Skip to main content

Consent to the processing of personal data in accordance with EU Regulation 679/2016 (article 7) and Law 4624/2019

I hereby declare that I expressly, freely, specifically and in full knowledge of the processing of my personal data by EPAFOS INFORMATION SYSTEMS SM SA (hereinafter referred to as the Company), in accordance with Regulation 679/2016 EU and Law 4624/2019. My consent is freely revocable and I can revoke it at any time, however, its subsequent revocation does not affect the legality of its receipt in relation to this declaration.

The Company is located at 46-48 Eleftheriou Venizelou Avenue in Kallithea, Attica and its main activity is the production of software, development of systems for education etc.

The contact details of the person responsible for the protection of personal data of the Company are the following

The Company stores and processes the following personal data: name, surname, telephone number, e-mail.

Throughout the time that the Company holds and processes your personal data, you have the following rights:

  • Right to be informed about your personal data after contacting the controller (Articles 13-14 of the Regulation)
  • Right of access to your personal data (Article 15 of the Regulation)
  • Right to rectification of your personal data that we hold if it is incorrectly recorded or needs to be completed (Articles 16, 19 of the Regulation)
  • Right to restrict the processing of your personal data (Article 18 of the Regulation): you can request that we do not process all your personal data that we hold.
  • Right to object to the processing of your personal data and automated decision-making, in particular "profiling" (Articles 21 and 22 of the Regulation)
  • Right to erasure of your personal data if it is no longer necessary ("Right to Oblivion") (Article 17 of the Regulation)
  • Right to transfer your personal data held by the Company (Article 20 of the Regulation)

Your personal data will never and under no circumstances be transmitted to third parties who do not have any employment contract with the Company and do not cooperate with it.

Cookie Policy

Information about the Cookies Policy

Find out here and get all the relevant information about the Cookies Policy.

This cookie policy explains what cookies are and how we use them on our website www.epafos.gr. We recommend that you take some time and read the policy so that you can understand the types of Cookies we use, how they work, the information we collect through Cookies and how this information is used.

What are Cookies?

"Cookies" are small files with information that a website stores on a user's terminal device (e.g. computer, tablet, mobile phone, etc.) (usually in the web browser such as Chrome, Opera, Mozilla Firefox, Edge, etc), so that each time the user logs on to the website, the latter retrieves this information and offers the user relevant services. A typical example of such information is the user's preferences on a website, as indicated by the choices the user makes on that website (e.g., selecting certain "buttons", searches, advertisements, etc.).

Information on Cookies Management

Upon entering our website www.epafos.gr, you can manage your cookie preferences by selecting which cookies will be enabled or disabled during your visits to our website, via the Cookie banner displayed at the bottom of the webpage screen.

Our website uses technically necessary Cookies for its proper and efficient operation. The use of these necessary Cookies does not require the user’s consent. You can continue your visit with only the necessary cookies by clicking the DO NOT ACCEPT button on the Cookie banner.

If you wish to consent to the use of Cookies that belong to other categories (Preferences, Statistics, and Marketing), you can declare your choices in the Cookies banner displayed at the bottom of our webpage screen. After selecting the categories of Cookies you prefer, click on the ACCEPT SELECTED button to save your choices and continue your visit.

You can modify your cookie preferences at any time (except for technically necessary Cookies). Management of your Cookie preferences can be done through the Cookie banner, available upon entering our website, at the bottom of the webpage screen or at the end of the current text.

How to control cookies

You can configure your web browser to warn you about the use of cookies and to refuse to accept them in any case. In this case, some services and functions may not work.

You can also delete all cookies already on your device by clearing your browser's browsing history. This way, all cookies from all websites you have visited using that browser will be deleted. However, keep in mind that some saved information (e.g., saved login details, website preferences) might be lost.

Additionally, you can prevent Google from collecting data through cookies and subsequent data processing by downloading and installing the browser add-on from the following address: http://tools.google.com/dlpage/gaoptout.

To manage and disable cookies, you can follow the relevant instructions for each type of browser:

The following pages provide instructions for setting cookies in the most popular web browsers:

Google Analytics

Our website uses the Google Analytics web analysis service.

Specifically, when you visit our website, if you have accepted the statistical cookies in the Cookie settings, Google Analytics records, among other things, your location, your searches, and data from websites that cooperate with Google. These are used to provide aggregated and anonymized information about user behaviors across devices, such as demographic information (gender, age group, interests expressed through your online activities).

If you have enabled Ad Personalization in your Google account settings, this data is collected and linked to your Google account. This way, Google can recognize, for example, if you view a product on the website via smartphone.

If you wish to disable this feature, you can do so through your Google account. For more information on how to adjust Google's advertising settings, please visit: https://support.google.com/ads/answer/2662856?hl=el.

Microsoft Clarity

Our website also uses the Microsoft Clarity web analysis service.

Microsoft Clarity is an analysis service we use to understand how you interact with our website. Through cookies and similar technologies, Microsoft Clarity collects information such as:

- Browsing behavior: which pages you go to, how long you stay, and how you move between them.
- Page interactions: clicks, scrolls, and mouse movements that help us understand what interests you most.
- Technical characteristics: information about your browser, device, and screen resolution to optimize your experience.

This data allows us to continuously improve our website, making it more user-friendly and functional.

It is important to note that Microsoft Clarity does not collect personally identifiable information. All data is anonymous and used solely for analysis purposes.

For more information on how Microsoft handles your data, you can visit Microsoft’s Privacy Policy.

We strive to be transparent about our practices and are committed to protecting your data. Informing you is part of this commitment, and we are always available for any questions or clarifications.

Depending on the purpose of service and functionality, we categorize cookies into various types, which are detailed by selecting the Cookies Settings link at the bottom of the page.

Special CCTV Statement

1. Data Controller

EPAFOS Single-Member S.A., 46-48 Eleftheriou Venizelou Avenue, 17676, Athens, Tel. 2106990401
Purpose and Legal Basis of Processing:
We use a surveillance system for the purpose of protecting individuals and property. The processing is necessary for the purposes of legitimate interests pursued by us as the data controller (Article 6, paragraph 1(f) of the GDPR).


2. Analysis of Vested Interests


Our vested interest lies in the need to protect our premises and the property located within them from illegal acts, such as theft. The same applies to the safety of life, physical integrity, health, and property of our staff and third parties lawfully present in the monitored area. We collect only image data and limit recording to areas evaluated as having a higher likelihood of illegal acts occurring, e.g., theft, such as entrances, without focusing on areas where individuals’ privacy might be excessively restricted, including their right to respect for personal data.


3. Recipients

The recorded material is accessible only to our authorized/appointed personnel responsible for site security. This material is not disclosed to third parties, except in the following cases:

  1. To competent judicial, prosecutorial, and police authorities when it contains elements necessary for investigating a criminal act involving persons or property of the data controller.
  2. To competent judicial, prosecutorial, and police authorities when they lawfully request data in the exercise of their duties.
  3. To the victim or perpetrator of a criminal act when the data may constitute evidence of the act.

4. Retention Period


We retain the data for thirteen (13) days, after which it is automatically deleted. In case an incident is detected within this period, we isolate a segment of the video and retain it for up to one (1) additional month to investigate the incident and initiate legal proceedings to defend our legitimate interests. If the incident involves a third party, we retain the video for up to three (3) additional months.


5. Rights of Data Subjects


Data subjects have the following rights:

  • Right of Access: You have the right to know whether we are processing your image and, if so, to receive a copy of it.
  • Right to Restriction: You have the right to request that we restrict processing, such as refraining from deleting data you deem necessary for the establishment, exercise, or defense of legal claims.
  • Right to Object: You have the right to object to the processing.
  • Right to Erasure: You have the right to request that we delete your data.

To exercise any of the above rights, you may contact the Data Protection Department at: [email protected].

If you wish to contact the Data Protection Officer, please email: [email protected], call 2106990401, or send a letter to our postal address, or submit your request in person. To process a request related to your image, you must specify approximately when you were within the cameras’ range and provide us with a photo of yourself to help identify your data and obscure the data of other individuals depicted. Alternatively, you can visit our premises to view the images in which you appear. Note that exercising the right to object or erasure does not entail the immediate deletion of data or modification of processing. In any case, we will provide a detailed response as soon as possible, within the GDPR deadlines.

6. Right to File a Complaint


If you believe that the processing of your data violates Regulation (EU) 2016/679, you have the right to file a complaint with a supervisory authority.
The competent supervisory authority in Greece is the Hellenic Data Protection Authority, 1-3 Kifisias Ave., 115 23, Athens, https://www.dpa.gr/, Tel. 2106475600

Written on July 31, 2023.
Last updated: May 24, 2024.
 

Procedure for Reporting Breach Incidents of the Code of Conduct & Ethical Behaviour

Our Company, following the policies and principles of the Quest Group is committed to fostering an entrepreneurial spirit of transparency and accountability. Therefore, it demands the highest possible level of professional and ethical conduct from all its employees and business partners. In order to establish the prevention of wrongdoing, unethical and unlawful behaviour/actions, we wish to ensure that if any of our employees or a third party has suspicions about the above issues regarding the operation of our Company, they have the opportunity to report it, while remaining anonymous if they so wish.


Submitted reports may be official (signed) or anonymous.

However, it is encouraged that the reporting persons submit official (signed) reports as this facilitates the necessary investigation and the adoption of the necessary measures.

You can report incidents involving violations of company Policies/Procedures and the applicable legislation (e.g. fraud, corruption, theft, embezzlement, non-compliance with the Quest Group's Code of Conduct & Ethical Behavior, data breaches and/or security incidents and any act or omission in general that may cause moral or material damage to Quest Holdings and its subsidiaries) using the following communication channels:

  • E-mail: [email protected]
  • By post: El. Velizelou 46-48 Ave., Kallithea (Attn: Group Compliance Officer, marked "Confidential").

More specifically, in cases of data breaches and security incidents, you can use the following communication channels:

  • Email: [email protected] (data breach)
  • Email: [email protected] (security incident)
  • By post:El. Velizelou 46-48 Ave. & Kanakidi and Kosmeridi 1, Kallithea, Athens Greece (Attn: Regulatory Compliance Officer, marked "Confidential") if there is a data breach or for the attention of the Group Information Security Officer if it relates to Information Security breach issues.

Frequently Asked Questions

It is noted that Quest Group has established clear rules and Policies that define, among others, which incidents constitute violations and what the procedure followed to monitor and manage them is.

You can find a summary of the Whistleblowing Policy – Incident Reporting here.

It is noted that Quest Group has established clear rules and Policies that define, among others, which incidents constitute violations and what the procedure followed to monitor and manage them is. If you want to know more about the processing of your personal data and your rights, please refer to the Specific Privacy Notice of Incident Reporting which you can find here

Electronic Breach Incident Report Form

Special Confidentiality Statement - Whistleblowing

INFORMATION REGARDING THE PROCESSING OF PERSONAL DATA
WITHIN THE FRAMEWORK OF INCIDENT REPORTING CHANNELS

Who is responsible for the processing of personal data?

EPAFOS SA, located at 46-48 Eleftheriou Venizelou Avenue, is the data controller for the personal data (hereinafter referred to as Data) collected through existing incident reporting channels, in accordance with current legislation on personal data.

What is the purpose of collecting and processing your Data?

EPAFOS SA has implemented reporting channels to prevent, detect, and investigate irregular, unethical, illegal, or punishable behaviors within the Company. Reports or complaints of irregularities, negligence, or punishable acts may include, but are not limited to, the following:

  • Theft
  • Fraud
  • Corruption
  • Bribery (offer/acceptance)
  • Violation of human rights (diversity, discrimination based on gender, religion, nationality, etc.)
  • Misuse of proprietary information
  • Acts endangering the health and safety of employees
  • Acts harmful to the environment
  • Acts that may lead to a violation of competition laws
  • Acts conflicting with the interests of the Company and/or the Group
  • Violation of Company Policies and Procedures, risking financial loss
  • Violation of the legal framework governing the Company and its Group companies (including legislation protecting individuals reporting violations of EU law)
  • Other unethical or inappropriate behavior (acts that violate the ethical and moral standards of the Group)
  • Incidents of violence and harassment
  • Incidents of personal data breaches
  • Incidents of information security breaches

Please note that the above list is not exhaustive but is intended to explain the indicative nature of the issues.

If any of the aforementioned actions are subject to legal proceedings, as stipulated by national legislation, the Management of the Company or the respective company within the Group will promptly submit the complaint to the competent Service/Authority for further investigation.

What sources are used to collect the Data

The Company receives the Data submitted in the following ways:

  • Via email at the address: [email protected]. In the case of an anonymous report/whistleblowing, it is recommended to use a non-corporate email for submitting the report (e.g., gmail).
  • Through the Company's website: https://www.epafos.gr/en
  • Via email for cases of personal data breach at the address: [email protected]
  • Via email for cases of information security breach at the email address: [email protected]
  • By mail to the address of EPAFOS S.A., attention to the Regulatory Compliance Group Manager, marked as "Confidential" or if it concerns a personal data breach, attention to the Data Protection Officer, or if it concerns information security breach, attention to the Information Security Officer of the Company.

Additionally, the company may receive data through reports transmitted by its subsidiary companies. This is applicable when a report raises issues of public interest or directly/indirectly concerns the company. During the investigation of a report, the company may collect further data through interviews with involved parties and from other sources, in accordance with its internal policies and procedures.

What data does the company process?

In order to verify the validity of a specific report or whistleblowing and conduct further investigations into the reported incident, the company voluntarily processes the data submitted by the reporters. This data includes, but is not limited to:

  1. Detailed information about the events that raised suspicion or concern, including names, dates, documents, and locations.
  2. The underlying reasons that led to the submission of the report or whistleblowing.

It is important to note that the purpose of the report or whistleblowing is not to prove the concerns or suspicions of the reporter. However, we strongly encourage reporters to provide all available information to facilitate a thorough investigation of the case.

We would like to emphasize that our company provides established reporting channels that allow reporters to submit their reports either anonymously or with their identity disclosed. It is essential that all reports are made in good faith. We are fully committed to protecting reporters from any form of discrimination or adverse treatment, including targeting or actions that aim to punish them. This includes adverse professional movements, transfers, or termination of employment. It is important to highlight that no sanctions or consequences will be imposed on individuals whose reports are not proven to be malicious after a thorough examination.

Who has access to the data?

Access to the data contained in the reports, for the purpose of examination or management, is strictly limited to individuals involved in the management and investigation of the respective incident, and only to the extent necessary.

Specifically, the disclosure of data included in the reports is done on a case-by-case basis, depending on the nature of the incident, and always in accordance with the relevant policies and procedures. This includes members of the Company's Reports Assessment Committee (in cases involving violence/harassment), the Regulatory Compliance Officer (responsible for receiving and monitoring reports), the Head of Internal Audit (responsible for report management/examination), the Data Protection Officer, the Audit Committee, the Board of Directors, external consultants bound by confidentiality agreements, lawyers, as well as judicial and/or administrative authorities.

Furthermore, the data included in the reports or whistleblowing is shared with the individuals mentioned in the report or whistleblowing, witnesses, and any other parties with a legitimate interest. However, when granting access to the data to the individuals mentioned in the report or whistleblowing, the personal details of the complainant and witnesses are redacted, unless explicit consent has been given, or unless it has been proven that the report or whistleblowing was made with malicious intent. 

Those individuals who are mentioned or involved in the investigation process of the report will be duly informed about the report's content, their related rights, and how they can exercise those rights, in accordance with the applicable framework. However, the provision of information will be evaluated on a case-by-case basis, as there may be situations where disclosing such information could, for instance: a) hinder the investigation and impede the assessment of the report, as well as the collection of necessary information and evidence; b) directly or indirectly reveal the identities of the reporters; c) disclose confidential information that, due to its nature and particularly the Company's overriding legal interests, must remain confidential; or d) obstruct the establishment, exercise, or support of the Company's legal claims and/or any criminal proceedings. If those mentioned in the report or whistleblowing are not promptly informed about its content to prevent actions that could obstruct the investigation, the reasons for the delay must be documented in writing, and the document must be recorded in the case file.

Are the data received by the whistleblowing management team disclosed to third parties?

The data and information received by the whistleblowing management team are not disclosed to any other individuals or teams within the Company or its affiliated companies, unless it is absolutely necessary for further investigation of the complaint. In such cases, disclosure is limited to individuals who possess the required knowledge.

How long are the data contained in a report/whistleblowing kept?

The Company retains the data for a specific period following the completion of the investigation, which varies depending on the findings. Here are the specific guidelines:

  • If a report is deemed unfounded, abusive, or lacks substantial evidence of a violation, the data will be deleted within six (6) months from their inclusion in the file.
  • If a report/whistleblowing proceeds through legal channels, the data will be deleted upon the issuance of an irrevocable judicial decision.
  • If a report/whistleblowing provides documented evidence against an employee/executive of the Company or its affiliated companies, the data will be retained for the duration of their employment/relationship and deleted twenty (20) years after any termination or resolution of the collaboration.
  • If a report/whistleblowing yields documented findings against a third party (e.g., customer, supplier, external collaborator) of the Company or its affiliated companies, the data will be retained for the duration of the collaboration and deleted five (5) years after any termination or resolution of the collaboration.

In all cases, the Company adheres to its relevant policies regarding the retention and deletion of personal data.

What technical and organizational measures does the Company implement for data protection?

The Company implements necessary technical and organizational measures to ensure a certain level of security that aligns with the risks associated with data processing and takes into account the nature of the processed data. These measures are in accordance with the Company's applicable policies and procedures regarding data processing and information security. They encompass various aspects such as access control based on need-to-know, commitment of personnel with access to maintain confidentiality, control of access rights, utilization of encryption, supervision of equipment and information technology services in full compliance with current legislation, and more.

Where can I find more information?

For further details regarding the processing of your data and your rights, please refer to the Privacy Statement available at the following link: https://www.epafos.gr/en/privacy-policy. Additionally, you can consult the Reporting-Whistleblowing Management Policy or reach out to the Data Protection Officer (DPO) via email at [email protected].

Company Policy

EPAFOS IT Systems S.M. S.A. is committed to the evolution and continuous improvement of our services. Our goal is to establish long-lasting and sustainable relationships with our customers by providing high-level services that are completely adapted to their needs. We prioritize the health, safety, and well-being of our employees and partners, and we are constantly striving to minimize the impact of our actions on the environment. We are committed to monitoring applicable legislation and ensuring our full compliance with it.

In order to successfully reach our objectives, we have implemented our Company's Integrated Management System. This system adheres to the strict guidelines set forth by the ISO 45001:2018, 9001:2015, 14001:2015, 27001:2013, and 22301:2019 standards.

Every day, our customers are asked to evaluate the quality of our services. Our policy is a reflection of our primary objective, which is to stay up-to-date with the latest advancements and meet market demands effectively.

Our philosophy of service provision is achieved through the following methods:

Application of all the rules and procedures provided by the legislation for the health and safety of projects and the protection of the environment.

Implementation and compliance with the client's additional health and safety rules and procedures.

Full compliance at all times with the applicable Legislation and in particular with what is determined by the General Data Protection Regulation (EU) 2016/679 (GDPR) for the protection of personal data. The company is constantly improving its existing practices in order to fully meet the obligations deriving from these provisions.

Developing direct and flexible communication with our customers in order to recognize their different needs and expectations and focus on their satisfaction by always providing them with personalized solutions in order to fully meet their requirements.

Continuous information and training of all personnel and partners involved in the company's operations, encouraging them to actively participate in the goal of improving quality.

Search and identify for any potential risks that may pose a threat to the health and safety of all personnel involved and implement appropriate measures to avoid or minimize their impact.

Protection of both employees and the community in which the company operates, by implementing sacure technologies and operating procedures.

Respecting the environment and conservating natural resources by adopting sustainable practices such as reusing and recycling materials, sourcing recycled materials, and using recyclable packaging and other materials

Providing the necessary resources for the smooth, effective and efficient operation of each department of the company.

Continuous monitoring the effectiveness of our company's policies at all levels, constant search and adoption of new methods to enhance the quality of our services, ensuring safety and occupational health in our work environment and improving the environmental management system we implement.

It is imperative that all staff and partners of our company adhere to the regulations outlined in this text. 

Ensuring high quality, promoting environmental awareness, and prioritizing occupational health and safety are the collective responsibilities of every member of EPAFOS IT Systems S.M. S.A.. This includes management, staff, and partners. The daily actions of each individual contribute to the continuous improvement of our products, services, and overall company image.

For the Administration,
CHRISTOS CHALDAIOPOULOS

SAFETY AND HEALTH POLICY STATEMENT

EPAFOS IT Systems S.M. S.A. is committed to providing a safe and healthy working environment for its valued staff. We take proactive measures to effectively manage and continuously improve our safety and health protocols, with the ultimate goal of minimizing or eliminating potential risks. Our dedication to maintaining a healthy workplace is unwavering, and we strive to ensure that our employees feel secure and supported at all times.

Ensuring the safety and well-being of our staff, partners, and third parties is a fundamental aspect of our organization. We prioritize accident and disease prevention in all of our activities, from the highest levels of management to the day-to-day operations.

The management of the company is committed to:

  • ensuring Health and Safety,
  • management of any possible change in view of the Safety and Health of the workers,
  • complying with all laws and regulations in the workplace,
  • proviede the required resources and logistical infrastructure so that the Safety, Health and Well-being of our staff, partners, and third parties are in line with the highest standards,
  • prioritize the continuous training of our staff in both general and specific safety and health matters,
  •  investigate all incidents, regardless of their frequency or severity,
  • monitor, document, and evaluate safety and health at work, and review our policies to ensure that we are always improving our safety standards.

For all of the above, EPAFOS implements a Safety and Health Management System that adheres to the ISO 45001:2018 standard. This system is applied by all staff members independently to ensure a safe working environment.

On behalf of the Administration, we are committed to upholding these principles of health and safety in the workplace.

QUALITY POLICY STATEMENT

At EPAFOS, we prioritize the satisfaction of our customers by providing them with personalized, high-quality solutions. To achieve this, we have established an integrated Quality Management System that adheres to the ISO 9001:2015 standard. Our commitment is to consistently deliver services of a known and constant quality, while continuously improving our processes across all tasks we undertake. 

For EPAFOS, the concept of quality includes the following:

  • Focusing on meeting the needs and expectations of our customers.
  • Providing services characterized by high quality, reliability and security to the user.
  • Commercial policy to maintain competitive prices.
  • Quick response to service delivery requests.
  • Honesty, clarity and reliability in communication and cooperation with customers.
  • Compliance with laws and regulations.

This quality policy is reviewed and checked for its continued suitability, and is communicated to all executives of our Company.

ENVIROMENTAL POLICY

EPAFOS IT Systems S.M. S.A. Company is committed to sustainable development. We recognize the importance of using natural resources in a responsible manner to minimize negative impacts on the environment. To achieve this goal, we have developed and implemented an Environmental Management System that adheres to the ISO 14001:2015 standard.

In our Company:

  • We are committed to upholding Environmental Legislation and meeting the requirements set forth by the competent authority.
  • Our staff is an integral part of this commitment, and we encourage them to contribute creatively to our efforts. We provide ongoing training to ensure that our team is equipped with the knowledge and skills necessary to maintain our high standards.
  • We are also selective in our choice of suppliers, evaluating their environmental awareness before making any decisions. This ensures that we work with partners who share our values and commitment to sustainability.
  • Our Environmental Management system is applied throughout all aspects of our operations.
  • We are constantly seeking ways to improve our prevention and emergency response procedures.

None of this would be possible without the dedication and sense of responsibility demonstrated by our team. They are the driving force behind our success, and we are grateful for their support in implementing our Environmental Management system on a daily basis.

This policy is reviewed and checked for its continued suitability, and is communicated to all executives of our Company.

INFORMATION SECURITY MANAGEMENT POLICY STATEMENT

At EPAFOS, we recognize the critical importance of information security. That's why we have implemented a management system that adheres to the ISO 27001:2013 Standard for information security management. Our system fully covers all requirements outlined in the Standard.

Our policy regarding information security management is as follows:

  • We are committed to complying with all applicable laws, regulations, and contractual obligations.
  • We prioritize the confidentiality, integrity, and availability of the data and information we manage.
  • We ensure that only authorized personnel have access to our information resources.
  • We ensure that only authorized personnel have access to our information resources.
  • We have established and implemented a business continuity plan to ensure the availability of information and communication systems even in the event of a major security incident.
  • We provide information security training to all EPAFOS employees to minimize the risk of security incidents.
  • We require our partners and suppliers to comply with our information security needs and requirements.
  •  We have established systematic controls to assess the implementation, adequacy, and effectiveness of our information security system. 
  • We investigate all security incidents and alleged weaknesses with competent staff.
  • We hold EPAFOS management directly responsible for implementing this policy and ensuring compliance among all staff in their areas of responsibility. Any deviations from this policy could result in legal and financial consequences for both the individual and the company.

At EPAFOS, we are fully committed to upholding all legal and regulatory requirements, as well as contractual obligations to our customers, in matters of information security and personal data protection related to our activities.

We understand that the information security system is dynamic and goes beyond the necessary technological infrastructure. It requires the active participation of all personnel within our Company.

To ensure that we maintain the highest standards of information security and personal data protection, we regularly review and check our policies for continued suitability. We also communicate these policies to all executives within our Company.

BUSINESS CONTINUITY POLICY STATEMENT

At EPAFOS IT Systems S.M. S.A. we understand the potential risks that could disrupt our operations and systems. To ensure the continuity of our critical activities, we have implemented a Business Continuity Management System in accordance with the international standard ISO 22301:2019, in order to:

  • Ensure the uninterrupted operation of our facilities, even in the event of an incident that renders them unavailable or inaccessible.
  • Restore our operations to acceptable levels as quickly as possible.
  • Minimize the impact of any interruptions on our reputation and the trust of our customers.

The Company has adopted strategic contingencies in accordance with the Standard to ensure the safety of personnel and protect the reputation of the organization. These measures are combined with the continuous and reliable provision of services for stakeholders, while maintaining contractual and legal compliance with regulations.

To achieve these objectives, the Company has implemented a Business Continuity Management System that adheres to policies, procedures, and related Business Continuity plans. The system aims to:

  • safeguard the health and safety of staff and protect the image and reputation of the Company
  • ensure the continuity of activities that generate value
  • ensure the Company's ability to provide its services and products without interruption.
  • establish systematic methods for the design and evaluation of the Company's Business Continuity requirements
  • establish the development of recovery strategies and applicable Business Continuity incident response plans, are integral components of the system.

The Company's Management is committed to complying with applicable requirements and continuously improving the adequacy, suitability, and effectiveness of the Business Continuity Management System.

This policy is regularly reviewed and checked for its continued suitability and communicated to all executives of the Company.

Shipping Policy

Our products are shipped free of charge by courier company, unless otherwise stated on the product page.

For products classified as "readily available", the delivery time is estimated at a maximum of 5 working days.

For any questions or clarifications you can contact us or call us at 210-6990401.