Privacy Policy

Introduction

This constitutes the Privacy Policy of the BuildBoard application, available at https://app.buildboard.gr/ (hereinafter referred to as "BuildBoard" or "application" or "platform"). The company under the name "Resolute Cepal Greece S.A." (hereinafter: "RCG", "Company", "we", "our" or "us"), having its registered office at 8 Xenofontos Street, Athens, PC 10557, has developed and manages the BuildBoard application.

This policy complies with applicable laws, regulations and directives on the protection of personal data, including Regulation (EU) 2016/679 (hereinafter referred to as the "GDPR") and the relevant provisions of the Greek legislation on the protection of personal data.

Our main goal is to inform you about the processing of personal data, about the type of personal data collected, the purpose of their collection and processing, their recipients, the duration of data retention, their potential transmission outside the EU, as well as about your rights in relation to your data as a customer of the Company and how you can exercise them.

For us, the privacy as well as the security of your personal data is of paramount importance, which is why we take the appropriate technical and organizational measures to protect your personal data that we collect and process, ensuring that they are processed lawfully.

Personal Data Controller

In this Privacy Policy, the company under the name "Resolute Cepal Greece S.A.", having its registered office at 8 Xenofontos Street, Athens, PC 10557, is referred to as the "Company" and/or "We" and/or the "Data Controller".

The Company is the Data Controller within the meaning of the law and the purposes as well as the way in which your personal data are collected, used and/or possibly disclosed to third parties by the Company are clarified in this Privacy Policy.

Legal Basis for Processing

We process your personal data only if one of the following conditions is met:

• The processing is necessary for the performance of a contract.
• The processing is necessary for the satisfaction of the legitimate interests of the Data Controller.

The Personal Data We Collect About You

We collect and process the following personal data:

• Name
• Surname
• Telephone number (landline and/or mobile)
• Email address
• Postal address
• Details of legal representatives

How We Use Your Personal Data

Who Your Personal Data Is Shared With

• Authorized employees of the Company who need access to your personal data in order to fulfil their duties and the obligations arising from our contractual relationship.
• Third-party service providers who process personal data on our behalf, under appropriate data processing agreements, to support the operation and maintenance of the platform.
• In the event of a potential sale, transfer, or restructuring of the Company or its assets, your personal data may be transferred to the acquiring entity or its advisors, provided that appropriate safeguards are in place.
• When required by law, regulation, legal process, or enforceable governmental request, your personal data may be disclosed to the competent authorities.

Where Your Personal Data Is Transferred

Your personal data are stored on secure servers within the European Union. We do not transfer your personal data outside the EU.

For How Long We Retain Your Personal Data

Your personal data are retained for the period that is absolutely necessary for the fulfilment of the purposes for which they were collected. Upon expiration of this period, the data are retained for an additional five (5) years. If a legal claim is pending or reasonably anticipated, the retention period may be extended accordingly until the claim is fully resolved.

What Your Rights Are

In relation to the processing of your personal data, you have the following rights:

• Right of access: You have the right to request and receive confirmation as to whether your personal data are being processed and, if so, to access them.
• Right to rectification: You have the right to request the modification or correction of inaccurate personal data concerning you.
• Right to erasure: You have the right to request the deletion of your personal data, subject to applicable legal obligations.
• Right to restriction of processing: You have the right to request the restriction of the processing of your personal data under certain circumstances.
• Right to data portability: You have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit them to another controller.
• Right to object: You have the right to object to the processing of your personal data at any time, on grounds relating to your particular situation.

You also have the right to submit a complaint to the Hellenic Data Protection Authority (Kifissias 1-3, 11523 Athens, tel. +30 210 6475600, www.dpa.gr).

To exercise any of your rights, you may contact us at dpo@res-cep.com. We will respond to your request within thirty (30) days. This period may be extended by an additional two (2) months if the request is complex or if there is a high volume of requests.

Data Security

We implement appropriate technical and organizational measures to ensure the security and confidentiality of your personal data. Our infrastructure is hosted on Google Firebase, which is certified under ISO 27001 and SOC 1, SOC 2, and SOC 3 standards.

Contact - Data Protection Officer (DPO)

For any questions or concerns regarding this Privacy Policy or the processing of your personal data, you may contact our Data Protection Officer at dpo@res-cep.com.