This update concerns the processing of your personal data carried out "HELLINIC SECURITIES DEPOSITORY S.A." (hereinafter "AXIACSD" or "Company") in the context of your capacity as a user of the "AXIAweb" service, which aims to inform you as an investor - beneficiary of a share and account of securities in the Intangible Securities System (S.A.T.). Please read this text in order to be informed in detail about the terms of processing your data:

1. Controller

   The Company is, in accordance with the General Data Protection Regulation 2016/679 ("GDPR"), the controller of personal data processed in the context of using the Service. The headquarters of the Company is located in Athens, on Athens Avenue, no. 110, Postal Code 104 42, contact phone: +30 210 33 66 800, e-mail: protocol@athexgroup.gr

2. Source & Categories of Personal Data

   The personal data processed by the Company is collected directly from you and is:
   • Basic data of a natural person: name, surname, patronymic, date of birth, identification certificate number, VAT number, AMKA.
   • Contact details: email, mobile phone, contact address.
   • Application usage data and metadata (e.g. username, Service access logs, IP address)

3. Purpose of processing

   The personal data collected by the Company are processed exclusively for the purpose of: a) obtaining access and providing the possibility to use the Service, in your capacity as a user and b) the security of the Company's information systems that support the Service.

4. Legal basis for data processing

   In the context of using the Service, the Company processes your data according to the following legal bases:

   • Contract Execution (Article 6, par. 1b GDPR)

     The processing carried out by ATHEXCSD in pursuit of the above purpose a) is necessary for the execution of the contract for the issuance of user codes and the provision of access to the AXIAweb service signed between the Company and the investors - beneficiaries of shares and securities accounts in the Intangible System Titles (S.A.T.).

   • Legitimate Interest (Article 6, par. 1f GDPR)

     In addition, in pursuit of the above purpose b), the Company processes personal data in the context of its legal interest which consists in protecting the security of the network, systems and information of ATHEXCSD.

5. Recipients of personal data

   ATHEXCSD ensures that access to your personal data is exclusively available to the necessary, in any case, Company personnel, who have received the appropriate information for the secure processing of your personal data.
   In addition, recipients of your data are natural and legal persons, to whom the Company assigns the execution of specific tasks on its behalf such as, among others, system maintenance and technical support providers, software service providers and information security service providers. The persons in question, acting as processors of personal data, have been informed and committed in advance to respect the confidentiality of your data, are aware of and follow our instructions regarding the processing of personal data and take all appropriate measures to protect of these. Finally, recipients as independent Processors may also be the competent supervisory authorities.

6. Data transfers to countries outside the European Economic Area (EEA) or to an international organization

   Your personal data is not transferred to third countries (outside the EEA).

7. Data retention period

   Your personal data are kept only for the reasonable period of time required by the nature of their processing and only for as long as necessary to achieve its purpose, unless there is a contrary legal obligation to keep them.

8. Rights of the subject of personal data

   According to the GDPR, as a data subject, you have the following rights, which may be exercised on a case-by-case basis:
   • Right to access your personal data.
   • Right to correct and/or complete your data.
   • Right to erasure/right to be forgotten.
   • Right to restriction of processing.
   • Right to object to the processing of your data.
   • Right to portability of your data.

9. Exercise of rights

   If you wish to receive further information regarding the processing of your personal data or to exercise any of your above rights, you may contact the Company by physical mail to Hellenic Central Securities Depository S.A., 110 Athens Avenue, 104 42