Privacy Policy

"Personal data": any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one whose identity can be ascertained, directly or indirectly, in particular by reference to an identifier such as a name, an identity number, location data, an online identifier or factors that characterise physical, physiological, genetic, psychological, economic, cultural or social identity.

"Special categories of personal data": personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as genetic data, biometric data for the purpose of identification, data concerning health or data concerning sexual life or orientation.

"Processing": any act or series of acts carried out with or without automated means on personal data, such as collection, registration, organisation, storage, adaptation, retrieval, use, disclosure, dissemination, combination, restriction, deletion or destruction.

"Anonymisation": the processing of personal data in such a way that the data can no longer be attributed to a specific data subject.

"Pseudonymisation": the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information kept separately and subject to appropriate technical and organisational measures.

"Controller": the natural or legal person, public authority, agency or other entity that, alone or jointly with others, determines the purposes and manner of processing personal data.

"Processor": the natural or legal person, public authority, agency or other body that processes personal data on behalf of the controller.

"Consent": any free, specific, express and fully-informed indication of the data subject's agreement to processing, by statement or by clear affirmative action.

"Personal Data Breach": the breach of security resulting in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access to personal data.

"Existing legislation": includes Law 2472/1997, Law 3471/2006, Directive 2002/58/EC, and the GDPR (Regulation (EU) 2016/679).

Euroxx, in the context of its services and operations, may collect personal data of its customers, as well as visitors and users of the Website's services.

A. Data from Euroxx operations

1. Pre-contractual and contractual relationship data:

In the context of fulfilling our obligations, both during the pre-contractual stage and during the execution of our contract with our customers, we collect and process personal data, such as:

• i. Identification information: Surname, First Name, Date of Birth, Nationality, ID/Passport number, Date and Issuing Authority, TIN, Tax Office, Country of Tax Residence, AMKA, etc.
• ii. Contact details: Street, Number, City, Postal Code and Region/Country, Home and Work Phone, Mobile Phone, Fax and E-mail.
• iii. Professional status details: Profession, Street, Number, City, Postal Code and Region/Country.
• iv. Bank account details: Bank, IBAN, account number.
• v. Evidence of origin of funds to be invested: liquidation notes, contracts of sale of assets, documents of acquisition of assets through inheritance or will, bank account statements, etc.

Purpose: Identification and communication with the client, execution of investment and ancillary services, compliance with legal obligations (e.g. AML prevention).

2. Suitability / compatibility assessment data:

• Personal information: investor type, marital status, current employment, nationality, education level, etc.
• Investment profile: experience, familiarity with financial instruments, frequency of transactions, current composition of investments.
• Investment objective / risk profile: age, investment goal, investment horizon, percentage of available funds, risk tolerance.
• Financial data: regular annual income, professional activity, joint assets, sources of income, main assets, regular financial obligations and monthly expenses.

Purpose: Evaluating the client's investment profile, assessing suitability of instruments or services, and categorising the client for product governance requirements.

B. Data collected via the website

1. Z Trade / EUROXX ZTRADEPLUS registration: Surname, First Name, Patronymic, Identity Number, VAT number, email, AX Code. Legal basis: execution of the contract between the Company and the customer.

2. Newsletter subscription: Email address only. Legal basis: your consent. You may request unsubscription at any time via the unsubscribe option.

3. Contact Form: First and last name, email, comments, and optional subject field. Legal basis: our legitimate interest in responding promptly to your requests and providing a high level of service.

Euroxx may transfer the personal data it collects to third parties in the context of fulfilling its contractual, legal and/or regulatory obligations, as well as for the defence of its legitimate interests. In particular, Euroxx may transmit personal data, indicatively, to:

• Third parties cooperating with it, to facilitate/carry out investment transactions (e.g. affiliated agents, intermediaries, etc.).
• Cooperating companies providing relevant services to Euroxx such as insurance companies, law firms, etc. — all contractually bound to Euroxx and the obligation of confidentiality.
• Public authorities and other independent authorities (e.g. Police, Prosecution Authorities, Athens Stock Exchange, Capital Market Commission, etc.).

For transfers outside the EU/EEA, Euroxx ensures either an EU Commission adequacy decision exists for the third country or that appropriate GDPR safeguards are in place. Otherwise, transmission is prohibited unless a specific GDPR exception applies (e.g. explicit consent of the subject, necessity for contract execution, reasons of public interest, support of legal claims, vital interests of the subject, etc.).

The personal data collected and processed by Euroxx are kept for a predetermined and limited period of time, depending on the purpose of the processing, after which the data is deleted from the Company's records, unless a different retention period is provided for or permitted by applicable law.

Euroxx may in certain cases process information that constitutes personal data by automated means, in order to evaluate your investment profile (profiling). In particular, the Company may use automated decision-making tools, when:

• Required by the regulatory and legislative framework (e.g. MiFID II — Directive 2014/65/EU as incorporated into national legislation with L.4514/2018; L.4557/2018 on AML prevention).
• Necessary for finding suitable services that meet your needs, in the context of the execution of the contractual relationship.

In any case, customers retain the right to object at any time and to request human intervention during automated processing of their data.

Euroxx ensures and takes the appropriate measures so that you can exercise your rights at any time regarding the collection and processing of personal data concerning you. These rights are the following:

• 1. The Right to information and access to data.
• 2. The Right to correct data.
• 3. The Right to delete data ("right to be forgotten").
• 4. The Right to restrict data processing.
• 5. The Right to data portability.
• 6. The Right to object to data processing and in particular to automated decision-making, including profiling.
• 7. The Right to withdraw consent.

Euroxx can refuse to satisfy in whole or in part a relevant request only when this possibility is provided by the Regulation or national legislation.

To exercise all the above rights, you can contact the Data Protection Officer:

In the event that any of the above requests/rights are exercised, the Company will arrange for the response to your request and its satisfaction, if possible, within thirty (30) days from the identification of the submitted request, informing you in writing of its satisfaction progress.

For any complaint regarding this policy or personal data protection issues, if we do not respond satisfactorily to your request, you may contact the Greek Personal Data Protection Authority: www.dpa.gr.

Euroxx has appointed a Data Protection Officer (DPO). Contact details:

Euroxx may amend this Privacy Policy from time to time for reasons of compliance with regulatory changes or in order to respond to the needs of its operation and its legal obligations. Updated versions of this Privacy Policy will be posted on this Website with a date, so that it is known which is the most recently updated version.

Revision: May 2019

These Terms and Conditions are governed and interpreted by Greek law.

These Terms and Conditions are governed and interpreted by Greek law. The parties agree that an effort will be made to amicably resolve any dispute arising in relation to these Terms and Conditions. In case it is not possible to resolve them amicably, the courts of Athens are designated as competent for the resolution. By using the Company Website, you expressly and unconditionally accept the above terms.

The Company bears no responsibility, direct or indirect, for any damage (positive or negative) that may occur to anyone from the use of the Website

The Company bears no responsibility, direct or indirect, for any damage (positive or negative) that may occur to anyone from the use of the Website and / or elements contained in ’ him, regardless of whether the relevant information is provided by the Company or by a third party.

The Company makes every effort to ensure that the Website content is as up-to-date, secure and error-free as possible, but in no case does it absolutely guarantee the accuracy and correctness of the data/information contained therein. In any case, the user of this Website is solely responsible for evaluating the published content and the Company bears no responsibility for any risk or damage suffered by the user from the use of its content.

The Company makes every effort to ensure that the Website content is as up-to-date, secure and error-free as possible, but in no case does it absolutely guarantee the accuracy and correctness of the data/information contained therein. In any case, the user of this Website is solely responsible for evaluating the published content and the Company bears no responsibility for any risk or damage suffered by the user from the use of its content.

The Company may modify these Terms of Use and Conditions from time to time for reasons of compliance with regulatory changes, for reasons of optimizing its operations and services.

The Company may modify these Terms of Use and Conditions from time to time for reasons of compliance with regulatory changes, for reasons of optimizing its operations and services. Any updates, modifications will be posted on this Website with a date indicating which is the most recently updated version.

Revision: April 2019

The use of the electronic pages and services provided to the visitor/user by the Company's Website presupposes his unconditional agreement with the terms and conditions.

The users and visitors of this Website have the obligation to respect all the rules of Greek and International law as well as user morals.

Users may use this Website only in accordance with the applicable Terms and Conditions, in the event that unauthorized use of this Website is found, the user agrees to indemnify the Company for any loss or damage that may occur.

The Company's Website provides at some points references (hyperlinks) to other web sites (site).

The Company's Website provides at some points references (hyperlinks) to other web sites (site). Users' browsing of them is done solely at their own risk.

The information provided by the company 'EUROXX A.X.E.P.E.Y.' (hereinafter the 'Company') through the euroxx.gr website may be advertised for informational purposes only and not for commercial, investment or other purposes. Under no circumstances can it be expressed as an offer, advice, proposal to buy or sell the mobile phones of any company mentioned on the website, nor as an invitation to make any form of investment. The Company is not for any commercial or investment decisions to be evaluated based on this information.