Privacy Policy

SEMAC Group (Greece) — Semac Construction S.A. & Semac Automation S.A.

Version 2.3 · Published 14 September 2026 · Effective date: 14 September 2026

Version 2.3 is a clarifying version: it restores the internal consistency of the text as regards automation.semac.gr, which was named in the scope (§1) but appeared neither in the controller table (§3.2) nor in the scope section (§4.1). It introduces no new processing, purpose, legal basis or recipient, and it does not alter the announcements made by versions 2.1 and 2.2, which take effect on their own dates.

Version 2.0, effective 15 August 2026, remains in force until 17 September 2026. The provisions introduced by version 2.1 concern advertising measurement on services.semac.gr and are marked "from 17 September 2026" where they appear. Version 2.2 adds one new named recipient for that same measurement — OpenAI Ads — and is marked "from 1 October 2026" where it appears. Both are listed in the change log in section 20. Both are published in advance under section 18, which requires at least 30 days' notice of a material change; neither operates before its own effective date, and for both, consent to the "Marketing" category is requested again before it starts.

This Privacy Policy covers the websites www.semac.gr, services.semac.gr and automation.semac.gr, together with all processing of personal data carried out by the Greek companies of the SEMAC Group in connection with those properties and with our business activities.

1. At a glance

• Who we are: two independent companies — Semac Construction S.A. and Semac Automation S.A. (Greece). Each acts as a separate controller for its own data.
• What this covers: the three properties named above and our relationships with visitors, enquirers, customers, suppliers and candidates.
• What we collect: mainly business contact details submitted through our forms, technical browsing data, contract and invoicing data and — on the Careers page — CVs.
• Why: to answer enquiries, prepare quotations, perform contracts, invoice, recruit, secure our systems and — only where permitted — send newsletters.
• On what legal basis: performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR), legal obligation (Art. 6(1)(c)), legitimate interests (Art. 6(1)(f)) and consent (Art. 6(1)(a)) where required.
• For how long: according to the detailed retention schedule in section 6 — e.g. 12 months for an enquiry that leads nowhere, 6 years for tax records.
• Who receives data: IT and hosting providers, represented manufacturers where a technical enquiry must be routed to them, our affiliated company Semac International Ltd (Cyprus) where an enquiry concerns the Cyprus or Middle East market, advisers and auditors, and public authorities where the law requires it. From 17 September 2026: also Google Ads, and from 1 October 2026 also OpenAI Ads — both as our processors for measuring our own advertising on services.semac.gr, and only if you accept marketing cookies.
• Outside the EEA: some providers are established in third countries; transfers are made under standard contractual clauses or an adequacy decision.
• We do not take automated decisions producing legal effects or similarly significantly affecting you, and we do not carry out profiling.
• We do not sell personal data and we do not make it available to advertisers or marketing partners for their own purposes. That remains true of the advertising measurement described in section 6 (purpose 20): the hashed contact details sent to Google Ads may be used only to measure our own campaigns, on our instructions, and not for Google's own purposes.
• Your rights: access, rectification, erasure, restriction of processing, portability, objection, withdrawal of consent, complaint to a supervisory authority. We respond within 1 month.
• Contact: privacy@semac.gr.

2. Table of contents

1. At a glance
2. Table of contents
3. Who we are — the controllers
4. Scope
5. What personal data we collect
6. Purposes, legal bases and retention
7. Where the data comes from
8. Recipients and processors
9. International transfers
10. Automated decision-making and profiling
11. Security of your data
12. Personal data breaches
13. Your rights
14. Direct marketing and the soft opt-in
15. Children
16. Users outside the EU/EEA
17. Links to third-party sites
18. Changes to this Policy
19. How to contact us
20. Version, effect and change log

3. Who we are — the controllers

3.1 The two companies

Collectively we refer to ourselves as the "SEMAC Group", "SEMAC", "we", "us". Both companies are established in Greece and are together referred to as "the Greek entities".

3.2 Which company controls which property

3.3 Separate, not joint controllers

The two Greek entities act as separate (independent) controllers and not as joint controllers, unless expressly stated otherwise. Each determines the purposes and means of its own processing and is responsible for it.

Where a shared CRM, shared group IT infrastructure or the internal referral of an enquiry between the two companies is involved (for example, where an enquiry submitted on www.semac.gr concerns a product or service supplied by the other company), they still act as separate controllers. The transfer between them rests on the legitimate interests of the Group in internal administration and in serving the enquirer properly (Art. 6(1)(f) GDPR, read with Recital 48).

Enquiries that concern the Cyprus or Middle East market may be referred to our affiliated company Semac International Ltd (Cyprus), which is not a controller under this Policy but a separate controller in its own right; see section 8.1.

3.4 Data Protection Officer and contact point

SEMAC has not appointed a Data Protection Officer (DPO) under Art. 37 GDPR, because no such obligation arises: we are not a public authority, our core activities do not consist of processing operations requiring regular and systematic monitoring of data subjects on a large scale, nor of large-scale processing of special categories of data.

We have, however, designated a Data Protection Contact Point, who coordinates compliance and handles data subject requests: Stamatios Evmorfiadis, privacy@semac.gr.

4. Scope

4.1 Sites covered

This Policy applies to www.semac.gr, services.semac.gr and automation.semac.gr.

4.2 People covered

• Visitors to our websites.
• Enquirers who submit a request through a contact form, by telephone or by email, or who download material from the Resource Center.
• Customers and their staff (contact persons, engineers, procurement officers, accounts payable staff).
• Suppliers, subcontractors and their staff.
• Candidates who submit a CV through the Careers page or by email.

4.3 What this Policy does not cover

• Processing of employee data in the employment context, is governed by a separate Employee / Internal Users Privacy Notice and its accompanying Acceptable Use Annex, which are issued to every employee and user.
• Cookies and similar technologies (trackers, pixels, local storage, device fingerprinting) are described in the separate Cookie Policy, which contains a per-site cookie table and the consent mechanism required by Art. 4(5) of Greek Law 3471/2006 and Art. 5(3) of Directive 2002/58/EC.
• Third-party websites we link to (see section 17).

5. What personal data we collect

We collect only the data necessary for the purposes set out in section 6 (data minimisation, Art. 5(1)(c) GDPR). Fields marked with an asterisk (*) are mandatory in the relevant form; without them we cannot answer your request.

5.1 www.semac.gr (S1)

5.2 services.semac.gr (S2)

5.3 Data we receive from third parties

• Represented manufacturers / principals (Krohne, Bürkert, Danfoss, Ecom, Michell, Knick and others): contact details of prospective customers referred to us for the local market.
• Business partners, agents and subcontractors: contact details of their representatives.
• Public registries and publicly available sources (GEMI, corporate websites, trade directories): company and contact details used for due-diligence checks and B2B business communication.
• LinkedIn: where you contact us or interact with our company pages, or where we identify public professional profiles in the context of recruitment or business communication.

5.5 Special categories of data

We do not seek to collect special categories of personal data (Art. 9 GDPR). Please do not include such data in your messages or CVs. Exceptionally, we may process health data in the context of health and safety at industrial sites (for example, medical fitness to enter a site) on the basis of Art. 9(2)(b) GDPR, or in the context of the establishment and exercise of legal claims (Art. 9(2)(f)).

6. Purposes, legal bases and retention

The following table is the master table of this Policy. Where the legal basis is legitimate interests, we have carried out a balancing exercise between our interest and your rights and freedoms; you may request a summary of that assessment at privacy@semac.gr.

6.1 What happens when a retention period expires

When a retention period expires, the data is securely deleted or anonymised. Data contained in backups is deleted in the ordinary course of the backup rotation cycle; in the meantime, processing of that data is restricted to what is strictly necessary to restore systems and it is not used for any other purpose. We do not refuse erasure merely because backups exist.

7. Where the data comes from

8. Recipients and processors

8.1 Categories of recipients

We do not sell personal data and we do not make it available to advertisers, contest sponsors or marketing partners for their own promotional purposes. The two advertising-measurement rows in the table above (Google Ads, and from 1 October 2026 OpenAI Ads) are not an exception to that statement: both providers receive the data as our processors, on our instructions and solely to measure the performance of campaigns we ourselves run, neither receives readable contact details for that purpose, and neither receives anything at all from a visitor who has not accepted marketing cookies. OpenAI Ads is sent no contact details even in hashed form — purpose 20 does not extend to it.

8.2 Contracts with processors (Art. 28 GDPR)

With every processor we conclude a written contract meeting Art. 28(3) GDPR, which provides at least for: processing only on our documented instructions; a confidentiality undertaking from the processor's staff; appropriate technical and organisational measures under Art. 32; restrictions on the use of sub-processors and an obligation of prior authorisation or notification; assistance in satisfying your rights and in handling incidents; deletion or return of the data at the end of the engagement; and an obligation to demonstrate compliance and to submit to audits.

8.3 Company pages — joint controllership for page insights

We maintain company pages on LinkedIn and Facebook. For the page insights statistics generated by those platforms, SEMAC and the relevant platform act as joint controllers under Art. 26 GDPR, following the case law of the CJEU in C-210/16 (Wirtschaftsakademie Schleswig-Holstein) and C-40/17 (Fashion ID).

In that context we receive aggregated statistics (for example, views, interactions, general audience demographics) and we have no access to the underlying data of individual users. The processing carried out by the platform itself is governed by its own terms and privacy policy; you may exercise your rights either against us or against the platform. The essence of the arrangement between us is made available by the relevant platform.

9. International transfers

9.1 When they happen

Some of our service providers (for example, the website platform, email, maps, advertising measurement and social networks) are established or maintain infrastructure outside the European Economic Area, mainly in the United States and Israel. In addition, where a project, a delivery or a quotation concerns a customer established outside the EEA, performing the contract or submitting the quotation involves transferring the contact details of the individuals concerned.

9.2 What safeguards apply

Every transfer to a third country is made in accordance with Arts. 44 to 49 GDPR, on one of the following bases:

1. An adequacy decision of the European Commission (Art. 45 GDPR). For transfers to US organisations certified under the EU–US Data Privacy Framework, the European Commission's adequacy decision of 10 July 2023 applies, which is currently valid but subject to ongoing judicial review.
2. The standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914 (Art. 46(2)(c) GDPR), accompanied by a transfer impact assessment and, where necessary, by supplementary measures (for example, encryption, pseudonymisation, contractual transparency undertakings regarding government access requests).
3. Exceptionally, and for occasional, non-repetitive transfers, the derogations in Art. 49 GDPR — in particular where the transfer is necessary for the performance of a contract between you and us or of a contract concluded in your interest (Art. 49(1)(b) and (c)), or with your explicit consent after being informed of the risks (Art. 49(1)(a)). For transfers to countries not covered by an adequacy decision we rely as a rule on standard contractual clauses or, where these cannot be put in place, on Art. 49(1)(b).

9.3 How to obtain a copy of the safeguards

You may request a copy or a description of the safeguards applied to a particular transfer by writing to privacy@semac.gr. We may redact commercially confidential information (for example, pricing) before providing a copy.

10. Automated decision-making and profiling

SEMAC does not carry out automated decision-making producing legal effects or similarly significantly affecting individuals, including profiling, within the meaning of Art. 22 GDPR.

Specifically: we do not screen job applications automatically, we do not score customers or suppliers automatically, and we do not take automated credit or commercial decisions. If this changes, we will inform you in advance, provide the information required by Art. 13(2)(f) GDPR and give you the right to obtain human intervention.

11. Security of your data

We implement appropriate technical and organisational measures under Art. 32 GDPR, proportionate to the nature, context and risks of the processing:

• Access control and least privilege: access to data is granted by role and only to the extent required by the user's duties; permissions are reviewed periodically and revoked immediately when staff leave or change role.
• Strong authentication: multi-factor authentication (MFA) is mandatory for access to corporate email accounts; we enforce a strong-password policy and store credentials in hashed form.
• Encryption in transit: all connections to our sites and application use TLS 1.2 or later, with HTTP-to-HTTPS redirection enabled.
• Encryption at rest: databases, backups and laptop disks are encrypted.
• Backup and recovery: regular backups with integrity checking and periodic restore testing; backups are held encrypted and in a separate location.
• Segregation of environments and data: separate production and test environments; real personal data is not used in test environments; logical segregation of data between Group companies where required.
• Vendor due diligence: each provider is assessed before engagement (processing location, certifications, sub-processors, security measures) and a contract meeting Art. 28 GDPR is put in place.
• Staff training and confidentiality: regular data protection and information security training, phishing awareness, and confidentiality undertakings for all staff.
• Logging, monitoring and incident response: access and audit logs are kept, systems are patched, and a documented incident management procedure defines roles and response times.

No method of transmitting or storing data is completely secure and we cannot guarantee absolute security. This does not limit our obligations or our liability: we remain responsible for implementing and keeping appropriate measures up to date, for investigating every incident, and for the consequences of any failure on our part under the applicable law.

12. Personal data breaches

We maintain a documented procedure for detecting, recording, assessing and responding to personal data breaches.

• Notification to the supervisory authority: where a breach is likely to result in a risk to the rights and freedoms of natural persons, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it (Art. 33 GDPR). Where notification is delayed, we give the reasons for the delay.
• Communication to data subjects: where a breach is likely to result in a high risk to your rights and freedoms, we inform you without undue delay, in clear and plain language, describing the nature of the breach, its likely consequences, the measures we have taken, the measures you can take, and contact details (Art. 34 GDPR).
• Internal record: we keep a record of all incidents, whether or not notified, setting out the facts, the effects and the remedial action taken.
• Processors: our contracts require processors to notify us without undue delay after becoming aware of a breach.

13. Your rights

As a data subject you have the following rights:

13.1 How to exercise your rights

Send your request to privacy@semac.gr, or by post to the address in section 19. Please state which right you are exercising and, if possible, which processing activity you are referring to — this helps us answer faster.

13.2 Deadlines and cost

We respond without delay and in any event within one (1) month of receiving your request. That period may be extended by two (2) further months where justified by the complexity or number of requests; in that case we inform you of the extension and the reasons for it within one month (Art. 12(3) GDPR).

Exercising your rights is free of charge. Only where a request is manifestly unfounded or excessive, in particular because of its repetitive character, may we either charge a reasonable fee or refuse to act — always giving reasons and informing you of your right to complain and to a judicial remedy (Art. 12(5) GDPR). The burden of demonstrating that a request is manifestly unfounded or excessive lies with us.

13.3 Identification

We may ask for additional information where we have reasonable doubts as to the identity of the person making the request (Art. 12(6) GDPR). Identification is proportionate: as a rule it is enough that the request comes from an email address we already hold, or that you confirm details we already have. We do not ask for a copy of an identity document as a blanket rule; where an identity document is genuinely needed in a particular case, we ask for the minimum information, accept redaction of the fields that are not required, and do not keep the copy beyond the time needed to verify.

13.4 Request handling procedure

The way in which we receive, record, assess and answer requests is described in the separate document "Data Subject Access Request (DSAR) Procedure", available on request.

14. Direct marketing and the soft opt-in

• If you are not a customer, we send you a newsletter or other marketing message only with your prior express consent (Art. 6(1)(a) GDPR, art. 11 of Law 3471/2006).
• If you are already a customer, we may use the email address you gave us in the course of a previous transaction to tell you about our own similar products and services ("soft opt-in", art. 11(3) of Law 3471/2006). You are given a clear opportunity to object both at the point of collection and in every subsequent message.
• Every marketing message contains a link or another simple, free method of unsubscribing, together with the identity of the sending company.
• The right to object to direct marketing is absolute (Art. 21(2) GDPR): once you exercise it, we stop that processing immediately and you do not need to give reasons. We keep a suppression list containing the minimum data necessary to ensure that you do not receive messages again.
• Objecting does not affect operational messages connected with a contract or service (for example, order confirmations, calibration due notices, invoices).

15. Children

Our websites are addressed to professionals and businesses (B2B) and are not directed at minors. We do not knowingly collect personal data of minors through www.semac.gr or services.semac.gr.

For completeness: where processing is based on consent in relation to information society services, the age of consent is 15 in Greece (art. 21 of Law 4624/2019); below that age, the consent or authorisation of the holder of parental responsibility is required. As a matter of policy, SEMAC does not collect data from minors at all, and any information that comes to our attention concerning a person under 16 is deleted without delay.

If you are a parent or guardian and believe we have received a minor's data, please contact privacy@semac.gr and we will delete it.

16. Users outside the EU/EEA

SEMAC is established in Greece, and the processing described here is governed by the GDPR and by Greek law (see section 3 of this Policy and the "Governing law" section of the Terms of Use).

If you visit our websites or contact us from a country outside the EU/EEA, your data is transferred to and processed in the EU/EEA, where a level of protection different from that of your own country may apply. We apply GDPR standards to all data subjects, regardless of residence or nationality.

You may have additional rights under your national law. We will consider any such request in good faith, to the extent that the relevant legislation applies to SEMAC. The law of the State of California (CCPA/CPRA) does not apply to SEMAC, and the references to it in the previous version of this text have been removed as inaccurate.

17. Links to third-party sites

Our websites contain links to third-party sites — in particular to represented manufacturers, social networks and embedded maps. We do not control those sites and are not responsible for their content or privacy practices. Once you move to a third-party site, that site's own privacy policy applies — we recommend that you read it. Embedded elements that store or read data on your device are activated only with your consent, in accordance with the Cookie Policy.

18. Changes to this Policy

We update this Policy whenever our processing activities, the legal framework or our providers change, and we review it at least once a year.

• Each new version carries a version number, an effective date and an entry in the change log in section 20.
• For material changes — for example, a new processing purpose, a change of legal basis, a new category of recipients, a new transfer to a third country, or a significant extension of a retention period — we post a prominent notice on the websites at least 30 days before the change takes effect and, where we hold your contact details and the change concerns you, we also notify you by email.
• Where a change requires your consent, we do not begin the new processing before we obtain it; silence or continued browsing is not treated as consent.
• Previous versions are retained and are available on request at privacy@semac.gr.

19. How to contact us

19.1 SEMAC

19.2 Supervisory authorities

If you consider that the processing of your data infringes the GDPR, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). We would appreciate the chance to address the matter first, but that is not a precondition.

Greece — Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα / HDPA) Kifissias Avenue 1-3, 115 23 Athens Tel.: +30 210 6475600 · Email: contact@dpa.gr · www.dpa.gr

You may also address the supervisory authority of the Member State of your habitual residence, your place of work or the place of the alleged infringement (Art. 77(1) GDPR), and you have the right to an effective judicial remedy against SEMAC or against a decision of a supervisory authority (Arts. 78 and 79 GDPR).

20. Version, effect and change log

Change log