Restriction of Processing:

You have the right to request restriction of processing in the circumstances set out in Article 18(1) GDPR.

Right to Data Portability:

You have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit those data to another controller, where processing is based on consent or contract and carried out by automated means.

Right to Object:

You have the right to object, on grounds relating to your particular situation, to processing. The Company shall cease processing unless it demonstrates compelling legitimate grounds which override your interests, rights and freedoms, or the processing is required for the establishment, exercise or defense of legal claims.

Right to Withdraw Consent:

Where you have provided consent to the retention of your application for future employment opportunities, you may withdraw your consent at any time by contacting Us at jobs@hellenicammo.com. Withdrawal does not affect the lawfulness of processing based on consent prior to its withdrawal.

Right not to be subject to automated decision-making:

You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you, subject to Article 22(2) GDPR.

Right to lodge a complaint:

You have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA/ΑΠΔΠΧ), 1–3 Kifissias Avenue, Athens, Greece, PC 115 23, tel. +30 210 64 75 600, http://www.dpa.gr, without prejudice to any other administrative or judicial remedy available to you.

12.2 Exercise of your rights

You may exercise your rights by submitting a written request to the Company using the contact details provided in this Policy. The Company reserves the right to take reasonable measures to verify the identity of the person submitting a request, where necessary.

The Company shall respond without undue delay and in any event within one (1) month of receipt of the request. This period may be extended by up to two (2) additional months where necessary, taking into account the complexity and number of requests, provided that you are informed of the extension and the reasons thereof within one (1) month of receipt of the request.

Responses shall be provided free of charge. Where requests are manifestly unfounded or excessive, in particular due to their repetitive character, the Company may charge a reasonable fee based on administrative costs or refuse to act on the request, in accordance with Article 12 GDPR. In both cases the Company shall have the burden of proof.

13. AMENDMENTS

This Policy is effective from 06.10.2026.

The Company reserves the right to amend or update this Policy at any time and without prior notice, either at its discretion, subject always to compliance with Applicable Laws, or as necessary to reflect any changes in Applicable Laws or regulatory requirements. Any such amendments or updates shall become effective upon their publication on the Website.

14. LANGUAGE

This Policy is made available in both English and Greek; in the event of any inconsistency between the two versions, the Greek version shall prevail.