DATA PROTECTION POLICY

of ΟΤΕestate

The protection of your personal data is important to us.

Please take a few moments to read this Data Protection Policy of OTEestate (hereinafter "Privacy Policy") and find out how the company "OTEestate" with registered office in Marousi, Attica, 99 Kifissias Ave., GR-15124, Greece (tel. +30 210 6372700, email: info@ote-estate.gr) (hereinafter "ΟΤΕestate" or "we"), acting as Controller, collects, stores, uses and, in general, processes personal data (hereinafter "Data"), which you submit by visiting, registering at or using the website www.ote-estate.gr.

For any matter related to the processing of your Data you can contact us at:

tel.: +30 210 6372787 - Legal Services Department
Email: tania.zarkou@ote-estate.gr
Address: Maroussi Attica, 99 Kifisias Avenue, GR-15124, Greece
(for the attention of the Legal Services Department).

1. A few words about OTEestate.

ΟΤΕestate (www.ote-estate.gr) is an OTE S.A. subsidiary to which the Organisation’s entire real estate was transferred for the purpose, among other things, of managing, developing and commercially exploiting its real estate portfolio. Furthermore, OTE ESTATE is a licensed Electricity Supplier, covering, among other things, the energy needs of OTE Group.

2. What are personal data?

The term "personal data" refers to information of individuals, such as name and surname, postal address, email address, contact telephone number, etc., which identify or may identify you, hereinafter "Personal Data" or "Data".

3. What is Personal Data Processing?

Any act or series of acts carried out with or without the use of automated means on personal data or on a set of personal data, such as the collection, registration, organisation, structure, storage, adaptation or change, recovery, the search for information, use, disclosure by transmission, dissemination or any other form of disposal, correlation or the combination, restriction, erasure or destruction.

4. Which categories of personal data do we collect and for what purpose?

For the provision of services, as specifically described below, through the Company's website, we collect and process:

4.1. Data you provide to us when submitting, through the OTEestate’s website, a request/enquiry/complaint (via the Contact Form for Other Issues) to OTEestate, i.e. name and surname / corporate name, contact email, telephone).

4.2. Data you provide to us when you register on the OTEestate’s website for the activation of services provided by OTEestate, as the case may be, as part of its commercial activity, which you wish to use (e.g. providing real estate information during a tender procedure for selling them). The data you provide to us for your registration on the OTEestate’s website are as follows: name and surname/corporate name, contact email, Tax Registration Number (if required) and mobile/landline phone number.

4.3. Data you provide to us for the activation of the "OTE ESTATE eBILL" service through which you, as electricity customers, may electronically access your bills regarding the supply of electricity. The data you provide to us for the activation of the above service are as follows: name and surname/corporate name, contact email, Tax Registration Number and mobile/landline phone number.

4.4. Data you provide to us at the time of submission, through the OTEestate’s website, of the Rental or Purchase Expression of Interest Form, namely 1. for the rental expression of interest: (a) your personal details (name and surname/corporate name, Tax Registration Number, Tax Office), (b) your contact details (telephone number, postal address, email address and fax number), and (c) a recent Income Tax Return Statement (as appropriate, namely, when you are asked to present it to OTEestate) and 2. for the purchase expression of interest: (a) your personal details (name and surname/corporate name), and (b) your contact details (telephone number, email address). OTEestate collects and processes the above personal data: (a) when you express your rental interest: to carry out a search in a credit control system and assess your rental interest including any transaction risk undertaken by OTEestate in the event of conclusion of a lease agreement, aiming to satisfy its legitimate interest, namely the exercise of its right to economic freedom, in order to ensure trade credit, reliability and transaction security as part of its business activities, and (b) when you express your purchase interest, if OTEestate needs to contact you.

4.5. Data you provide to us when submitting, through the Company's website, and/or by sending an email to the Human Resources Department (at the email address christiana.tsoblektzoglou@ote-estate.gr), your CV, such as name and surname, father's name, date and place of birth, home address, telephone/mobile phone number, marital status, military service, department of interest, education (studies/seminars, computer skills, foreign languages, etc.), work experience (duration of work, employer, position). The information sent by you will be used by the Human Resources Department to assess your ability to fill a position for which you have sent your CV, or to fill another position for which you will be considered, in the course of processing your CV, to possess the required skills.

4.6. Data that you provide to us to register, through the OTEestate’s website, to the newsletter, in order to be informed about future real estate sales by tender, such as your email and your name and surname.

5. What is the legal basis for processing the Data of the subjects?

We collect and process the Data solely for legal reasons. In any case, the processing will be based on one of the following legal bases:

1. on the contractual relationship or on taking measures during the pre-contractual stage;
2. on the Company's legal obligations;
3. on the Company's legal interest.

6. How long do we keep your personal data?

OTEestate keeps: (a) your personal data, as referred to in Article 4 above, for as long as the services under items 4.2., 4.3., and 4.6. are active; (b) with respect to the personal data under item 4.1., for six (6) months from completion of the processing of your request/enquiry; (c) with respect to the personal data under item 4.5., for two (2) years from sending your CV, and (d) with respect to the personal data under item 4.4., for one (1) year from completion of the assessment of your rental/purchase interest submitted. In case of negotiations between us for the purpose of concluding a lease agreement between us or in case of expression of purchase interest and any intention to participate in a future tender procedure for the sale of a property, OTEestate legally keeps your personal data (prospective tenant) for the duration of the negotiations, in the event of tenancy, or until completion of the tender procedure that may be announced and carried out, in which you will have participated, expressing your purchase interest.

After any termination of the contract by you or the permanent discontinuation of the Service under items 4.2., 4.3., and 4.6. for any reason whatsoever, your personal data will be kept for a maximum of eight (8) months from the date of termination or permanent discontinuation.

7. Will OTEestate process your personal data for other purposes?

OTEestate will not process your personal data for purposes other than those listed above. In case OTEestate wishes to use your personal data for other purposes, it will only do so after informing you and obtaining your explicit consent.

8. Who are the (third party) recipients and for which purpose are personal data transmitted to them?

Recipients of personal data can be:

• for the service under item 4.3., financial institutions through which your bills are paid;
• for category under item 4.4. (assessment of rental/purchase interest), companies conducting audits in OTEestate in accordance with the requirements of the law and/or its regulatory provisions and Policies (certified auditors, internal audit, etc.), legally operating credit control companies (only in the case of rental expression of interest), as well as any other companies providing OTEestate with data storage centres or software products;
• for category under item 4.5. (sending of a CV), OTEestate may transmit your personal data to other Companies of the OTE Group, for the same purpose for which they were given.

OTEestate does not disclose, process or publish your personal data to any third parties other than the above recipients, except in cases where their communication/transmission is required by applicable law or by court decision or court order.

9. What are your rights as a user of the above Services regarding the processing of your personal data?

You have the right to submit a request to OTEestate to:

• access and rectify your personal data in the event of processing of inaccurate data concerning you.
• erase your personal data if they are no longer necessary for the provision of the Service.
• restrict the processing of your data.
• object to the processing of your data.
• transmit your data to another controller (right to data portability), namely to exercise your right to receive your data in a structured format in order to be technically feasible to be transmitted to another controller.

In addition, you reserve the right to file a written complaint with the competent supervisory authority regarding the protection of personal data, which is the Hellenic Data Protection Authority, 1-3 Kifisias Avenue, GR-11523, Athens, +30 210 6475600, email contact@dpa.gr.

10. When do we respond to your Requests?

We respond to the Requests of the individuals referred to above free of charge, without delay, and in any case within one (1) month from the time we receive their request. However, if their Request is complex or there is a large number of Requests from the same individual, we will notify them within a month, if we need to extend for another two (2) months within which we will respond.

Where Requests from an individual are manifestly unfounded or excessive, in particular because of their repetitive character, OTEestate may charge a reasonable fee, taking into account the administrative costs of providing the information or communication or taking the action requested or refuse to act on the request.

11. Who is the controller and how can the controller be contacted?

The controller is the company under the corporate name "OTE REAL ESTATE SOCIETE ANONYME" (and the distinctive title "ΟΤΕestate"), with registered office in Maroussi, Attica (99 Kifisias Avenue, 1st Floor).

12. Who can you contact for matters regarding the protection of your personal data?

For any questions or with respect to the exercise of your rights under the General Data Protection Regulation (GDPR) and the applicable data protection laws, you may contact OTEestate in the following ways:

• by completing the Contact Form for Other Issues found on the OTEestate’s website;
• by sending a letter to 99 Kifisias Avenue, 1st Floor, GR-15124, Maroussi;
• by sending an email at info@ote-estate.gr.

13. What kind of measures are applied for the protection of your personal data?

OTEestate takes the necessary and appropriate organisational and technical measures for the security of your data and their protection against accidental or unlawful destruction, accidental loss, alteration, prohibited dissemination or access and any other form of unauthorised processing.

It also implements Security Policies and Procedures to protect your personal data. As a member of the Deutsche Telekom Group, it has adopted the Binding Corporate Rules for the protection of personal data when transmitting data between Group companies (Binding Corporate Rules Privacy of Deutsche Telekom (BCRP)). The full text of the BCRP will be available upon request that you can send to OTEestate via email at info@ote-estate.gr

Indicatively, some of the measures applied are:

• mechanisms for authentication and access to systems that process personal data;
• restriction of access to personal data on a need-to-know basis;
• recording and controlling access to personal data.

14. Do we use automated decision making/including profiling when processing your Data?

We do not carry out automated individual decision-making, including profiling other than using "cookies" on our website www.ote-estate.gr, always after informing you and subject to your consent.

15. What is the applicable law when we process your Data?

The applicable law is Greek law, as formed in accordance with the General Data Protection Regulation 2016/679/EU, and in general the current national and European legal and regulatory framework for the protection of personal data. Any disputes arising in connection with your Data are subject to the jurisdiction of the Courts of Athens, Greece.

16. How will you be notified of any changes to this Policy?

We update this Privacy Policy whenever necessary. If there are significant changes to the Privacy Policy or in the way we use your Personal Data, we will post an update of this Privacy Policy on our website before the changes take effect and we will notify you in any appropriate way. We encourage you to read this Privacy Policy regularly to know how your Data are protected.

INFORMING THIRD PARTIES SUBMITTING THE RENTAL EXPRESSION OF INTEREST FORM FROM ICAP (CONTROLLER) FOR PROCESSING OF PERSONAL DATA

ICAP would like to inform you through OTE ESTATE SOCIETE ANONYME that, as part of its legitimate interest, which consists in the provision of commercial and financial information concerning the creditworthiness of the transacting parties, in order to exercise the right to economic freedom based on information securing trade credit, reliability and transaction security, keeps a record ("ICAP Database") with your personal data on economic behaviour, which have been collected from legal sources (such as courts, Land Registry, the General Electronic Commercial Registry GEMI). The data recipient of the ICAP Database referred to above will be OTE ESTATE SOCIETE ANONYME, with which you trade or are going to trade, after accessing the data of ICAP Database. More information about ICAP Database, the time of data retention, as well as in order for you to be informed about and exercise your rights, either by contacting OTE ESTATE SOCIETE ANONYME (info@ote-estate.gr) or ICAP (privacy@icap).gr), in accordance with the current provisions of the Greek law and the General Data Protection Regulation EU 2016/679 can be found in the Privacy Policy of ICAP, which is available on the website https://www.icapb2b.gr/portal/web/b2b/privacy-notice).