In order to become our subscriber, we will ask you for the necessary information to conclude the contract, such as name, VAT number, ID number, Address, contact details (phone and / or e-mail). We will also ask for proof of identity such as identity card or passport.

For the provision of telecommunication services and the transmission of your communication we process Traffic & Location Data, as mentioned above and we exchange them with other providers to ensure that you can communicate with subscribers of other providers as well as to use our services when you are abroad.

In order to serve your requests through the customer care channels of the Company (eg call center, store network), we process your data to identify you and to serve your requests. The requests include, among others, information requests, requests for exercising rights, complaints or grievances that we receive through competent authorities (eg EETT, Consumer Ombudsman, Data Protection Authority (DPA), ADAE).

For the charge of our services we process Contract Data and Traffic Data, in order to configure your invoice. For the payment of the provided services, we process additional information, such as where you paid the bill, as well as Invoicing Data (means of payment, credit / debit card details, in case a card is used and / or the IBAN, in case of payment by standing order).

Also, in order to verify the correct operation of the billing process and to detect possible incorrect charges, we process Traffic Data, Invoicing Data and limited Contract Data, in order to carry out sample checks.

In addition, SMS messages originating from abroad networks are processed, in order to achieve their correct billing and payment of interconnections, as well as to protect the network from massively sent SMS messages, originating from dangerous destinations.

The Company collects and processes Traffic Data (which includes location data) of subscribers and users and Contract Data, in order to provide effective fault management. The Traffic Data we process for fault management purposes also include data of subscribers of other networks (mainly their phone number), which received call(s) by fixed and mobile telephony subscribers, as well as data of foreign subscribers, which use our mobile network as roamers.

Data are utilized:

• to perform preventive actions to our network, in order to ensure the smooth operation of the services provided.
• to deal with a specific problem of our network, which is reported by you and may relate to the coverage or quality of the network such as call interruption, poor call quality, low access speed, frequent disconnections from the Internet, etc. In these cases we refer to your Data, in order to identify if this is a generalized problem in a specific area or if it only concerns your connection, in order to deal with the problem as efficiently and as quickly as possible.
• to resolve problems in the operation of our information systems, which are necessary for the provision of our services and their billing, such as for example the fault management of billing systems.

In order to inform you about issues related to your contract, such as e.g. to inform you about your current bill or for requests you have submitted, we contact you via email, sms, post or by phone and/or automatically via the interactive voice response (IVR) system for the imminent termination of your contract.

Under applicable law and in case of overdue debt, we reserve the right to transfer your personal data to cooperating debt collection companies in accordance with the provisions of Law 3758/2009 or any currently applicable law, in order to inform you of the existence of overdue debts and to negotiate the time, manner and other terms of repayment, on our behalf. In this context, we transfer Simple Personal Data to the aforementioned debt collection companies and to cooperating law firms.

The Company reserves the right to modify this list, by posting the updated list in this Policy. Moreover, reserves the right to transfer your personal information to cooperating law firms in order to settle claims or settle disputes between us. Lawyers and / or offices may, cooperating with us and within their mandate, seek an amicable settlement of the dispute between us prior to any possible recourse to the courts by calling the contact phone number, we provide them with, or via mail, by using the available contact details e.g. telephones, e-mail, fax etc.

We process a limited range of your personal data and specifically Contract Data, Usage Data, Billing Data, Customer Care Data, Terminal Equipment Data and Promotional Data for the direct promotion of similar products and services. This processing is limited and aims solely at the submission of proposals and offers concerning the promotion of products and services similar to those you already have and are tailored to your needs. Examples of such messages are messages for offers in our store network, contract renewals and pre-paid cards, Internet speed upgrades. Our communication will take place using the contact details that you provided us in your contract or in a transaction.

We further process Customer Care Data, such as queries, complaints, fault reporting, call center downtime, new service requests, fault time or other service malfunctions in order to provide you with free communication packages with airtime and / or GB on your mobile phone, which facilitate your communication and internet access.

Also, in order to offer you reciprocal gifts (eg packages with free airtime and / or GB, discount coupons, etc.) for your loyalty, we process Simple Personal Data, such as the date of activation of your connection. Gifts can be given either automatically and then you receive relevant information (eg via sms or push notification through Company’s applications) or you could be informed (eg via sms or push notification through the Company’s applications) for the gifts you are entitled to and activate them through Company’s applications.

In addition, after the expiration of the contract for any reason and the settlement of any pending issues between us (eg payment of overdue bills) and after the expiration of the data retention period provided by the current regulatory framework, the Company retains your connection number (fixed or mobile) without any other information about you in order to identify you as our former customer in case we wish to contact you, in order to promote your return to our network.

We process a limited range of your personal data and in particular Contract Data, Billing Data, Customer Care Data and Equipment Data to ask you to participate to our customer satisfaction surveys or product/customer care evaluation surveys. These surveys are in the form of a questionnaire and can be sent to you via sms or IVR system, through Company’s applications, via email, or they could be conducted through outgoing telephone calls. They can also be carried out by an external partner.

In case you choose to participate in a survey, we will analyze your answers and may contact you.

We process Contract Data, Traffic Data, Usage Data, Billing Data in order to limit your exposure to usage that results in unusually high charges, as well as to ensure their payment.

For this purpose we process personal data related to an unusually high charge of a subscriber. An "abnormally high charge" is determined based on specific criteria, which include the average of the previous six months' billed traffic and the current billing period's above-average charge rate.

As long as the above charges meet the combination of the relevant criteria, they are included in the daily reports with unusually high subscriber charges. Then, the cases that require control and management are evaluated by a human agent and specific actions are performed such as: (a) sending an informative SMS for unusually (repetitive or not) high charges and a related SMS request for payment of the due amount within five (5) days , otherwise outgoing call barring will be applied, (b) in case of communication with you, information is given about the non-billed usage, while the call is recorded and kept in accordance with article 6 of this Update.

We process Contract Data, Traffic Data, Equipment Data and Invoicing Data in order to protect our subscribers and prevent or detect telecommunications fraud.

For these reasons, we create a profile of your telecommunications traffic and make automated decisions to prevent or mitigate fraud.

The automated evaluation of your telecommunications traffic results from the evaluation of indications of unusual telecommunication traffic in combination with your Contract Data, Equipment Data and Invoicing Data. After this assessment is carried out and if there are indications of telecommunications fraud, automated actions are activated, such as temporarily blocking of outgoing calls to high-risk destinations. The above processing constitutes profiling and automated decision-making, which has an impact to our subscribers such as possible adaptation of the service provided (e.g. temporary blocking).

In order to prevent unauthorized access to our network and information systems and to protect our network and systems against electronic attacks, we perform traffic management actions and process traffic and location data. This is how we prevent illegal and unfair actions on our network and ensure the privacy of your communications. In addition, we maintain logs, which may include traffic and location data of our subscribers for the purpose of monitoring compliance with our policies and ensuring the confidentiality of communications

In order to provide a one-stop service to our subscribers from the Group's network of stores, i.e. stores which belong to GERMANOS (GERMANOS ANONYMOUS INDUSTRIAL AND COMMERCIAL COMPANY OF ELECTRONIC TELECOMMUNICATION EQUIPMENT AND PROVISION OF TELECOMMUNICATION SERVICES) or to partners- franchisees of GERMANOS or to other commercial partners of OTE, mutual processing of limited contract data between OTE and GERMANOS. For example, when you visit a store to pay bills or provide GERMANOS services for which personal data processing is required (e.g. to issue an invoice), your name and surname appears automatically in the store's systems. Also, in case you are a customer of GERMANOS (e.g. you have provided information for the issuance of an invoice) and you request services from the Company, the information already available to GERMANOS (TIN, full name, DOY, address) will appear automatically in Company's systems for the faster submission of your application. Finally, the sellers of the store network have access to an overall picture of your products, so they can serve you uniformly for OTE products, but also other technology products, available through the store network.

In the event of an outstanding debt on your mobile telephony account, the Company reserves the right to disclose your personal data to the company TELEGNOUS, which was established by all mobile telephony companies operating in Greece and maintains a file of data on the financial behaviour (inconsistency) of subscribers-customers as the data controller for processing such record. The purpose of this record is the conduction of an effective credit assessment at the pre-contractual stage and to consolidate transactions in the mobile telephony sector.

The establishment of TELEGNOUS has been approved by the Hellenic Data Protection Authority (HDPA) as per its positive opinion No. 1/2015, while further details regarding the conditions for the legal operations of TELEGNOUS are included in the decision No. 28/2017 of the Hellenic Data Protection Authority (HDPA).

Thus, the Company as provider of mobile telephony services may transfer personal data of a mobile subscriber to TELEGNOUS in the event that:

a) the subscriber has an overdue debt for mobile telephony services for a period of more than ninety (90) days and for an amount equal to or greater than 200€,

b) the subscriber's connection has been disconnected from the mobile telephony network or transferred to another one through a number portability procedure, without the subscriber having paid any bill and having refused to make a settlement of the debt.

The personal data that the Company may transmit to TELEGNOUS are the VAT or ID or passport number, the name and surname of the Subscriber, as well as an indication of whether the Subscriber belongs to category a or b, as mentioned above.

Each Subscriber retains the rights of access and objection (including rectification) in relation to the processing of his/her personal data by TELEGNOUS. For this purpose, your request may be addressed to the Company, in the ways described here or to TELEGNOUS (12 Rizariou Street, Halandri, 15233).

More information on TELEGNOUS and its operation can be found at http://www.telegnous.gr.

The Company provides services on credit, i.e. on post-payment cycles and invoicing, but also due to the provision of subsidies and the provision of equipment with retention of ownership

In this context, we wish to protect our legitimate interest in dealing with reliable subscribers and to prevent the generation of overdue debts in the course of our business activity. For this reason, we process personal data for credit assessment, which takes place: a) for new subscribers at the pre-contractual stage and b) for existing subscribers requesting new service.

This processing does not concern prepaid subscribers.

3.3.8.1 Credit assessment for mobile services

For the credit risk assessment in mobile services we process data in an automated way and perform credit profiling and automated decision making.

You may declare within your connection application form that you do not wish the automated processing of his personal data for the above purposes. In this case, the credit assessment will be performed with the involvement of our representative.

The information we process for credit profiling and automated decision making of existing and new subscribers requesting mobile services is:

Criteria	Who does it concern
1. Information on overdue debts and/or any write-off of a debt under the write-off procedure.	Existing and new subscribers.
2. Transactional behaviour profile, created on the basis of subscriber's behaviour related to the payment of his/her bills (e.g. payment method, amount of debt in arrears, last day of payment, use of voice service, sms data, purchase of packages, (prepaid) amount of payments in relation to any debts, months during which your connection is in a blocking state, etc.)	Existing subscribers, for whom there is data from other active connections with a duration of more than 4 months. New subscribers for whom there is data from recently deactivated connections (within the last quarter).
3. Application profile, which is derived from information that you fill in on the Company’s network connection application form, as well as from information about the products you are applying for. The information includes: Occupation and age of the applicant. type of connection (corporate/home) & plan, number of device purchase requests per request, number of connections requested. indication of device purchase or fixed asset credit, number of applications submitted in the last 30 days excluding the current application, membership of a loyalty programme (e.g. Cosmote ONE), number of previously deactivated lines of the applicant (if available). any duration of prepaid connection and ratio of last six months of prepaid usage to corresponding fixed asset value.	New subscribers for whom no transactional behaviour profile is obtained.
4. Information from the TELEGNOUS database.	New or existing subscribers, for whom there is no profile of transactional behaviour (either because there are no existing overdue debts in their data or because they have a contract with a duration of less than four (4) months) The information that the Company derives from the TELEGNOUS database is the indication whether a subscriber is included in the TELEGNOUS database and whether it belongs to category a' or b'. This information will under no circumstances be used to exclude subscribers from telecommunications services or from portability. On the contrary, they are used to determine a financial guarantee, in case the prospective subscriber is included in the TELEGNOUS database, as well as a complementary advisory tool during the contracting process with prospective subscribers, in order to help you choose the appropriate telecommunication product that best meets your personal needs and financial possibilities.
5. Transactional behaviour information from companies providing business intelligence services.	New subscribers - legal entities, provided that the search in the TELEGNOUS database did not yield any result.
6. Information from the published list of overdue debts of legal persons and entities to the State and e-Government in accordance with the provisions of paragraphs 1, 2 and 4 of Article 9 of Law 3943/2011 (Government Gazette A' 66), as currently in force.	New subscribers - legal entities

3.3.8.2 Fixed telephony and internet services
The criteria taken into account for the credit assessment of existing and new subscribers applying for fixed telephony and internet services are:

Criteria	Who does it concern;
1. Information on overdue debts and/or any write-off of a debt under the write-off procedure.	Existing and new subscribers.
2. Information about the products you are requesting.	Existing and new subscribers.
3. Transactional behaviour information from companies providing business intelligence services.	Existing and new subscribers - legal entities.

Information about the operation of the cameras in our stores can be found here.

In order to ensure a high level of quality in the provided customer care service, a sample of the recorded communications with costumer care agents is evaluated.

***

The specific types of processing based on our legitimate interests are very important for the development of our products and services, but also for the protection of your interests as a consumer. However, you can at any time object to one or more types of processing, which are carried out on the basis of legitimate interest. To exercise the right to object please see here.

Tax legislation sets out obligations for the retention and generally the processing of tax documents (e.g. telephone bills) containing personal data.

The Company may process your data, in order to transmit it to the competent police or prosecutor / judicial or supervisory authorities, after first receiving a relevant legal request and for the purpose of compliance by of the current legislation.

In the context of our compliance with article 3.2 par. N of no . 991/4 / 31-5-2021 Decision of EETT "Regulation of General Authorization", the Company or their associates process Simple Personal Data in order to contact you via email or sms or even by phone in order to inform you about the upcoming termination of your contract, which may lead to changes in your invoice, and suggest you the best current invoice for the services you receive from OTE.

If you are roaming, we process Traffic Data to inform you via SMS about any restrictions on or consumptions of periodic roaming, i.e. the charges for making and receiving calls and sending SMS messages applicable in the Member State you are visiting (compliance with Regulation 2022/612 (EU) of the European Parliament and of the Council of 6 April 2022 on roaming on public mobile communications networks within the Union.

Additionally, in order to prevent abusive or abnormal use of regulated roaming services in case you are roaming in a country within the EU, we process Traffic Data in order to calculate the use of mobile services, so in case you stay in the country within the EU for a long period of time we inform you via SMS messages about the imposition of additional roaming charges (compliance with Commission Regulation 2016/2286 of 15 December 2016 laying down detailed rules for the application of the roaming charges).

In order for the Company to comply with Directive no. 876/7B/17-12-2018 decision of EETT "National Open Internet Regulation", as currently in force, under which we process internet speed measurement data (such as upload/download speed), Equipment Data such as IP address, your phone number and SIM card number, the address of the subscriber's connection, Location Data at the location where the measurement was taken, in order to investigate complaints and conduct deviation checks, and to respond to relevant requests from our subscribers relating to any discrepancies between the measured Internet speed and the speed stated in the terms and conditions of mobile or fixed line services. In addition, we process personal data for the purpose of providing the relevant redress/compensation as provided for by the aforementioned Regulation. For more information on such processing you can find available in the Notice regarding the processing of your personal data via the website myspeedtest.cosmote.gr at the following link.

To provide information to emergency authorities, to respond to calls to emergency numbers, including the single European emergency number 112, and to locate the caller, we provide to the emergency services caller location information (Traffic and Location Data).

In case of emergencies, such as major natural disasters, and in order to meet the increased needs of our subscribers, we may process Contract Data and limited Location Data in order to determine which of our subscribers are at the scene of the natural disaster or emergency (eg state of war, terrorist attacks) and offer them benefits such as free airtime or free MB. The purpose of these temporary benefits is to cover the increased telecommunications needs of our subscribers which arose due to the emergency and to facilitate their communication.

The Company seeks the continuous improvement of the services provided to you, the provision of a high level of service and the implementation of promotional actions that meet the needs of our subscribers. For this purpose we further process:

• Simple Personal Data, in order to draw conclusions about the use of our services and the level of service. For example, we will process your Contract Data and Customer Care Data in order to draw statistical conclusions about the average customer response time to our customer requests or the average customer waiting time at our call center We will also process Simple Personal Data to draw conclusions regarding the use of our services and offers, in order to improve them and also to design new ones..
• Simple Personal Data in order to draw conclusions about the use of our services and offers in order to improve them, to design new services and to make business decisions.
• Contract Data and Promotional Data in order to understand how effective our advertising campaigns are and to improve the design of new ones..
• Customer Care Data and Contract Data, in order to configure the Customer Experience Index in order to provide you with the best service. Through the Customer Experience Index we evaluate the level of service we provide and the quality of our telecommunications services in order to launch immediate remedial actions of the problem that you may mention and to identify the points that need improvement in our internal processes.
• Traffic Data and Location Data, in order to analyze and draw useful statistical conclusions regarding the operation and design of our network after the application of anonymization techniques. Anonymity is the application of practices to personal information so that it is no longer possible to identify from this information what your identity is.
• Simple Personal Data, to which we have applied mechanisms to hide IDs, in order to improve our information systems. In particular, we process limited data in order to control and improve our information systems in case of upgrades or changes.

The Company in the context of its participation in European research programs, discloses to partners anonymous data, including Traffic data or Location Data, in order to draw useful statistical conclusions related to their research.

The Company, in the context of its participation in innovation competitions, discloses anonymous data to participants, in order to use them for the development of innovative products and / or services.

The Company uses anonymous data in order to draw useful conclusions so as to improve our internal processes.

The above cases are compatible further processing of the data for the evaluation of which we took into account specific factors, such as: the relationship between initial and further processing purpose, the reasonable expectations of our subscribers, the nature of personal data and the possible consequences of further processing, as well as the measures taken by the controller for data protection.