Our Commitment
The National Centre for Scientific Research "Demokritos" (hereinafter "NCSRD Demokritos") is committed to making the protection of your privacy our highest priority. This privacy policy aims to inform you about the processing of your personal data and your rights in accordance with Regulation (EU) 679/2016 (General Data Protection Regulation – GDPR) and Law 4624/2019.
At NCSRD Demokritos, we enhance the protection of your data with technical measures and internal procedures, as well as with physical measures for the protection of personal data.

Useful Definitions
For your convenience, we use the following terms and abbreviations that have the corresponding meaning.

1. GDPR: Regulation (EU) 679/2016 (General Data Protection Regulation).
2. Personal Data: Any information relating to a natural person ("data subject") who can be identified, directly or indirectly (e.g., name, identification number, tax ID, home address, telephone numbers, age, gender, physical characteristics, family status, profession, interests, etc.).
3. "Special categories of personal data" or "sensitive data": A subcategory of personal data specifically related to the core of an individual's personality that requires special protection, such as data concerning health, sexual life, or sexual orientation of the data subject, as well as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or participation in trade union organizations.
4. "Processing": The collection or use of personal data in any way, such as storage, disclosure to third parties, deletion, etc.
5. "Data Controller": The natural or legal person, public authority, or other entity that determines the purposes and means of processing personal data. In this case, the data controller is the National Center for Scientific Research "Demokritos."

Purposes and Legal Bases for Processing
The National Center for Scientific Research "Demokritos" (hereinafter "Demokritos") is a public entity according to Greek data protection legislation (Law 4624/2019) and, therefore, generally processes personal data to the extent necessary for the performance of tasks carried out in the public interest or in the exercise of official authority, in accordance with Article 6.1(e) of the GDPR and Article 5 of Law 4624/2019.
In this context, Demokritos conducts processing activities necessary for its internal administrative operations and to fulfill its mission of promoting scientific and technological research, developing technology, and creating new research potential for the benefit of the Greek economy and society.
Below, we provide you with a summary of the main reasons you may contact us as data subjects and the data processing activities we undertake in each of these cases, within the framework of the aforementioned mission of Demokritos. Please note that for the sake of brevity and better understanding of this policy, we do not include specific and detailed information regarding all processing activities, as we separately inform each category of data subjects in accordance with the provisions of the GDPR and Law 4624/2019.

A) Scholarship Programs
The National Center for Scientific Research "Demokritos" designs and implements significant academic and industrial scholarship programs, either independently or in collaboration with other public and/or private sector entities. In this context, we collect and process different categories of personal data, such as identification details, information included in resumes, scholarship deliverables, etc., which are necessary for the evaluation of candidates, monitoring the progress of scholars, and disbursing scholarships, as defined in the corresponding calls for applications, scholarship agreements, and applicable legislation. This processing is based on the legal basis of Article 6.1(e) of the GDPR and Article 5 of Law 4624/2019, as it is necessary for the performance of tasks carried out in the public interest, primarily regarding the transparent selection and support of scholars based on clear and predetermined qualitative criteria, for the benefit of the Greek economy and society.

B) Training Programs
The National Center for Scientific Research "Demokritos" provides quality education and support in various fields related to the physical sciences and technology, including the preparation of thesis works for undergraduate, postgraduate, and doctoral degrees, postdoctoral research, the organization and supervision of practical training for students of all study cycles, as well as other activities concerning the educational community and citizens in general.
Regarding educational programs for students and researchers, we process the personal data necessary for the performance of the related mission of "Demokritos," which is carried out for public interest reasons, specifically to ensure the provision of high-quality education services (Article 6.1(e) of the GDPR and Article 5 of Law 4624/2019). This includes identification and contact data, data related to certificates issued by universities or research centers for students and researchers, social security data, as well as any other information required for a specific purpose, e.g., registering participants in the Ion Accelerator.
Additionally, for other activities such as "Young Researchers," "Summer Schools," conferences, seminars, and events like "Open Doors" that target the general public, data processing is usually based on the legal basis of Article 6.1(a) of the GDPR, that is, on the consent of the data subject or—in the case of minors—their guardians, and includes identification and contact data as well as other data required for specific activities, such as written examinations and grades of candidates for the "Young Researchers" program.

C) Technological Park "Lefkippos"
The "Lefkippos" is a unit of the National Center for Scientific Research "Demokritos," aimed at hosting and providing support services to startups and spin-offs to facilitate innovation and the commercial exploitation of intellectual property and scientific knowledge.
To be accepted into Lefkippos, a company submits an application that is evaluated by "Demokritos." This evaluation requires the processing of personal data related to the partners and legal representatives of the companies (identification, data included in resumes, etc.), and if the application is accepted, "Demokritos" further processes data necessary for their establishment and operation in Lefkippos (e.g., identification details of employees and vehicle license plate numbers for issuing the corresponding entry permits). In this case, two legal bases apply for the processing of data: the conclusion and execution of the relevant lease contracts according to Article 6.1(b) of the GDPR, and, on the other hand, the execution of a public interest project according to Article 6.1(e) of the GDPR and Article 5 of Law 4624/2019, which mainly concerns the selective choice of companies that meet the acceptance criteria for the Technological Park, as well as the protection of the property of "Demokritos," along with the individuals and goods present on its premises.

D) Research and Testing
The National Center for Scientific Research "Demokritos" primarily aims to promote scientific and technological research and conducts basic, translational, and applied research across a wide range of scientific fields through its Institutes. These research activities occasionally require the processing of personal data, including sensitive data related to health, such as medical records, blood samples, and tissues, etc. In such cases, the processing of data is based on the prior consent of the research subjects, specifically under the legal basis of Article 6.1(a) of the GDPR concerning simple data (identification, contact details, etc.) and the "explicit consent" under Article 9.2(a) of the GDPR, which pertains to sensitive data. For this purpose, "Demokritos" initially provides written and detailed information regarding the data processing so that the data subjects can consciously decide whether they wish to provide their data for the purposes of specific research or testing.

E) Contractors of the National Center for Scientific Research "Demokritos"
The National Center for Scientific Research "Demokritos" processes personal data concerning individual businesses or contractors that provide services or goods, specifically their professional data (name, professional address, tax identification number), contact details, payment information (bank account number, etc.), as well as information regarding transactions. The purpose of collecting and processing such personal data is to facilitate payments, communication, issue tax documents, and complete and submit the necessary tax returns. The legal basis for this data processing is Article 6.1(c) of the GDPR, which allows "Demokritos" to process personal data when it is necessary to comply with legal obligations under applicable tax legislation.

Data Retention
Personal data is retained in a form that allows for the identification of data subjects only for as long as necessary for the purposes for which the personal data are processed, taking into account the legislation on the disposal of public records.
By way of exception, the National Center for Scientific Research "Demokritos" may store personal data for longer periods if the personal data are processed exclusively for archiving purposes in the public interest, scientific or historical research purposes, or for statistical purposes, provided that appropriate technical and organizational measures are implemented to protect the rights and freedoms of the data subject.

Recipients of Personal Data
The processing of data is limited within the National Center for Scientific Research "Demokritos," and personal data is accessible only to authorized personnel.
Personal data may be disclosed to third parties only to the extent that such disclosure is necessary for the fulfillment of the purpose for which the data was collected, provided that there is a legal obligation or cooperation agreement, or, by exception, with prior request/consent of the data subject. These third-party recipients include:

1. Ministries (Managing Authorities), Supervisory Authorities, Social Security Funds, other Public Services.
2. Courts and prosecutorial authorities in the case of legal claims or criminal offenses.
3. "Single Payment Authority," General Accounting Office of the State, auditors, banks, financial institutions.
4. European and international organizations (e.g., within the framework of European and international research programs). In case of data transfer to international organizations or recipients in third countries, the National Center for Scientific Research "Demokritos" takes all legal measures to protect the data ("mechanisms") and ensures that the third countries provide an adequate level of protection according to an adequacy decision by the European Commission or that the transfer is subject to appropriate safeguards in accordance with Articles 46 et seq. of the GDPR (e.g., standardized contractual clauses, binding corporate rules, additional technical and organizational security measures).
5. Independent contractors bound by confidentiality, to whom we transfer data necessary for the implementation of a project we have assigned to them (e.g., IT service providers).

Your rights
If the EKEFE Demokritos holds data related to you, you can exercise the following rights at any time under the conditions provided by Greek and European law, via email at support@egov.demokritos.gr:

1. Right of access, meaning the right to receive confirmation as to whether personal data concerning you is being processed and, if so, to receive specific information about this processing or a copy of the personal data.
2. Right to rectification, i.e., to request that we correct or complete incomplete personal data. This right cannot be exercised if such rectification would substantially hinder the fulfillment of (a) archiving purposes in the public interest, according to Article 29 of Law 4624/2019, and (b) scientific, historical, or statistical research according to paragraph 2 of Article 30 of Law 4624/2019.
3. Right to erasure for the reasons provided by Article 17 of the GDPR. This right is subject to limitations when the processing is carried out for the performance of a task in the public interest or in the exercise of official authority.
4. «Right to restriction of processing» of your data in specific cases.
5. "Right to object," i.e., to invoke specific reasons so that we no longer process your data.
6. Right to withdraw your consent for the processing of your personal data at any time.
7. Right to data portability, i.e., to receive your personal data in a structured, commonly used, and machine-readable format or to transfer it directly to another data controller where technically feasible. The right to portability can be exercised if the processing is based on consent or a contract and is carried out by automated means. It should be noted that the rights of access, rectification, restriction of processing, and objection may be limited if such rights are likely to make it impossible or seriously hinder the achievement of scientific or historical research purposes or statistical purposes, provided that these restrictions are necessary for fulfilling those purposes. For the same reasons, the right of access does not apply if the personal data are necessary for scientific purposes and providing the information would involve a disproportionate effort (Article 30, Paragraph 2 of Law 4624/2016). Furthermore, if you believe that your data protection rights have been violated in any way, you have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

Updates
This policy will be updated when deemed necessary to enhance the protection of your personal data and the safeguarding of your rights. Therefore, please refer to the revision date at the end of this policy.

Contact details of the Demokritos Research Center
If you have any questions regarding the processing of your personal data, you can contact support@egov.demokritos.gr (tel.: +30 2106503410).
Last revision: July 2023