Basic Information
This section is intended to inform visitors to the website about the processing of their personal data both while browsing the website and in connection with the provision of DIAS S.A.’s services. Where the terms “DIAS”, “the Company” or similar are used below, they refer to INTERBANKING SYSTEMS S.A. (DIAS S.A.).
DIAS places particular importance on protecting the personal data it processes. The principal legislative sources governing the protection of personal data in Greece are Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”), Greek Law 4624/2019, and the opinions, instructions and guidelines issued by the competent European and national authorities, including the Hellenic Data Protection Authority and the European Data Protection Board.
This Privacy Notice is updated in accordance with the applicable regulatory framework and may be amended, within the limits permitted by law, without prior notice, solely by posting the updated version here. You are therefore encouraged to visit this section regularly. The last amendment was made in September 2026.
Corporate Identity of the Data Controller
The Company is INTERBANKING SYSTEMS S.A., with the distinctive title “DIAS S.A.”, having its registered office at 2 Alamanas Street, Marousi, Attica, postal code 15125, telephone +30 210 6171600, email info@dias.com.gr and General Commercial Registry number 000740401000.
DIAS’s Role in the Processing of Personal Data
Depending on the specific activity and the nature of each processing operation, DIAS may act either as Data Controller or as Data Processor, in accordance with the GDPR.
Where DIAS acts as Data Controller, it determines, in accordance with applicable law, the purposes and means of processing personal data and is responsible for ensuring compliance with the applicable data-protection requirements, including selecting and implementing the appropriate legal basis.
Where DIAS acts as Data Processor, it processes personal data on behalf of the relevant Data Controller and in accordance with the latter’s documented instructions, within the framework of its contractual and regulatory obligations. In such cases, DIAS does not independently determine the purposes of processing or the legal basis relied upon by the Data Controller.
For each processing activity, DIAS’s role is determined on the basis of the actual circumstances and the nature of the specific processing operation.
Personal Data Processed by DIAS as Data Controller
Personal data means any information relating to an identified or identifiable natural person.
DIAS lawfully retains and processes personal data collected while you browse its website, including:
· Personal (name, surname, gender, occupation) and contact details (email address, telephone number, personal address, postal code) voluntarily provided through the website’s contact form or other communication channels;
· The content of written communications with DIAS (including emails, postal letters, faxes and messages submitted through the contact form), which may contain additional personal data that you voluntarily provide to the Company through such communications;
· Personal Data including IP address data collected through cookies where your explicit and clear consent is required (Further information can be found in the Cookies Policy ).
· Professional and academic information and any information contained in a CV submitted when expressing an interest in cooperating with DIAS; and
· Personal data voluntarily provided through the “Join our team” section of the website.
Β. In relation to its partners and suppliers, DIAS may, in addition to the above categories of data, collect and process the following categories of personal data:
In relation to sole proprietorships / self-employed professionals:
· Personal data and unique identifiers (full name, Tax Identification Number, identity card details, telephone number, address, bank account details, IBAN, remuneration, etc.).
· Object data (vehicle registration number, vehicle brand).
· Image data (video), where they enter the Company’s premises (Closed-Circuit Television System – CCTV).
In relation to legal entities:
· Personal data and contact details of representatives, authorized persons, project managers and contact persons (full name, job title, telephone number, address).
· Object data (vehicle registration number, vehicle brand).
· Image data (video), where they enter the Company’s premises (Closed-Circuit Television System – CCTV).
Personal Data Processed by DIAS as Data Processor
In the ordinary course of its operations and for the purpose of executing interbank transactions on the instructions of contracting Payment Service Providers or other organisations, DIAS collects and processes, as Data Processor, personal data of their customers, which are either transmitted by those organisations or provided directly by the data subjects.
· Basic personal details (full name, address, date of birth, place of birth, email address, fax number, contact telephone number).
· Unique identifiers (Tax Identification Number, Social Security Number, Identity Card Number).
· Transaction data (debit/credit card number, payment reference, payment amount, date and time of payment, cheque number, IBAN/BBAN, issuing bank, receiving bank, indicator, time, status, number of transactions, beneficiary code, etc.).
· CCTV System – Video-Surveillance Data
The Company informs you that it has installed and operates video-surveillance systems in the common areas of its building and around its perimeter, which record and collect image data only. For compliance purposes, DIAS has carried out a Data Protection Impact Assessment concerning the operation of these systems and has placed information signs in every area where image data are recorded.
Video surveillance is carried out for the security and protection of the property of the Company, its employees, customers and suppliers, including assets and data held within its office building. It is also carried out to safeguard the performance of transactions and the life and physical integrity of employees and third parties lawfully present in the monitored area in the event of an emergency.
All cameras are monitored in real time, 24/7/365, by persons authorised by the Company, who have undertaken in writing to maintain the confidentiality of the information and comply with all obligations arising from applicable legislation.
There are no third-party recipients of your data other than authorised personnel or third-party contractors of the Company, to the extent necessary for the security of persons and assets, the operation of the CCTV system and the secure and smooth operation of the Company’s technical systems. Where required by law, access may also be granted to competent judicial, prosecutorial and police authorities. The recorded material is not transferred to third countries or international organisations.
Purposes and Lawfulness of Processing
DIAS processes personal data for specific, explicit and lawful purposes and only to the extent necessary to achieve them. Depending on the nature of the processing, processing is based on one or more of the legal bases set out in Article 6(1) GDPR.
More specifically, DIAS may process personal data for the following purposes:
Purpose category | Purpose of processing | Indicative categories of data | Legal basis |
1. Human Resources and Labor Relations Management | Management and support of the employment relationship, including the recruitment and integration of staff, the management of attendance, leaves and transfers, payroll, employee benefits and coverage, as well as the termination of the employment relationship. | Identification and contact details, employment and professional status details, attendance and leave details, financial and salary details, benefits details, marital status/dependents details, where required. | Performance of a contract (Article 6 par. 1(b) GDPR) – Compliance with a legal obligation (Art. 6 par. 1(c) GDPR), if applicable. |
2. Staffing, Training and Staff Development | Management of the selection and recruitment process of candidates, organization and monitoring of training programs, development of professional skills and evaluation of the work environment and human resources practices. | Identification and contact details, CV and professional data, image data, financial data (e.g. IBAN), education and professional experience, details of participation and completion of training, evaluation results, work environment evaluation data. | Performance of a contract – taking pre-contractual measures, for candidates (Article 6 par. 1(b) GDPR) – Legitimate interest of DIAS, for training, development and improvement of HR practices (Article 6 par. 1(f) GDPR), as the case may be. |
3. Management of Suppliers, Partners and Contractual Relationships | Selection, evaluation, registration and conclusion of contracts with suppliers and external partners, procurement management and monitoring of contractual cooperation and related costs. | Name and contact details of representatives/employees of suppliers and partners, professional details, contract details, financial, tax and invoice information. | Performance of a contract (Article 6 par. 1(b) GDPR) -- Legitimate interest of DIAS, in particular for the efficient management of supplies and cost control (Art. 6 par. 1(f) GDPR), as applicable. |
4. Corporate communication and operational information management | Ensuring smooth, efficient and secure corporate communication, the availability and proper management of business and non-operational information, as well as the archiving and management of corporate communications of documents and requests of natural persons. | Full name, business details, corporate email address, telephone number, call details, email data, communications metadata, IP addresses, log files, corporate communications content and attachments, as well as corporate documents and records details. | Legitimate interest of DIAS, in particular to ensure corporate communication, business continuity, security of communications and transactions and effective management of operational information (Article 6 par. 1(f) GDPR). |
5. Corporate Governance, Governance, Legal and Regulatory Compliance | Support of corporate administration and governance, operation and staffing of corporate bodies, evaluation and participation of Board members, prevention and management of conflicts of duties/interests, as well as ensuring the Company's compliance with the applicable legal, regulatory and corporate framework. | Identification and contact details, professional details, capacity and position, details of participation in corporate bodies, details of professional experience and suitability, data on conflicts of duties/interests and other data required for legal and sound corporate governance. | Legitimate interest of DIAS in establishing, exercising and supporting legal claims and defending against claims of third parties (Article 6 par. 1(f) GDPR),-- Compliance with a legal obligation (Art. 6 par. 1(c) GDPR), as the case may be |
6. Business Operation and Continuity, Information Systems, Communications and Security | Ensuring the smooth operation and business continuity of the Company, technical support of employees, management of information systems, creation of backups, management of corporate e-mail and telephony, protection of information and personal data, prevention and response to security incidents and control of the proper use of information systems. | Identification and business data of information system users, username and account details, corporate email and telephone number, IP addresses, logfiles, data of system and device usage, communications and file data, availability data, audio and video data, metadata, technical request and support data and, where required, corporate communications content. | Legitimate interest of DIAS in particular to ensure the smooth, safe and effective operation of its services, systems and infrastructure, to ensure the security of its persons, facilities, information systems, networks and infrastructure, to prevent, detect and investigate fraud, malicious actions, unauthorized access and security incidents (Article 6 par. 1(f) GDPR),-- Performance of a contract (Article 6 par. 1(b) GDPR), as the case may be. |
7. Security of Persons, Facilities, Records and Assets | Protection of people, facilities, equipment, archives and other assets of the Company, control of incoming and outgoing persons, operation of video surveillance systems, as well as secure keeping, archiving, registration and management of corporate records and documents. | Identification data, entry/exit data, visitor, employee and partner data, access data, image/CCTV data, vehicle data, document, document and company record data. | Legitimate interest of DIAS, in particular to ensure the security of its persons, facilities, information systems, networks and infrastructure (Article 6 par. 1(f) GDPR),-- Compliance with a legal obligation (Article 6 par. 1(c) GDPR), as the case may be |
The purposes and legal bases listed above are indicative. The applicable legal basis is determined by DIAS before each processing operation, taking into account the nature, purpose and actual circumstances of the processing.
Children’s Data
Within the framework and for the fulfilment of the purposes described above, DIAS does not manage children’s personal data. In any event, processing of children’s personal data may take place following consent from the person or persons exercising parental responsibility.
The website is intended for adults. If you are under 18 years of age, please do not provide your personal data to DIAS under any circumstances. If you believe that your personal data have been collected and processed by DIAS, please inform the person or persons exercising parental responsibility so that they may request their deletion and exercise your rights lawfully.
Disclosure of Personal Data to Third Parties
DIAS may disclose personal data it retains and processes to third parties in order to better achieve the purposes described above. These may include authorised employees, contractors, legal and financial advisers, suppliers, processors, data-storage companies and companies cooperating in the settlement and clearing of cross-border transactions. Disclosure takes place only for limited purposes and only where necessary for their proper fulfilment.
DIAS ensures that third parties process your personal data lawfully. Before disclosing personal data, DIAS enters into confidentiality agreements requiring third parties to adopt strong technical and organisational measures for the protection of the personal data they process.
DIAS may also provide personal data to judicial, prosecutorial, police, supervisory, tax or other public authorities following a relevant request or where necessary to comply with its legal obligations.
Transfers of Personal Data Outside the European Economic Area
Depending on its activities and the partners or service providers it uses, DIAS may transfer or make personal data accessible to recipients located outside the European Economic Area.
Any transfer to a third country or international organisation is carried out in accordance with Chapter V GDPR and only where the required level of protection is ensured.
Depending on the circumstances, transfers may be based on
· an adequacy decision of the European Commission,
· appropriate safeguards such as the European Commission’s Standard Contractual Clauses, or
· another lawful transfer mechanism provided by the GDPR.
Where required, DIAS adopts appropriate supplementary measures to safeguard personal data during transfers and considers the relevant requirements and guidelines of the European Data Protection Board.
Further information regarding the safeguards applied and, where provided for by the GDPR, a copy of the relevant safeguards may be requested from the Data Protection Officer at dpo@dias.com.gr.
Data Retention Period
DIAS retains personal data only for as long as necessary to fulfil the relevant processing purpose and, where required, for as long as imposed by applicable law or necessary for the establishment, exercise or defence of legal claims.
The retention period varies depending on the category of data, the purpose of processing and the applicable legal basis, and is determined in accordance with DIAS’s Personal Data Protection Policy.
After the applicable retention period has expired, data are deleted, destroyed or anonymised, as appropriate, unless further retention is required or permitted by law or is necessary for the establishment, exercise or defence of legal claims.
For further information regarding the retention periods applicable to specific categories of personal data, you may contact DIAS’s DPO.
Protection of Personal Data
DIAS has adopted appropriate technical and organisational measures to ensure the highest level of protection reasonably possible for the data it processes in accordance with the principles laid down by law. It has also developed and implements an integrated Information Security and Business Continuity Management System covering the requirements of PCI DSS, ISO 27001 and ISO 22301.
Your Rights
Every data subject whose personal data are processed by DIAS may contact the Company to exercise the following rights in accordance with the law. The Company must respond within 30 days of receipt. It may extend the response period by an additional 60 days, provided that it informs the data subject and states the reasons for the delay. Rights may be exercised by submitting the relevant request form provided below (electronically to email address dpo@dias.com.gr or by post to the Company’s registered office, for the attention of the Data Protection Officer), or by any other appropriate means.
Your rights are as follows and may be exercised in accordance with the procedures and limitations provided for by law:
· Right of access.
· Right of rectification and updating.
· Right to erasure (right to be forgotten).
· Right to restriction of processing.
· Right to data portability.
· Right to object.
· Right not to be subject to automated decision-making and profiling.
· Right to withdraw your consent, where consent constitutes the legal basis for the processing of your personal data.
More specifically, requests for access to CCTV image data must be submitted to DIAS in writing. To locate the relevant images and verify the identity of the data subject, DIAS may request additional information (such as the date and time of recording).
In addition, depending on the purpose of processing, the provision of personal data may be mandatory or optional.
Where the provision of specific personal data is required by applicable legislation or is necessary for the conclusion or performance of a contract, failure to provide such data may result in the relevant service not being provided, the contract not being concluded or performed, the relevant request not being processed, or DIAS being unable to fulfil its respective obligation.
Where the provision of personal data is optional, the data subject will be informed accordingly, and failure to provide such data will not affect the provision of services or the exercise of their rights, unless otherwise required by the nature of the specific processing activity.
DIAS does not collect more personal data than is necessary to achieve the specified processing purposes.
Automated Decision-Making and Profiling
DIAS does not make decisions producing legal effects or similarly significant effects on data subjects solely on the basis of automated processing, including profiling, within the meaning of Article 22 GDPR.
DIAS does not carry out profiling of data subjects for the purpose of making such decisions.
If, in the future, DIAS introduces automated decision-making or profiling falling within Article 22 GDPR, this Notice will be appropriately updated and data subjects will be informed in accordance with applicable law.
Personal Data Breach
DIAS makes every effort to process your personal data securely, prudently and lawfully. If you believe that your personal data may have been or have been breached, you may submit a complaint to the Company by email at dpo@dias.com.gr, by post to its registered office for the attention of the Data Protection Officer, or by any other appropriate means.
Irrespective of submitting a complaint to DIAS, you retain the right to lodge a complaint with the competent Hellenic Data Protection Authority at 1–3 Kifisias Street, postal code 115 23, Athens, telephone +30 210 6475600, email contact@dpa.gr, if you believe that the processing of your personal data violates the applicable national or regulatory data-protection framework.
Data Protection Officer
For any information concerning the processing of your personal data by DIAS and the exercise of your legal rights, you may contact the Data Protection Officer’s Office at:
Email: dpo@dias.com.gr
Telephone: +30 210 6171600
Address: 2 Alamanas Street, Marousi, postal code 15125, Greece
Disclaimer: This is an English translation of the official company text originally drafted in Greek, provided for informational purposes only. In the event of any discrepancy between the Greek and the English versions, the Greek version shall prevail.