Privacy Policy

This Privacy Policy (the “Policy”) is designed to inform you about how we collect, process and protect your personal data (“Data”) when you use our services through our website (“Services”).

Changan Hellas Single Member S.A. (“Changan Hellas”, “we”, “us” or “our”) operates the website https://www.avatr.com.gr and processes your Data in connection with the Services.

The processing of your Data is carried out in accordance with Regulation (EU) 2016/679 (“GDPR”), Greek Law 4624/2019, the Decisions, Guidelines and Opinions of the Hellenic Data Protection Authority (“HDPA”), as well as the applicable national and European data protection legislation in force from time to time.

When you use Changan Auto Vehicle Technologies and Services or the related Application (App), Changan Hellas, Changan authorised dealers and service partners process your Data in order to ensure the proper provision of services throughout Greece. Further information can be found in the relevant section of the Vehicle and App interfaces.

1. Who is responsible for your Data / Contact us

The data controller under the GDPR is:

Changan Hellas Single Member S.A.
31 Viltanioti Street, Kifisia, 14564, Athens, Greece
Email: gdpr@changan.com.gr

If you have any questions or concerns, you may contact the Data Protection Officer by email at: gdpr@changan.com.gr 

The information you provide when contacting us will be processed in order to handle your request and will be deleted once your request has been completed. Alternatively, we will restrict the processing of the relevant information in accordance with statutory retention requirements.

2. Categories of Data and purposes of processing

When you browse the Changan Hellas website, certain information, such as your IP address and access time, is transmitted in order for us to provide the Services, such as the latest updates for customer management in your area. At the same time, we also receive information about your device type, operating system, browser and screen resolution. We cannot use this data to identify you personally. This data is collected automatically and is used, pursuant to Article 6(1)(f) GDPR (legitimate interests), to provide the Services to you in the best possible way, improve our systems, make our websites more user-friendly and secure our websites. This data is stored for a limited period and is automatically deleted once the above purposes have been fulfilled.

You can find more information about our use of Cookies in our Cookie Policy.

We collect, process and use Data only if you provide it to us, for example by completing an online form, contacting us by email or for the performance of a contract. The extent of the Data we collect, process and use will vary depending on how you interact with us and use the Services.

If you do not provide your Data, certain features of our website may not be available or may be available with limited functionality. In particular, we collect, process and use Data when:

• You visit our Changan Hellas website and use its content or individual website features.
• You contact us through an online form or correspond directly with us for information about products or services. In particular, when you:
• Request a test drive with one of the Changan vehicles.
• Request a quotation for a Changan vehicle you have configured.
• Subscribe to our newsletter.

The types of Data you may provide may include your contact details, such as first name, last name, email address, mobile phone number, postal code and country.

3. Legal bases for processing your Data

We process your Data on the following legal bases and for the purposes described below:

• Your consent (Article 6(1)(a) GDPR), which you voluntarily provide by selecting the checkbox before submitting your request through online forms or by other means. You may withdraw your consent at any time. We rely on consent in particular to provide you with:
• customer service, e.g. enquiries about our products or Services through an online form, email, telephone call or contract form;
• promotional and marketing content, such as newsletters by email and/or personalised communications to keep you informed about the latest information regarding our products and Services.

• The performance of our contractual and pre-contractual obligations in connection with the provision of our Services or the ordering of Changan vehicles (Article 6(1)(b) GDPR), namely:
• processing test drive requests, such as checking availability and arranging appointments, and subsequent communication regarding test drives;
• providing customer service, such as responding to your requests by email or telephone;
• processing service, maintenance or warranty claims.

• Compliance with our legal obligations (Article 6(1)(c) GDPR)
  We process Data to the extent necessary to comply with legal obligations or to establish, exercise or defend legal claims, for example: to comply with business or tax filing obligations, disclosure pursuant to administrative or judicial orders, such as for the processing of traffic violations committed during test drives.

4. Disclosure of Data

We may need to disclose your Data to the following parties:

Changan Group. Depending on the Services you use, we may disclose your Data to other companies within the Changan Group.

Service providers. Data may be disclosed to third-party suppliers and service providers that perform services on our behalf, including postal and email services, fraud prevention services, web hosting, product delivery and traffic analytics.

Corporate transactions. If Changan Hellas undergoes changes to its corporate or business structure, such as a merger, acquisition, sale of assets or shares, restructuring or financing, your Data may be disclosed to the third parties involved.

Law enforcement. If required by law, or if we believe such action is necessary to comply with the law or reasonable requests from competent authorities, we may disclose your Data to third parties such as government agencies and judicial and/or other authorities.

5. International transfers of Data

Any transfer of your Data outside the European Union (EU) / European Economic Area (EEA) will only take place:

• to a recipient located in a country or territory for which the European Commission has issued an Adequacy Decision providing a level of data protection equivalent to the GDPR, an overview of which countries can be found here; and/or
• where no adequacy decision exists, subject to other safeguards, such as binding corporate rules, European Commission standard contractual clauses, certifications or approved codes of conduct.

You may contact the Data Protection Officer if you have any questions.

6. Google Analytics

We use Google Analytics, a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, California 94043, USA. For users in the EU and EEA, this service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics uses cookies and JavaScript code to collect and analyse pseudonymised usage data (such as page views, referral sources, browser and operating system details, IP address and device identifiers), as well as demographic data (e.g. country, city, age, gender, interests) and user interactions on our website (e.g. clicks, search terms and use of forms). This data helps us understand how visitors use our website and allows us to tailor content and advertising to better match users’ interests.

The collected data is used to generate aggregated statistics that do not allow us to identify individual users. We use this information to optimise our website and deliver targeted advertising campaigns, particularly through Google advertising services.

The processing of the data is based on your consent pursuant to Article 6(1)(a) GDPR. Your consent is voluntary and may be withdrawn at any time.

The data may be transferred to countries outside the EU/EEA, particularly the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, which ensures an adequate level of data protection. Where necessary, standard contractual clauses and additional safeguards are used to ensure compliance with EU data protection standards.

For more information about how Google handles your data, please visit: https://policies.google.com/privacy?hl=en.

7. Security, storage and retention of Data

We implement appropriate technical and organisational measures to protect the Data we manage. We take steps to prevent the accidental or unlawful destruction, loss, alteration or damage of Data.

We retain your Data only in accordance with the storage limitation principle, meaning for as long as its retention is necessary to fulfil the purposes for which we collected it, including the fulfilment of any legal, accounting or regulatory requirements.

We take into account the nature and sensitivity of the Data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process your Data and whether those purposes can be achieved by other means, as well as applicable legal requirements, in order to determine the appropriate retention period.

Data processed for marketing and direct communication purposes is stored from the time you give your consent until the time you withdraw it. Once you withdraw your consent, we will no longer use your Data for these purposes, although the Data may be retained if and to the extent that we have a legitimate interest or a legal obligation requiring further retention.

Data processed for the purposes of a contractual relationship, such as a test drive or the provision of a quotation, is stored for as long as necessary to fulfil any obligations arising from the contract with you, and if and to the extent that we have a legitimate interest or a legal obligation requiring further retention. After the end of the contractual relationship, your Data is generally retained for up to 10 years in order to comply with legal, accounting or regulatory requirements.

In certain cases, we may anonymise your Data (so that your identity is no longer identifiable) for research or statistical purposes, in which case we may use this information indefinitely.

With regard to the retention of log files, please note that for technical security reasons, and in particular to prevent attacks on our web server, such data is stored.

Under no circumstances is this data stored together with your other Data, linked to other databases or disclosed to third parties.

8. Newsletter / Communication

When you subscribe to our newsletter, we use the information required for this purpose, or any additional information you have separately provided to us, in order to send you our newsletter regularly by email, based on your consent pursuant to Article 6(1)(a) GDPR. You may unsubscribe from the newsletter at any time via a dedicated link provided in the newsletter. After unsubscribing, we delete your email address from the recipient list, unless you have expressly given further consent to the use of your data pursuant to Article 6(1)(a) GDPR, or unless we retain the right to further use the data as permitted by law and as described in this statement.

9. Social Media

We use social media platforms (TikTok, Facebook, Instagram, YouTube, LinkedIn) to communicate with our audience, share updates and promote our Services. Any information you choose to share with us through these platforms — such as through comments, messages or interaction with our content — may be publicly visible, depending on your privacy settings on those platforms. We encourage you to review the privacy policies of the social media platforms mentioned above, as we do not control how they collect, use or disclose your Data. Please note that your interactions with us on social media are also subject to the terms of use and privacy policies of those platforms.

10. Your rights

As a data subject, you have the following rights in relation to your Data, in accordance with the GDPR and Greek Law 4624/2019:

• Right of access. You have the right to obtain confirmation as to whether we process your Data (Article 15 GDPR). This information includes the purposes of the processing, the categories of personal data concerned, the categories of recipients to whom your data has been or will be disclosed, the envisaged retention period, the existence of the right to rectification, erasure, restriction of processing or objection, the existence of the right to lodge a complaint, the source of your data where it was not collected from you, as well as the existence of automated decision-making, including profiling, and, where applicable, meaningful information about the details of such processing.

You may obtain one copy of your personal Data free of charge. We reserve the right to charge you for additional copies.

• Right to rectification. You have the right to request the immediate correction/completion of inaccurate or incomplete personal data that we hold about you (Article 16 GDPR).
  
  
• Right to erasure (“right to be forgotten”). You have the right to request the deletion of your personal data under the conditions provided for in Article 17 GDPR, unless the processing is necessary for exercising the right of freedom of expression and information, compliance with a legal obligation, reasons of public interest, or the establishment, exercise or defence of legal claims.
  
  
• Right to restriction. You have the right to request restriction of the purposes for which we process the Data where one of the following cases under Article 18 GDPR applies: (a) you contest the accuracy of the Data, for the period enabling us to verify its accuracy; (b) the processing is unlawful, but you oppose the erasure of the Data and request restriction of its use instead; (c) we no longer need the Data for the purposes of processing, but you require it for the establishment, exercise or defence of legal claims; or (d) you have objected to processing pursuant to Article 21 GDPR, pending verification as to whether our legitimate grounds override yours.
  
  
• Right to data portability. Under certain circumstances, you have the right to receive a copy of the personal information you have provided to us in a structured, commonly used and machine-readable format, or to request the transfer of your personal information to another data controller (Article 20 GDPR).
  
  
• RIGHT TO OBJECT
  You have the right to object to the processing of your Data on grounds relating to your particular situation. In particular, you have the right to object if we do not need to process the Data in order to comply with a contractual or legal obligation, or if we use your Data for direct marketing purposes (Article 21 GDPR). This does not apply where we can demonstrate compelling legitimate grounds for the processing which override your interests.

• Right to withdraw consent. You have the right to withdraw your consent at any time with effect for the future in relation to Data that we have processed on the basis of your consent (Article 7(3) GDPR). In the event of withdrawal, we will promptly delete the relevant data unless further processing is permitted on another legal basis. Please note that withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

If you wish to exercise any of these rights, please contact us at gdpr@changan.com.gr. We attach great importance to your rights and concerns and make every effort to respond as promptly as possible. As a rule, we will respond to your request within one (1) month. If we need to extend this timeframe due to the complexity of your request and/or for other reasons permitted by law, we will inform you accordingly in due time.

However, if you believe that we have not adequately addressed your requests or concerns in accordance with data protection law, you have the right to lodge a complaint with the competent data protection authority (Article 77 GDPR), without prejudice to any other rights you may have.

The competent supervisory data protection authority in Greece is:
Hellenic Data Protection Authority (HDPA)
Address: 1-3 Kifisias Avenue, 115 23 Athens, Greece
Tel.: +30 210 6475600
Website: https://www.dpa.gr/ 
Email: contact@dpa.gr 

11. Updates to this Policy

We periodically review and improve our Services and processes. We may update this Policy from time to time, so please check this page regularly. Updates to the Policy will take effect from the effective date stated in each version of the Policy and will be published on this page.