Information Notice to Candidate Employees Regarding the Processing of Their Personal Data
Notice to Candidate Employees
Information Notice by Enerwave to Candidate Employees Regarding the Processing of Their Personal Data
The company “Enerwave S.A.”, having its registered office in the Municipality of Maroussi (6 Fragkokklisias St., P.C. 15125) (“Enerwave” or the “Company”), collects, stores and generally processes Personal Data (as defined below) of candidate employees, in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the applicable national data protection legislation (collectively, the “Data Protection Legislation”).
This notice by the Company to candidate employees, provided pursuant to Articles 13 and 14 of the GDPR (the “Notice”), applies to Personal Data maintained electronically and also extends to paper-based filing systems. This Notice outlines how Enerwave collects and generally processes the Personal Data of candidate employees. In carrying out this activity, and in its capacity as Data Controller, Enerwave is fully committed to safeguarding the security of candidate employees’ Personal Data, ensuring compliance with all data security standards imposed by the Data Protection Legislation.
1. Sources of Personal Data Collection
Enerwave collects your personal data either directly from you, namely the candidate employees, or through authorized third parties (such as the Workable application for the submission of CVs, recruitment service providers and recruiters), social media platforms related to employment opportunities, former employers, or other references provided by you or by current Enerwave employees. In any case, your personal data is considered a necessary prerequisite for the pursuit of the processing purposes, as detailed below.
2. Personal Data Processing and Legal Bases
The table below sets out the purpose for which the personal data is processed by Enerwave, the categories of such personal data, as well as the legal basis for their processing.
| Purpose of Processing | Categories of Personal Data | Legal Basis for Processing (Article 6 of the Regulation) (Article 9 of the Regulation) |
|---|---|---|
| Recruitment & selection of permanent staff and senior executives |
1. Basic personal data (phone number, address, email, full name, gender, date of birth, marital status, military status, etc.) 2. CV data (education, professional experience, skills, photos, etc.) 3*. Assessment data (e.g. answers to psychometric tests, interview evaluation, skill test results, reference letters, etc.) 4*. Health data (health data through psychometric tests) *These categories of personal data will be processed by Enerwave in case the candidate proceeds to the next evaluation stage. |
Article 6(1)(b) – processing is necessary in order to take steps at the request of the data subject prior to entering into a contract. Article 6(1)(a) – for candidate data retained after the selection process, the data subject must have given consent for one or more specific purposes. Especially for the processing of special categories of personal data (health data through psychometric tests), the legal basis is processing for purposes of preventive or occupational medicine, assessment of the working capacity of the employee, medical diagnosis, provision of health or social care or treatment or the management of health or social care systems and services pursuant to Union or Member State law or pursuant to a contract with a health professional, and subject to the conditions and safeguards referred to in paragraph 3 (Article 9(2)(h) of the GDPR). |
| Ensuring medical fitness of candidates for positions within the factories |
1. Basic personal data (full name, father’s name, mother’s name, age, address, social security number - AMKA) 2. Health data (certificates/declarations of medical fitness) |
Company’s legal obligation (Article 6(1)(c) GDPR) Legal Basis for Processing (Article 9 of the Regulation): Processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law (Article 9(2)(b) of the GDPR). |
3. Disclosure to third parties and categories of recipients
Your personal data, as described above, may be disclosed to the relevant internal departments of Enerwave responsible for reviewing and assessing candidate employees, who are bound by confidentiality obligations. Where necessary, and in accordance with applicable legislation, your data may also be disclosed to third parties, either public or private entities, when required for the Company’s compliance with a legal obligation or is necessary for the purposes of the legitimate interests pursued by the Company. More specifically, the Company may disclose your personal data, as necessary in each case:
To government authorities, either by submitting documents, digital files, or through online platforms, as defined from time to time.
To administrative, judicial, and prosecutorial authorities in the context of handling the Company’s legal cases, or pursuant to a court decision or lawful request addressed to the Company.
Third parties that provide technical support services, companies that provide software to the company (e.g. Workable platform), companies and candidate assessment and matching services.
In all cases and wherever feasible, the Company complies with the requirements of the GDPR (Article 28) regarding the compliance of third parties/data processors with whom it cooperates, by binding them to safeguard the personal data disclosed to them, in accordance with the provisions of the GDPR and the Company’s applicable policies and procedures.
4. International Transfers of Personal Data
Due to the global nature of our email support systems (Microsoft), your Personal Data may be disclosed to entities outside the European Economic Area (EEA), specifically to Microsoft Ireland Operations Limited. In such cases, excluding countries that the European Commission has determined offer an adequate level of protection, we require recipients to comply with appropriate safeguards for the protection of Personal Data.
Any transfer of your Personal Data to Enerwave entities outside the EEA is carried out on the basis of a data transfer agreement incorporating Standard Contractual Clauses approved by the European Commission.
The Company transfers data to countries outside the European Economic Area (EEA), specifically within the context of its collaboration with the Data Processor Microsoft (USA). The data transfer is based on the legal basis of Article 46(2)(c) Standard Contractual Clauses as adopted by Commission Implementing Decision (EU) 2021/914. It is noted that, as of 10 July 2023, the European Commission adopted an Adequacy Decision for data transfers to the United States (EU-U.S. Data Privacy Framework) - Article 45 of the GDPR. The majority of recipients, including Microsoft, are certified under the Data Privacy Framework List (https://www.dataprivacyframework.gov/s/participant-search).
This section outlines your rights in relation to your personal data. These rights are subject to certain exceptions, reservations, or limitations. We kindly ask that you submit your requests responsibly. The Company will respond to you as soon as possible and, in any case, within one (1) month from the date of receipt of the request. If the review of your request is expected to require additional time, you will be duly informed. To exercise your rights, you may contact us via email at: dpo@enerwave.gr
The Company will ensure the unhindered exercise of the following rights:
- Right of access to your personal data (Article 15 of the GDPR)
- Right to rectification and/or completion of your data (Article 16 of the GDPR)
- Right to erasure/right to be forgotten (Article 17 of the GDPR)
- Right to restriction of processing (Article 18 of the GDPR)
- Right to data portability (Article 20 of the GDPR)
- Right to object to the processing of your data (Article 21 of the GDPR):
- Right to withdraw your consent, where consent has been provided for any reason (Article 7(3) of the GDPR)
5. Retention Period of Personal Data
When determining the retention periods for Personal Data, Enerwave generally follows the principle that Personal Data must be retained only for as long as necessary to fulfil the purpose for which it was collected, and deletes your Personal Data once that purpose no longer exists. If the recruitment process has been completed and the position has been filled by another candidate, your CV may be retained in our records for a period of two (2) years from the date it was received by the Company, subject to your explicit consent, in order to be reconsidered should a relevant job opportunity matching your profile arise in the near future. Otherwise, your personal data will be deleted immediately upon completion of the recruitment process for the position.
Specifically, for the purpose of ensuring the medical fitness of candidates, the retention period for your Personal Data is five (5) years from the termination of the contract.
The above-mentioned retention periods may be extended if we are required to retain the Personal Data in connection with legal proceedings, investigations, or other processes, or where a longer retention period is provided for by law.
6. Contacting the Supervisory Authority
For further information and advice regarding your rights, or to lodge a complaint, you may contact the Hellenic Data Protection Authority, the national supervisory authority in Greece:
Postal address:
Hellenic Data Protection Authority (HDPA), Offices: 1-3 Kifissias Avenue, P.C. 115 23, Athens
Call Centre: +30-210 6475600
Fax: +30-210 6475628
E-mail: contact@dpa.gr.
For the management of your data and your rights under the GDPR, the provisions outlined in this Information Notice apply. You may also withdraw any consent you may have previously given at any time by contacting us at dpo@enerwave.gr.