This Privacy Policy sets out the institutional and operational framework of principles, rules, and procedures that the Hellenic Institute of Non-Destructive Testing (HINDT) applies to ensure the protection, integrity, and confidentiality of the information it receives, processes, or generates while carrying out its activities as a Personnel Certification Body.

This policy aligns with the requirements of international standards EN ISO/IEC 17024 and EN ISO 9712, as well as the current legislative and regulatory framework on the protection of personal data, including the General Data Protection Regulation (GDPR).

The main goal of this policy is to ensure that every piece of information is handled responsibly, legally, and transparently, boosting the credibility, institutional integrity, and trust of stakeholders in HINDT.

The Confidentiality Policy applies universally and in a binding manner:

• In all information and data concerning candidates, certified individuals, clients, partners, suppliers, and other interested parties.
• To all members of the Administration, the staff, external examiners, evaluators, committee members, as well as any third party acting on behalf of HINDT.
• In any form of information, regardless of the storage or distribution medium, including printed files, electronic data, oral communications, and digital systems.
• The obligation to maintain confidentiality continues even after the end of the cooperation or contractual relationship with the Hellenic Institute of Non-Destructive Testing.

HINDT is committed to applying high standards of information security and to effectively safeguarding all confidential information. In particular, the Institute:

• It ensures that all information collected or produced during the assessment and certification processes is used only for the purpose for which it was obtained.
• They don’t share information with third parties without the prior, explicit, and documented consent of the person involved, unless sharing it is required by law, a court decision, or a relevant supervisory authority.
• It lets the interested party know in time when data disclosure becomes legally required, unless the relevant law prohibits it.
• It properly applies technical and organizational measures to prevent unauthorized access, leakage, alteration, destruction, or loss of information.
• It adopts the principle of data minimization, ensuring that only the absolutely necessary information is collected and kept.

All individuals involved in HINDT’s activities bear individual and collective responsibility for safeguarding confidential information. In this context:

• They sign a Confidentiality Declaration prior to assuming their duties.
• They are committed to not sharing, reproducing, storing without authorization, or using information that comes to their knowledge because of their position.
• They are required to comply with the applicable personal data protection laws and with internal information security policies.
• They must immediately report any incident or suspicion of a confidentiality breach.

HINDT implements a structured information management system designed to ensure the protection of information throughout its lifecycle. In particular:

• The files are kept in controlled physical spaces or in secure information systems with defined access levels.
• Role-based access control policies and strong user authentication mechanisms are applied.
• Backups are kept and data recovery procedures are applied to ensure business continuity.
• The retention time of files is clearly defined according to regulatory requirements and business needs.
• After the retention period ends, the files are destroyed in a safe and irreversible way.

HINDT discloses only information that is permitted to be publicly available, such as certification status or withdrawal of certificates, through its official communication channels. All other information is considered strictly confidential and shall not be disclosed without prior authorization or a lawful basis. All external communications are conducted in a manner that safeguards the organization’s reputation, credibility, and institutional integrity.

HINDT ensures the continuous information and training of its personnel and collaborators regarding:

• Policies and procedures for the protection of confidential information.
• Obligations arising from the data protection regulatory framework; and
• Best practices in information security.
• The strengthening of awareness contributes to the development of a culture of discretion, responsibility, and professionalism.

In the event of an actual or potential breach of confidentiality:

• A documented investigation procedure is immediately initiated.
• Management is informed without delay and, where required, the competent supervisory or regulatory authorities are notified.
• Corrective and preventive measures are implemented to limit the impact and prevent recurrence of the incident.
• Disciplinary, administrative, or legal sanctions may be imposed in accordance with applicable legislation and internal procedures.

HINDT Management:

• Ensures the implementation of confidentiality principles at all operational levels of the organization.
• Provides the necessary human, technical, and financial resources for the effective protection of information.
• Actively supports the development of a culture of information security and organizational responsibility.
• Regularly monitors and evaluates the effectiveness of the implemented protective measures.

This Confidentiality Policy is formally approved by HINDT Management and constitutes a binding framework for all involved parties. The Policy is reviewed periodically — and at least annually — or whenever substantial changes occur in activities, standards, or the legislative framework, in order to ensure its continued suitability and effectiveness. The Policy is made available to personnel, collaborators, and the wider public through the Institute’s official communication channels, thereby enhancing transparency and stakeholder confidence.