The protection of individuals with regard to the processing of personal data is a fundamental right. Article 8(1) of the Charter of Fundamental Rights of the European Union ('the Charter') and Article 16(1) of the Treaty on the Functioning of the European Union (TFEU) provide that everyone has the right to the protection of personal data concerning him or her.
Furthermore, as of 25.05.2018, the General Data Protection Regulation (GDPR) of the European Parliament and of the Council (hereinafter the "General Regulation") as well as the Greek Law 4624/2019 apply, which introduce a stricter framework for the protection of natural persons with regard to the processing of personal data and for the free movement of such data.
The protection of individuals with regard to the processing of personal data is of paramount importance to Metlen Energy & Metals Plc-Group of Companies (hereinafter the "Company"). Therefore, the collection and processing of personal data by the Company is carried out only in accordance with the General Regulation and applicable legislation and where this is required in relation to the operation of employment relations and its business activity Company. The Company allows access only to authorized persons and takes increased data security measures including loss, mishandling, unauthorized access, modification or disclosure.
1. Processing of personal data on the Company's websites (with the exception of those of Protergia which have a separate policy)
1.1 Categories of personal data
During your visit to the Company's websites, the Company processes:
(a) Personal data automatically collected during your browsing (IP address, device type, browser, redirection website, company websites visited, date and time of visit).
(b) The data you enter on the website for your subscription to the company's newsletter and for the communication / complaints service. The categories of data for these processing operations are name, contact telephone, e-mail address, communication content.
(c) CV details in case you are applying for an open job position (there is a separate policy for this processing at the time of application),
(d) contact details and reference content when using the company's internal reporting channel (there is a separate policy for such processing at the time of submission of the report);
(e) data entered by our suppliers for their evaluation in the context of third-party audit.
1.2 Purposes of processing
Personal data is processed for the following purposes:
(a) The creation of anonymized statistics on the traffic and accessibility of the main website as well as the subsequent pages, so that we can take the necessary actions to improve them in order to improve your browsing experience. The establishment of any legal claim or defense of the Company against attempted fraud, possible cyberattack or other illegal activity.
(b) sending the newsletter as well as to respond to your requests or contact you at your request.
(c) the evaluation of CVs you enter to fill vacancies.
(d) receiving and investigating reports in the Company's internal reporting channel
(e) the evaluation of the data you enter in the digital Supply Chain Assessment platform in the context of issuing sustainability reports.
1.3 Legal bases for processing
The processing of your personal data is necessary for the fulfillment of the aforementioned purposes. Unless otherwise specified at the time of collection of personal data, the legal basis for their processing is:
Purpose a: your explicit consent has been given to the processing of personal data (Article 6 (1) (a) of the General Regulation) through cookies, the processing is necessary for the purposes of the legitimate interests pursued by the Company (Article 6 (1) (f) of the General Regulation),
Purpose b & c: your explicit consent to the processing of personal data has been given (Article 6 (1) (a) of the General Regulation)
Purpose d: processing is necessary for the legal obligation of the Controller to receive and investigate reports in accordance with Law 4990/2022,
Purpose e: processing is necessary for the purposes of the Company's legal obligations (European Directive CSRD and Law 4403/2046)
1.4 Processors - Recipients and transfers
Some of the Company's websites are managed by third-party IT companies (processors). In these cases, we ensure, through contractual terms and regular checks, that if and when they have access to personal data, the legislation on their protection is adequately complied with. Some of the data may be transmitted to the competent authorities for purpose a. We do not transfer personal data outside the EEA.
1.5 Cookies Policy
Cookies are small text files that are stored on your computer or mobile device when you visit a website. We use the term "cookies" as an aggregate term to describe techniques such as cookies, Flash cookies and web beacons.
Cookies are primarily used to ensure that your visit to our websites is as user-friendly as possible, as well as for advertising purposes during your future visits to other websites. We have created a mechanism for the management by the user of the cookies that he wishes to receive. Our cookie policy provides further details on the types of cookies we use, their categories and purpose.
1.6 Personal data of minors
The Company and its websites are addressed to persons who have completed the eighteenth (18th) year of age. If underage users voluntarily visit our websites, the Company bears no responsibility. In the event that during the collection of data it is perceived that the user is younger, the Company will not process his/her personal data.
2. Processing of personal data related to your business relationship with the Company
2.1 Categories of personal data and sources
In the context of an upcoming or existing business relationship with the Company, the Company processes the following categories of personal data of its trading partners:
(a) Data processed in the context of a project, a purchase or sale of a product or service, or provided by the business partner, such as personal data relating to orders, payments made, requests and reports in the context of implementing a project or cooperation in general.
(b) creditworthiness and integrity data (information regarding court cases or other legal proceedings against business partners) collected from publicly available sources, databases and credit reference agencies. Details of legal representatives, beneficial owners
(c) shareholder’s contact details and number of shares.
2.2 Purposes of processing
(a) Management of the contractual relationship with business partners such as receipts, deliveries of products, provision of services, execution of works, collections, payments, audits, operational and IT services, execution, support and monitoring of the contract, fulfillment of contractual obligations, etc.;
(b) Ensuring the Company's compliance with legal obligations (tax, insurance, customs, accounting, etc.) for the purposes of compliance checks of business partners to prevent financial crimes as well as to safeguard its overriding legitimate interests such as the transmission of data to law firms or competent authorities.
(c) Monitoring of the share register and payment of dividends to shareholders.
2.3 Legal bases for processing
Unless otherwise specified at the time of collection of personal data, the legal basis for their processing is:
Purpose a & c: processing is necessary for the performance of the contractual relationship with you (Article 6 (1) (b) of the General Regulation), and processing is necessary for the purposes of the legitimate interests pursued by the Company (Article 6 (1) (f) of the General Regulation);
Purpose b: the processing is necessary for compliance with a legal obligation of the Company or for the purposes of the legitimate interests pursued by the Company (Article 6 (1) (c) or (f) of the General Regulation, respectively) and the processing is necessary for the purposes of the legitimate interests pursued by the Company (Article 6 (1) (f) of the General Regulation);
2.4 Recipients and transfers
The Company may transmit personal data to other subsidiaries or third parties, but only if and to the extent that such transmission is strictly required for the aforementioned purposes.
The Company may transmit personal data to judicial, administrative, tax, customs, arbitration authorities or other public authorities, regulatory bodies and lawyers if this is necessary for compliance with the law and/or for the establishment, exercise or defense of its legal claims.
Furthermore, the Company may assign part or all of the above processing to third parties (processors) including their directors and employees:
to parties that have contracted with the Company for the promotion of the Company's services, for the provision of postal services, IT support services, record keeping services, IT services, banking and credit institutions, companies of chartered accountants.
to parties who have contracted with the Company to assess the creditworthiness of the partner to fulfill his obligations under the contract.
In these cases, we ensure through contractual terms and regular checks that, if and when they have access to personal data, the legislation on their protection is adequately complied with.
The recipients of the personal data may be located outside the European Economic Area. In such cases, the Company takes measures to implement adequate and appropriate safeguards for the protection of personal data by other means, notably through the use of standard binding clauses from the EU.
3. Data Retention Period
The Company will keep your personal data for as long as it is required to fulfill the purposes described in this policy, unless applicable law requires or allows a longer period of time. The criteria governing the determination of the data retention period include the following: (a) for the duration of the contractual relationship between us, (b) as long as it is required in order for the Company to comply with a legal obligation incumbent on it, (c) as long as it is required in view of the legal position the Company is in (such as defending rights before courts, regulatory audits, etc.).
4. Technical and organizational measures
The Company effectively implements, both at the time of determining the means of processing and at the time of processing, appropriate technical and organizational measures, such as pseudonymization, designed to implement data protection principles, such as data minimization, and to incorporate the necessary safeguards in such processing in such a way as to meet the requirements of applicable legislation and protect the rights of natural persons.
5. Right to withdraw consent
In case you have given your consent to the processing of specific personal data by the Company, you have the right to withdraw your consent at any time, with future effect. The withdrawal of consent does not affect the lawfulness of processing based on consent before it was withdrawn. In case of withdrawal of consent, the Company may further process personal data only in cases where there is another legal ground for processing.
6. Data subject rights
Under the applicable legislation on the protection of personal data and provided that the relevant legal requirements are met, you have the following rights:
6.1 Right of access
You have the right to be informed if the Company processes your data, to have access to the data and to receive additional information about their processing.
6.2 Right to rectification
You have the right to request the updating, correction, completion of your personal data.
6.3 Right to erasure
You have the right to submit a request for deletion of your personal data, which will be satisfied provided that there is no other legal basis for processing (such as, but not limited to, an obligation to process personal data imposed by law).
6.4 Right to restriction of processing
You have the right to request restriction of processing of your personal data in the following cases: (a) when you contest the accuracy of the personal data and until it is verified, (b) when you object to the deletion of personal data and request instead of deletion the restriction of their use, (c) when personal data are not needed for processing purposes, but are necessary for your foundation, exercise, support of legal claims, and (d) when you object to processing and until it is verified that there are legitimate reasons that concern us and override the reasons for which you object to processing.
6.5 Right to object to processing
You have the right to object at any time to the processing of your personal data when it is based on the legal basis (Article 6 (1) (e) or (f) of the General Regulation) which will be satisfied unless the Company demonstrates compelling and legitimate reasons for their processing.
6.6 Right to portability
You have the right to receive your personal data free of charge in a structured, commonly used and machine-readable format or to request, if technically feasible, that we transmit the data directly to another controller.
6.7 Right to object to a decision based on automated processing
You have the right to opt out of decision-making based on automated processing, including profiling.
7. Personal Data Controller
The Data Controller is "Metlen Energy & Metals Single Member SA", based in Maroussi, Attica, 8 Artemidos Street.
The Company provides support to all questions, comments, concerns or complaints related to the protection of personal data or in case you wish to exercise any right regarding the protection of your data. The Data Protection Officer can be contacted via email at DPO@metlen.com or by post at:
Metlen Energy & Metals
Attn. DPO
Artemidos 8, Marousi
P.C.151 25 Athens
8. Right of appeal to the Authority
The competent authority is the Hellenic Data Protection Authority. You have the right to appeal to the Personal Data Protection Authority for issues relating to the processing of your personal data. You must have made an effort to exercise your rights with the Company before appealing to the competent Authority. For the competence of the Authority and how to lodge a complaint, you can visit its website (www.dpa.gr > My Rights > Filing a Complaint) where detailed information is available.
Policy Reviewed at 04/08/2026
