a. Data from Publicly Available Sources
Linked Business platform offers an integrated experience of accessing unique business data and tools of high added value, tailored to the common entrepreneurial needs of the majority of the enterprises in Greece. The core of the application consists of the broad publicity web formalities, as they are introduced in a series of laws by the Greek state, such as Law 3861/2010 (Diavgeia Program), Law 3979/2011, as amended by Law 4305/2014 (Open Data Law), Law 3979/2011 (Electronic Governance), Law 3419/2005 (General Commercial Registry), as amended by Laws 441/2016 and 4443/2016.
Purpose of the platform is to provide comprehensive information in order to strengthen the ability of the citizens and legal persons to enjoy and practice constitutional rights, primarily the right to information, as established in Article 5 A [1] of the Constitution, and consequently any constitutional rights attached to or dependent on the aforementioned information, such as the right to personal development, the right to participate in social, financial and political life (Article 5 [1]), but also the right to participate in Information Society (Article 5 A [2]).
Under this perspective, the platform processes data, for which the Greek society has decided that, for reasons concerning the wider public interest, it should be governed by full transparency. This view was fully endorsed by the Court of Justice of the European Union (ECJ) in its recent judgment in case # C-398/15, in which it held that those who choose to commercially operate under S.A. and Ltd. Companies, should disclose data relating to the activity in question without maintaining the right to deletion. Additionally, data being processed by the platform are clearly disclosed and any processing operation that takes place in the context of the provision of the service concerned, always serves the freedom of expression and information, both on the side of data and service supply and on the side of the demand.
In view of the implementation of Regulation (EU) 2016/679 and the finalization of the Law on the Protection of Natural Persons with Regard to the Processing of Personal Data in the implementation of the General Data Protection Regulation (GDPR), Linked Business IKE (VAT Number 800950289 and Business Registry Number 145587001000) has thoroughly examined its report on the requirements of this legislative framework and assessed both the data quality principles as introduced by Article 5 of the Regulation and the compliance measures according to the type of data it collects and processes. In particular, Linked Business collects and processes the following three main categories of data:
- Data relating to new and existing enterprises.
- Data of natural persons as board members.
- Data from the platform users
As far as the first category data, taking into consideration that it is corporate data, it is clear that it doesn’t fall within the scope of the Regulation. In particular, information that pertains to the concept of personal data under Article 4 [1] (GDPR) is: "any information relating to an identified or identifiable natural person ("data subject"); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that person."
Corporate data under this definition, cannot be construed as personal data. In any case, however, and insofar as the corporate data being processed by the company in conjunction with the provision of the service in question, are personal data, these are governed by the broad publicity web formalities as introduced by the above mentioned legislation, while data processing takes place within the framework of freedom of expression and information in full attunement with the proposed Article 16 of the under-reconstruction Law on the Protection of Personal Data, in implementation of the Regulation. The same applies to data in the second category.
b. Data from the Platform Users
With regards to data in the third category, the company receives specific personal data that users provide in the context of the sale contract for the provision of the service, which are strictly necessary for the fulfillment of the sale contract. However, in any case, users have the permanent and non-negotiable right of cancellation, in case they fulfill their contractual obligations.
In addition, users voluntarily provide a special consensus, which will be taken using tools and procedures fully harmonized with the consensus criteria as introduced by the Regulation, for the sole purpose of communicating and implementing newsletter campaigns, with a continuous and non-negotiable right of a recall.
Finally, Linked Business processes user traffic, acquisition and behavior data exclusively within the website that maps to in-house analytics and solely for the purpose of measuring the platform’s performance and user satisfaction.
Regarding other actions that may be taken, we note that due to its limited size the company is not required by law to retain a registry to justify the lawfulness of the processing of personal data under Article 30 [5] of the GDPR. However, since the processing of any volume will not be occasional, foresight of Article 30.5 does not apply as defined by WP29, with the result that it falls under the strategic planning of the company to create and maintain a relevant such file as soon as the user registrations process begins. In this sense, relevant policies will be issued if and when they will be required.
Finally, regarding security issues, the platform uses Okeanos (GRNET's cloud service for the Greek Research and Academic Community), Amazon Web Services and NCSR Demokritos Datacenters, certified by ISO 27001 for the security and protection of personal data under GDPR, and has all the necessary technical features required by a modern cloud infrastructure storage environment.
For any further question about data management and the use of Linked Business platform, please contact [email protected].