ARISTOTLE UNIVERSITY OF THESSALONIKI PERSONAL DATA PROTECTION POLICY IN COMPLIANCE WITH THE EU GENERAL DATA PROTECTION REGULATION 2016/679 & LAW 4624/2019.
In compliance with the applicable legal framework, which includes the EU General Data Protection Regulation 2016/679 (GDPR) & Law 4624/2019, Aristotle University of Thessaloniki (AUTh) adheres to this Protection Policy by adopting appropriate technical and organizational measures for the collection, use, storage, disclosure, and transfer of the personal data of all members of the academic community, faculty members, administrative staff with permanent or fixed-term employment, Laboratory Teaching Staff (EDIP), Special Teaching Staff (EEP), Scientific Associates, Special Technical Laboratory Staff (ETEP), lecturers under Presidential Decree 407/80, forensic medical examiners, AUTh students and graduates, including participants in internships (Technological Educational Institutes, Manpower Employment Organization, etc.), foreign students, primary and secondary school teachers participating in training programmes, foreign language teachers, scholarship holders, PhD candidates, suppliers and enterprises, individuals as recipients of services provided by AUTh (patients, external users of the library, high school students), external contractors/contracting parties (property lessors, donors), participants in events under the auspices of AUTh, contractors, subcontractors, and any third party with access to AUTh electronic systems (data subjects), in order to ensure effective protection against unlawful processing.
THE ROLE OF AUTh PURSUANT TO THE GDPR
Under the GDPR, AUTh acts as the Data Controller of the academic community personal data, defining the personal data, the procedures, the means and the purpose of processing such data in accordance with GDPR requirements and Law 4624/2019.
Contact Details: ARISTOTLE UNIVERSITY
Address: University Campus, 54124, Thessaloniki
Phone number: 2310 996000
In compliance with the applicable legal framework, AUTh takes all appropriate technical and organizational measures to secure the processing of personal data in order to ensure an appropriate level of security against risks arising from unlawful processing.
PURPOSE OF PROCESSING & LEGAL GROUNDS FOR PROCESSING DATA
The primary legal ground for the processing of personal data by AUTh is the performance of a task carried out in the public interest under Art. 16, par. 5 of the Constitution, and in particular, education at university level.
In compliance with the General Data Protection Regulation and as per the purpose of processing, the lawfulness of the processing of personal data by AUTh is determined on a case-by-case basis and also on the basis of:
- compliance with a legal obligation
- the fulfillment and protection of AUTh legitimate interests
- the obligation to protect the vital interests of data subjects or any other natural persons
- the performance of a contract to which the data subject is a contracting party, or in order to take steps at the request of the data subject prior to entering into the contract
- the consent of the data subjects.
METHODS OF PERSONAL DATA COLLECTION
Personal data collection is conducted by the AUTh staff, acting as data controllers on the basis of their duties in order to fulfill the aforementioned purpose of processing.
Data collection occurs during the application process or student registration forms, as well as upon signing a contract or when entering into another legal relationship. Personal data may also be collected through:
- The use of the website or online platforms or other AUTh electronic programmes and means of communication
- Mail and/or e-mail
- The completion of surveys in order to improve AUTh services
- Participation in research programmes
- Participation in events under the auspices of AUTh
PERSONAL DATA COLLECTED BY AUTh
- Identity Data (User ID, Surname, Forename, Father’s name, Mother’s Name, Photograph, Identity Card or Passport Number, Issuing Authority, Date of Issue)
- Marital Status Data (marriage, number of children & age of children, student status)
- Contact Data (postal address, fixed and mobile phones, e-mail address)
- Student academic performance
- Data on administrative, academic, and research staff qualifications
- Financial Status Data (Tax Identification Number, Tax Office, IBAN, loans, AUTh third-party garnishments)
- Asset Data (registration number of vehicles entering the University Campus)
- Demographic Data (Gender, Citizenship, Nationality, Date of Birth, Place of Birth, Country of Birth)
- Health Data (Social Security Number, social security registration number) as well as medical history, medical reports, medical certificates in special cases only and for the purpose of granting special privileges and/or protecting the vital interests of data subjects or other natural persons
- Data generated by using electronic services (such as cookies, Google Analytics, internet protocol (IP) addresses, etc., and electronic identification)
- Student and graduate CVs
PERSONAL DATA RECIPIENTS
AUTh may disclose personal data of data subjects for the performance of tasks carried out in the public interest, where necessary, as well as to public and private bodies and independent authorities, when there is a legal obligation to do so as Data Controller or in order to safeguard its legitimate interests. AUTh discloses personal data to private bodies or enterprises for the lawful promotion of students and graduates in the labour market and in internships (Presidential Decree 206/2005, Government Gazette 251/11-10-2005, Vol. A).
Any transfers of personal data to third countries and international organizations shall take place pursuant to the relevant provisions of the GDPR or, where necessary, with the consent of data subjects.
AUTh may also entrust the provision of services to natural or legal persons, in the context of which your personal data may be processed on its behalf. In such a case, these persons shall be the processors; they shall only carry out the specific processing that has been assigned to them under the terms of a contract or any other legal act and they shall be bound to protect such personal data.
METHOD & TIME LIMIT FOR THE RETENTION/STORAGE OF PERSONAL DATA
AUTh processes personal data by implementing appropriate technical and organizational measures to ensure the level of protection set out by the GDPR.
AUTh shall retain your personal data for a specified and legitimate purpose and shall only process the data necessary to fulfill this purpose (P.D. 768/1980, P.D. 87/1981 & P.D. 480/1985 and any other amendment thereof or any other relevant legal provision). Where personal data are processed for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes law may provide for derogations from the data subject rights, provided that these are in accordance with the GDPR requirements and necessary for the purpose of satisfying the aforementioned requirements.
DATA SUBJECT RIGHTS
Pursuant to the provisions of the GDPR, data subjects shall have the following rights:
- Right to be informed about any personal data collected and processed, as well as any further processing thereof
- Right of access to personal data retained by AUTh
- Right to rectification of inaccurate or incomplete personal data
- Right to erasure under GDPR and Law 4624/2019
- Right to restriction of processing where specific conditions apply
- Right to data portability to another organization. This right shall not apply to processing necessary for the performance of a task carried out in the public interest.
- Right to object pursuant to the provisions of the GDPR, where permitted by law.
- Right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr), the competent supervisory authority for the protection of the fundamental rights and freedoms of natural persons with regard to the processing of personal data, provided that the data subject considers that the processing of personal data relating to him or her infringes the GDPR.
- Right to withdraw their consent at any time in the context of an electronic/written message to the competent unit responsible for personal data processing. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
As the data controller, AUTh shall respond to relevant requests arising from the exercise of the aforementioned rights without undue delay, and no later than one month after submission. However, where requests are manifestly unfounded, excessive or repetitive, AUTh may either impose a reasonable penalty or refuse to comply with it.
DESIGNATION OF A DATA PROTECTION OFFICER – CONTACT DETAILS
Should there be any queries regarding the processing and protection of personal data and the rights pertaining thereto, any data subject may contact the Data Protection Officer by phone at 2310996200, by email at data.protection@auth.gr, or by post at the following address: University Campus, Postal Code 54124, Thessaloniki.
UPDATE – AMENDMENT OF PERSONAL DATA PROTECTION POLICY
AUTh may update/amend the present Personal Data Protection Policy in accordance with the applicable legislative and regulatory framework. In such a case, the updated/amended version of the Personal Data Protection Policy will be posted and made available on the AUTh website (see link below).