Data Protection Notice
Last Update: October 21, 2026The Company under the trade name ERGASTIRIO ELEUTHERON SPOUDON QMS NAUTIKIS / NAUTILIAKIS EKPAIDEUSIS ETERORRYTHMI ETAIREIA (and distinctive title QMS MARITIME TRAINING L.P.) (hereinafter referred to as “QMS”), hereby informs you, as the Data Controller, in accordance with Regulation (EU) 2016/679 (hereinafter referred to as the “GDPR”) and Hellenic Law 4624/2019, on the processing of your personal data.
Definitions
For the purposes of the present Data Protection Notice, the following terms shall have the meaning set out below:
- ‘Personal Data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
- “Special categories of personal data” means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation;
- ‘Processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
- ‘Data Controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law. For the purposes of this Notice, QMS acts in its capacity as a Data Controller;
- ‘Data Processor’ means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;
- “Consent” of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
- ‘Applicable Law’ means the relevant national and Union legislation on the protection of personal data and in particular Regulation (EU) 2016/679 (hereinafter referred to as the “GDPR”), Hellenic Law 4624/2019, Hellenic Law 3471/2006, the jurisprudence of the Court of Justice of the European Union (CJEU) as well as the Decisions, Guidelines and Opinions of the European Data Protection Board (hereinafter referred to as the “EDPB”) and the Hellenic Data Protection Authority (hereinafter referred to as the “HDPA”).
Personal data we process in the context of our Website
Book a course
| Personal Data Categories | Purpose | Legal Basis | Retention Period | Recipients |
|---|---|---|---|---|
| Identification data (e.g. name, surname) | Course registration | Article 6(1)(b) GDPR | 5 years | Processors: providers of IT support services providers of hosting services, cloud providers. |
| Contact data (e.g. postal and e-mail address, telephone number) | ||||
| Data relating to the course of interest (e.g. subject, course, content of message) |
Contact
| Personal Data Categories | Purpose | Legal Basis | Retention Period | Recipients |
|---|---|---|---|---|
| Identification data (e.g. name, surname) | Communication with interested parties | Article 6(1)(f) GDPR – Direct and interactive contact with QMS | 5 years | Processors: providers of IT support services providers of hosting services, cloud providers. |
| Contact data (e.g. e-mail address, telephone number) | ||||
| Δεδομένα που αφορούν την επικοινωνία (λ.χ. θέμα, περιεχόμενο μηνύματος) |
Data we collect autmatically
When you use our Website, we automatically collect certain data, including information that constitutes personal data. These include language settings, IP address, location, device settings, device operating system, activity details, time of use, redirect URL, status report, user information (information about browser version), operating system, browsing result (simple visitor or registered customer), browsing history. We may also collect data through cookies. For information on the use of cookies, click here.
Personal data we process in the context of recruitment
| Personal Data Categories | Purpose | Legal Basis | Retention Period | Recipients |
|---|---|---|---|---|
| Identification details (full name, father’s name, mother’s name, gender, date of birth, ID number/passport number) | Assessment of the candidate for recruitment purposes | Legitimate Interest [Article 6 para. 1 (f) GDPR] – Our legitimate interest in the recruitment of qualified personnel | 6 months or for a greater period subject to your consent | Processors: providers of IT support services providers of hosting services, cloud providers. |
| Contact data (postal and e-mail address, telephone number) | ||||
| Data contained in CVs (marital status, disabilities, education and qualifications data, work experience) |
Transfer of data outside the EEA
In principle, QMS does not transfer your personal data to third countries and/or International Organizations. In the event of a transfer of your personal data to a country outside the European Economic Area (EEA) or an International Organization, QMS shall first ensure that one of the legal bases of Article 6 of the GDPR is complied with cumulatively to the following:
- the Commission has issued an adequacy decision for the third country or International Organization to which the transfer is to be made (Article 45 of the GDPR); or
- appropriate safeguards in accordance with the GDPR are in place for the transfer of such data (Article 46 of the GDPR); or
- for occasional processing, one of the exceptions provided for in Article 49 of the GDPR must apply (e.g. the explicit consent of the subject upon having been informed of the risks of such transfer, the transfer is necessary for the performance of a contract at the request of the data subject, the transfer is necessary for important reasons of public interest, the transfer is necessary for the establishment, exercise or defense of legal claims or for the protection of vital interests of the data subject, etc.).
Data subject rights
QMS ensures that it can respond directly to the requests of the subjects, for the exercise of their rights in accordance with Applicable Law.
In particular, every data subject has the following rights:
| Portability | Rectification |
| Erasure | Restriction |
| Access | |
You have the right to object to the processing of your personal data as regards any processing carried out by QMS based on our legitimate interests.
If you give your consent for your CV to be retained for a greater period of time, you may withdraw your consent at any time.
If you wish to exercise any of your rights or acquire any information concerning the processing of your personal data, you can contact us via email in the following address gdpr@qms-mtc.com, and QMS will respond promptly [in any case within thirty (30) days of the request], notifying you in writing of the progress of the request.
If you have any complaints regarding this Notice or any data protection concerns, and if we fail to comply with your request, you may contact the Hellenic Data Protection Authority, 1-3 Kifissias Avenue, 115 23, Athens (www.dpa.gr).
Exclusion of Liability for Third Party Websites-Social Media Widgets
On this Website there are links to third party websites and/or social media widgets (e.g. Google, Facebook, Instagram), through which, after the user logs in to the third party’s website or social network, a special digital fingerprint is created in respect of which both QMS and the third party itself act as joint controllers.
As regards QMS, the purpose of processing such data is to improve the functionality of the Website and the services provided, as well as for traffic analysis. The lawful basis for the processing of personal data is the pursuit of the legitimate interest of the user and in particular the interoperability with applications used by them (Article 6(1)(f) GDPR).
QMS does not have control over and is not responsible for any further processing carried out on such data by the Joint Controllers.
For more information about the data processing policy and the options for configuring these networks, please visit the following websites: