1. Data Controller

THE NATIONAL MEDICINES ORGANIZATION (EOF), a legal entity under public law (n.p.d.d.) headquartered in Cholargos, 284 Mesogeion Ave., P.C. 15562 (website www.eof.gr, contact tel. +30 213 2040 000), informs you in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation) and the provisions of national legislation on the protection of personal data, in its capacity as Data Controller, that it processes personal data within the framework of its responsibilities in order to fulfill its mission.
EOF, in compliance with the applicable legal framework, takes all necessary technical and organizational measures for the secure processing of the personal data of the subjects, in order to ensure in every way their protection against loss, leakage, alteration, transmission or other unlawful processing, in accordance with articles 25 and 32 of the General Data Protection Regulation (EU) 2016/679.

2. Purpose and legal basis for processing personal data:

EOF processes personal data for the exercise of its powers provided for in the law, its compliance with the legal obligations arising from national and EU law, the performance of tasks carried out in the public interest and in the exercise of public authority vested in it, in accordance with par. 1, point e) of art. 6 of the General Data Protection Regulation (EU) 2016/679. It also collects and processes personal data in the context of Contracts it concludes, as well as of the personnel serving in it.
The processing of personal data by EOF is necessary for the fulfillment of the mission assigned to it by the legislator in the context of the protection of Public health and the execution of its Contracts.
Also, EOF processes personal data for archiving purposes or for scientific research purposes.

3. Personal data collected by EOF:

EOF collects and generally processes identification data of subjects included in Responsible Declarations (such as name, ID Card Number, etc.), Tax Identification Number, legalization data (such as Authorizations), contact data (such as postal and email address, landline, mobile phone, etc.), mainly of representatives of companies producing products under the jurisdiction of EOF, but also of citizens. It also collects and processes personal data of special categories, such as health data and criminal records data.
It collects and processes personal data of its partners (Declarations of interests, CVs, etc.), its suppliers, and its employees (Tax ID, Social Security Number, IBAN, CVs, marital status data, etc.)
Furthermore, EOF collects image data from video surveillance systems of the external perimeter areas and entrances of the building in which it is housed, with the aim of protecting the Organization's people and property.

4. Method and sources of obtaining personal data:

EOF collects data from data subjects directly or from third parties when submitting any declaration or application, electronically or otherwise.
Also, personal data from third-party sources (individuals, public authorities and services, national and foreign, as well as European and international organizations), as well as from law enforcement, judicial and prosecutorial authorities in the context of investigating the commission of offenses, are disclosed to EOF.

5. Retention period of personal data:

EOF retains personal data for as long as necessary to fulfill the purposes it pursues and in any case for the entire period of time provided for by law, within which the State may exercise its rights and responsibilities.

6. To which recipients or third parties may personal data be disclosed or transmitted:

EOF does not transfer personal data to third parties. It only discloses it if requested by law enforcement and judicial authorities in the context of investigating or prosecuting crimes or following a justified prosecutorial order. In this case, EOF is not obliged to inform data subjects about this disclosure as this processing does not constitute a transfer and public authorities in these cases are not considered “recipients” (art. 4 par. 9 GDPR).

7. Transfer of personal data to third countries and International Organizations.

EOF does not transfer personal data to third countries and International Organizations.

8. Rights of personal data subjects:

1. Right to information and transparency (Articles 12, 13 and 14 of the GDPR. Individuals have the right to be informed accurately and clearly about the collection and use of their personal data by EOF.
2. Right of access Article 15 of the GDPR. Individuals may request free access to their personal data processed by the organization.
3. Right of correction Article 16 of the GDPR. Individuals may request the correction of inaccurate personal data or the completion of incomplete personal data.
4. Right to erasure ("right to be forgotten") Article 17 of the GDPR. Individuals have the right to request the erasure of their personal data, under certain conditions. It is noted, however, that this is not an absolute right, as the further retention of personal data may be necessary for EOF to comply with a legal obligation in order to fulfill a task carried out in the public interest or in the exercise of official authority vested in the Organization, or for reasons of public interest in the field of public health, as well as for the establishment, exercise or defense of legal claims.
5. Right to restrict processing Article 19 of the GDPR. Individuals may request from EOF the restriction of the processing of their personal data under certain conditions, such as during the verification of their data, when their accuracy is disputed, if the processing is unlawful, the data is no longer needed but the individual requests their retention for the exercise and defense of legal claims, etc.
6. Right to object to processing Article 21 of the GDPR. Individuals have the right to object, on a case-by-case basis, – at any time and for reasons relating to their particular situation – to the processing of personal data carried out by EOF in the exercise of public authority vested in it and for the performance of a task carried out in the public interest.

9. Data Protection Officer

For issues regarding the processing of personal data by EOF and the exercise of your rights arising from the GDPR, you can contact the Data Protection Officer of EOF, at email: dpo at eof dot gr, at telephone number 2132040284 or by post at the address Mesogeion 284, 15562 Cholargos.

10. Rights to submit a complaint to the Personal Data Protection Authority

You have the right to appeal to the Hellenic Data Protection Authority (HDPA) for issues concerning the processing of your personal data. For the competence of the HDPA and how to submit a complaint, you can visit its website, www.dpa.gr – My rights – Submitting a complaint, where detailed information is available.

11. Update – modification of the Personal Data Protection Statement.

EOF may update/supplement this personal data protection statement, in accordance with the applicable legislative and regulatory framework. In this case, the updated/supplemented version of the personal data protection statement will be posted and available on the EOF website, /politics-aporritou/