Notification regarding the processing of personal data of participants in Hellenic American Union's training programs

Pursuant to the application of the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Hellenic American Union (22 Massalias Street, 10680 Athens) (the “HAU”) would like to inform you of the following:

1. The HAU, in its capacity as data controller, processes personal data of adult persons who attend or will attend its training programs (“data subjects”). The HAU processes data subjects’ personal data, on a case-by-case basis, for the following purposes: (a) To provide further information or clarifications regarding the training programs upon the data subject’s relevant request. For such data processing the legal basis for the processing of the relevant data subject’s data is the data subject’s consent which is given by a clear affirmative act, namely by the fact that the data subject raises a question and awaits for the HAU’s response. (b) To register (or take measures upon the data subject’s request prior to the conclusion of the relevant contract), provide services to and in general manage the data subjects and issue certificates of attendance. For such data processing the legal basis shall be the performance of the relevant contract concluded with the HAU (or the adoption of the above measures) and the compliance with the legal obligations of the HAU. (c) To safeguard the interests of the HAU. For such data processing, the legal basis is that processing is necessary for the purposes of the prevailing legitimate interests of the HAU. (d) To conduct satisfactory surveys/ assessments of the training programs that the data subject attended (including assessments of the relevant lecturers) (jointly the “Assessment”). Where communication with the data subjects is required in order for the HAU to notify them about the Assessment, the legal basis for such data processing is that the processing is necessary for the purposes of the prevailing legitimate interests of the HAU (e.g. the legitimate interests that relate to the evaluation and improvement of its services), when the data subjects agree to participate in the Assessment, the legal basis for the processing of the relevant data subjects’ data (including those arising out of their answers) is the data subjects’ consent which is given by a clear affirmative act, namely by the fact of their participation in the Assessment. Therefore, any answers given by the data subject to the relevant questions of the Assessment and their submission constitute consent to the Assessment. (e) To send marketing material via electronic mail. The HAU is entitled to use the data subjects’ electronic mail contact details, lawfully obtained in the context of the provision of its services or any other transaction, for the direct promotion of similar services or for the fulfilment of similar purposes, even where data subjects have not given their prior consent, provided that they are given, when contact details are collected, as well with every message, a clear and transparent option to object, easily and free of charge, to the collection and use of their electronic data. For such processing of data, the legal basis is that processing is necessary for the purposes of the prevailing legitimate interests of the HAU (i.e. the legitimate interests relating to the promotion of its services). For all the above purposes, the HAU does not proceed with automated decision-making, including profiling of data subjects.
2. Data processed by the HAU, as appropriate, include, inter alia: (a) personal information, such as  the information collected in the context of the queries that may be raised by the data subject, as well as the content of the queries and the HAU’s responses; (b) other personal information, such as the information collected from the Registration Form; (c) financial data relating to the payment of any amount due to the HAU, such as credit/ debit card information, bank account number, billing and payment data, etc.; and (d) with regard to the Assessment, the information of the relevant questionnaire e.g. the training program, the year of attendance/ participation in the training program, the IP address of the data subject and other technical information (which shall be subject to processing even where no other data of the participant is requested), as well as the data subject’s answers to the Assessment.  The disclosure/ processing of the data specified in subparagraphs (b) and (c) above is a legal or contractual obligation of the data subject, namely for their attendance in the HAU’s training programs, while the disclosure/ processing of the data specified in subparagraphs (a) and (d) above is a requirement in order for the HAU to respond to the queries raised by the data subject or for the data subject’s participation in the Assessment accordingly.
3. Depending on the case, the source of the data will either be the data subjects themselves disclosing their data, or the data subject’s employer (in case the employer pays the relevant fees). To the extent that such employer transmits third party personal data to the HAU, they shall be responsible for complying with the applicable provisions of the personal data legislation. In this context, they may need to obtain the data subjects’ consent before transmitting data to the HAU.
4. Depending on the case and purpose of processing, personal data may be transmitted to the authorized employees in each department/ service of the HAU, to the data subject's employer (when the employer pays the relevant fees) and to companies associated with the HAU with which the HAU has concluded a relevant contract and which processes the data on its behalf (e.g. IT companies, IT service providers, etc.), within their competencies and subject to the obligation of confidentiality, secrecy and compliance with the data protection legislation. In addition, the HAU may transmit personal data to third parties where so required by law, or for the purposes of, or in connection with legal proceedings in which it participates, or otherwise for the purposes of supporting, exercising or defending its rights, or to third parties that are law enforcement authorities and have submitted a lawful transmission request, or where it considers that transmission is necessary in connection with any investigation into the suspicion or existence of any illegal activity. Personal data shall not be transmitted outside the European Economic Area.
5. The above data will be retained for the period of time required or allowed by the legislation/regulatory framework each time in force, taking into account the applicable prescription period, which may extend up to 20 years. Specifically: (a) where processing is carried out in order for the HAU to respond to queries that may be raised by the data subject regarding the training programs, if there is no other ground for the retention of the data, such data will be destroyed after fifteen days following the relevant communication;   (b) where processing in carried out under a relevant contract, the personal data shall be stored for as long as necessary for the performance of the contract and for the establishment, exercise and/or support of any legal claims of the HAU arising from that contract; and (c) where the processing is imposed as an obligation by provisions stemming from the applicable legal framework, personal data shall be stored for as long as the relevant provisions so require.

6. The data subjects shall have the following rights under the GDPR: (a) to receive a copy of the personal data held by the HAU, together with other information on how data is processed; (b) to request that personal data concerning them be rectified and, under conditions, to request the deletion or restriction of processing, or to object to the processing of personal data; (c) to receive a copy or to request the transmission of a copy of their personal data to a third party in a structured, commonly used and machine-readable format (right to data portability). Where the processing of data is based on their consent, the data subject shall have the right to withdraw that consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. If the data subjects wish to receive further information about the processing of their personal data or to exercise any of their above rights, they must email the HAU Data Protection Officer exclusively at:, or send a letter to the mailing address mentioned above. Finally, the data subjects have the right to file a complaint with the competent supervisory authority about how the HAU handles their data  (


Last Update At: 2021/01/22 - 12:40:37


Stay Connected

Hellenic American Union Twitter Hellenic American Union Facebook  linkedin logo

 YouTube logo  Instagram logo

Worth Visiting 

Center of Excellence in Project Management


Hellenic American Union Thessaloniki


Where to find us

Business & IT
Massalias 22, (7th & 6th  floor)
10680 Athens
Business Programs: 2103680006, 2103680907, 2103680056, 2103680927
IT Programs:
2103680966, 2103680912
Fax: 2103633174



Print this page
Send this page