Cookie Policy

SEMAC Group (Greece) — Semac Construction S.A. & Semac Automation S.A.

Version 2.3 · Published 14 September 2026 · Effective date: 14 September 2026 Supersedes every earlier text on cookies, including the references contained in the Terms and Conditions of 21 September 2021. Version 2.3 is a clarifying version and does two things. First, it expressly extends the scope to automation.semac.gr, Semac Automation's product website, giving it its own row in the controller table (§1.1) and its own technology table (§4.4); until now the text named the website without describing it. Second, it names Google reCAPTCHA, which protects the contact form on Semac Automation's websites and appeared in no table at all (§4.3, §4.4). No new provider, no new purpose and no new cookie is introduced: what is described was already happening. This is therefore not a material change under §10.2, and the consent you have already given remains valid — we do not ask you again for a correction that changes nothing on your device. The announcements made by version 2.1 (enhanced conversions, from 17 September 2026) and version 2.2 (OpenAI Ads pixel, from 1 October 2026) are unchanged. What each version changes is set out in §10.4.

Covers the websites www.semac.gr, services.semac.gr and automation.semac.gr.

At a glance

• What cookies are: small files and other technologies that store or read information on your device (computer, phone, tablet).
• When we ask for your consent: for anything that is not strictly necessary to make the website work. Consent is asked for before the cookies are placed.
• Strictly necessary cookies (security, session, load balancing, remembering your cookie choices) are placed without consent, because the site does not work without them.
• Refusing is as easy as accepting. The first layer of the banner carries a "Reject all" button equivalent to "Accept all".
• You can change your mind at any time, through the "Cookie settings" link in the footer of every site. Withdrawal does not affect the lawfulness of what happened before it.
• We do not sell data and we do not use cookies for automated decision-making producing legal effects concerning you.
• How long we keep your decision: 12 months; then we ask you again.
• Questions: privacy@semac.gr.

Table of contents

1. Who we are and what this Policy covers
2. What cookies and similar technologies are
3. The legal rule in plain terms
4. The categories we use — tables per website
5. How to give, change or withdraw your consent
6. Managing cookies in your browser
7. What happens if you refuse
8. Do Not Track and Global Privacy Control
9. Transfers, consent records and relationship with the Privacy Policy
10. Changes, version, change log
11. Contact

1. Who we are and what this Policy covers

1.1 The controllers for the websites covered by this Policy are:

1.2 Semac Construction S.A. and Semac Automation S.A. act as separate (independent) controllers, not as joint controllers. Each is responsible for its own processing and for its own website.

1.3 No Data Protection Officer has been appointed under Article 37 GDPR, as no such obligation arises. A Data Protection Contact Point has been designated: Stamatios Evmorfiadis.

1.4 This Policy supplements and does not replace the SEMAC Group Privacy Policy, which sets out in detail the purposes, legal bases, recipients, retention periods and your rights.

2. What cookies and similar technologies are

2.1 Cookies are small text files that a website places in your browser and that are returned to the server on subsequent visits. They are distinguished:

• 2.1.1 By duration, into session cookies (deleted when you close the browser) and persistent cookies (which remain for a set period).
• 2.1.2 By origin, into first-party (set by the site itself) and third-party (set by another provider, e.g. an analytics platform or a social network).

2.2 Beyond cookies, other technologies are used that have the same effect — they store or read information on your terminal equipment:

• 2.2.1 Local storage / session storage (browser-side storage).
• 2.2.2 Tracking pixels, web beacons, clear GIFs — invisible images or code fragments that notify a provider that a page was loaded or a message opened.
• 2.2.3 Third-party SDKs and embedded scripts (e.g. maps, video, forms, marketing tools).
• 2.2.4 Device fingerprinting — combining device and browser characteristics so that the device can be uniquely recognised, without storing a file. The SEMAC Group does not use fingerprinting techniques for tracking or marketing purposes.

2.3 Important: Article 5(3) of Directive 2002/58/EC (ePrivacy), as transposed into Article 4(5) of Greek Law 3471/2006, is not limited to cookies. It covers any storing of information, or gaining of access to information already stored, in the user's terminal equipment, whatever the technology. This has been confirmed by the European Data Protection Board in Guidelines 2/2023 on the technical scope of Article 5(3) of the ePrivacy Directive. Accordingly, everything stated below about cookies applies equally to local storage, pixels, SDKs and fingerprinting.

2.4 The information stored or read may constitute personal data (e.g. session identifiers, IP address, unique visitor identifiers), even if it does not contain your name. In that case the GDPR (Regulation (EU) 2016/679) applies in parallel, together with Law 4624/2019.

3. The legal rule in plain terms

3.1 Strictly necessary: exempt from the consent requirement, provided they are necessary solely to carry out the transmission of a communication or to provide a service that you have expressly requested. Examples: anti-CSRF security cookie, logged-in session cookie, load balancing, recording your own cookie choice. Legal basis for any processing of personal data: Article 6(1)(f) GDPR (legitimate interest in operating and securing the website).

3.2 Everything else — analytics, non-essential functional conveniences, marketing, targeting, third-party embeds — requires prior consent, on the legal basis of Article 6(1)(a) GDPR in conjunction with Article 4(5) of Law 3471/2006.

3.3 Consent must be, under Article 4(11) and Article 7 GDPR and EDPB Guidelines 05/2020:

• 3.3.1 Prior — non-essential cookies are not placed before you have expressed your choice.
• 3.3.2 Freely given — without coercion. We do not use cookie walls: access to content does not depend on accepting non-essential cookies.
• 3.3.3 Specific — a separate choice per purpose/category, not a single "all or nothing".
• 3.3.4 Informed — with clear information on who places what, why and for how long.
• 3.3.5 Unambiguous, by a clear affirmative act. No pre-ticked boxes are permitted, nor may continued browsing, scrolling or closing the banner be treated as acceptance (CJEU, C-673/17 Planet49, C-61/19 Orange România).
• 3.3.6 As easy to withdraw as to give (Article 7(3) GDPR) — and refusing must be as easy as accepting, on the same layer of the banner and with equivalent visual prominence.
• 3.3.7 Renewable — your decision is not permanent; we revisit it every 12 months.

3.4 We do not use dark patterns: accept and reject buttons have equivalent size, contrast and position.

4. The categories we use — tables per website

4.1 Categories used overall:

4.2 www.semac.gr

Sourcing note: www.semac.gr is hosted on the Wix platform (Wix.com Ltd). The set below is based on Wix's documented cookie set. Durations declared by the provider may change without notice.

4.2.1 Note on svSession and bSession: the provider classifies these as essential. However, to the extent they are used to measure visitors or performance beyond what is strictly necessary, the position of the Greek and European authorities is that consent is required. Pending technical verification we treat them conservatively: bSession is gated behind consent.

4.3 services.semac.gr

services.semac.gr is a static website with no session-management cookies of its own: it does not use a session cookie, a CSRF token or a load-balancing cookie. Your consent choice is stored locally on your device (localStorage, not a cookie). The language is not stored; it is determined by the URL you visit.

4.3.0 Strictly necessary technology: reCAPTCHA. The contact form is protected by Google reCAPTCHA (Google Ireland Ltd). It does not load with the page: your browser requests it at the moment you focus the first field of the form, and only then — if you never touch the form, nothing is exchanged with Google. At that point the _GRECAPTCHA cookie is set (duration as stated by the provider: 6 months) and signals from your device and browsing are assessed, in order to tell a human apart from an automated script. It falls under the strictly necessary exemption of article 4(5) of Law 3471/2006: without it the service you asked for — sending us your message — cannot be provided, because the form is overwhelmed by automated submissions. That is why no consent is requested for it, just as none is requested for any other security measure. It is not used for advertising, targeting or traffic measurement, and it is not linked to any of the cookies in the tables below. If you would rather it were never activated, do not use the form: the same contact details (email and phone) are published on every page, and reaching us does not depend on it.

The only non-essential technologies currently in use are the following, and they load only after your consent:

4.3.1 Note on the retention period of the OpenAI Ads pixel. The provider does not publicly document per-cookie retention periods as at the date of this text (the service is offered as a Beta). We do not state a number we cannot verify: a reassuring "90 days" with no source would be less honest than admitting the figure is missing. We will name the exact durations in a future version of this Policy once they are documented. In the meantime the following apply undiminished: (a) the consent gate in the table row above, (b) your right to withdraw under §5.3, and (c) deletion from your browser under §6, which removes whatever has been stored regardless of any declared duration.

4.3.2 What "does not load at all" means. The Google tag is permitted to sit on the page in a denied state (Consent Mode v2) and set nothing until you accept. The OpenAI pixel offers no such state, which is why we do not place it on the page as the provider recommends: your browser requests it only after you have given consent. The practical consequence falls on us and not on you: if you accept after having already moved to a second page, the link to the advertisement is gone and that visit stays unattributed. We accept that as the cost; the alternative would be to store the identifier before your consent, which is precisely what consent exists to control.

From 17 September 2026 — enhanced conversions. If you have consented to the Marketing category, the Google Ads tag will additionally transmit an irreversibly hashed (SHA-256) form of the email address, phone number and name you submit through the contact form, so that the enquiry can be matched to the advertisement click that produced it even when the cookie above is missing. This is a transmission, not a cookie, and it is described in full in sections 5.2, 6 (purpose 20) and 8.1 of the Privacy Policy. Google acts as our processor for it and may not use the data for its own purposes; no readable contact details are sent for this purpose; and where consent to the Marketing category is refused, nothing is transmitted at all. Because this is a new purpose, we will ask for your cookie consent again before it starts, in accordance with §10.2 below.

4.4 automation.semac.gr

Like services.semac.gr, automation.semac.gr is a static website with no session-management cookies of its own: it does not use a session cookie, a CSRF token or a load-balancing cookie, and it has no visitor accounts. Your consent choice, together with the accessibility settings (font size, contrast), is stored locally on your device in localStorage, not in a cookie: it is never sent to any server and cannot be read by third parties. The language is not stored; it is determined by the URL you visit (/ for English, /el for Greek).

4.4.1 Strictly necessary technology: reCAPTCHA. Exactly as described in §4.3.0: the contact form is protected by Google reCAPTCHA (Google Ireland Ltd), which is requested only when you focus a field of the form, sets the _GRECAPTCHA cookie, falls under the strictly necessary exemption, and is not used for advertising or statistics.

4.4.2 Non-essential technologies. One, and it loads only after your consent:

4.4.3 What is NOT here. This website carries no marketing cookies: no Google Ads conversion linker, no OpenAI Ads pixel, no social network pixel. The "Marketing" category appears in the banner for consistency across the Group's websites; on automation.semac.gr, accepting it today activates nothing. If that ever changes, a new version of this Policy will be published and your consent will be requested again under §10.2, before anything is put into operation.

4.4.4 Third-party embeds: none. The map showing our offices on the home page, the "About" page and the "Contact" page is our own static SVG image inside the page — it is not an embedded third-party map, it makes no network request and it stores nothing on your device. The "Get directions" links open Google Maps only if you click them, at which point Google's own terms and policy apply. The same holds for every outbound link (see "Links to third-party websites" in the Privacy Policy).

5. How to give, change or withdraw your consent

5.1 The consent banner. On your first visit a banner appears allowing you, on the very first layer, to choose "Accept all", "Reject all" or "Settings". Until you choose, no non-essential script or cookie is loaded.

5.2 Granular settings. The "Settings" screen shows each category separately, with a description and a toggle. Toggles for non-essential categories are off by default.

5.3 Changing or withdrawing. On all three sites (www.semac.gr, services.semac.gr, automation.semac.gr) there is a permanent "Cookie settings" link in the footer of every page. From there you can at any time change or fully withdraw your consent, in the same number of steps it took to give it. Withdrawal takes effect for the future and does not affect the lawfulness of processing based on consent before withdrawal (Article 7(3) GDPR).

5.4 Re-prompting. If you do not change your choice, the banner reappears after 12 months, and also on any material change to the purposes or providers.

5.5 Withdrawing consent through the settings does not automatically delete cookies already stored on your device. For full deletion, see section 6.

6. Managing cookies in your browser

6.1 Independently of our sites' settings, you can control or delete cookies in the browser itself. Paths differ by version; by way of indication:

• 6.1.1 Google Chrome: three-dot menu → Settings → Privacy and security → Third-party cookies / Delete browsing data.
• 6.1.2 Mozilla Firefox: menu → Settings → Privacy & Security → Cookies and Site Data → Clear Data / Manage Exceptions.
• 6.1.3 Apple Safari (macOS): Safari → Settings → Privacy → Manage Website Data. On iOS/iPadOS: Settings → Safari → Clear History and Website Data.
• 6.1.4 Microsoft Edge: three-dot menu → Settings → Cookies and site permissions → Manage and delete cookies and site data.

6.2 For the exact path in the version you are using, consult your browser's help function. We do not link to specific support addresses, as these change frequently.

6.3 Many browsers offer a private browsing mode, in which cookies are deleted when the window is closed. Setting the browser to block all cookies outright may prevent core parts of the website from working.

7. What happens if you refuse

7.1 Refusing non-essential cookies does not shut you out of our websites' content. You can read every page, download material from the Resource Center and submit a contact form.

7.2 Specific consequences:

• 7.2.1 Without functional cookies, your language or other preferences may not be retained between visits.
• 7.2.2 Without statistics cookies, we do not measure your visit; your experience does not change.
• 7.2.3 The third-party embeds category affects nothing on Semac Automation's websites today: there is no embedded map, video or third-party widget on any of their pages. The maps you see are our own static images inside the page, and the addresses of our facilities are always given in text form as well. Should a third-party embed ever be added, click-to-load will apply: you will see a static placeholder with a load button, and nothing will load without your explicit action.
• 7.2.4 Strictly necessary cookies cannot be switched off from the banner; if you block them in the browser, the website may not work correctly (e.g. form submission may fail).

8. Do Not Track and Global Privacy Control

8.1 The browser "Do Not Track" (DNT) signal was never standardised and has been abandoned by most providers. Our websites do not currently respond to the DNT signal. This does not disadvantage you, because non-essential cookies are not placed at all without your prior express consent.

8.2 Global Privacy Control (GPC) is a proposed opt-out signal standard. Our websites do not currently process it as a standalone declaration, for the same reason: our approach is opt-in by default. [If SEMAC adopts a CMP supporting GPC, this paragraph must be updated.]

8.3 We state the above honestly rather than claim a compliance that does not technically exist.

9. Transfers, consent records and relationship with the Privacy Policy

9.1 Transfers outside the EEA. Certain providers (for example Wix.com Ltd, Google, OpenAI, LinkedIn, Meta) may process data outside the European Economic Area. In such cases we rely on Articles 44–49 GDPR and specifically:

• 9.1.1 on the Standard Contractual Clauses of Commission Implementing Decision (EU) 2021/914, with supplementary measures where required; and/or
• 9.1.2 on the adequacy decision for the EU–US Data Privacy Framework of 10 July 2023, where the provider is certified.

Note: the validity and status of the EU–US adequacy decision, and each provider's certification, must be verified before every publication or update of this text.

9.2 Consent records. We record your choice (which categories you accepted or refused, timestamp, version of the text and of the banner, technical identifier) so that we can demonstrate compliance under Article 7(1) GDPR. Retention: 12 months, after which you are asked again.

9.3 Relationship with the Privacy Policy. This Policy concerns only the storing and reading of information on your device. For processing purposes, legal bases, recipients, retention periods and your rights (access, rectification, erasure, restriction, portability, objection, withdrawal of consent, complaint) the SEMAC Group Privacy Policy applies.

9.4 Right to complain. You may lodge a complaint with:

• Greece — Hellenic Data Protection Authority (ΑΠΔΠΧ / HDPA): Kifissias Avenue 1-3, 115 23 Athens · tel. +30 210 6475600 · contact@dpa.gr · www.dpa.gr

You may also approach the authority of your habitual residence or place of work, or of the place of the alleged infringement (Article 77 GDPR), and you have a judicial remedy (Article 79 GDPR).

10. Changes, version, change log

10.1 We update this Policy whenever the cookies, providers or the legal framework change, and at least annually, following a cookie scan.

10.2 For material changes (a new category, a new provider, a new purpose) we ask for your consent again before activating them.

10.3 Version details

10.4 Change log

11. Contact

11.1 For any question about this Policy:

11.2 We respond within one month of receiving your request, extendable by two further months where necessary, with reasons communicated to you (Article 12(3) GDPR).