1. Controller’s details
The non-profit organization “I HAVE RIGHTS AMKE” with GEMI registration number 165011601000 and registered seat at Aristarchou 25, Athens, zip code 11634 (email: info@ihaverights.eu) (hereinafter “IHR” or the “Organization”) hereby informs you, as the Data Controller, in accordance with Regulation (EU) 2016/679 (hereinafter referred to as the “GDPR”) and the relevant provisions of Hellenic Law no. 4624/2019 as applicable, on the type of personal data collected, the source of their collection, the reason for their collection and further processing, any recipients thereof, their period of retention, any transfer outside the EEA and your rights in relation to the processing of your personal data.
2. Data Processing Cycle
2.1. Personal data we process in the context of providing support for asylum procedures
|
Personal Data Categories |
Purpose |
Legal Basis |
Retention Period |
Recipients |
|---|---|---|---|---|
|
Identification details (e.g. full name, gender, date of birth) |
Provision of administrative or legal aid for asylum procedures |
Article 6 par. 2 (b) GDPR |
Until expiry of the relevant limitation period |
Greek & EU authorities, EU& UN bodies, NGOs, other private actors, including: Greek Asylum Service Directorates, Greek Reception and Identification Services (RIS), European Union Agency Asylum (EUAA), United Nations High Commissioner for Refugees (UNHCR).
|
|
Contact data (e.g. e-mail address, telephone number) |
||||
|
Special categories of data (e.g. ethnic background, political opinions, religions or ideological beliefs, health-related data) |
2.2. Personal data we process in the context of registering as a member and/or volunteer of IHR
|
Personal Data Categories |
Purpose |
Legal Basis |
Retention Period |
Recipients |
|---|---|---|---|---|
|
Identification data (e.g. name, surname, date of birth, data contained in personal message forms via the website ihaverights.eu) Contact data (e.g. postal and e-mail address, telephone number) Payment details (e.g. account holder details, IBAN) |
Become a member and/or volunteer of IHR |
Article 9 par. 2 (d) GDPR – Processing in the context of the NGO |
Until expiry of the relevant limitation period |
1. Data Processors: Accounting service providers, providers of IT support services, providers of hosting services, cloud service providers. 2. Payment service providers for the execution of transactions 3. Tax authorities, in accordance with applicable tax legislation 4. Lawyers, in so far as this is necessary for the exercise of the rights of the Organization and the protection of its legitimate interests |
|
Donations to IHR |
Article 6 para. 1 (b) GDPR – Performance of our contract |
|||
|
Billing details (e.g. tax identification number, tax office) |
Provision of donation receipt |
Article 6 para. 1 (c) GDPR in conjunction with the relevant tax legislation |
||
|
Transaction details (transaction history etc.) |
Maintenance of transaction history |
Article 6 para. 1 (f) GDPR – IHR’s legitimate interest in maintaining client logs |
||
|
Contact details (your email address) |
Direct promotional activities via electronic means |
Article 6 para. 1 (a) GDPR / Article 6 para. 1 (f) GDPR |
Until the expiry of the limitation period following the withdrawal of your consent/ until you object to the processing of your data |
Providers of promotional services |
2.3 Candidate employee data
|
Personal Data Categories |
Purpose |
Legal Basis |
Retention Period |
Recipients |
|---|---|---|---|---|
|
Identification details (full name, father’s name, gender, date of birth, ID number/passport number) |
Assessment of the candidate for recruitment purposes |
Article 6 para. 1 (f) GDPR – Our legitimate interest in the recruitment of qualified personnel |
6 months or for a greater period subject to your consent |
Processors: providers of IT support services providers of hosting services, cloud providers providers of product and service promotion services |
|
Contact data (postal and e-mail address, telephone number) |
||||
|
Data contained in CVs (marital status, disabilities, education and qualifications data, work experience) |
2.4. Vendor data (natural persons)
|
Personal Data Categories |
Purpose |
Legal Basis |
Retention Period |
Recipients |
|---|---|---|---|---|
|
Identification details (full name, father’s name, gender, date of birth, ID number/passport number) |
Supply of goods and/or services to the Organization |
Article 6 para. 1 (b) GDPR – Performance of the contract |
Until expiry of the relevant limitation period |
1. Data Processors: Accounting service providers, providers of IT support services, providers of hosting services, cloud service providers. 2. Financial institutions, to the extent necessary for the execution of transactions 3. Tax authorities, in accordance with applicable tax legislation 4. Lawyers, in so far as this is necessary for the exercise of the rights of the Organization and the protection of its legitimate interests |
|
Contact data (postal and e-mail address, telephone number) |
||||
|
Transaction data (invoices, tax forms, etc.) |
Compliance with relevant obligations under tax law |
Article 6 para. 1 (c) GDPR – Compliance with legal obligation |
*No automated decision-making processing operation, including profiling is conducted.
Data we collect automatically e.g. language settings, IP address, location, device settings, device operating system, activity details, time of use, redirect URL, status report, user information (information about browser version), operating system, browsing result (simple visitor or registered customer), browsing history. We may also collect data through cookies. For information on the use of cookies, click here.
3. Transfer of data outside the EEA
In principle, IHR does not transfer your personal data to third countries and/or International Organizations. In the event of a transfer of your personal data to a country outside the European Economic Area (EEA) or an International Organization, the transfer will be carried out pursuant to Chapter II and V of the GDPR cumulatively.
4. Data subject rights
IHR ensures that it can respond directly to the requests of the subjects, for the exercise of their rights in accordance with Applicable Law. In particular, every data subject has the following rights:
- Portability
- Rectification
- Erasure
- Restriction
- Access
You have the right to object to the processing of your personal data as regards any processing carried out by IHR based on our legitimate interests.
If you wish to exercise any of your rights or acquire any information concerning the processing of your personal data, you can contact us via email in the following address info@ihaverights.eu, and the Organization will respond promptly [in any case within thirty (30) days of the request], notifying you in writing of the progress of the request.
If you have any complaints regarding this Notice or any data protection concerns, and if we fail to comply with your request, you may contact the Hellenic Data Protection Authority, 1-3 Kifissias Avenue, 115 23, Athens (www.dpa.gr).
Exclusion of Liability for Third Party Websites-Social Media Widgets
On this Website there are links to third party websites and/or social media widgets (e.g. Google, Facebook, Instagram, X, LinkedIn), through which, after the user logs in to the third party’s website or social network, a special digital fingerprint is created in respect of which both IHR and the third party itself act as joint controllers.
As regards IHR, the purpose of processing such data is to improve the functionality of the Website and the services provided, as well as for traffic analysis. The lawful basis for the processing of personal data is the pursuit of the legitimate interest of the user and in particular the interoperability with applications used by them (Article 6(1)(f) GDPR).
IHR does not have control over and is not responsible for any further processing carried out on such data by the Joint Controllers.
For more information about the data processing policy and the options for configuring these networks, please visit the following websites:
https://policies.google.com/privacy
https://www.facebook.com/privacy/policy/
https://www.linkedin.com/legal/privacy-policy
Last updated: April 2026