Privacy policy

TenOikos Single-Member S.A., a part of the Ten Brinke Group
Classification: Public · Version 1.0 · Last updated: August 2026 · Owner: Data Protection Officer

1. Data Controller

The Data Controller within the meaning of Article 4(7) GDPR is:

TenOikos Single-Member S.A.
Address: Parodos Leof. Vouliagmenis 60, Elliniko, 16777, Greece
Email: info@tenbrinke.gr

This Policy applies to all processing of personal data carried out through this website. Processing is conducted in accordance with:

• Regulation (EU) 2016/679 (GDPR)
• Greek Law 4624/2019
• Greek Law 3471/2006
• Guidelines issued by the EDPB and the Hellenic Data Protection Authority

2. Data Protection Officer (DPO)

The Company has appointed an external Data Protection Officer (DPO). For any matter relating to the processing of your personal data, you may contact the DPO at dpo@isaudit.eu.

3. Definitions

For the purposes of this Policy, the definitions of Article 4 GDPR apply, including:

• Personal Data
• Processing
• Data Subject
• Processor
• Third Party
• Consent

4. Categories of Data Processed

We may process the following categories of personal data:

• Identification data: name, surname.
• Contact data: email address, telephone number.
• Technical data: IP address, device type, browser type, server logs.
• Consent data: consent ID, timestamp, cookie preferences.
• Newsletter data: email address, open-rate statistics.

The Company does not seek to collect special categories of personal data (Article 9 GDPR).

5. Principles of Processing

Processing is carried out in accordance with Article 5 GDPR:

• Lawfulness
• Transparency
• Purpose limitation
• Data minimisation
• Accuracy
• Storage limitation
• Integrity and confidentiality
• Accountability

6. Purposes and Legal Bases

• Website operation: Article 6(1)(f) GDPR (legitimate interest in ensuring secure and technically sound operation).
• Contact form: Article 6(1)(b) or Article 6(1)(f) GDPR.
• Analytics and marketing cookies: Article 6(1)(a) GDPR in conjunction with Greek Law 3471/2006.

7. Cookies and Consent (Usercentrics)

The website uses a consent management platform.

• The consent ID is recorded
• Proof of consent is documented (Article 7 GDPR)
• Users may modify their choices at any time

8. Processors (Article 28 GDPR)

The Company cooperates with:

• Google Ireland Ltd (Analytics)
• Usercentrics GmbH (Consent Management)

9. Joint Controllers (Article 26 GDPR)

In cases involving social media plugins or page insights, joint controllership may arise with:

• Meta Platforms Ireland Ltd
• LinkedIn Ireland
• Google Ireland Ltd

10. International Transfers

Where data is transferred outside the EU:

• Standard Contractual Clauses (SCCs) are applied
• A Transfer Impact Assessment is conducted
• Additional technical safeguards are implemented

11. Retention Periods

• Server logs: up to 7 days
• Newsletter data: until consent is withdrawn
• Consent records: 3 years (accountability documentation)

12. Security Measures (Article 32 GDPR)

The Company implements:

• Encryption
• Firewall protection
• Access limitation
• Password management policies
• Regular backups

13. Personal Data Breach

In the event of a breach:

• Notification to the Hellenic DPA within 72 hours (Article 33 GDPR)
• Notification to data subjects where required (Article 34 GDPR)

14. Rights of Data Subjects

Under Articles 15 to 22 GDPR, you have the right to:

• Access
• Rectification
• Erasure
• Restriction
• Portability
• Objection
• Withdrawal of consent
• Not to be subject to automated decision-making

Requests may be submitted to dpo@isaudit.eu. Responses are provided within one month.

15. Supervisory Authority

Hellenic Data Protection Authority
Website: www.dpa.gr

You have the right to lodge a complaint under Article 77 GDPR.

16. Judicial Remedies

Articles 79 and 82 GDPR apply. You may seek compensation for material or non-material damage.

17. Updates

This Policy may be amended. Last updated: August 2026.