Privacy Policy

1. Clarifications on the Processing of Personal Data

1.1 Introduction – Data Controller

The company under the name “Optimus Energy S.A.”, with its registered office in the Municipality of Athens, 124 Kifisias Ave., P.C. 115 26, email: info@optimusenergy.gr, website: https://optimusenergy.gr/, subsidiary of HERON ENERGY S.A. and member of the GEK TERNA Group (hereinafter referred to as the “Company”), informs you that for the purposes of carrying out its business activities, it processes personal data as the Data Controller, in accordance with applicable national and European legislation, and EU Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and the free movement of such data (General Data Protection Regulation – GDPR, hereinafter the “Regulation”), as in force.

We would like to assure you that for the Company, the protection of the personal data of natural persons who interact in any way with it is of primary importance. For this reason, we take appropriate measures to safeguard the personal data we process and ensure that their collection and processing is always carried out in compliance with the obligations set out by the legal framework, both by the Company itself and by third parties who process personal data on behalf of the Company.

1.2 Data Protection Officer (DPO)

For any matter related to the processing of personal data, please contact directly the Data Protection Officer (DPO) at: dpo@gekterna.com.

1.3 What personal data do we process?

The personal data you provide to us, such as identification data (e.g., full name, Tax Identification Number), contact details (e.g., full name, home address, email address, phone number, other additional personal information, etc.), as well as information required in the context of an employment relationship (e.g., education/training/special skills, prior work experience, social security, income tax, etc.), are processed only when we have a lawful basis for doing so.

2. What are the lawful bases for processing your personal data?

The lawful bases for processing your personal data include:

Performance of a contract assigned or to be assigned to us, such as carrying out a project or providing services, to fulfill our contractual obligations.
Safeguarding and protecting legitimate interests, both yours and ours.
Compliance with a legal obligation, e.g., publication of acts and details of the company (including identification details of natural persons such as shareholders), in accordance with Article 7b of Law 2190/1920, or processing required for supporting and satisfying legal claims.
Consent you may provide under the specific conditions of the legal framework.

3. How and why do we use your personal data?

For proper fulfillment of our contractual obligations and communication: We collect and use the necessary information to ensure the smooth execution of our cooperation, such as contract amendments, managing financial matters, etc.
For communication and relationship management: We may contact you by email for administrative purposes, to answer your queries or comments, and to improve both our relationship and the quality of services provided.
For compliance with legal obligations: For example, when we publish personal data of the Company’s natural persons (e.g., shareholders) on our website, GEMI registry, or the Athens Stock Exchange, or when notifying the Hellenic Capital Market Commission of significant holdings under Law 3556/2007.
For safeguarding legitimate interests and protecting persons and assets: For instance, by using CCTV and security cameras to protect people, materials, and Company premises.

4. Who may be recipients of your data?

The Company may disclose personal data to:

Public authorities, when required for audits under applicable financial, tax, insurance, labor, or other laws.
Company partners (contractors, subcontractors, banks, insurance companies, auditing firms, IT providers, etc.), with whom it signs data processing agreements to ensure compliance.
Third countries, where the Company operates business activities, ensuring full compliance with Chapter V of the Regulation for transfers outside the EU.

5. Data Retention Period

The retention period is determined based on specific criteria:

When imposed by law, data will be retained for as long as the legal provisions require.
When based on a contract, data will be retained for as long as necessary to execute the contract and for the establishment, exercise, or defense of legal claims arising from it.

6. What are your rights regarding your personal data?

Every natural person whose data is processed by the Company enjoys the following rights:

Right of access: to know and verify the legality of processing.
Right to rectification: to correct, update, or modify data.
Right to erasure (“right to be forgotten”): subject to the limitations of Article 17 GDPR.
Right to restriction of processing: in specific cases (e.g., contesting accuracy, pending verification, opposing erasure but requesting restriction, etc.).
Right to object: to processing based on legitimate interests.
Right to data portability: to receive your data in a structured, commonly used format and transmit it to another controller, where technically feasible.
Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of the above rights, you may contact the DPO at: dpo@gekterna.com.

Right to lodge a complaint: You may submit a complaint to the Hellenic Data Protection Authority (www.dpa.gr) via its electronic portal: https://eservices.dpa.gr/.

7. Security of Personal Data

Optimus Energy applies appropriate technical and organizational measures to ensure secure processing of personal data and to prevent accidental loss, destruction, or unauthorized and/or unlawful access, use, alteration, or disclosure. In determining suitable measures, the Company takes into account technological advancements, cost of implementation, the nature and purpose of processing, the likelihood and severity of risks, and the potential impact on individuals’ rights and freedoms.