Enarxis Dynamic Media Ltd  —  Personal Data Protection Policy  —  v1.1.20260707

PERSONAL DATA PROTECTION POLICY

REVISION TABLE

1 PURPOSE

The purpose of this Policy is to define and articulate the general framework and fundamental principles established and applied by ENARXIS DYNAMIC MEDIA LTD (hereinafter the "Company") regarding the processing of personal data and the protection of their security, confidentiality, integrity and availability.

2 SCOPE OF APPLICATION

This Policy applies to all personal data managed by the Company within the scope of its activities.

3 RESPONSIBLE FOR POLICY IMPLEMENTATION

• Management
• GDPR Officer
• All company personnel
• All partners who manage and/or have access to personal data

4 DESCRIPTION

4.1 General

Our Company recognises and respects the importance of the personal data it handles within the scope of its activities, and for this reason has fully aligned its policy with the requirements of the General Data Protection Regulation (hereinafter GDPR) 2016/679/EC.

With this statement, our Company wishes to:

• inform those transacting with it in what capacity, for what purpose and on what legal basis it processes personal data, i.e. information that can be used for the direct or indirect identification of individuals;
• specify the categories of data, the sources of data (when data is not provided by the individual themselves) and the criteria for determining the retention period of personal data;
• inform those transacting with it regarding the transfer of their personal data to third parties or to third countries;
• inform data subjects of the possibility of contacting our Company regarding any matter related to the processing of their personal data, the ability to exercise their rights of access, rectification and, where applicable, erasure, restriction of and objection to processing, as well as the right of individuals to lodge a complaint regarding any violation of their personal data rights with the Hellenic Data Protection Authority;
• establish the principles governing the observance of the relevant protection policies and security guarantees for personal data by the Company.

For any question or enquiry, or for anyone wishing to receive a copy of this statement, or wishing to exercise any of their rights related to their personal data, the interested party may contact the Company's GDPR Officer at telephone number 2109011900 and email data.protection@enarxis.eu.

4.2 Details of the Data Controller, Representative and GDPR Officer

Data Controller:

GDPR Officer:

This statement covers the collection of personal data by our Company during the conduct of its activities, including its presence on third-party websites, platforms and applications in accordance with the Terms of Use of our website.

Please note that when visiting our Company's website, simple data related to your interaction with the website and the installation of cookies are collected (see the relevant Cookies Policy). Third-party websites generally apply their own privacy statements and their own terms and conditions. We invite you to read them before using those websites.

4.3 How is my personal data collected?

We may collect personal data from various sources, namely:

• Personal data provided to our Company directly by the data subjects, for one of the following reasons:
  1. Information you provide to us during the conclusion, development and termination of our contractual relationship.
  2. Information you provide to us during your participation in events and activities of our Company.
  3. Information you provide to us during your communication with us or when submitting a request.
  4. Information you provide to us when subscribing to our Company's newsletter.
• We also receive personal information indirectly, in the following cases:
  1. Information we receive during the credit check of our customers, after the legal procedure has been followed and explicit consent has been obtained from the individuals themselves.
  2. Information we collect during the operation of a closed-circuit video surveillance system (CCTV) at our Company's premises.
• We also receive and store specific types of personal data each time anyone interacts with us online, i.e. when we use cookies and tracking technologies to receive personal data, and also when the web browser used by the internet user accesses our website or listings, as well as other content displayed by or on behalf of the Company on other websites.

4.4 What personal data is collected?

Personal Data means any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one whose identity can be ascertained, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person.

Due to the nature of our Company's activities, the Personal Data collected primarily relates to the following categories of data subjects:

• Company Employees: their personal data and information relating exclusively to their employment relationship with our Company, which includes, indicatively, identity and contact details, financial data as well as health data of the employees themselves or additional members related to our Company's compliance with labour and insurance legislation.
• Prospective Employees: their personal data and information relating to their evaluation as candidates and the recruitment processes by the Company, which includes, indicatively, identity and contact details, as well as professional CV details of the candidates.
• Company Partners: (suppliers and other partners in general): their personal data and information relating to our contractual relationship, which includes, indicatively, identity and contact details, transaction data as well as financial data related to our Company's compliance with its legal contractual obligations.
• Parties transacting with the Company (customers, prospective customers and individuals communicating with our Company in general): their personal data and information relating to our contractual relationship, where one exists, or used for their communication with our Company, which includes, indicatively, identity and contact details, transaction data as well as financial data related to our Company's compliance with its legal contractual obligations.
• Newsletter Recipients: personal data of individuals who, with their consent, provide information to our Company for the purpose of communicating with them for informational purposes and direct marketing of products and services, which indicatively includes identity and contact details, as well as details of any previous business relationship our Company has had with them (if the recipient is or was a customer of our Company).

Furthermore, Personal Data may be collected from natural persons entering the Company and its premises during the operation of the closed-circuit video surveillance system (CCTV), for the security of persons and property.

We note that we do not collect special categories of personal data, other than the health data mentioned in this document, such as personal data relating to race, ethnic origin, religion, sexual orientation or genetic biometric data etc., which are categorised as special categories of data and receive additional protection in accordance with European personal data protection legislation.

4.5 For what purposes is my data used?

The purpose of processing corresponds to the respective function being performed. Specifically:

• The personal data of employees is provided to our Company for the purpose of concluding, executing or terminating the respective employment/collaboration agreement. Additionally, personal data of employees regarding attendance, absences, hours of attendance, leave, medical certificates for sick leave, are maintained for the purpose of granting leave, including sick leave, while personal data regarding employee performance is provided by the heads of the respective departments for the purpose of personnel evaluation by the Company.
• The personal data of prospective employees, which they themselves provide during the various stages of candidate selection and evaluation, is disclosed to the relevant Department of the Company and to Management, for the purpose of informing the Company, conducting evaluations, interviews, etc. for the recruitment of employees and the establishment of collaboration.
• The personal data of partners, customers and other parties generally transacting with the Company, which they themselves provide to our Company, is collected and processed for the purpose of concluding and developing our contractual relationship, where one exists, our compliance with our legal contractual obligations, and where applicable, our communication with them following their request.
• The personal data of newsletter recipients is collected with their consent and is used for communicating with them for informational purposes and direct marketing of products and services.
• Surveillance of the entrance as well as other premises is also carried out using CCTV image recording cameras. Any person entering (employee or visitor) the building premises is informed in an appropriate, visible and comprehensible manner (signs) about their entry into an area monitored by closed-circuit television for security and protection of persons, property and critical infrastructure, and about other legally required information.

4.6 What is the legal basis for processing?

The collection and processing of personal data of the above data subjects is based either on the conclusion and performance of a contract, or on the Company's obligation to comply with legal obligations (as an employer in employment contracts as well as in relation to its general legal obligations), or in pursuit of a legitimate interest (security of persons, property and infrastructure, productivity optimisation). In cases where the legal basis is consent (such as in the case of sending newsletters by email), the data subject is explicitly informed and retains the right to withdraw consent, easily and at any time.

4.7 Profiling

The Company does not use personal data for profiling purposes.

4.8 Transfer of Data to Third Parties: To whom will my data be disclosed?

The Company, as a rule, does not disclose data to third parties, except in the following cases. Specifically:

• The Company transfers personal data of its employees, customers and partners to an external accountant, with whom it has signed a contract.
• Relevant medical data of employees is transferred to the Company's occupational physician, with whom a contract has been signed.

4.9 How long is my personal data retained?

The retention period of personal data depends primarily on the purpose of processing, as even their mere retention constitutes a processing activity, which is permitted only if it is governed by the processing principles. After the expiry of the retention period, personal data is deleted. Specifically:

• The personal data of prospective employees is maintained electronically on mail servers and file servers, accessible by the HR department and the Company's Management, for a period of two years from the completion of the employee selection-recruitment process. Retention is due to the possible re-evaluation of candidates by the Company.
• The personal data of employees, i.e. those who have already entered into an employment contract with the Company, is maintained in physical archives and on file servers by the HR department, initially for the duration of the employment relationship. After the termination of the employment relationship, for any reason, the relevant data is retained for a maximum of twenty years (indicative statute of limitations for any arising legal claims), a period during which any legal case for processing may arise, such as the emergence of civil cases or investigation of a criminal felony offence where an employee may be involved, tax audit cases, etc. The above also applies to data regarding corporate assets provided to employees, access to electronic and physical files and workspaces and corporate mobile phones, for the purpose of executing the employment contract. They also apply to personal data relating to the granting of leave to employees (attendance, absences, hours of attendance, leave, medical certificates for sick leave) and personnel evaluation.
• The personal data of the Company's customers and partners is maintained in physical archives and on file servers by the HR department, initially for the duration of our contractual relationship. After the termination of the contractual relationship, for any reason, the relevant data is retained for a maximum of twenty years (indicative statute of limitations for any arising legal claims), a period during which any legal case for processing may arise, such as the emergence of civil cases or investigation of a criminal felony offence, tax audit cases, etc.
• Personal data of employees and visitors originating from the closed-circuit video surveillance system operating at our building premises, including the entrance and selected workspaces, is retained for fourteen (14) days on CCTV recording equipment, subject to more specific provisions of legislation applicable to specific categories of data controllers. In the event of an incident related to the purpose of processing, the data controller is permitted to retain the footage in which the specific incident has been recorded in a separate file for three (4) months. If during this period an incident is identified, we isolate a portion of the video and retain it for up to four (4) additional months, for the purpose of investigating the incident and initiating legal proceedings to defend our legitimate interests, while if the incident involves a third party, we will retain the video for up to five (5) additional months.

4.10 What are my rights?

The processing of your personal data is also associated with corresponding rights, which, subject to provisions that may limit their exercise, are:

• Right to information: You have the right to receive clear, transparent and comprehensible information about how we use your personal data and what your rights are. For this purpose, we provide this information in this Statement – Protection Policy and encourage you to contact us for any clarifications.
• Right of access: You may request that we correct or supplement your data if it is incomplete or contains inaccuracies.
• Right to rectification: You may request that we correct or supplement your data if it is incomplete or contains inaccuracies.
• Right to data portability: You may request that we provide you or transfer to a third-party provider in electronic form specific information you have provided to us.
• Right to erasure. In certain cases, you may request the deletion of all or part of your data (e.g. if the data is no longer necessary for the purposes for which it was collected, etc.).
• Right to restriction of processing. You have the right to restrict the processing of your personal data.
• Right to withdraw consent. If you have given your consent for the processing of your personal data, you have the right to withdraw your consent at any time by contacting us at the details provided herein.
• Right to object: you may object to the processing of your data carried out in the context of pursuing our legitimate interests, as mentioned above.
• Right to lodge a complaint with the Hellenic Data Protection Authority. You have the right to lodge a complaint directly with the local supervisory authority, the Hellenic Data Protection Authority, regarding how we process your personal data.
• Rights related to automated decision-making. You have the right not to be subject to a decision based solely on automated processing that has legal or other significant effects on you. Specifically, you have the right to:
  • have human intervention,
  • express your point of view,
  • receive an explanation for the decision reached after an evaluation,
  • challenge that decision.

In the event of exercising any of the above rights, we will take every possible measure to satisfy your request within a reasonable timeframe and no later than one (1) month from the verification of your submitted request, informing you in writing of the satisfaction of your request, or the reasons that may prevent the exercise of the relevant right, or the satisfaction of one or more of your rights, in accordance with the General Data Protection Regulation. We note that in certain cases the satisfaction of your relevant requests may not be possible, such as when the satisfaction of the right is contrary to a legal obligation or conflicts with a contractual legal basis for processing your data.

If, however, you believe that any of your rights or a legal obligation of our Company regarding the protection of Personal Data has been violated, and you have previously contacted the Company's Data Protection Officer (DPO) regarding the relevant matter, i.e. you have exercised your rights towards the Company and either did not receive a response within one month (the deadline being extended to two months in the case of a complex request), or you consider that the response received from the Company is unsatisfactory and your matter has not been resolved, you may lodge a complaint with the competent supervisory authority, namely the Hellenic Data Protection Authority (HDPA), 1-3 Kifissias Ave., PC 115 23, Athens, email: complaints@dpa.gr, fax 2106475628.

4.11 How is my personal data protected?

We have taken appropriate organisational and technical measures to protect your personal data from misuse, interference, loss, unauthorised access, modification or disclosure. The measures we use include the implementation of appropriate access control measures, information technology security as well as ensuring that personal data is encrypted, pseudonymised and anonymised, where necessary and feasible.

Access to your personal data is permitted only to authorised employees and partners and only when necessary to support our Company's activities, and is subject to strict contractual confidentiality obligations when processing is assigned to and carried out by third parties.

4.12 How can I contact the Company?

You may contact us at our registered office address, 68 Ilia Iliou Street, PC 11744, Athens, Greece, or at the email address info@enarxis.eu, or submit a request through the Contact form on our website.

4.13 Updating – Review of this Personal Data Protection Policy Statement

This statement will be reviewed as needed to adapt to legislative changes, to respond to comments and needs of personal data subjects, and to changes in our Company's products, services and internal processes. Each change will be published with a simultaneous revision of the last updated date at the top of this Personal Data Protection Policy statement.