Personal Data Protection Policy
KOSMOCAR SA, Official Importer for Volkswagen, Audi, Skoda, Volkswagen Commercial Vehicles, Official Importer in Greece and Cyprus of Ducati Motorcycles, Official Sales Dealership and Authorised Repairer of Bentley and Lamborghini Service Center, is sensitive to and respectful of privacy and protection of personal data.
Building relationships of trust is a priority and is a fundamental business practice. This Policy provides information on the process of collecting, storing, using and generally processing personal data carried out by KOSMOCAR and the Network of its collaborating Authorized Merchants, Representatives and Partners and the vehicle manufacturing plants.
For the purposes of this Policy, the concepts mentioned are set out in the General Data Protection Regulation (EU) 2016/679 (hereinafter GDPR) (Article 4).
2. Data collection
The following data categories are collected for processing:
a) identification data, such as name, gender, TIN, ID card, passport, nationality, date of birth.
b) contact details, landline and mobile phone, home and/or work address, e-mail address.
c) health data, exclusively what the law requires in cases of sale and classification of cars to people with special needs or in the context of labour relations.
d) financial data necessary for the performance of contractual obligations, such as bank accounts, credit card numbers.
e) vehicle details such as chassis number, license plate number, brand, model, year of manufacture, vehicle equipment, repair history, vehicle status data, vehicle usage data.
f) transaction details, such as store date, offers, date and order details, date of purchase or lease, purchase or lease price, registration date, delivery date, customer preferences, participation in events, answers to customer satisfaction questionnaires, customer complaint records
g) photographs or any other material from events, competitions or draws.
h) GPS position data for connected car services.
i) data relating to identity and transactional identifiers and collected electronically when using the website, such as IP address or other data provided by the devices used by the Customer as location identification data, as well as navigation data on the Internet (cookies), which alone or in combination with unique IDs, can be used to identify and create profiles.
3. Data collection method
Data collection can be done in one or more of the following ways:
- Directly during the visit to Kosmocar SA or to the network of authorized Partners and Dealers, during the visit to the company's website or social media networks, during the participation in test drives, events or competitions, in telephone or electronic communications.
- Directly from the vehicle (connected car) regarding the status data, vehicle usage and information about the user's driving behaviour, position & preferences, as well as the user's account settings.
4. How data is processed
The Data, which are collected and processed, concern the following purposes:
a) responding to requests,
b) performance of contractual obligations,
c) fulfillment of legitimate interests,
d) compliance with a legal obligation of KOSMOCAR SA,
e) identification and communication with customers at any stage of the transaction,
f) giving information on new products and new services provided by KOSMOCAR SA, the Network of collaborating Authorized Merchants, Representatives and Partners and the vehicle manufacturing plants, as well as for the investigation of the degree of customer satisfaction and further desires or preferences for the purpose of improving the services provided,
g) the provision of digital services to vehicles,
h) cases where it becomes necessary to recall products,
i) processes in relation to subsidized products.
KOSMOCAR and the Network of collaborating Authorized Merchants, Representatives and Partners and vehicle manufacturing plants apply automated methods based on customers' preferences and transaction habits to create their trading profile and to provide targeted individualised offers for goods and services.
5. Legal Basis for Processing
The collection, use and general processing of Personal Data is done exclusively by consent or if the law allows it. Legal grounds for processing beyond the consent of the data Subject constitute the performance of a contract or compliance with a legal obligation and any other reasons provided for in Art. 6 of the GDPR, as well as national legislation.
6. Place of Processing
The processing of Personal Data takes place within the European Union. Exceptionally, if the data is transferred to a third country, then care will be taken to transfer it to a country for which the European Commission has decided that adequate data protection is ensured and that the processor has provided appropriate protection guarantees.
7. Data Recipients
The data collected is processed by KOSMOCAR S.A., the Network of collaborating Authorized Merchants, Representatives and Partners and the vehicle manufacturing plants of each vehicle to fully comply with contractual obligations and provide excellent and comprehensive service.
The Data is also transmitted to third parties, associates of Kosmocar S.A., the Network of collaborating Authorized Merchants, Representatives and Partners and the vehicle manufacturing plants producing each vehicle for the execution of specific tasks. Indicative and non-restrictive examples are advertising agencies and other third parties providing marketing services, market research, support and information (call centers), file storage and management companies, lawyers, law firms, notaries, executives, bailiffs, experts, expert witnesses, companies dealing with database management, IT application development and management, email service providers, web hosting services, including cloud services.
Data may also be forwarded to police, customs, municipal, tax Authorities and/or public or private emergency service providers.
Websites collect information through cookies. Cookies are small text files that are stored by a website in an Internet browser during browser navigation and then recognized the next time the website is visited. Cookies do not contain personal information, which could allow anyone to contact the visitor of the website such as e.g. by e-mail, etc. More information can be found here, Cookies Policy and at www.allaboutcookies.org.
9. Data Protection Measures
Kosmocar SA implements appropriate technical and organisational measures to ensure the protection of Data from loss, misuse and unauthorized access, disclosure or destruction. Taking into account the best practices of modern technology and implementation cost, Kosmocar has realised a comprehensive information security program including physical security, encryption, regular security checks, penetration tests. It has also created authentication and access management standards, network access control and risk management and security incident standards, business continuity and recovery due to disaster, etc.
10. Data retention time
Data retention time varies depending on the purpose of the processing. Data are kept for as long as necessary for the processing purpose and data that are no longer necessary are deleted or anonymized. In case of concluding a contract, Kosmocar SA maintains the Data until the completion of the statutory limitation period of the claims, i.e. for a period of up to twenty (20) years.
As regards data that Kosmocar SA processes based on consent (e.g., for marketing purposes), the data subjects may revoke their consent at any time and the data will not be processed for the specific purpose after the revocation of the consent.
11. The rights of Customers / Subjects
The Customer has the right at any time of:
a) access to their data, requesting and receiving information on the data concerning them,
b) rectification of inaccurate or incomplete data concerning them on provision of the appropriate evidence,
c) restriction of the processing of their data,
d) portability of their data, i.e. to receive the data concerning them and which they have provided to the Company and to transmit it to another controller,
e) objection to the processing of their data,
f) erasure of the data concerning them.
A response to any legal request will be given within thirty (30) days of receipt, unless, due to circumstances, a longer period of time is required, in which case there will be prior notice. There is no obligation to respond to a Customer's request for restriction, objection to the processing or erasure of his data, provided that the processing of the data is necessary for the establishment, exercise or support of legal interest, legal rights or compliance with Kosmocar's legal obligations or with those of the Network of collaborating Authorized Merchants, Representatives and Partners and vehicle manufacturing plants for the production of each vehicle.
The data subject has the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr) which is the supervisory authority, if the data subject considers that their rights are being infringed in any way by the processing of their data.
12. Exercise of Rights
The exercise of the above rights is done by completing the form for exercising each right located on the company's website (www.kosmocar.gr) and sending it to the email address (email@example.com) or by mail to Kosmocar SA, Leoforos Vouliagmenis 566-568, Argyroupolis 16452, (For attention of DPO).
13. Contact Information
Data Protection Officer (DPO)
566-568 Leoforos Vouliagmenis, Argyroupolis
14. Changes to this Policy
This Personal Data Protection Policy may be revised whenever necessary for legal or factual reasons.
15. Date of entry into force
Date of entry into force: 09/07/21