Privacy Notice to the Shareholders of OPAP S.A

Introduction

The Organisation of Football Prognostics (hereinafter "OPAP S.A." or "we"), having its registered seat at 112 Athinon Avenue, Athens, is according to the applicable legislation, responsible ("Data Controller") for processing your personal data in accordance with the applicable legislation and regulatory requirements.

The present Privacy Notice aims at informing you on the type of personal data that we collect for you, on the way and the purposes for which we collect your data, on the third parties with which we share such data, as well as on your rights, in order for OPAP S.A. to comply with the applicable Greek Law on Data Protection, L. 4624/2019, as well as with EU Regulation 2016/679 "on the protection of natural persons with regards to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC" (GDPR).

Categories of personal data that we collect and process

The main categories of personal data concerning the Shareholders and which the Company processes for legitimate purposes of processing include the following:

a) Identification data and demographic data, such as identification documents (such as name and surname, father's name, number of identity card or passport or other equivalent document, tax identification number, competent Tax Office, residence etc.),

  • b) Contact information such as postal and e-mail address, fixed and mobile telephone number,

  • c) Ownership of OPAP shares (such as number and type of shares, any legal relationship under which the shares are held or the voting rights attached to them are exercised),

  • d) Investor Account Number and Securities Account number in the Dematerialized Securities System (DSS), Shareholder Register Number,

  • e) Data relating to the capacity in which the Shareholder participates in the General Meeting of the Company and the relevant supporting documentation, details of the shares and of any rights they hold over such shares, information regarding any trading activity of shares,

  • f) Data relating to the participation and the exercise of the voting right of the Shareholder in the General Meeting of the Company, information regarding any requests addressed to the Company, signature of the Shareholders and in general any information in the context of implementing the current rules on financial instruments markets,

  • g) Audio-visual data of the shareholder's or their proxy's participation at the General Meeting.

Why we process personal data

The Company collects the personal data of the Shareholders, pursuant to the above and in general processes them, for the fulfilment of legitimate purposes of processing and always according to valid legal basis which establishes the lawfulness of the processing.

Specifically, the Company processes the personal data of the Shareholders in order to:

  • (a) Identify the Shareholder,

  • (b) Communicate with the Shareholder,

  • (c) Allow and facilitate the exercise of the Shareholder's rights,

  • (d) Comply with legal obligations, as defined by Laws 4548/2018 and 4706/2020, Regulation (EU) 909/2014 of the European Parliament & of the Council, Commission Implementing Regulation (EU) 2018/1212, Law 4569/2018, the Rulebook of the Hellenic Central

    Depository (hereinafter the "ATHEXCSD Rulebook") and all other applicable rules and regulations related to the purposes of the foregoing legislation. Indicatively, the Company processes personal data in order to maintain its Shareholder Registry, disclose transactions of liable persons to the Athens Stock Exchange and monitor transactions on the Company's shares,

  • (e) Perform corporate actions (e.g. dividend distribution, share capital increase, transfer of shares etc.),

  • (f) Exercise and defend its legal rights in order to pursue its legitimate interests, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subjects which require protection of personal data,

  • (g) Publish acts and information of the Company in the General Commercial Registry (G.E.M.I.), the Athens Stock Exchange or on the website of the Company, as required by law,

  • (h) Respond to requests of the Shareholders, carry out requests of the Shareholders in connection with the services provided by the Company (e.g. issuance of certificates), provide answers and clarifications to specific inquiries or requests addressed to the Company by the Shareholders,

  • (i) Keep a historical archive of the Company's Shareholders.

Recipients

The processing of your personal data will be carried out by the competent employees of OPAP

S.A. who are duly authorized to act in order to ensure the Company's compliance with the

applicable legal and regulatory framework.

The Company shall not transmit, communicate or disclose the personal data of the Shareholders to any person other than:

(a) Natural persons and legal entities to which the Company assigns the execution of certain tasks on its behalf, such as, inter alia, to providers of technical and support services, database management companies, file storage and recordkeeping companies, postal services providers, providers of services related to the development, maintenance and customization of IT applications, e-m ail services providers, web hosting services providers including cloud services, in general to providers of services, to lawyers, law firms, accountants, chartered auditors-accountants or audit firms, to external advisors and collaborators of the Company.

  • (b) The société anonyme under the name "Hellenic Central Securities Depository S.A.".

  • (c) Competent supervisory, audit, tax, independent, administrative or judicial authorities such as Hellenic Capital Market Commission, Hellenic Gaming Commission, National Betting Authority of Cyprus, Bank of Greece and General Commercial Registry (G.E.M.I.), Anti-Money Laundering Authority insofar as this is imposed by the applicable legal and regulatory framework, following relevant request or when it ought to submit a report with the said data, without giving you any special prior notice.

(d) Other Shareholders of the Company, as appropriate, in accordance with the law.

Retention Period

The personal data will be kept by the Company for the period of time as set out by law and in general as required by law and pursuant to the legal and/or regulatory framework in force or as required for the purposes of legitimate interests of the Company, for the exercise of claims and for the defense of the Company in case of litigation, for the pursuit of claims of the Company as well as for the performance of its contractual obligations, and in general in accordance with the current applicable legal basis and the purpose of their processing.

Your rights

You have the right to access, namely the right to be informed, following your request, on the extent to which your personal data is being processed and to receive further information regarding the processing carried out. Furthermore, you have the right to request the correction of inaccurate personal data of yours or the supplementation thereof, and if the conditions set out in Law are met, to exercise the right of deletion, the right of processing limitation, the right of data portability, andthe right to object to processing, subject to the conditions stipulated in the GDPR for the exercise of such rights.

Our commitments

We commit to maintain your data updated and accurate, and not to publish or otherwise process data that is not required.

Contact information

For any request regarding the processing of your data, as well as in case you ascertain that we have not observed the principles stipulated in the present Privacy Notice, we kindly ask you to address, the soonest possible, OPAP S.A.'s Data Protection Officer using the following contact details: Website:www.opap.gr/gdpr| Address: L. Athinon 112, 10442, Athens | Phone Number: +30 210 5798910 |Email addressdpo@opap.gr.

In case you consider that we have not properly addressed your complaint and the protection of your personal data is violated in any way, you may lodge a complaint through the special online platform:https://www.gov.gr/arxes/arkhe-prostasias-dedomenon-prosopikou-kharaktera and the website of the Hellenic Data Protection Authority(www.dpa.gr|Address: 1-3 Kifisias Ave., 115 23, Athens | Call Center: +30 210 6475600 | Fax: +30 210 6475628). Detailed instructions for submitting a complaint are provided on thewebsite of the Authority(https://www.dpa.gr/en/individuals/complaint-to-the-hellenic-dpa).

Attachments

Disclaimer

OPAP SA - Greek Organisation of Football Prognostics published this content on 02 April 2024 and is solely responsible for the information contained therein. Distributed by Public, unedited and unaltered, on 02 April 2024 15:05:06 UTC.