Skip to main content

Hellenic Catering

Menu
Menu
Menu

Privacy Policy

1. Preamble

HELLENIC CATERING S.A. FOOD AND FOOD PRODUCTS, headquartered in the Municipality of Oraiokastro, Thessaloniki (1st Street, Industrial Area of Thessaloniki), with a branch office located in Pallini, Attica (25 Odyssea Elyti Street, Vakalopoulo location), acts as the Data Controller. The Company is subject to all obligations and commitments arising from applicable data protection legislation, including the General Data Protection Regulation (EU) 2016/679 (hereinafter the “GDPR”) and Law 4624/2019 (hereinafter the “Data Protection Legislation”).

Respecting and protecting your personal data is an absolute commitment for the Company. We understand and take very seriously the fact that you care about how your personal data is handled.

This Privacy Policy describes the personal data that the Company collects and processes in the context of its business activities, the sale of products and services, the evaluation of job candidates, and the operation of its official website. It explains how we use and protect your data, the legal bases for processing, and your rights and choices. Its purpose is to provide full and transparent information regarding your personal data, the purpose of processing, categories of recipients, and the procedures for exercising your legal rights.

Recognizing its ongoing responsibility to protect your data, the Company implements appropriate technical and organizational measures based on the principles of lawfulness, fairness, transparency, purpose limitation, storage limitation, and data minimization.

We recognize that data protection is an ongoing responsibility; therefore, we will periodically update and modify this Policy. Please check our website periodically to ensure you remain informed of any changes.

The Company does not knowingly process personal data relating to minors under the age of 18, except with the explicit consent of a parent or legal guardian.

The Company has appointed a Data Protection Officer (DPO). Contact details: email dpo@evergood.group.

2. Core Processing Principles

The processing of personal data is carried out in accordance with the data protection principles set out in Article 5 of the GDPR:

  • Lawfulness, fairness, and transparency: Data is processed lawfully, fairly, and in a transparent manner in relation to the data subject.
  • Purpose limitation: Data is collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes. 
  • Data minimization: Data is adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed. 
  • Accuracy: Every reasonable step is taken to ensure that inaccurate data is erased or rectified without delay.
  • Storage limitation: Data is kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed.
  • Integrity and confidentiality: Appropriate technical and organizational measures are applied to protect against unauthorized or unlawful processing, accidental loss, destruction, or damage.
  • Accountability: The Company is responsible for and able to demonstrate compliance with all of the above principles.

3. Who We Are

Hellenic Catering and Olympic Catering S.A. form the industrial arm of the Goody’s-Everest Group, operating under the Foodservice Sector of Vivartia Group. With a presence of over 40 years in the Greek market, Hellenic Catering operates two modern production facilities in Attica and Thessaloniki, specializing in the production of meat products, frozen and chilled meals, salads & dressings, desserts, and bakery items.

4. What Personal Data We Collect About You

The provision of certain personal data is necessary for the performance of contractual obligations, invoicing, or handling requests. Failure to provide such data may prevent the provision of the respective service or the completion of the transaction/evaluation. The failure to provide other, non-mandatory personal data will under no circumstances affect our provision of services to you. Specifically, we collect:

  • Identity and Contact Details: Full name, contact telephone number (landline/mobile), email address, and postal address, collected during your communication with us, the submission of inquiries via the website, or the ordering of products and services.
  • Invoicing & Financial Transaction Data: We collect details of our customers/partners necessary for invoicing our services, such as Tax Identification Number (TIN/AFM), Tax Office (DOY), professional activity, and bank account details (IBAN) when required for the payment or certification of due remuneration.
  • CV & Job Candidate Data: Depending on the position for which you are applying, we collect the details submitted by you and process, indicatively, the following personal data: your educational background, employment history, previous employers, fields of specialization, professional and other work licenses and certifications held, educational institutions attended, job type preferences, verification of information regarding references and previous employers, any other information you choose to submit through the CV submission process, and additional data provided during telephone contact or via your application and other communications.

To verify the background of your application, we may also obtain information about you from other sources where permitted by applicable law, such as previous employers, subcontractors providing technical services, and publicly available sources (e.g., information posted on publicly accessible websites, social media profiles, public search engine results) provided that such information is relevant and appropriate for your evaluation for the position applied for.

  • Marketing & Communication Data (Newsletter): Email address of website visitors, collected upon their explicit consent through subscription to the newsletter service, exclusively for receiving news, offers, promotional content, and direct marketing actions.
  • Technical Browsing Data: Data collected via cookies during website navigation.

We do not process sensitive personal data (special categories), unless there is an explicit legal obligation (e.g., in the fields of labor law and food hygiene/safety).

5. How We Collect Your Personal Data

We collect your personal data through the following channels:

  • Directly from you when purchasing a product or service, within the context of concluding and executing the relevant commercial contract or order.
  • When you voluntarily submit or send your CV (via email, dedicated platform, job posting, or in print).
  • Through the online contact form on the website, direct email, or telephone communication with the Company.
  • When you voluntarily subscribe to the Company’s newsletter service via the website, providing your explicit and free consent to receive offers, news, promotional content, and direct marketing via email.
  • From third-party/public sources, exclusively for job candidates to the extent permitted by law (e.g., professional platforms, referrals upon your indication).

6. How We Process Your Data

The processing of your personal data includes operations such as collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, restriction, erasure, or destruction, as defined in Article 4(2) of the GDPR. Processing is carried out primarily through electronic and computerized means and secondarily via physical archives, always applying strict security procedures.

7. Who Else is a Recipient of Your Personal Data?

The Company does not transmit, disclose, or transfer your personal data in any way to third-party companies or external providers, with the exception of specialized partners such as “Strings Digital”, who, in the context of our operations—specifically for the technical implementation, maintenance, and management of the website as well as digital campaign management—may have access to environments or data, acting strictly as Data Processors on behalf of the Company and bound by appropriate confidentiality and data protection agreements (DPAs).

The processing of your personal data is carried out exclusively internally by the Company, specifically by authorized personnel bound by strict confidentiality and non-disclosure obligations, strictly to the extent necessary to manage and respond to your requests. Access by unauthorized persons, including non-competent employees, is strictly prohibited.

In any case, our Company will not sell, transfer, or publicize personal details of website visitors/users to third parties, except in the implementation of relevant legal mandates, where access may also be obtained by:

  • Lawyers, court bailiffs, or other professionals necessary for the judicial or out-of-court handling of the Company’s claims.
  • Public services, administrative and judicial authorities, and supervisory/regulatory agencies if required by law, court order, or any other binding act for the Company, in compliance with general statutory obligations.

8. Why We Use Your Data & Legal Bases for Processing

The Company collects and processes your personal data exclusively for the following purposes and based on the respective legal bases (Article 6(1) GDPR):

  1. Contract Performance, Sale of Products/Services, and Invoicing:

For the purpose of processing orders, providing catering/food service operations, issuing statutory documents (invoices/receipts), paying remuneration for rendered services, and certifying due remuneration, pursuant to Article 6(1)(b) GDPR (performance of a contract or taking steps prior to entering into a contract).

  1. Compliance with Legal Obligations (Tax, Commercial, etc.):

Such as the issuance, transmission (e.g., via the myDATA platform), and retention of tax documents and receipts, as well as compliance with labor, insurance, and market regulations, pursuant to Article 6(1)(c) GDPR (compliance with a legal obligation).

  1. Customer Support and Answering Inquiries:

Such as the management, servicing, and processing of requests submitted via the website contact form, email, or telephone, pursuant to Article 6(1)(b) GDPR and subsidiarily Article 6(1)(f) GDPR (legitimate interest of the Company in effective communication and customer service).

  1. Evaluation of CVs and Job Applications:

For the purpose of evaluating a candidate’s application for a specific job vacancy, conducting interviews, and performing professional background checks, pursuant to Article 6(1)(b) GDPR (taking steps at the request of the data subject prior to entering into an employment contract) and Article 6(1)(a) GDPR (consent, particularly for retaining CVs for future job openings).

  1. Sending Newsletters and Promotional Content:

For the purpose of informing about news, offers, promotional actions, and providing advertising material, pursuant to Article 6(1)(a) GDPR (explicit user consent). In every such case, you have the right to withdraw your consent at any time, either via the “Unsubscribe” link included in every such message or by sending a relevant request to info@helleniccatering.gr, without affecting the lawfulness of processing based on consent before its withdrawal.

  1. Establishment, Exercise, or Defense of Legal Claims:

For the legal protection of the Company, proving compliance, and defending its rights in out-of-court or judicial proceedings, pursuant to Article 6(1)(f) GDPR (legitimate interest).

  1. Compliance with Legal Obligations of the Company:

Compliance with obligations imposed by law, e.g., tax or other applicable legislation, pursuant to Article 6(1)(c) GDPR.

9. How Long We Retain Your Personal Data

Data is retained only for the period necessary to fulfill the purposes for which it was collected.

  • Legal/Tax Obligations: Where retention is mandated by legislative provisions (e.g., tax, market regulations), personal data is retained for the period explicitly required by the respective provisions.
  • Request/Communication Data: Data submitted via the contact form is retained for the period required to fully examine, answer, and process your request, unless the content of the request indicates a need for longer retention.
  • CV Data: Retained during the evaluation and selection process for the specific vacancy, unless deletion is requested earlier.
  • Promotional/Marketing Activities: Data related to newsletter subscriptions and promotional content is retained until you withdraw your consent, and in any case for up to two (2) years, after which we will request your renewed consent for the same purpose. You may exercise your right to withdraw consent at any time without affecting the provision of our services or order fulfillment in any way. The withdrawal of consent does not affect the lawfulness of processing based on consent prior to its withdrawal.
  • Legal Claims/Legitimate Interest: The Company may continue to store your personal data for a longer period if necessary to protect its legitimate interests regarding potential liability related to the provision of its Services. Specifically, in the event of any legal claim by a customer against the Company, data will be retained until the relevant claim is finally resolved.

10. Security Guarantees and Measures

When you provide us with your personal data, we take steps to ensure they are handled and managed securely. To protect your personal data, we implement adequate physical, technical, and organizational protection measures. We continuously update and review our security technology. We restrict access to your personal data exclusively to employees who need to know such data to provide you with the services you request. Furthermore, we train all employees on the importance of confidentiality and maintaining the privacy and security of your data.

Among other measures, we have implemented the following technical and organizational procedures to protect your personal data against loss, alteration, unlawful processing, or modification:

  • Access to your personal data is restricted exclusively to authorized personnel for specific purposes.
  • IT systems used for data processing are secured to allow access only by authorized individuals.
  • Access to said IT systems is monitored to detect and immediately prevent unauthorized access.
  • Deployment of information systems and computer software configured in a way that minimizes the use of personal data and/or user identification data.
  • Adoption of specific procedures for personal data retention and secure deletion/destruction.

11. Your Rights

As a data subject, you possess the following rights under the terms and specific provisions of the GDPR:

  • Right of Access (Article 15 GDPR): You have the right to be informed whether we process your personal data and, if so, to access your processed personal data and related processing information. Under this right, you may request a free copy of your processed personal data. Should requests be repetitive and manifestly unfounded, the Company reserves the right to charge a reasonable fee.
  • Right to Rectification (Article 16 GDPR): You have the right to request the correction of inaccurate data or the completion of incomplete data.
  • Right to Erasure (“Right to be Forgotten”) (Article 17 GDPR): You have the right to request the erasure of data without undue delay upon your request, under the conditions set forth by applicable Greek and European Data Protection legislation. In certain cases (such as when processing is mandated by law or public interest), this right is subject to specific limitations or may not apply.
  • Right to Restriction of Processing (Article 18 GDPR): You have the right to request the restriction of processing (suspension or limitation), when you contest the accuracy of the data, object to its processing, or other grounds defined in applicable legislation apply.
  • Right to Data Portability (Article 20 GDPR): You have the right to receive the data you have provided to us with your consent in a structured, commonly used format, to use elsewhere.
  • Right to Object (Article 21 GDPR): You have the right to object at any time to the processing of your data based on legitimate interest (Article 6(1)(f) GDPR). In such cases, we will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
  • Right to Withdraw Consent (Article 7(3) GDPR): Where we process your personal data based on your consent, you have the right to withdraw your consent at any time or modify your consent level without affecting the lawfulness of processing prior to withdrawal.
  • Right to Lodge a Complaint with the Hellenic DPA (Article 77 GDPR): You have the right to lodge a complaint with the competent supervisory authority if you believe your rights are violated (see Section 14 below).

Should you exercise any of the above rights, the Company will respond within one month.

12. Transfer of Personal Data Outside the EU

Personal data collected via www.helleniccatering.gr is stored on servers located within the European Union (EU) / European Economic Area (EEA) and is neither transferred nor processed in third countries outside the EU.

13. Use of Cookies & Links to Other Websites

Our website may contain links to other websites. This privacy policy applies solely to data provided via www.helleniccatering.gr. Therefore, whenever you follow a link from this website to another, we recommend reading the privacy policies of the respective website. If you choose to connect to any third-party website via links, hyperlinks, or banners contained on our site, the Company bears no responsibility for the terms of data management and protection applied by such third parties.

14. How to Contact Us & Complaints

You can contact us regarding any questions about our processing of your personal data, our use of cookies, or to exercise your rights, using the online contact form on our website.

Please visit the company website www.helleniccatering.gr periodically to stay informed of any updates to this policy.

If you wish to submit any inquiry regarding the terms of this Policy, please direct it via email to info@helleniccatering.gr or by phone at +30 216 93 92 900.

If the Company fails to appropriately satisfy a request without adequately justifying its refusal, or otherwise violates its obligations under Data Protection Legislation, you are entitled to lodge a complaint or grievance with the Hellenic Data Protection Authority (HDPA):

  • Telephone: +30 210 6475600
  • Fax: +30 210 6475628
  • Email: contact@dpa.gr

You can contact the Data Protection Officer by sending an email to dpo@evergood.group.

15. Version Information – Changes and Updates

This Policy was last updated on October 7, 2026.

We reserve the right to modify and update this Policy, either wholly or partially, at our absolute discretion at any time. Any modification will take effect immediately upon posting the revised Policy on the website, accompanied by a notice on our homepage indicating the change. In any case, if you continue to use the website and its services after modifications have been made, you will be deemed to accept those modifications. If you do not agree with the terms of this Policy as it may be amended, wholly or partially, you must cease using the website.