Preamble

“HELLENIC PETROLEUM PROVISION OF ELECTROMOBILITY SERVICES SINGLE MEMBER SOCIETE

ANONYME”, which uses the discrete title “ElpeFuture” (hereinafter referred to as the

“Company”, takes a responsible stance towards the protection of personal data and privacy and

believes it to be an issue of supreme importance and is committed to handling your personal

data responsibly and in accordance with the applicable national and European legislative and

regulatory framework on the protection of personal data. By determining the purposes and

means of the processing of personal data, the Company becomes controller of said data.

1. Subject

This Privacy Policy describes how the Company processes your personal data when you sign up

to the Application and use its services. By using the Application or any other feature or content

that the Company offers from time to time in relation to its software or applications, it is

presumed that you accept the practices and policies described in this Privacy Policy. If you do not

accept the policies and practices described herein, it is recommended that you do not proceed

to browse through, register to, or use the Application in general. The Company reserves the right

to modify and adjust this Policy whenever necessary. Your continued use of the Application after

any amendment to this Policy shall be construed as acceptance of such amendments.

This Policy does not apply to third party applications or to data provided by you to third parties

or collected by third parties. Said third parties may have their own privacy policy, which you are

encouraged to read before disclosing data to or through them.

2. Data collected by the Company

Provision of information to users regarding the nearest ElpeFuture charging points

When you use the geolocation and navigation services to receive information through the

Application on the location and details of the nearest ElpeFuture charging point and to receive

information on promotions offered by ElpeFuture near you, the processing of your location data

is done via GPS by the Google Maps application, and your consent is requested for activation of

the geolocation function on your device and the receipt of promotional material.

For your information, the Company processes information via GPS and as regards the use and

collection of your personal data for the provision of geolocation and navigation services, it is done

by Google through the Google Maps application. For more information on how Google handles

your personal data, it is recommended that you refer to the Privacy Policy of that application by

visiting the following website: https://policies.google.com/privacy?hl=en

Registration

When you register to create your account, the Company collects from you and processes the

following personal data:

• name

• surname

• email address

• phone

• password

• information disclosed via the use of social media through add-ons. If the user connects to

the Application through a social networking website (Facebook, Twitter, Google) and in

this way consents to the Company accessing that page, the Company collects the personal

data to which it may have access depending on the user's privacy settings or the privacy

policy of that particular social networking website. However, social network add-ons and

similar technologies are controlled by the social networks themselves and are subject to

the terms of use and privacy policies of the networks themselves.

ElpeFuture Card

As part of the “ElpeFuture Card” feature, and aside from the data collected for identification of

the user, the Company collects from the user the number of any Card entered by the latter.

Furthermore, the Company creates the following data on the user based on the aforementioned

information:

• A transaction history and details regarding said transaction, such as the name of the

charging point and the date and value of the transaction. This data is automatically

collected by the Company from the points of sale where the user used the Card entered

to purchase EV charging services.

• Statistics regarding the user's transactions, such as the value of transactions, energy

consumption (kWh) and the products most often purchased.

Payments

As part of the “Payments” feature, and aside from the data collected for identification of the

user, the Company collects from the user the number of the ElpeFuture Card and credit/debit

card information (card type, credit card number, name on the card, expiration date), if the user

chooses to provide this information and make use of the feature. Billing information (such as the

name of the user, the number and expiration date of the credit/debit card) is collected for the

purpose of carrying out and completing transactions and purchases made through the

Application and is stored in the Application.

Promotional and Information Material - Personalized offers

In order to send promotional and information material on behalf of the Company or on behalf of

other companies and provided that the user has granted consent for the specific processing, the

Company will use the e-mail address provided by the user. The user may revoke his consent

through the Profile settings of the Application.

Data collected automatically

Each time the user interacts with the Application’s services, data may be automatically received

and recorded in the server's log files from the user's device platform, including:

a) usage data, i.e. data related to the access to and use of the services, your interactions via email,

and text messages you may receive from the Company, including traffic data, log files and other

communication data;

b) device identification data and device and software features, i.e. information regarding the

mobile device and Internet connection, including the unique device identifier, the IP address, the

operating system, the browser type, mobile network information, the telephone number of the

device;

c) if the user gives his consent, the Company collects his location data, i.e. real-time information

on the location of his device, either through the Application or through the Google Maps

application. The user's location is determined based on the location of the wireless network or

the Wi-Fi access points within the range of which he is located, as well as by use of the Global

Positioning System (GPS);

d) if the user provides the relevant consent, stored data and files, i.e. metadata, tags, and other

data related to other files stored on the user's device, such as photos, video and audio files and

information regarding his personal contacts and address book.

3. The purpose of processing of your personal data

The Company always processes your personal data for specific purposes, which are:

• To inform you regarding the nearest ElpeFuture charging point and provide you with

relevant information.

• To give you instructions on how to reach that charging point by integrating a relevant

service from an online digital map service with an integrated service providing real-time

local traffic information through the Google Maps app.

• To give you with the option of creating an account, for easy and quick identification.

• To allow you to manage your cards.

• To give you access to your order history and allow you to monitor statistics based on your

transactions.

• To help you calculate energy consumption and give you tips on economical driving.

• To improve the services it provides.

• To contact you, using any of your contact details, regarding the services offered.

• To promote the Company's products and to send information and advertising material,

as well as offer vouchers.

• To create a user profile; provided you consent to such processing, the data you provide

to the Company and the data resulting from the use of its services are taken into account,

so that appropriate commercial communication messages can be sent to you according

to your preferences and profile, and that Company services and products can be adapted

to your individual needs.

4. Legal basis for processing your personal data

The Company legally processes your personal data and for each instance of processing there

exists at least one of the following legal bases:

a) Processing is necessary for the performance of the Company’s contractual obligations.

The Company may process data, provided that "processing is necessary for the performance of a

contract to which the data subject is party". An example of personal data processing based on

the legal basis of the contract is the processing of users' personal data required for the conclusion

of the agreement for the use of the Application (e.g. name, surname, email, telephone number,

password).

If you refuse to provide the Company with the data necessary for the conclusion and performance

of the above agreement, such conclusion and performance shall not be possible.

b) The Company has your prior consent to process your data for one or more specific purposes.

In this case, you are free to withdraw your consent at any time. Withdrawal of your consent shall

not affect the legality of consent-based processing prior to such withdrawal.

Examples of processing based on your consent are the detection of your location so that you can

be informed regarding the nearest ElpeFuture charging points, the accessing of your profile on

social networking sites, and the sending of information to the user based on his profile.

c) Processing is necessary to serve the Company’s legitimate interests, except where such

interests are overridden by your interests or fundamental rights and freedoms which require

protection of personal data. Indicative examples of processing carried out by the Company for

the pursuit of its legitimate interests are the following:

• The calculation of the size of the public and the standards of use, so that the services can

be adapted to the individual interests of the users.

• The improvement of the services provided and provision of a better and more

personalized user experience.

• The identification of users and speeding up of their searches.

5. Personal data retention period

The Company retains your personal data relating exclusively to your account for as long as it is

active; as soon as you delete your account your data is deleted. In all other cases, the Company

will retain your personal data in accordance with the applicable provisions of the law and only

for as long as necessary in order to meet the above objectives or for the time required by law or

to defend the Company any possible legal action brought against it.

6. Who has access to your personal data and to who is it transmitted?

The Company shall in no way share, exploit or in any way transmit your personal data to third

parties other than those referred to in this Privacy Policy. Before any information is disclosed to

a third party, the Company shall ensure that each recipient is bound by strict security standards

and confidentiality.

In the context of the Company's activities and for the purposes mentioned in this Privacy Policy,

only authorized employees of the Company have access to your personal data. In addition, the

Company shall disclose the personal data of users in a form that allows personal identification in

the following cases:

• To companies of the HELPE Group, when necessary for: the processing and storage of

data, the provision of access to the Company's services, the provision of customer

support, decision-making for the improvement of the Company's services, the

development of content.

• To the Company associate providing the former with geolocation and navigation services

through the Google Maps application. You can find out more about the Privacy Policy of

this App at: https://policies.google.com/privacy?hl=el

• If the user gives his consent, the Company collects his location data, i.e. real-time

information on the location of his device through the Google Maps application. The user's

location is determined based on the location of the wireless network or the Wi-Fi access

points within the range of which he is located.

• To third party developers using the Application Programming Interface (“API”), such as for

example Google Maps. The use of third party applications developed using the API is

subject to the terms of use and privacy policy of said third parties. When a user uses the

Application, certain third parties may use automatic data capture technologies to collect

information regarding the user or his device. Third parties may use tracking technologies

to collect information about the user each time he uses the Application’s services. They

may collect information relating to the user's personal data or they may collect

information, including personal data, regarding the user's activities in the application.

Third parties may use this information to provide interest-based (behavioral) advertising

or other targeted content. The Company does not control these third-party monitoring

technologies or the way in which they may be used.

• To the external associate of the Company that manages on behalf of the Company the

central application for Management of the ElpeFuture Card and Payments, when the user

uses that service.

• To other Service providers that the Company uses to provide marketing, advertising,

communication, infrastructure and IT services, to personalize and optimize the services

provided, to process transactions by credit card or other payment methods, to provide

customer service, to analyze and improve data (including data on user interactions with

Application functions), as well as to process and manage consumer surveys. In the

framework of provision of such services, these Service Providers may have access to your

personal data or other information. The Company does not authorize them to use or

disclose your personal information beyond the extent required to provide their services.

• In case of business transfer: As part of the reorganization, restructuring, merger, sale or

other transfer of assets, the Company shall transfer your information, including your

personal data, if the recipient agrees to handle your personal data in a manner consistent

with the Company's Privacy Policy.

As a rule, your personal data shall not be transmitted to countries outside the European

Economic Area. However, if personal data is transmitted to countries outside the European

Economic Area, the Company shall ensure the transfer of information in accordance with this

7. Security

The Company takes appropriate security measures to ensure the best possible storage of all

personal data and the avoidance of accidental loss, use or unauthorised access to personal data,

and restricts access to personal data to persons who really need it to perform their duties.

Persons who process personal data on behalf of the Company act in accordance with the

authorization granted to them by the Company and undertake a duty of confidentiality with

respect to their actions. The Company has established procedures for dealing with any breaches

of data security in order to be able to comply with its legal obligations in case of a breach of

personal data.

8. Your rights

You have a number of rights regarding your personal data that are processed by the Company.

In particular:

a) Rights of access, rectification and erasure

You have a right to request at any time to be informed about your personal data held by the

Company and to request the modification, rectification, updating or erasure of this information.

You may be asked for additional information in order for the Company to process your request,

however, if you are given access to the information held about you, such access shall be granted

free of charge, unless your request is manifestly unfounded or abusive. If you request further

copies of this information from the Company, you may incur a reasonable administrative fee. If

the Company has a legal right to reject your request, you shall be notified of the grounds for such

rejection.

In some cases, especially as regards the data you enter in the Application, you are given the

option to erase or modify your own data through the Application. Furthermore, as regards the

erasure of your data, you have the right to erase some or all your data from the Application,

either individually or via the full deletion of your account. Some of your data related to the

provision of products and services by the Company (ElpeFuture Card) are retained in other

Company systems, regardless of their erasure from the Application, as part of the provision of

the product or service.

b) Right to object

This right allows you to object to the processing of your personal data, especially when the

processing is conducted for the Company's legitimate interest. If the processing is carried out for

the purpose of serving its legitimate interests, the Company shall comply with your objection and

will terminate the specific processing, unless the Company may demonstrate compelling and

legal grounds for the processing, which prevail over your interests, rights, and freedoms or such

processing is done for the establishment, exercise or defense of the Company’s legal claims. In

case of objection to processing related to the granting of benefits to you by the Company and

consequent termination of such processing, this may result in the Company's inability to provide

such benefits in their entirety.

c) Right to restriction of processing:

In certain cases, you have the right to restrict or cease further processing of your personal data.

In practice, this means that the Company may store your data, but will not be able to process it

further, unless such processing is done with your consent or is necessary for the establishment,

exercise or defence of the Company’s legal claims, for the protection of the rights of a third party,

or for reasons of public interest.

d) Right to data portability

You have the right to transfer your data to other controllers. For the implementation of the right

to data portability, the Company will provide you with your data in a structured, commonly used

and machine-readable format. In the alternative, data can be sent directly to your account. The

right to portability applies to (i) data processed by the Company automatically (i.e. without

human intervention), (ii) personal data provided by you, and (iii) personal data that the Company

processes based on your consent or if processing is necessary for the performance of the

agreement.

e) Automated individual decision-making, including profiling

You have the right to not to be subject to a decision based solely on automated processing,

including profiling, which produces legal effects concerning you or similarly significantly affects

you. The Company does not make automated individual decisions, but, with the consent of the

user, creates the user’s profile taking into account the data provided by the latter and the data

resulting from the use of its services, in order to send appropriate commercial communication

messages according to the user’s preferences and profile, and adapts its services and products

to the user’s individual needs. Profiling for the above purpose does not produce legal effects

concerning you or similarly significantly affecting you.

f) Right to lodge a complaint with the competent authority

You have the right to lodge a complaint with the competent supervisory authority, which in

Greece is the Hellenic Data Protection Authority.

You may contact the Data Protection Agency as follows:

• Postal address: Data Protection Authority, Offices: 1-3 Kifisias Avenue, P.C. 115 23,

Athens

• Call Centre: +30 210 6475600

• Fax : +30 210 6475628

• Email: complaints@dpa.gr

• Submission in person: At the Authority’s offices, 1st floor, Protocol office, 09:00-13:00.

If you have any questions, feel free to contact us.

If you have any questions regarding this Notification, please contact us by calling +30 210

6302252, or by email at DPO@helpe.gr .