Privacy

1. Roles of the Parties
The Organization, HELLENIC INSTITUTE FOR WOMEN’S CARDIOVASCULAR HEALTH, acts as the Data Controller (Controller), and EVENTURE acts as the Data Processor (Processor) in relation to the personal data processed in connection with the electronic auction. The Processor shall process personal data exclusively on behalf of and in accordance with the documented instructions of the Controller.

2. Subject Matter, Duration and Purpose
The processing concerns the registration and management of participants, the conduct of the auction, communication with bidders, the processing of payments, the issuance and/or support of tax and transaction documentation, the completion of deliveries, and the maintenance of necessary records for as long as required under this Policy, applicable law, or the documented instructions of the Controller.

3. Categories of Personal Data and Data Subjects
The personal data processed may include identification and contact details, user account information, transaction and order details, payment information necessary for the transaction, technical and usage/log data, and information required for customer support. Data subjects include, in particular, auction participants, bidders, and purchasers.

4. Confidentiality and Authorized Personnel
The Processor shall ensure that persons authorized to access personal data are subject to confidentiality obligations and have access only to the extent necessary for the performance of the services.

5. Security of Processing
The Processor shall implement appropriate technical and organizational measures, taking into account the nature of the personal data and the associated risks, to protect against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data. Where appropriate, such measures shall include access controls, strong authentication, encryption during transmission, activity logging, secure backups, and recovery procedures.

6. Sub-processors
The Processor may use providers of auction platforms, hosting, cloud services, email/SMS services, analytics services strictly necessary for the provision of the services, and payment service providers as sub-processors. The Processor shall impose contractual data protection obligations on such sub-processors that are substantially equivalent to those set out herein and shall remain responsible to the Controller for the sub-processors’ compliance with the obligations assigned to them, to the extent required by the GDPR.

7. Rights of Data Subjects
The Processor shall assist the Controller, to the extent reasonably possible and taking into account the nature of the processing, in enabling the Controller to respond to requests from data subjects seeking to exercise their rights. The Processor shall forward any such request it receives to the Controller without undue delay and shall not respond to the substance of the request unless instructed to do so by the Controller or required to do so by law.

8. Personal Data Breach
The Processor shall notify the Controller without undue delay after becoming aware of a personal data breach affecting personal data processed on behalf of the Controller and shall provide the available information necessary for managing and, where required, reporting or notifying the relevant parties of the incident.

9. International Data Transfers
The Processor shall not transfer personal data outside the European Economic Area (EEA) unless an appropriate transfer mechanism is in place in accordance with the GDPR. Where service