PRIVACY AND PERSONAL DATA PROTECTION POLICY
Corporate activities and online services of Cosmos Business Systems S.A.
Regulation (EU) 2016/679 (GDPR) • Law 4624/2019 • Law 3471/2006, as amended and in force
• Organization / Controller: COSMOS BUSINESS SYSTEMS S.A.
• Version: v1.1 / 04.09.2026
• Original effective date: 15.05.2018
• Document owner: Data Protection Officer (DPO)
• Approval: CBS Management
• Next scheduled review: 15.09.2027 or earlier in the event of a material change
This Policy constitutes CBS’s general privacy notice regarding the processing of personal data. More specific privacy notices (including, indicatively, for job applicants, CCTV, employees, whistleblowing or specific services) apply supplementarily where required.
Version History
| Version | Date | Description of change |
| 1.0 | 15.05.2018 | Initial privacy policy. |
| 1.1 | 04.09.2026 | Consolidation of the corporate and online privacy policy into the standard GDPR framework. |
1. Purpose and legal framework
Cosmos Business Systems S.A. respects the privacy and protection of the personal data of customers, partners, users, visitors and other natural persons with whom it interacts. This Policy explains, in a transparent and understandable manner, what personal data we process, for what purposes, on which lawful bases, to whom we may disclose them, how long we retain them and what rights you have.
Processing is carried out in accordance with Regulation (EU) 2016/679 (GDPR), Law 4624/2019, Law 3471/2006 on privacy in electronic communications, as well as any other applicable provision, regulatory act or binding decision of a supervisory authority.
2. Scope
This Policy applies to the processing of personal data carried out by CBS in the context of its corporate and business activities, the provision of products and services, the operation of its premises and information systems, and the use of the website www.cbs.gr and its related digital channels.
Where a specific privacy notice is provided for a particular activity, that specific notice prevails in relation to that activity and this Policy applies on a supplementary basis.
3. Controller
- Legal name: COSMOS BUSINESS SYSTEMS ΣΥΣΤΗΜΑΤΑ ΠΛΗΡΟΦΟΡΙΚΗΣ ΚΑΙ ΤΗΛΕΠΙΚΟΙΝΩΝΙΩΝ ΑΝΩΝΥΜΗ ΕΜΠΟΡΙΚΗ ΚΑΙ ΒΙΟΜΗΧΑΝΙΚΗ ΕΤΑΙΡΕΙΑ
- Registered address: 44 Pavlou Bakogianni Street, 14452 Metamorfosi, Attica, Greece
- General Commercial Registry (G.E.MI.) No.: 000412401000
- Telephone: +30 210 6492 800
- Email: cosmos@cbs.gr
- Website: www.cbs.gr
4. Data Protection Officer (DPO)
For questions regarding the processing of personal data or the exercise of your rights, you may contact the CBS Data Protection Officer (DPO):
- Email: dpo@cbs.gr
- Telephone: +30 210 6492 800
- By post: 44 Pavlou Bakogianni Street, 14452 Metamorfosi, Attica, Greece, marked ‘Personal Data Protection Matters’.
5. Principles of processing
CBS processes personal data in accordance with the principles of the GDPR, in particular lawfulness, fairness and transparency. We apply purpose limitation, data minimisation, accuracy and keeping data up to date, storage limitation, integrity and confidentiality, as well as accountability for compliance with these principles.
6. Categories of data subjects
Depending on the activity, this Policy may apply to:
- customers, prospective customers and end users of CBS services or solutions,
- suppliers, subcontractors, partners and representatives or executives of legal entities,
- users of www.cbs.gr and persons who contact us through online forms or other channels,
- visitors to CBS premises and participants in corporate events,
- job applicants and, where this Policy applies on a supplementary basis, employees or external contractors,
- any other natural person whose personal data is lawfully processed by CBS.
7. Categories of personal data
- Identification data: Full name, identity card/passport details where necessary, signature.
- Contact data: Postal address, email address, telephone number.
- Professional data: Employer, job title, corporate email address, representation details and professional experience.
- Transaction and contract data: Enquiries, quotations, orders, contracts, invoices, payments, communication history and support history.
- Financial and tax data: Bank account details, payment details, Tax Identification Number (TIN) and other accounting/tax data.
- Technical and electronic data: IP address, device identifiers, browser/operating system, cookies, logs, access times, usage data and security data.
- Image/visitor data: CCTV footage, visitor entry/exit records or other physical security data, where applicable.
- Applicant data: CV, education, professional experience, skills, certifications and contact details.
- Special categories of personal data: Only exceptionally, where strictly necessary and where an appropriate legal basis under Article 9 GDPR applies.
8. Sources of personal data
Personal data may be collected:
- directly from you, when you contact us, complete a form, request a quotation or support, submit a job application, participate in an event or enter into/perform a contract,
- from the organisation or business you represent or from a contractual partner, where this is necessary for the transaction or the provision of a service,
- from lawfully available public sources, professional registers or platforms, where their use is necessary, proportionate and permitted,
- automatically, through the website, applications, information systems, log files and cookies/trackers, in accordance with the relevant settings and your choices.
Where personal data has not been obtained directly from you, CBS provides the information required under Article 14 GDPR within the prescribed time limits, unless a lawful exemption applies.
9. Purposes of processing and lawful bases
- Provision of products/services, pre-contractual communications and performance of contracts
- Indicative data: Identification, contact, professional and transaction data
- Lawful basis: Article 6(1)(b) GDPR – contract / pre-contractual steps
- Handling enquiries, communications and customer support
- Indicative data: Contact details, content of the enquiry and communication history
- Lawful basis: Article 6(1)(b) or 6(1)(f) GDPR, as applicable
- Billing, accounting, tax and regulatory compliance
- Indicative data: Financial, tax and contractual data
- Lawful basis: Article 6(1)(c) GDPR – legal obligation
- Security of premises, networks and information systems
- Indicative data: CCTV, visitor records, logs and access data
- Lawful basis: Article 6(1)(f) GDPR – legitimate interests and, where applicable, Article 6(1)(c)
- Corporate communications, events and promotion of products/services
- Indicative data: Contact details, professional data and preferences
- Lawful basis: Consent or legitimate interests, in compliance with Law 3471/2006
- Service improvement, statistics and usage analytics
- Indicative data: Technical data, usage data and feedback
- Lawful basis: Legitimate interests or consent for non-essential technologies
- Applicant management and recruitment processes
- Indicative data: CV, education, experience and contact details
- Lawful basis: Pre-contractual steps, legitimate interests and, where required, consent
- Establishment, exercise or defence of legal claims
- Indicative data: Transaction, communication, contract and case-related data
- Lawful basis: Article 6(1)(f) GDPR and, where required, an applicable specific provision
10. Specific processing activities
10.1 Contact form and other enquiries
When you use the contact form on www.cbs.gr or contact CBS by email/telephone, we process the information you provide (including, indicatively, your full name, email address, telephone number, subject and message content) in order to handle and respond to your enquiry. Please do not include more personal data in free-text fields than is necessary.
10.2 Customers, partners and technical/commercial support
In the context of quotations, contracts, projects, deliveries, technical support and other transactions, CBS processes only the personal data necessary in relation to natural persons acting on behalf of customers, suppliers or partners, in order to perform its obligations, document transactions and protect its legitimate interests.
10.3 Corporate news, events and direct marketing communications
Where corporate news, updates, invitations or marketing communications are sent, CBS applies the requirements of the GDPR and Law 3471/2006. Where consent is required, you may withdraw it at any time. For electronic communications, a functional unsubscribe/opt-out method is provided where applicable.
10.4 Job applicants
Applications for employment are assessed by the competent CBS Human Resources Department. Processing concerns the information included in your application and CV and is carried out for the management of the specific recruitment process and, only where an appropriate legal basis exists, for future opportunities. A specific applicant privacy notice may be provided on the careers page or through the relevant application submission system.
10.5 Visitors to premises and CCTV
For physical security purposes, visitor records may be maintained and video surveillance systems may operate in appropriately signposted areas. Processing is limited to what is necessary to protect persons, premises and property. Where required, a more specific CCTV notice is provided at the premises.
10.6 Satisfaction surveys / feedback
Where CBS invites customers or partners to participate in a satisfaction survey or provide feedback, participation is voluntary unless otherwise stated for a lawful reason. Results are used to assess and improve products, services and processes, with appropriate data minimisation.
11. Legitimate interests
Where processing is based on Article 6(1)(f) GDPR, CBS assesses the legitimate interest pursued and balances it against the rights and freedoms of data subjects. Indicative legitimate interests include:
- protecting premises, personnel, customers and information systems,
- preventing fraud, malicious activity, misuse or unauthorised access,
- effective administration, management of contractual relationships and documentation of transactions,
- the establishment, exercise or defence of legal claims,
- improving the quality of services and the operation of the Company.
You have the right to object to processing based on legitimate interests, in accordance with Section 17.
12. Special categories of personal data, criminal convictions and minors
CBS does not seek to systematically collect special categories of personal data. Any processing of health data, biometric data or other data falling under Article 9 GDPR is carried out only where strictly necessary, where a specific legal basis applies and where enhanced safeguards are implemented. Personal data relating to criminal convictions or offences is processed only under the conditions of Article 10 GDPR and applicable law.
The CBS corporate website and services are primarily intended for a professional/adult audience. CBS does not seek to knowingly collect personal data relating to minors through general corporate forms. If it is identified that such data has been submitted without an appropriate basis, the necessary measures are taken to delete or otherwise properly manage it.
13. Recipients and processors
CBS restricts access to personal data to persons who need it to perform their duties. Depending on the activity, personal data may be disclosed, to the extent necessary, to:
- authorised personnel and relevant organisational units of CBS,
- IT, cloud, hosting, cybersecurity, technical support and business systems providers,
- transport/courier companies, payment service providers, banks, insurers or other providers necessary for the performance of a transaction, where applicable,
- accountants, auditors, legal advisers and other professional advisers,
- customers, suppliers, partners or subcontractors where required for the implementation of a project or contract,
- affiliated companies, where there is a lawful purpose and an appropriate legal basis,
- public, supervisory, tax, judicial, prosecutorial or police authorities, where required or permitted by law.
Processors are bound by appropriate contractual obligations in accordance with Article 28 GDPR and are required to implement adequate technical and organisational measures. Where a third party acts as an independent controller, it is separately responsible for the obligations applicable to it.
14. Transfers outside the European Economic Area
As a general rule, CBS seeks to ensure that processing takes place within the European Economic Area (EEA). Where a specific service, provider or project requires the transfer of personal data to a third country or an international organisation, the transfer is carried out only where the requirements of Chapter V GDPR are met, such as an adequacy decision of the European Commission, Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or another lawful derogation or safeguard.
Information on the safeguards applied or, where provided for, a copy of them may be requested at dpo@cbs.gr.
15. Retention of personal data
CBS retains personal data only for as long as necessary for the purpose for which it was collected and thereafter for as long as required by legal obligations, limitation periods or the needs of establishing, exercising or defending legal claims. The periods below are general rules and may vary where a specific privacy notice or mandatory legal provision applies:
- Contract and transaction data: For the duration of the contract and thereafter for up to 5 years; up to 20 years where a longer statutory limitation period applies or where necessary for a legal claim.
- Accounting and tax data: For the period required by tax/accounting legislation and for longer where there is a lawful reason, an audit or a pending dispute.
- Data subject requests: As a general rule, for up to 5 years after completion of the request, for accountability and documentation purposes.
- Marketing / corporate communications: Until consent is withdrawn or the individual opts out, and for a reasonable period thereafter to document your choice.
- CCTV: As a general rule, for up to 15 days, unless an incident is recorded that justifies longer retention in accordance with the applicable framework.
- Job applicants: As a general rule, for up to 1 year after completion of the relevant recruitment process, unless a specific notice or legal basis provides otherwise.
- Technical and security logs: In accordance with the approved retention policy and security/accountability needs, with an indicative limit of up to 2 years where this is necessary and proportionate.
16. Cookies and similar technologies
The CBS website may use cookies and similar technologies for technical operation, security, storage of preferences and, where permitted, analytics or other optional purposes. Strictly necessary cookies may be used without consent where they are necessary for the transmission of a communication or for a service you have expressly requested. Prior consent is requested for non-essential cookies/trackers, and such consent may be withdrawn or changed through the cookie preference mechanism.
The specific Cookie Policy or the website consent management tool provides information on cookie categories, providers, purposes and duration. Rejecting optional cookies does not prevent access to the core functions of the website.
17. Rights of data subjects
Subject to the conditions and limitations of the GDPR, you have the following rights:
- Access: To be informed whether we process your personal data and to receive a copy of the data and the relevant information.
- Rectification: To request the correction of inaccurate data or the completion of incomplete data.
- Erasure: To request erasure where the legal conditions are met and there is no overriding lawful reason for retention.
- Restriction of processing: To request restriction in the specific circumstances provided for under the GDPR.
- Data portability: To receive personal data you have provided in a structured, commonly used and machine-readable format or, where feasible, to request its transmission to another controller.
- Objection: To object to processing based on legitimate interests and at any time to processing for direct marketing purposes.
- Withdrawal of consent: To withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
- Automated decision-making: Subject to the conditions of Article 22 GDPR, not to be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects.
18. Exercising your rights and lodging a complaint
To exercise a right or ask a question about processing, you may send a request to dpo@cbs.gr, by post to CBS at 44 Pavlou Bakogianni Street, 14452 Metamorfosi, Attica, Greece, or by telephone at +30 210 6492 800. To protect your personal data, additional information may be requested solely to verify your identity where there are reasonable doubts.
CBS responds without undue delay and, as a general rule, within one (1) month. This period may be extended by up to two (2) additional months, taking into account the complexity and number of requests, in which case you will be informed within the initial one-month period. Exercising your rights is in principle free of charge; for manifestly unfounded or excessive requests, the options provided under Article 12 GDPR may apply.
If you believe that the processing infringes the applicable data protection framework, you have the right to lodge a complaint with the Hellenic Data Protection Authority: 1-3 Kifisias Avenue, 115 23 Athens, Greece, www.dpa.gr, tel. +30 210 6475600.
19. Automated decision-making and profiling
Within the general activities covered by this Policy, CBS does not make decisions that produce legal effects or similarly significantly affect individuals based solely on automated processing. If such processing or profiling is used in a specific service, a specific notice will be provided regarding the logic involved, its significance, the envisaged consequences and the available rights.
20. Personal data security
CBS implements appropriate technical and organisational measures taking into account the nature, context, purposes and risks of processing. Measures may include:
- access controls, account management and the principle of least privilege,
- encryption, pseudonymisation or other protective techniques where appropriate,
- logging and monitoring of events in critical systems,
- backups, business continuity and recovery procedures,
- security incident and personal data breach management procedures,
- staff training, confidentiality obligations and periodic awareness activities,
- assessment of suppliers/processors and contractual security requirements.
No system or transmission method can guarantee absolute security. CBS assesses and reviews its measures so that they remain proportionate to the relevant risk.
21. Third-party links and services
The CBS website or services may contain links to third-party websites, platforms or services. Those third parties determine their own privacy practices and CBS does not control the processing that takes place after you move to a third-party environment. You are advised to read the privacy policy of the relevant third party before providing personal data to it.
22. Changes to this Policy and contact
This Policy may be amended periodically to reflect changes in processing activities, systems, legislation, regulatory requirements or CBS internal procedures. The current version will be published on www.cbs.gr with the date of the latest update. In the event of material changes, an appropriate method of notification will be used depending on the nature of the change and the relationship with the data subjects.
For any matter concerning personal data protection, you may contact us at dpo@cbs.gr.