Candidate privacy notice

Version 1.1·Published 28/10/2026

CANDIDATE PERSONAL DATA PROTECTION NOTICE

Thank you for your interest in working with Accepted Ltd.

Please read this Notice carefully, in order to be informed about how the company under the name “Accepted Ltd.” (ACCEPTED Συστήματα Πληροφορικής ΕΠΕ), located in Greece, 2A Elpidos Str., Agia Paraskevi 15343, Athens, VAT number 999449971 (hereinafter referred to as “the company”, “Accepted Ltd.”, “we”, “our” or “us”), collects and processes your personal data when you apply for a job position through our careers website careers.accepted.gr, when you submit your CV to us, or when you participate in a recruitment process of the company (hereinafter referred to as “the Notice”).

By submitting a job application through the electronic application form, you confirm that you have been previously informed about the processing of your personal data by Accepted Ltd. in accordance with this Notice.

INTRODUCTION

Accepted Ltd. is committed to collecting and processing your personal data in accordance with the EU General Data Protection Regulation (EU) 2016/679 (hereinafter “GDPR”), the Greek law 4624/2019 and any other applicable legislation.

Personal data means any information that refers to natural persons (“data subjects”) whose identity is known or can be ascertained (hereinafter referred to as “data” or “personal data”). A personal data controller is the natural or legal person, public authority, agency or other body which determines the purposes and means of the processing of personal data. Accepted Ltd. is the controller of the personal data described in this Notice.

PRINCIPLES OF DATA PROCESSING

Personal data shall be:

  1. processed lawfully, fairly and in a transparent manner in relation to the data subject;

  2. processed for specified, explicit and legitimate purposes;

  3. adequate, relevant and limited to what is necessary in relation to the purposes that we have set;

  4. accurate and kept up to date;

  5. kept for no longer than necessary in relation to the purposes for which they are collected, and in accordance with the applicable data protection legislation.

HOW WE COLLECT YOUR PERSONAL DATA

  • Directly from you: when you fill out the electronic application form on our careers website and attach your CV, when you send us your CV by any other means, and through any communication that may be required to assess your skills in order to be selected for a job position (e.g. phone calls, emails, interviews).

  • From publicly available professional sources: where one of our recruiters contacts you first, for example after finding your public professional profile on a professional networking platform. In this case we process the data collected from that source in accordance with this Notice.

  • From technical assessment providers: where you are invited to complete a technical assessment, we receive its results.

WHICH PERSONAL DATA WE COLLECT

We collect and process:

  • your first name, last name and email address, which are required in order to submit an application;

  • your CV and all the information included in it, such as identity details, contact details, education, employment history, references, additional abilities and skills, and employment preferences (e.g. desired position, type of employment relationship);

  • the information you optionally enter in our electronic application form: phone number, LinkedIn profile, location, expected salary, and your message to us;

  • the job position you applied for and the channel through which you found it (e.g. our website, LinkedIn);

  • notes from our communications and interviews with you, the results of any technical assessments, and our correspondence with you;

  • your choice regarding the retention of your profile for future job opportunities, and the version of this Notice that was presented to you when you submitted your application.

We do not ask for information about your current or previous salary.

Important note: You are responsible for providing accurate and truthful information. The information you provide should not relate to criminal convictions and offences, nor to special categories of personal data (such as information on racial or ethnic origin, political views, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation), nor contain data related to third (natural) persons, except after their express authorization.

PURPOSE OF THE PROCESSING

The purpose of the data collection/processing is:

  • to assess your qualifications and competencies in order to be selected for the job position you applied for, or for any other job position within the company for which you are deemed to have the required qualifications, including positions involving work on projects of our clients;

  • to contact you in order to request additional information or to arrange an interview appointment;

  • to propose you, with your prior agreement, to a specific client of the company for a specific position;

  • where you have given your consent, to retain your profile and contact you about future job opportunities;

  • to organise, summarise and search applications efficiently, including with the use of software tools that incorporate artificial intelligence, as described below;

  • to comply with our legal obligations and to establish, exercise or defend our legal rights.

LEGAL BASIS FOR PROCESSING

The legal basis for the aforementioned processing is:

  • Taking steps at your request prior to entering into a contract (article 6(1)(b) GDPR): for the assessment of your application for the position you applied for and for other positions within the company, for communicating with you, and for proposing you to a specific client after you have agreed to it.

  • Your consent (article 6(1)(a) GDPR): for retaining your profile for future job opportunities, where you have provided it by ticking the relevant optional box in the application form. You may withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

  • The legitimate interests of the company (article 6(1)(f) GDPR): for the efficient organisation, summarisation and search of applications with the use of software tools, including artificial intelligence, and for the establishment, exercise or defence of legal claims. The company always balances your rights and interests in the protection of your personal data against its own interests.

  • Compliance with a legal obligation to which Accepted Ltd. is subject (article 6(1)(c) GDPR).

AUTOMATED PROCESSING AND USE OF ARTIFICIAL INTELLIGENCE

The company uses software tools, including artificial intelligence, to produce summaries of CVs and to help its recruiters search and organise applications. These tools support the work of our recruiters and do not replace it. Every decision regarding your application is taken by a person. The company does not take decisions concerning you based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you. You have the right to object to this processing at any time, as described in the section “YOUR RIGHTS”.

PROVISION OF PERSONAL DATA

The provision of your first name, last name, email address and CV is necessary for the assessment of your application. Without them we are unable to process your application. The provision of any other information is optional.

RECIPIENTS OF PERSONAL DATA

For the data necessary for the fulfilment of each of the above processing purposes, and within the scope of each recipient’s responsibilities, the recipients of your data may be:

  1. The competent employees of the company who are specifically responsible for recruitment, within the exercise of their duties.

  2. Clients of the company, only in relation to a specific job position and only after you have been informed of the client and the position and have agreed to be proposed.

  3. Service providers who process personal data on behalf of the company (processors), who are contractually bound by confidentiality and data protection obligations, namely:

    • Railway Corporation: application hosting and database services, with data stored in the European Union;

    • Cloudflare, Inc.: storage of CV files, with data stored in the European Union;

    • Backblaze, Inc.: backup storage, with data stored in the European Union;

    • Google LLC: email, calendar and contact services used by our recruiters;

    • Postmark (ActiveCampaign, LLC): delivery of system emails, such as the confirmation of your application;

    • Anthropic, PBC: artificial intelligence processing used for CV summaries and search;

    • HackerRank: technical assessments, where you are invited to one.

  4. Public authorities (such as tax, judicial, public and independent authorities), where such transfer of or access to data is strictly necessary for the defence of legal rights or the fulfilment of the company’s legal obligations.

In any case, the company protects the confidentiality of your data and does not transfer it to any third party (person or legal entity) other than those mentioned above. The company does not sell your personal data.

It should be noted that when storing, accessing and/or processing your personal data, the employees and partners of the company fully comply with the relevant provisions of the GDPR and the rest of the applicable legislation on the protection of personal data.

INTERNATIONAL TRANSFERS

Some of the above service providers are established in the United States of America, or may process personal data there. Where your personal data is transferred to a third country, the company ensures appropriate safeguards for the protection of your data, in particular the EU–US Data Privacy Framework for providers certified under it, or otherwise the Standard Contractual Clauses adopted by the European Commission, so as to ensure an adequate level of protection and the lawfulness of the processing.

RETENTION PERIOD

Your data is stored strictly for the period considered necessary for the processing purposes. Specifically:

  • If you have not consented to the retention of your profile for future job opportunities, your personal data will be deleted six (6) months after the completion of the recruitment process in which you participated.

  • If you have consented, your personal data will be retained for twenty-four (24) months from the date of your consent. Before the end of this period, we will ask you whether you wish us to retain your profile for a further period. If you do not respond, your data will be deleted.

  • If you are hired by the company, your personal data will become part of your employee record and will be retained in accordance with the company’s rules on the processing of employees’ personal data.

  • Personal data may be retained for a longer period where this is necessary in order to comply with a legal obligation, or for the establishment, exercise or defence of legal claims, and only for as long as this is required.

Personal data that has been deleted is removed from the company’s backups as these expire in accordance with their regular retention cycle.

TECHNICAL AND ORGANISATIONAL MEASURES

Accepted Ltd., its processors and its employees implement appropriate technical and organisational security measures to protect personal data against unauthorised access, misuse, loss or destruction. Such measures include, but are not limited to, encryption of data in transit, secure server facilities, network security measures, appropriate access rights systems and procedures, an access control policy, due diligence in the selection of processors and their compliance with the GDPR, and other reasonable organisational and technical measures that provide adequate protection of personal data. All employees are bound by confidentiality and privacy clauses, and personal data is processed only by specially authorised personnel of the company.

These measures aim to ensure a level of security appropriate to the risk, taking into account the nature, scope, context and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, while applying procedures for the regular testing, monitoring and evaluation of their effectiveness.

YOUR RIGHTS

Under the GDPR, you have the following rights:

  • the right of access to your data;

  • the right to rectification of your data;

  • the right to erasure of your data;

  • the right to request restriction of processing;

  • the right to data portability;

  • the right to object to processing, including processing based on the legitimate interests of the company, such as the use of artificial intelligence tools described above;

  • the right to withdraw your consent at any time, where processing is based on consent;

always under the applicable GDPR terms and depending on the legal basis and the processing concerned.

To exercise any of the above rights, you may contact Accepted Ltd. via email at privacy@accepted.gr, or by post at the company’s address: 2A Elpidos Str., Agia Paraskevi 15343, Athens, Greece. We may ask you to provide proof of your identity. We will respond to your request without undue delay and in any case within one (1) month of its receipt. That period may be extended by two (2) further months where necessary, taking into account the complexity and number of the requests, in which case we will inform you of the extension.

If you consider that we do not comply with the personal data protection legislation, you have the right to lodge a complaint with the Hellenic Data Protection Authority (Kifisias 1-3, PC 115 23, Athens, Greece, phone number: +30 210 6475600). You can lodge your complaint by filling in the special electronic form on its online portal at https://www.dpa.gr/en/individuals/complaint-to-the-hellenic-dpa.

CHANGES TO THIS NOTICE

Accepted Ltd. may change this Notice. Each version of the Notice is identified by a version number and its publication date, shown at the top of this page. We keep a record of the version of this Notice that was presented to you when you submitted your application.

This Notice applies specifically to the processing of personal data of job applicants and candidates. For any matter not specifically regulated in this Notice, our general Personal Data Policy, which applies to all visitors and users of the website www.accepted.gr, also applies.