Privacy Statement

PPC S.A. hereby discloses the principles on the basis of which it handles, in the context of its Group's activity in the field of energy and related products and services, the personal data that come to its knowledge, in full compliance with the requirements of the General Data Protection Regulation 2016/679/EC (hereinafter referred to as GDPR).

Through this Notice, PPC S.A.:

• Informs its customers, partners, and, in general, those who conduct transactions with the company (data subjects) in what capacity, for what purpose, and on what lawful basis it processes personal data, the meaning of which is specified below.
• It informs about the possibility for data subjects to contact PPC S.A. for any issue related to the processing of their personal data, the possibility to exercise their rights to access, rectification and, where applicable, erasure, restriction, and object to the processing of their personal data, as well as the possibility to lodge a complaint with the Personal Data Protection Authority in relation to any breach of their personal data protection rights.

Please carefully read this Privacy Statement, as well as the more detailed Personal Data
Protection Policy.

If you need further information or clarification, you may contact the Office of the Data Protection Officer of PPC via e-mail at dpo.office@dei.gr.

Contents:

Purposes of Processing
What personal data do we use?
On what legal grounds do we process your personal data?
To whom may we disclose your personal data?
Transfer of your personal data to third countries
How do we ensure the confidentiality and security of your personal data?
How long do we keep your personal data?
What are your rights under the General Data Protection Regulation?
How can you lodge a complaint?
Cookie Policy
Amendment of the personal data protection policy

1. Purposes of Processing

1.a. For customers, prospective customers, and persons in general who contact the Company, as well as recipients of newsletters and other updates:

The purpose for which we collect and process your personal data is the conclusion (precontractual stage) and performance of the PPC-Customer contract in the context of the
products and services offered.

In particular, in the context of the above purpose, the processing of personal data serves the
following:

Providing the possibility of electronic payment through PPC’s website or third payment service providers and electronic management of your bill
Informing you about new products and services of PPC Group
Conducting customer satisfaction surveys
Participating in Contests, in case you choose/agree to participate
Customer profiling for personalization of communication and offers, aiming to improve customer experience
Improving procedures and analyzing needs
Establishing, exercising, or defending legal claims of any kind, directly or through its external
associates
Fulfilling legal obligations towards Authorities

1.b. For Associates (suppliers and other associates in general):

The purpose for which we collect and process your personal data is the conclusion (precontractual stage) and execution of the PPC-Customer contract in the context of the products and services offered.

In the context of the above purpose, the processing of personal data may also serve:

extracting and analyzing data concerning transaction data and any financial data related to the fulfillment of mutual obligations
informing about new activities and opportunities for cooperation
fulfilling legal obligations towards Authorities

2. Which personal data do we use, and how do we collect it?

We will process the personal data that is absolutely necessary for the purpose at issue each time/as set out above; personal data consists of:

Personal data that you declare to PPC employees or representatives of PPC with your physical presence in PPC Stores or infrastructure in general
Personal data that you enter electronically on our website or send via e-mail to the competent PPC Services or representatives thereof (identification data, contact details, relation with the supplied property, details of special tariffs beneficiaries)
Personal data that is automatically collected through cookies when browsing
Personal data that you enter electronically during your participation in special actions such as contests, surveys, contact forms, chatbots (software interactive robot), etc.

3. On what legal grounds do we process your personal data?

a) processing is necessary for the fulfillment of our contractual relationship (Article 6 (1) (b) of the GDPR);
b) processing is necessary for compliance with the legal obligation of the company (tax, insurance, accounting requirements under the law, etc.) (Article 6 (1) (c);
c) processing is necessary for the purposes of pursuing or protecting the legitimate interests of the company (Article 6 (1) or (f) of the GDPR);
d) your consent to the personal data processing (Article 6 (1) (a) of the GDPR), as may be provided for/requested each time.

4. To whom may we disclose your personal data?

Your data is processed by PPC employees responsible for managing contracts and providing related services and products.

Your personal data is not transferred or disclosed to third parties without prejudice to the following cases and subject to the regulations and conditions laid down by the legislation:

Financial Institutions, DIAS Interbank Systems, and other legally licensed Payment Providers or Electronic Money Agents for the purposes of electronic payment
Companies to which PPC assigns the issuance and dispatching of bills and other support services related to contract execution, such as issuing and dispatching invoices
Companies to which PPC assigns services such as phone or electronic customer support, conducting customer satisfaction surveys, promoting new products and services through phone calls, e-mails, SMS, and any other legal and appropriate way of multimedia communication
Alternative Suppliers in special cases of switching Supplier where there are overdue debts
Judicial Authorities and Public Administration bodies such as tax authorities, social security bodies, law enforcement authorities
Transfer to debtor notification companies, associate lawyers, law firms and bailiffs, notaries for debt collection
Transfer to companies providing solutions and services in the field of its organization and administrative support, development, maintenance, configuration of IT applications services, e-mail services, digitalization and record-keeping services, web management, social media services, and web hosting services, including cloud services, under the provisions laid down in Article 28 and the relevant provisions of the GDPR
Advertising companies, in order to carry out market surveys and promotions of new products and services
Companies within PPC Group, subsidiaries of PPC, as well as HEDNO.

5. Transfer of your personal data to third countries (outside the EU)

PPC or its authorized partners may transfer personal data collected and processed to controllers or processors, e.g., cloud service providers, third countries outside the European Union.

The transfer of data to third countries is subject to the requirements and conditions of Articles 44-49 of the GDPR.

In this case, PPC provides appropriate safeguards for the processing of personal data outside the European Union. Moreover, it will fully notify the Hellenic Data Protection Authority, if necessary, in line with the relevant provisions of the GDPR and the applicable legislation in general.

6. How do we ensure the confidentiality and security of your data?

PPC uses technical, physical, and organizational security measures in order to secure the integrity and confidentiality of personal data. It applies security technologies to protect data from unauthorized access, improper use, conversion, illegal or accidental destruction, and accidental loss and continues to enhance its security processes.

The personal data collected by PPC in the context of the operation of the website and the provision of services through it is strictly confidential. PPC applies adequate security systems and takes all necessary and appropriate organizational and technical measures in order to prevent any breach of personal data security and applies what is required to protect personal data in particular from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access by unauthorized persons.

7. How long can we keep your personal data?

PPC keeps all the above data, in accordance with the current institutional framework and in conjunction with Law 1040/1980 (National Official Gazette Volume A, issue 76 / 3.4.1980), which is in force and applicable specifically for PPC.

8. What are your rights under the General Data Protection Regulation?

In accordance with the General Data Protection Regulation 679/2016/EU and national legislation, you have the right to be informed, both during the collection phase and afterward, about the processing of your data, its purpose, and its disclosure/transmission to third parties and their identity (right to information and access).

You also have the right to request the rectification, updating, or erasure of your personal data retained by PPC.

Moreover, you have the right to restriction of processing and the right to object.

Any natural person whose data is processed by PPC on the legal basis of consent is entitled to withdraw consent to collect and process their data at any time.

In this case, the data shall be erased, unless its further retention is required by law as per case, is necessary on grounds of public interest, for the purposes of archiving, for historical, scientific research purposes or statistical purposes, as well as for the fulfillment of a legal obligation of PPC, or the establishment, exercise, or defense of a right and /or legal claims before courts.

If you wish to exercise any of the above rights, you can use the relevant form in the following link.

You can exercise your rights directly via e-mail at customercare@dei.gr or by submitting the form to one of PPC Stores.

For further information and for exercising rights, users/visitors may contact the Data Protection Officer at dpo.office@dei.gr or by submitting their request in writing at the following address: 30 Chalkokondyli st., GR- 104 32 Athens.

9. How can you lodge a complaint?

In accordance with the GDPR, users/visitors have the right to lodge a complaint with the Hellenic Data Protection Authority (1-3 Kifissias Ave, GR-115 23 Athens, www.dpa.gr/en).

10. Cookie Policy

What are cookies?
Cookies are small text files that websites store on your computer or mobile device when you visit a site. The purpose is to enable the site to remember your actions and preferences for a certain period to provide a more user-friendly service. In addition, some cookies serve the commercial promotion or/and marketing of PPC.

Why do we use cookies?
PPC uses cookies primarily to ensure that your visit to its website is as pleasant as possible, as well as for advertising-related purposes during your future visits to other websites. A more detailed overview of the categories of cookies that we use in PPC's Personal Data Protection Policy.

11. Amendment of the personal data protection policy

The Personal Data Protection Policy may be amended whenever required to comply with national and European law. For this reason, you are invited at regular intervals to visit this page for your information.