GDPR — Data Protection

Last updated: Οκτώβριος 2026

What this page is, and what it is not. It is pre-contractual information: it sets out the commitments we undertake, so that a body's Data Protection Officer can assess them before any award — which is when the answer is needed. It is not the agreement itself. The binding text is the Data Processing Agreement signed with your organisation, where the periods, the measures and the sub-processors are fixed for that specific engagement; if the two ever diverge, the contract prevails. The figures here are our defaults, not terms in force.

1. Two different sets of data

This page concerns the data inside an organisation's e-ROE platform. For this website's own data — the contact form and the statistics — the Privacy Policy applies, and there we are the controller.

2. Who is what

The organisation using e-ROE is the controller: it decides the purposes and means, and for Greek public bodies the legal basis is set by art. 5 of Law 4624/2019. Our own role depends on how the software is deployed and is not a matter for negotiation — it follows from the facts:

Our role per deployment model

Deployment	Our role
On your infrastructure, with no access by us	Neither controller nor processor. We process no data; we supply software.
On your infrastructure, with a support contract that grants access	Processor for the support activity — there the access is systematic and unavoidable.
Hosted by us (or by a provider we appoint)	Processor. Storage alone qualifies, even for encrypted data we cannot read.
The e-roe.gr website	Controller — see the Privacy Policy.

We never use a client's data for our own purposes — not for statistics, not for product improvement, not for training models. Doing so would make us a controller for that activity under art. 28(10) GDPR.

3. The Data Processing Agreement

Where we are a processor, an agreement under art. 28(3) GDPR is signed. We are willing to sign your own text; we also have ours, built on the standard contractual clauses of Implementing Decision (EU) 2021/915. The agreement specifies the subject matter, duration, nature and purpose, the types of data and the categories of data subjects — specifically, not with the general phrase «personal data», which the EDPB has held inadequate — and includes:

• (a) processing only on your documented instructions, including as regards transfers;
• (b) confidentiality undertakings from every person with access;
• (c) the security measures of art. 32;
• (d) sub-processing only with your prior written authorisation, with active notification of every change — a published web page is not enough — and the same obligations flowed down; we remain fully liable to you;
• (e) assistance in satisfying data subjects' rights;
• (f) assistance with arts. 32-36 (security, breaches, DPIA, prior consultation);
• (g) deletion or return of the data at your choice on termination;
• (h) making all necessary information available and allowing audits and inspections.

We further undertake to inform you immediately if we consider that an instruction of yours infringes the GDPR or national law.

4. Sub-processors

The chain has three links and we state them: your organisation is the controller, we are the processor, and the infrastructure provider is the sub-processor.

Hosting and e-mail

OVH Hosting Limited, Dublin, Ireland, registered no. 468585 — a company established in the EU. The provider's DPA (version 17.10.2025) is in force. The server sits in a datacentre in France.

Every addition or replacement of a sub-processor is notified to you in advance and you may object. We also say where that commitment stops, because a promise we cannot keep is worse than an honest one: for changes to its own sub-processors, the infrastructure provider gives us 30 days' notice (90 where the new sub-processor is not in a country with an adequacy decision) and accepts an objection within 15 days — but it is under no obligation to withdraw the change. If it does not, the remedy is termination of the affected service, not prevention of the change. The same therefore holds towards you.

The provider remains fully liable to us for its sub-processors (art. 7.4 of its DPA), and publishes the full list itself; we will supply it with the agreement.

4a. Requests from third-country authorities

Worth stating explicitly, because it is one of the few places where the contract gives more than the law: under art. 4.3 of the provider's DPA, where a non-European authority requests personal data the provider processes on behalf of a European client, the provider objects to the request. Three exceptions are provided — an international mutual legal assistance agreement, data stored in a datacentre outside the EU, or an art. 49 GDPR case — and the second does not apply here, the datacentre being in France. Under art. 4.2 the provider also checks the requesting authority's competence and informs us beforehand unless the law forbids it.

5. Security (art. 32)

• Pseudonymisation and encryption — TLS in transit, encryption of sensitive fields and secrets at rest.
• Confidentiality and integrity — permissions by role and position in the org chart, two-factor authentication, malware scanning of every uploaded file, an immutable audit trail of every action.
• Availability — backups and a documented restore procedure; high availability where the plan provides it.
• Regular testing and evaluation — automated checks on every code change, static analysis, and dependency vulnerability scanning.

We claim no certifications we do not hold. Where a tender requires one, we say so plainly in the offer.

6. Personal data breach

We notify you within 24 hours of the moment we become aware of a breach affecting your data. The figure is not arbitrary: the 72 hours of art. 33(1) run for you, and you are deemed to become aware the moment we tell you — so a 72-hour commitment on our side would consume your entire window.

The clock starts at our awareness, and that is not a quibble. Art. 33(2) binds a processor «without undue delay» from the point at which it becomes aware, and the same holds one level up: where an incident originates in the infrastructure, our awareness depends on the provider telling us — and art. 5.1 of its DPA binds it «without undue delay» with no hour figure at all. So we cannot promise 24 hours from the incident; we promise 24 hours from awareness, and we tell you what that depends on. A commitment silent on this is one that collapses on the day it is needed.

Notification is phased: what we know immediately, then further detail as the investigation proceeds. We do not assess the risk to data subjects — that judgement is yours — and we do not notify the Authority without your instruction; note in any case that the Greek DPA's notification portal accepts submissions from controllers only.

If your organisation also falls under Law 5160/2024 (NIS2), remember that a parallel clock runs: early warning within 24 hours, notification within 72 and a final report within one month, to the competent CSIRT. The two procedures do not substitute for one another.

7. Data subject requests

Requests are addressed to you as controller. The platform lets you locate and export an individual's data yourself; where needed we assist by technical means, within a time that lets you meet your own one-month deadline. We do not answer data subjects directly unless you ask us to in writing.

8. Return and deletion

On termination you choose return or deletion, under art. 28(3)(g). The order matters: we first hand over a complete copy in an open, machine-readable format, you confirm it, and then we delete — including backups, within their retention cycle, with a deletion certificate.

«We delete everything» would be the wrong promise, and the reason is your legislation rather than our reservation. Point (g) itself carves out the case where «Union or Member State law requires storage», and here the provisions engaged are substantial:

• Law 4610/2019 art. 162(5)(a) — «any destruction of public archives without the written permission of the General State Archives is prohibited». For material that is a public archive, deletion is not merely deferred: it is prohibited without that permission. Law 1946/1991, still often cited, had its arts. 1-45 repealed by art. 201 of Law 4610/2019.
• Law 4610/2019 art. 161(3)(b) — «semi-active» archives «cannot be cleared because the retention period has not expired». That period is set per document type and per type of body by Presidential Decrees 106/1979, 162/1979, 768/1980, 87/1981 and 480/1985 — not a number we can compute.
• Presidential Decree 25/2014 art. 11 — clearing electronic records is a documented administrative act with a destruction protocol, and requires prior verification that the data are «authentic, intact, legible, reliable and exportable».
• Law 4412/2016 art. 45(4) (Book II: art. 277(4)) — the public contract file is kept for at least three years from acceptance of the subject matter, and the copy of the contract at least for its duration.
• Regulation (EU) 2021/1060 art. 82 — for co-financed expenditure, five years from 31 December of the year of the last payment to the beneficiary; the period is interrupted by legal proceedings or a Commission request, and is therefore open-ended in those cases.
• Law 5104/2024 art. 13(2) (the Tax Procedure Code, which replaced Law 4987/2022) — five years, or until the right to assess tax prescribes, or until the case becomes final, whichever is longer.

Three practical consequences, better agreed in the contract than at its end: you set the period, because only you know the funding source, the date of the last payment and whether litigation is pending; the trigger is an event, not a date, so a clause reading «X years then delete» will be wrong in both directions; and deletion may require a third party's permission. Our commitment is therefore phrased as: we place the data beyond use, in a defined, access-restricted and exportable form, and delete it permanently once you confirm that doing so is lawful.

Independently of the above, where the law requires us to retain a record of the engagement (accounting documents), it is kept for the period the law sets and for that purpose only.

9. Audits

You are entitled to audit our compliance, under art. 28(3)(h). In practice we provide documentation of the measures and answer security questionnaires; an on-site audit takes place on reasonable notice and under confidentiality, so that other organisations' data is not exposed.

10. Legal framework

• Regulation (EU) 2016/679 (GDPR) — in particular arts. 5, 24, 28, 29, 32, 33 and 34.
• Law 4624/2019 — implementing measures: art. 4 (definitions), art. 5 (legal basis for public bodies), art. 6 (a mandatory DPO for every public body — which concerns you, not us), arts. 24-26 (further processing and transmissions), arts. 31-35 (restrictions of rights), art. 39 (administrative fines — public bodies are not exempt).
• Law 3471/2006 — electronic communications.
• Law 5160/2024 — cybersecurity (NIS2), where it applies to your organisation.
• Law 4610/2019 arts. 160-201 — General State Archives, clearance, and the prohibition on destroying public archives.
• Law 4727/2020 arts. 85-88 — government clouds, data classification, source code.

We do not settle for «we comply with the GDPR»: compliance is shown by the agreement, the measures and the records, and those are available for inspection.

11. Contact

For data protection matters and for the text of the processing agreement: dpo@e-roe.gr, tel. +306937085785.