Legal Centre Lesvos (“LCL”) is committed to protecting your personal data and being transparent about what we do with it, no matter how you interact with us. That’s whether you want to work, volunteer or advocate for us, donate, use our legal services, want information, training or want to learn more about what we do.
In this policy, “we” refers to Legal Centre Lesvos, its partners, staff, co-operating attorneys, interpreters, volunteers, consultants and any other individuals who are required to abide by data protection legislation as part of their relationship with Legal Centre Lesvos.
We are committed to using your personal data in accordance with our responsibilities. We are required to provide you with the information in this Privacy Notice under applicable law which includes the European Union General Data Protection Regulation (Regulation (EU) 2016/679) (‘GDPR’), the Privacy and Electronic Communications Regulation (2003) and Law No. 4624/2019, referred to as the ‘data protection legislation’.
We won’t do anything with your personal data you wouldn’t reasonably expect.
Processing of your personal data is carried out by or on behalf of Legal Centre Lesvos, constituted as a Non-Profit Company on 5/5/2019 in the Court of First Instance of Mytilene, Registration No. 2/2019.
This notice tells you about how we collect, use and protect your personal data.
If you have any queries about our Privacy Notice, please get in touch with our Data Protection Officer at firstname.lastname@example.org.
How and when we collect personal data about you
When you directly give us information
We may collect and store personal data about you when you interact with us. For example, this could be when you:
- submit an enquiry
- use our legal services
- support our work through a donation fundraise on our behalf
- give us feedback
- make a complaint
- apply for a job
- volunteer for us
- enter into a contract with us
When you indirectly give us information
When you interact with us on social media platforms such as Facebook, WhatsApp, Twitter or LinkedIn we may also obtain some personal data about you. The information we receive will depend on the privacy preferences you have set on each platform and the privacy policies of each platform. To change your settings on these platforms, please refer to their privacy notices.
We may obtain information about your visit to our site, for example the pages you visit and how you navigate the site, by using cookies. Please visit our cookies policy for information on this.
What information we might collect
When you engage with us by phone, mail, in person or online, we may collect personal data about you. This may include your name, address, email address, telephone number, date of birth, job title and details of your education and career, why you are interested in Legal Centre Lesvos, and other information relating to you personally which you may choose to provide to us.
Data protection law recognises that certain types of personal data are more sensitive. This is known as ‘sensitive’ or ‘special category’ personal data and covers information revealing racial or ethnic origin, religious or philosophical beliefs and political opinions, trade union membership, genetic or biometric data, information concerning health or data concerning a person’s sex life or sexual orientation.
Sensitive data will only be collected where necessary, for example, we may need to collect such data to assist in preparing for an application for asylum or to advocate for access to health services on the island. Clear notices will be provided at the time we collect this data, stating what data is needed, and why.
With your explicit consent, we may also collect sensitive personal data if you choose to tell us about your experiences relating to our services for use in a case study.
If you’re under 15
If you’re aged under 15, you must get your parent/guardian’s permission before you provide any personal information to us.
Should a child under 15 be unaccompanied and a parent’s or guardian’s permission consequently be unobtainable, LCL will only process personal data if it is either in the Legitimate or Vital interests of the child.
How and why we use your personal data
We will use your personal data for the following purposes:
- Provision of legal information, advice, assistance and/or representation: If you request these services from us, we will process your personal data to the extent necessary to effectively provide them.
- Legal, regulatory and tax compliance: Where required we are subject to a legal obligation, we may process your personal data to fulfil that obligation.
- Donation processing: We will process personal data you provide in order to administer any one-off or on- going donations you make.
- Responding to a request: If you contact us with a query, we may use your personal data to provide you with a response.
- Fundraising or direct marketing: We will only send you marketing information by email, SMS, or phone if you have given us specific consent. If you withdraw your consent and then subsequently opt in to receive marketing information again, then your most recent preference may supersede. If you respond to a fundraising appeal by post, you may also receive fundraising mail, which you can opt out of at any time.
- Monitoring and Evaluating: We may use your personal data in order to improve current and future delivery of our services.
- Processing an application to work/volunteer with us: If you apply to work/volunteer with us, we will only use the personal data you give us to process your application or to monitor recruitment statistics on an unidentified basis. If we want to disclose personal data to someone outside Legal Centre Lesvos, for example, if we need a reference from your previous employer, we will tell you beforehand. The only exception is where the law obliges us to disclose personal data to a third party (such as the police) and we are not allowed to tell you.
- If you are unsuccessful in your job/volunteer application, we may hold your personal data after we’ve finished recruiting for the post you applied for, for up to 12 months to deal with any follow up queries or issues.
- If you commence employment/volunteering with Legal Centre Lesvos, your personal data will be processed in accordance with your employment contract and other applicable human resources policies we have from time to time.
- Transactional purposes: We will need to process your personal data in order to carry out our obligations arising from any contracts entered into between you and us for goods or services.
- Providing and developing our website: We may use your personal data to help provide you with access to our website, personalise your experience, and improve and develop it further.
- Administration: We may process your personal data to record and deal with a complaint, record a request not to receive further information, record what our volunteers have done for us, and for other essential internal record keeping purposes.
- Protecting your vital interests: We may process your personal data where we reasonably think that there is a risk of serious harm or abuse to you or someone else.
Who do we share your personal data with?
We will only use your personal data for the purposes for which it was obtained. We will not, under any circumstances, sell or share your personal data with any third party for their own purposes, and you will not receive marketing from any other companies, charities or other organisations as a result of giving your details to us.
We will only share your personal data for the following purposes:
- Third party suppliers: We may need to share your personal data with data hosting providers or service providers who help us to deliver our services, projects, or fundraising activities and appeals. These providers will only act under our instruction and are subject to pre-contract scrutiny and contractual obligations containing strict data protection clauses.
- Where legally required: We will comply with requests where disclosure is required by law, for example, we may disclose your personal data to the government for tax investigation purposes, or to law enforcement agencies for the prevention and detection of crime. We may also share your personal data with the emergency services if we reasonably think there is a risk of serious harm or abuse to you or someone else.
We always aim to ensure that personal data is only used by those third parties for lawful purposes in accordance with this Privacy Notice.
How we protect your personal data
We use technical and corporate organisational safeguards to ensure that your personal data is secure. We limit access to personal data on a need-to- know basis and take appropriate measures to ensure that our people are aware that such personal data is only used in accordance with this Privacy Notice.
We undertake regular reviews of who has access to personal data that we hold to ensure that your personal data is only accessible by appropriately trained staff, volunteers and contractors.
If you provide us with your credit or debit card details to donate to us, we pass these securely to our payment processing partners. We do this in accordance with industry standards and do not store the details on our website.
However, please be aware that there are always inherent risks in sending personal data by public networks or using public computers and we cannot 100% guarantee the security of data (including personal data) disclosed or transmitted over public networks.
We understand that additional care may be needed when we collect and process the personal data of vulnerable supporters and volunteers. In recognition of this, we observe good practice guideline in our interactions with vulnerable people.
How long will we keep your personal data?
We will keep your personal data in respect of financial transactions for as long as the law requires us to for tax or accounting purposes (which may be up to six years after a particular transaction).
If you request that we stop processing your personal data for the purpose of marketing we may in some instances need to add your details to a suppression file to enable us to comply with your request not to be contacted.
In respect of other personal data, we will retain it for no longer than necessary for the purposes for which it was collected, taking into account guidance issued by the Hellenic Data Protection Authority (“HDPA”) and in accordance with our retention policy.
International transfers of personal data
We may, on occasion decide to use the services of a supplier outside the European Economic Area (EEA), which means that your personal data is transferred, processed and stored outside the EEA. You should be aware that, in general, legal protection for personal data in countries outside the EEA may not be equivalent to the level of protection provided in the EEA.
However we take steps to put in place suitable safeguards to protect your personal data if processed by the supplier such as entering into the European Commission approved standard contractual clauses. When we transfer your personal data and process it in the United States, we do so in accordance the European Commission approved standard contractual clauses. By submitting your personal data to us you agree to this transfer, storing or processing at a location outside the EEA.
Your rights to your personal data
Data protection legislation gives you the right to request access to personal data about you which is processed by Legal Centre Lesvos and to have any inaccuracies corrected.
You also have the right to ask us to erase your personal data, ask us to restrict our processing of your personal data or to object to our processing of your personal data.
If you wish to exercise these rights, please contact our Data Protection Officer at email@example.com will assist you with your request. We will respond within 30 days, on receipt of your written request and copies of your identification documents.
How to make a complaint or raise a concern
If you would like more information, or have any questions about this policy, to make a formal complaint about our approach to data protection or raise privacy concerns please contact the Data Protection Officer at firstname.lastname@example.org.
If you would like to make a complaint in relation to how we have handled your personal data, please follow our complaints procedure. If you are not happy with the response you receive, then you can raise your concern with the relevant statutory body:
Hellenic Data Protection Authority
Data Protection Authority Offices: Kifissias 1-3, 115 23 Athens, Greece
Call Centre: +30-210 6475600
Fax: +30-210 6475628
Our Privacy Notice may change from time to time, so please check this page occasionally to see if we have included any updates or changes, and that you are happy with them.