1. Introduction

1.1 Company Commitment
Personal data protection is a key priority for “PIRAEUS TOWER SOCIETE ANONYME MANAGEMENT DEVELOPMENT AND EXPLOITATION OF THE COMMERCIAL SHIPPING CENTER PIRAEUS”, with the trade name “PIRAEUS TOWER S.A.” (hereinafter “the Company”). The Company respects the privacy and is committed to observing the professional secrecy and in general protecting individuals from the processing of personal data.

1.2 Purpose and Scope
With a view to achieving transparency in the collection and use of your personal data, this General Privacy Notice (the “Notice”) is intended to inform you of the categories of personal data we collect and process, as well as of the manner in which and the purposes for which we collect, store, use and transmit such personal data, as the case may be.

2. Definitions

2.1 Personal Data
Any information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

2.2 Special Personal Data Categories (Sensitive Personal Data)
Personal data which are, by their nature, particularly sensitive in relation to fundamental rights and freedoms merit specific protection, as the context of their processing could create significant risks to the fundamental rights and freedoms. Any information relating to a natural person’s racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, and genetic data, biometric data, data concerning health or data concerning a natural person’s sex life or sexual orientation.

2.3 Data Subject
The natural person to whom the personal data relate.

2.4 Data Processing
Any operation or set of operations performed on personal data or sets of personal data, regardless of the manner in which it is performed, such as collection, recording, organisation, structuring, storage, adaptation / alteration, retrieval, use, transmission or otherwise making available, alignment / combination, restriction, erasure / destruction.

2.5 GDPR
The European General Data Protection Regulation (GDPR) 2016/679, which entered into force on 25 May 2018 and establishes a uniform legal framework for the protection of personal data in all EU Member States and any reference thereto should be interpreted to include national implementing legislation.

2.6 Data Controller
The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. For the purposes of this Privacy Notice, the Data Controller means the Company that alone or jointly with others determines the purposes and means of the processing of personal data.

2.7 Data Processor
The natural or legal person, public authority, agency or other body which processes personal data on behalf of the Controller.

3. Data Controller

PIRAEUS TOWER SOCIETE ANONYME MANAGEMENT DEVELOPMENT AND EXPLOITATION OF THE COMMERCIAL SHIPPING CENTER PIRAEUS
Registered Office: 115, Neratziotissis Str., Postcode 151 24, Maroussi, Attica, Greece
Telephone: + 30 210 8774200
Fax: + 30 210 6801160
General Commercial Registry (GEMI) no.: 154019701000

For any matter relating to the processing of personal data please contact directly by email at: info@piraeustower.gr

4. Legal Basis for the Processing of your Personal Data

4.1 Legal Basis
Your personal data will be processed by the Company in accordance with the legal “justification” of such processing, to the extent required or permitted by applicable law. The processing of special categories of personal data (including data relating to health, sex life, racial or ethnic origin, or religious beliefs) shall always require additional justification, as set out below.

In most cases, the processing of your personal data will be justified according to one of the following bases:
• for the performance of a contract to which the data subject is a party;
• for the fulfilment of the corporate purpose and for accommodating the Company’s business operations in general;
• for compliance with an obligation imposed by law, such as regulatory compliance, compliance for tax purposes, etc.;
• to safeguard and protect the Company’s legitimate interests;
• based on the consent you provide under the specific conditions set by the legal framework, in order to receive updates on the Company’s activity, services, etc.

The processing of special categories of personal data will be justified by one of the above mentioned conditions and, usually, by one of the following special conditions:
1) It is necessary for the purposes of the discharge of the Company’s obligations under labour law.
2) It is necessary for the establishment, exercise or defence of the Company’s legal claims.
3) In exceptional circumstances, it is necessary in order to protect your vital interests and you are unable to give your consent.

5. What types of Personal Data we collect and how we use them

5.1 Data of BoD Members / Shareholders
In the context of its statutory organisation and operation, the Company collects and processes personal data of the Members of the Board of Directors, as well as of its Shareholders, which are absolutely necessary for the Company’s compliance with its legal and statutory obligations. In this framework, the Company collects the following data: Full Name, Home Address, Work Address, Mobile Phone, Home Phone, Degrees /Qualifications, Identity Card/ Passport information, CV, statements on the avoidance of conflicts of interest and on scrutiny of transactions with related parties, information on criminal convictions, tax clearance, certificates of non-bankruptcy.

We collect your data for the following purposes:
• The Company’s compliance with its statutory, regulatory and legal obligations, including the Company’s transparency obligations.
• Fulfilment of the corporate purpose and accommodating the Company’s business operations in general; The legal basis is the Company’s legitimate interest in the support and performance of key functions, the improvement of operation and the fulfilment of its main purpose of operation.

5.2 Data of visitors to the Company’s facilities
The Company collects and processes personal data of visitors to its facilities and in particular, name, professional or other capacity and contact information.

We collect your data for the following purposes:
• Communication and arranging meetings with Company executives. The legal basis is the Company’s legitimate interest in the support and performance of key functions, the improvement of operation and the fulfilment of its main purpose of operation.

5.3 Data of suppliers, partners and other counterparties
The Company cooperates with third parties (suppliers/ external partners) to accommodate its statutory purposes and its daily operational needs. In this framework, the Company collects, among others, the following data: name, Identity Card number, permanent residence and commercial premises address, e-mail, telephone number, Tax Identification Number and Local Tax Office, bank account number, IBAN, etc.

We collect your data for the following purposes:
• The fulfilment of our legal obligations as a Société Anonyme. The legal basis is the processing of your data for tax compliance with obligations imposed by law.
• The management of the contractual relationship. The legal basis is the need for processing within the framework of the contractual relationship.
• Fulfilment of the corporate purpose and accommodating the Company’s business operations in general; The legal basis is the Company’s legitimate interest in the support and performance of key functions, the improvement of operation and the fulfilment of its main purpose of operation.

5.4 Data of landlords, tenants and buyers of real estate
The Company collects and processes personal data of landlords, tenants and buyers of real estate, specifically name, address, telephone number, Tax Identification Number and Local Tax Office, property ownership information, etc.

We collect your data for the purpose of searching for and assessing new investments (purchase of real estate), performing property valuations (new investment), periodic valuations of the Company’s properties, managing legal issues and providing legal advice, acquiring new real estate (legal / technical due diligence), evaluating counterparties in terms of audits to avoid money laundering and terrorist financing, as well as technical due diligence for the assessment of investments. The processing of these data is necessary for compliance with a legal obligation and for the performance of the relevant contract, while processing may be carried out to the extent necessary to serve the legitimate interests of the Company and its regulatory obligations (fulfilment of the corporate purpose, defence of legal claims, support and discharge of basic functions).

5.5 Data of users of the Company’s website
The Company collects and processes personal data submitted by Users through the e-mail address stated on the Company’s Website (info@piraeustower.gr).

We collect your data for the purpose of replying to your request; the legal basis is the Company’s legitimate interest in the support and performance of key functions, the improvement of operation and the fulfilment of its main purpose of operation.

6. Transmission of Personal Data
Personal data that you provide to us are held and kept securely. We may share your information:
• With our group of companies to the extent that this transmission is necessary for the pursuit of our purposes.
• With Supervisory, Judicial, Independent and other Authorities at national and European level, in the context of issuing fines, upon request or whenever necessary.
• To third parties (legal or natural persons) who will process your personal data for the pursuit of our purposes in accordance with our written instructions and formalities (Personal Data Processors).

When information is transmitted in accordance with the above, we limit the scope of the information communicated to what is strictly necessary to achieve that purpose. Any transmission of your data to third countries outside the European Economic Area (i.e. Outside European Union Member States, Norway, Iceland, and Liechtenstein) will only be made in compliance with the legislative framework governing data protection and only when adequate safeguards for the protection of your data are provided.

7. Personal Data Security
The Company attaches great importance to the issue of personal data security and for this reason we take measures to securely process personal data and to prevent accidental loss or destruction and unauthorized and/or unlawful access, use, modification or disclosure. We have put in place appropriate physical, electronic, and administrative procedures to safeguard the information we collect. We have no control over the privacy of email messages until they reach us. We recommend that you do not include confidential, private or sensitive information in your emails.

8. Update on the use of cookies
We do not use cookies to collect and store information about visitors to our Website. This means that we do not know how you scroll, what you click on or how you use our Website. Therefore, we have no idea of who you are and we cannot monitor or track you either in or out of our Website.Simply put: your visit to our Website is not tracked in any way and you are completely anonymous.

9. Data retention duration
The personal data processed by the Company must be kept for as long as necessary for the fulfilment of the purpose of processing. Upon expiration of this (duration), the data shall be deleted unless otherwise specified by the applicable legislative and regulatory framework or to the extent required to defend the rights of the Company before a Court of Justice or other competent Authority.

10. Your rights and how to exercise them
Any natural person whose data are processed by the Company shall enjoy the following rights in accordance with applicable law:

Right to Information
The Company must inform you regarding the processing of your data, for instance what data it processes, for what purpose, for how long it keeps such data in a concise, transparent, intelligible and easily accessible form, using clear and plain language.

Right to Access
You have the right to obtain from the Company confirmation as to whether or not your personal data are being processed and, where that is the case, you have the right to access such data.

Right to Rectification
The Company must inform you regarding the processing of your data, for instance what data it processes, for what purpose, for how long it keeps such data in a concise, transparent, intelligible and easily accessible form, using clear and plain language. You have the right to request that the Company rectify inaccurate personal data and complete any incomplete data.

Right to Delete
You have the right to request that the Company delete your personal data, provided that these have been given with your consent and provided that they are no longer required for the fulfilment of the purposes described above, or to meet our legal, tax or accounting requirements or to defend our rights before any competent Court or any other Authority.

Right to Restriction of Processing
You have the right to require that the Company restrict the processing, subject to conditions.

Right to Portability
You have the right to request from the Company to receive your personal data, in a structured, commonly used and machine-readable format, or to be transmitted to another provider without objection.

Right to Object to the Processing for a Legitimate Interest
You have the right to object, at any time, to the processing of your personal data. The Company in this case should stop the processing, unless it demonstrates compelling and legitimate reasons which override your interests, rights and freedoms as a data subject or for the establishment, exercise or defence of legal claims.

You can exercise your rights via our Website using the e-mail address below:
info@piraeustower.gr

We undertake to respond within one (1) month from the receipt of your request. Note that the said deadline may be extended by an additional two (2) months in view of the complexity of your request, as well as the number of requests in general.

Furthermore, our Company undertakes to inform you, without undue delay, of any breach of your personal data, which may seriously jeopardize your rights and freedoms and provided that it does not fall within one of the exceptions expressly provided by law. In any case, if you discover a breach of the protection of your personal data, you have the right to appeal to the Hellenic Data Protection Authority.

Right to lodge a complaint with the HDPA
You also have the right to lodge a complaint regarding the processing of your personal data with the Hellenic Data Protection Authority (HDPA). You can contact HDPA in the following ways:
• Website: www.dpa.gr
• Switchboard: +30 210 6475600
• Fax: +30 210 6475628
• E-mail: complaints@dpa.gr

11. Links – Links to other sites
This Website may contain links or references to other websites that are beyond our control. Such links have been placed for the sole purpose of facilitating visitors/users while browsing the internet. Please note that we have no control over these sites and that the Privacy Notice does not apply to them. We advise you to read the privacy notices and the terms and conditions of the linked or referenced websites you visit. User is solely responsible when accessing websites by using the links provided.

12. Updates – changes to this Notice
The Company reserves the right to modify, update, revise, or otherwise alter this Notice from time to time, if it so deems necessary, without prior notice in accordance with the law. For this reason, please check this Notice at regular intervals to be informed of any modified versions. Updates will be posted on our website with a last modification date, so you will always be aware of our most up-to-date Notice.

Privacy Notice was last updated: 16.11.2021