PRIVACY NOTICE

Update on Personal Data Processing

Data Controllers – Data Protection Officer (DPO)

The company NEA ODOS S.A. (hereinafter referred to as “NEA ODOS” or Company) having its registered office in 87 Themistokleous Str., 106 83 and offices in Nea Erythraia, 19 Neas Erythraias Ave., 146 71, General Commercial Registry no. 7349501000, TAX identification no. 998807387, and the company ODOS KENTRIKIS ELLADAS S.A. (hereinafter referred to as “KENTRIKI ODOS” or Company) having its registered office in Lamia, 1^st km of Lamia – Athens, 351 00, and offices in Nea Erythraia, 19 Neas Erythraias Ave., 146 71, General Commercial Registry no. 22510254000, TAX Identification no. 998437175, inform that, for the purposes of the Project assigned to them by the Greek State based on the relevant Concession Agreements, jointly process motorway users personal data in the framework of the program to issue a card for disabled persons, in accordance with the applicable national law and the European Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, hereinafter referred to as the “Regulation”) as it is currently in force.

Furthermore, ΝΕΑ ODOS and KENTRIKI ODOS inform that the Operation and Maintenance of the Concession Projects have been assigned, under the 05.03.2021 corresponding Operation and Maintenance Agreements (the “O&M Agreements”), which have been approved by the Greek State, to the company GEK -TERNA S.A. headquartered in Athens on 85 Mesogeion Avenue, PO 115 26, General Commercial Registry no. 000253001000, TAX identification no. 094005751, (hereinafter “the Operator”). Pursuant to the terms of the O&M Agreements, the Operator has undertaken to perform the day-to-day operation and maintenance of the Concession Projects and in particular has undertaken, inter alia, the traffic management, routine maintenance and the periodic inspection of the Concession Projects, the users and subscribers customer service, as well as the toll collection in the name and on behalf of ΝΕΑ ODOS and KENTRIKI ODOS respectively, as their proxy and direct trustee. Therefore, the Operator also processes, in the context of the provision of its services and under the O&M Agreements only, the absolutely necessary personal data of the motorway users and the subscription program subscribers and is jointly responsible for the processing of the above data with ΝΕΑ ODOS and KENTRIKI ODOS.

ΝΕΑ ODOS, KENTRIKI ODOS and Operator’s contact details (jointly responsible for data processing) email: info@neaodos.gr and/or info@kentrikiodos.gr , tel: +30 210 344 7300.

For any matter concerning the processing of personal data, you may contact the NEA ODOS, KENTRIKI ODOS and Operator’s Data Protection Officer (DPO) directly at the following email addresses: dpo@neaodos.gr and/or dpo@kentrikiodos.gr

How and why we use your personal data

The Companies process the personal data you provide to them by completing the application form to issue a card for disabled persons, only for the following legal grounds:

1. the use of motorways and their infrastructure managed by the Company under the concession agreement and in performance of a public service ratified by law.

1. the compliance with the statutory obligation to pay tolls charged to motorway users.

1. the issuing of a card for disabled persons that is common for the Ionia Odos, PATHE, and Aftokinitodromos Kentrikis Elladas (E65) motorways, respectively managed by the Companies, to those who are eligible to have it; the provision of the relevant service as well as the service of the beneficiaries during the use thereof.

The passes of the disabled persons by the toll stations are electronically recorded for the purpose of their verification and as proof of their making in the context of the execution of the relevant Concession Agreements that have been ratified by law and for safety reasons.

All personal data you provide by completing the relevant application forms is necessary for the issuing of the card for disabled persons to those who are eligible to have it, the provision of the relevant service as well as the service of the beneficiaries during the use of the motorways managed by the companies. Failure to fill in or incorrectly fill in one or more of the fields of the Application Form makes it impossible to provide the service.

Third-party recipients of personal data

The Companies send personal data to third parties to whom they have assigned the processing of personal data on their behalf. Personal data collected for the issuing of the card for disabled persons to those who are eligible to have it and, for the provision of the relevant service are stored by a partner company. Finally, the Companies cooperate with IT companies that provide related services, such as IT systems maintenance and security systems. In providing these services, IT companies may have access to personal data and, in specific cases they perform processing operations necessary for the provision of the services concerned.

In particular, the companies NEA ODOS and KENTRIKI ODOS remain jointly responsible for the processing of your personal data and specify the details of the processing, signing a specific contract with the third-parties to whom they assign processing activities in order to ensure that the processing is carried out in accordance with the applicable legal framework and that any natural person may freely and without hindrance exercise the rights conferred on him/her by the legal framework.

Furthermore, the Companies forward personal data to the competent governmental authorities when required by the applicable legal framework and for the performance of their duties in the public interest or in the exercise of the public authority entrusted to them, such as when necessary for the collection of toll charges, and/or when necessary to identify any violations of the Highway Code and generally of Greek law.

Storage time

The data storage time is decided on the basis of the following specific criteria, as appropriate on each case:

When processing is required as a necessity under provisions of the applicable legal framework, your personal data will be stored for as long as required by the relevant provisions.

When processing is done on the basis of a contractual relationship, your personal data will be stored for as long as is necessary to perform the contract and for the foundation, exercise, and/or support of legal claims under the contract.

For promotional and marketing purposes, your personal data is retained until your consent is withdrawn. This can be done by you at any time. Withdrawal of consent does not affect the legality of consent-based processing in the period before its revocation.

To withdraw your consent, you may contact the Data Protection Officer (DPO) at the following email addresses: dpo@neaodos.gr and/or dpo@kentrikiodos.gr

You may also use the de-registration options by following (clicking) the corresponding link in our online communications.

What are your rights with respect to your personal data

Any natural person whose data is being processed enjoys the following rights:

Right of Access:

You have the right to be aware and verify the legitimacy of the processing. Therefore, you have the right to access the data and get additional information about how your data is processed.

Right to Rectification:

You have the right to study, correct, update or modify your personal data by contacting the Data Protection Officer (DPO) at the above contact details.

Right to Erasure (“Right to be forgotten”):

You have the right to request the erasure of your personal data only if the Companies process it based on your consent or in order to protect their legitimate interests. In all other cases (such as, for example, where there is a contract, due to an obligation to process personal data required by law, for reasons of public interest), this right is subject to specific restrictions or and may not apply, depending on the case.

Right to Restriction of Processing:

You have the right to request a restriction on the processing of your personal data in the following cases: (a) when the accuracy of the personal data is questioned and until such accuracy is verified; (b) when you oppose the erasure of personal data and request (instead of erasure) the limitation of its use; (c) when personal data is not needed for processing purposes, but is, however, indispensable for the foundation, exercise, support of legal claims; and (d) when you object to the processing and until it is verified that there are legitimate reasons that concern the Companies and supersede the reasons for which you oppose processing.

Right to Oppose Processing:

You have the right to oppose at any time the processing of your personal data where, as described above, such processing is necessary for the purposes of legitimate interests the Companies seek as processors, as well as for processing for direct marketing and consumer profiling.

Right to Data Portability:

You have the right to receive your personal data free of charge in a format that allows you to access, use, and edit them, using commonly used editing methods. You also have the right to ask the Companies, if technically feasible, to pass the data directly to another processor. This right exists for the data you have provided to the Companies and is processed by automated means based on your consent or for the performance of a relevant contract.

In order to exercise any of the above-mentioned rights and for any relevant information you may refer to the Data Protection Officer (DPO) at the email addresses: dpo@neaodos.gr and/or dpo@kentrikiodos.gr

Right to file a complaint with the Data Protection Authority

You have the right to file a complaint with the Data Protection Authority (www.dpa.gr): Telephone: +30 210 6475600, Fax: +30 210 6475628, email: contact@dpa.gr

PERSONAL DATA SECURITY

The Companies NEA ODOS and KENTRIKI ODOS implement appropriate technical and organizational measures aimed at the safe processing of personal data and the prevention of accidental loss or destruction and/or unauthorized access to them, use, modification or disclosure thereof. To ensure the appropriate level of security against risks and to select appropriate technical and organizational measures, the Companies take into account the latest technological and other developments, the cost of implementation, the nature, the scope and purposes of the processing, as well as on the one hand, the likelihood and risk of occurrences of accidental loss or destruction and unauthorized and/or illegal access to personal data, use, modification or disclosure thereof and, on the other hand, the severity of the consequences for the rights and freedoms of natural persons.