Privacy Notice on the processing of personal data of persons who report violations of Union (EU) law – ΕU Directive 2019/1937
1. Data Controller:
BOX NOW S.A.
Georgiou Papandreou 141,
14452 - Metamorfosi
Greece
Tel. : +30 211-100 5304
E-mail: [email protected]
Website: https://boxnow.gr/
Joint Data Controllers
• BOX NOW SA
• BOX NOW CYPRUS LTD, BOX NOW CYPRUS Λ. Θεμιστοκλή Δέρβη 48, Κτήριο Athienitis Centennial, 1066 Λευκωσία,
• BOX NOW d.o.o, BOX NOW Croatia, Oreškovićeva 6H/1, Zagreb , Croatia
• BoxNow OOD – BOXNOW BULGARIA , Ulitsa Lyuba Velichkova 7 1407, Sofia Bulgaria
2. Data Protection Officer
3. Purpose and legal basis of the processing:
A. We process your personal data to comply with our legal obligations under Article 6(1)(c) of EU Regulation 2016/679, Greek Law 4990/2022, and EU Directive 2019/1937 on protecting whistleblowers.
B. Furthermore, we might process your personal data to safeguard our, or a third party’s, legitimate interest [article 6 (1) (f) of EU regulation 2016/679].
4. Legitimate Interests
Our legitimate interest consists of our right to protect our property, our employees and our reputation, as well as to prevent and detect breaches of Union Law within our organization and to ensure compliance with applicable laws. In this context, your personal data will be processed to investigate the reported breaches.
Important information: You can use the whistleblowing platform and the telephone lines provided anonymously, without registering or reporting your personal data, in this case the whistleblower's personal data will not be processed
5. How we share your personal data
Only authorized staff and designated managers handling reports and investigations can access stored personal data. This data is not disclosed to third parties, except in the following cases:
A. To the competent judicial, prosecutorial and police authorities when it contains information necessary for the investigation of criminal acts involving members of the administration or any of the employees of BOX NOW SA as well as any third parties involved.
B. To the competent judicial, prosecutorial and police authorities when they request data, lawfully, in the exercise of their duties
.
6. Retention Period
Your personal data will be retained for as long as is necessary for the processing and investigation of your report, as well as for the fulfillment of our legal and regulatory obligations. In the event that legal or disciplinary proceedings are initiated, your personal data will be kept until the process is definitively concluded.
7. Your Data Subject Rights
When your personal data is processed based on our legitimate interests, your rights are as follows:
• Right of access: You have the right to know if we are processing your data and, if so, to receive a copy.
• Right to correction: You have the right to request the correction or update of your data.
• Right to restriction: You have the right to ask us to restrict the processing, for example, to not delete data that you consider necessary for the establishment, exercise, or support of legal claims.
• Right to object: You have the right to object to the processing.
• Right to erasure: You have the right to request that we delete your data.
You may contact BOX NOW SA to exercise your rights as defined in Articles 15-22 of the European Regulation EU 2026/679 by sending an email to [email protected] or by registered mail to our postal address, attention: Data Protection Officer.
Please note that exercising your rights to object and erasure does not automatically result in the immediate deletion of data or the modification of processing. In all cases, we will respond to you in detail within the deadlines established by the GDPR.
8. Right to lodge a complaint
If you believe that the processing of your data violates Regulation (EU) 2016/679, you have the right to file a complaint with the supervisory authority DPA.