The companies of the Athens Stock Exchange Group, namely:

a) The joint-stock company with the name "HELLENIC EXCHANGES - ATHENS STOCK EXCHANGE S.A." and the distinguishing title "ATHEX" with A.F.M. 099755108, D.O.Y. FAE of Athens,
b) The anonymous company with the name "HELLENIC CENTRAL SECURITIES DEPOSITORY S.A." and the distinctive title "ATHEXCSD" with A.F.M. 094449050, D.O.Y. FAE of Athens,
c) The anonymous company with the name "ATHENS EXCHANGE CLEARING HOUSE S.A." and the distinguishing title "ATHEXClear" with A.F.M. 999081508, D.O.Y. FAE of Athens,

are jointly responsible for the processing of personal data described in this information.

Contact information: phone +30 210 33 66 800, e-mail: protocol@athexgroup.gr.

The purpose of processing your data is to protect the persons and goods located in our Group's facilities. The data that we will process upon your entry is used to identify you, as an entering person, in the building facilities of our Group.

The legal basis for the processing described in this information is the legitimate interest of the Group Companies, which consists in ensuring the protection of persons and goods located in their facilities (Article 6 par. 1 f GDPR).

Our legal interest consists in the need to protect our site and the goods located in it from illegal acts, such as theft. The same applies to the safety of life, physical integrity, health and property of our staff and third parties who are legally present in the supervised area. We only collect image data and limit capture to critical areas (e.g. Data Rooms), as well as areas we have assessed as having an increased potential for illegal acts (e.g. theft), such as at the entrance/exit and perimeter of the building and in the parking lot, without focusing on areas where the privacy of the persons whose image is taken may be excessively limited, including their right to respect for personal data.

In the context of the above purpose, the following categories of your personal data are subject to processing:

1. Basic details of a natural person (name and surname)
2. Unique identifiers (Unique identifiers)
3. Car registration number
4. Time to enter the building
5. Signature
6. Image data

The data of the first to fifth category is obtained directly from you and/or through our internal addresses in the cases of the existence of specific lists of persons (eg guest lists for events, trainings, etc.).

Your image data is obtained through the video surveillance system installed on our premises.

Recipients of your data are exclusively the necessary, in any case, staff of the Group companies, who have received the appropriate information for the safe processing of your personal data.

In addition, recipients of your data are cooperating natural and legal persons who offer their services to the Group (performing the processing), such as the cooperating security company of our facilities. The processors have been informed and committed in advance to respect the confidentiality of your data, they are aware of and follow our instructions regarding the processing of personal data and take all appropriate measures to protect them.

In addition, the recipients of your data will be, where required, the competent judicial, prosecutorial and police authorities in the exercise of their duties.

In particular, the material resulting from the installed video surveillance system is not transmitted to third parties, with the exception of the following cases: a) to the competent judicial, prosecutorial and police authorities when it includes elements necessary for the investigation of a criminal act, which concerns persons or goods of the data controller, b) to the competent judicial, prosecutorial and police authorities when they request data, legally, in the exercise of their duties and only after examining whether the legal conditions for the transfer of such data are met, and c) whenever the transfer is foreseen or required by law or when permitted by law and serves legitimate and proportionate legal interests or the public interest.

Your personal data is kept only for the reasonable period of time required by the nature of the data processing and only for as long as is necessary to achieve its purpose, unless there is a contrary legal obligation to keep it further. In particular, the data processed through the video surveillance system are kept for fifteen (15) days, after which they are automatically deleted. In the event that we discover an incident during this period, we isolate part of the video and keep it for up to one (1) month, with the aim of investigating the incident and initiating legal proceedings to defend our legal interests, while if the incident concerns third we will keep the video for up to three (3) more months. If any data is eventually used, as evidence, in a legal claim by the Group, it is kept until the relevant legal dispute is finalized.

We promise that we have taken appropriate organizational and technical measures for the security and protection of your data from any form of accidental or unlawful processing. It is noted that our specially authorized staff, who process your personal data, have received appropriate training, guidance and information.

The measures we take are reviewed and modified at regular intervals or when deemed necessary based on new needs and technological developments.

Transfers outside the EEA
Your personal data is not transferred to countries outside the European Economic Area.

As a Data Subject you have the following rights:

• Right of access to your personal data
• Right to rectification of inaccurate personal data (for the processing carried out on your data, as a person entering our premises)
• Right to erasure/right to be forgotten
• Right to restriction of processing
• Right to object to the processing of your Data

If you wish to receive further information regarding the processing of your personal data or to exercise any of the above rights, you can contact the Group's Data Protection Officer at the email address: dataprotectionofficer@athexgroup.gr, or send a letter to the postal address mail: Leoforos Athinon 110, 104 42 Athens, quoting "To the Data Protection Officer", with a description of your request and we will take care to examine it and answer you as soon as possible.

In order to consider a request regarding your image, you will need to tell us approximately when you came into range of the cameras and provide us with an image of yourself to help us identify your own data and mask the data of third-party images. Alternatively, we allow you to come to our premises to show you the images in which you appear. We also point out that the exercise of the right to object or deletion does not imply the immediate deletion of image data or modification of its processing.

Our response to your request will take place within (1) one month of receiving it and will not incur any cost to you. The above deadline can be extended for a period of two (2) additional months, due to the complexity or number of requests, in which case you will be informed of the extension and the reasons for it as soon as possible and at the latest within a month of receiving the request.

In the event that: a) you consider that one of your requests has not been satisfied sufficiently and legally or b) you consider that the right to the protection of your personal data is violated by some processing that we carry out, you have the right to submit a complaint to the Personal Data Protection Authority (postal d /nsi Kifisias 1-3, PO Box 115 23, Athens, https://www.dpa.gr/, tel. 210 6475600, e-mail: contact@dpa.gr).

Your personal data is not transferred to any countries outside the European Economic Area.