Tempus Holdings 97 Sarl - Privacy Notice

The limited liability company with the corporate name Tempus Holdings 97 Sarl, whose registered offices are in Senningerberg, Grand Duchy of Luxembourg, at 8 Lou Hemmer St., Companies Reg. No. B257178 (hereinafter the “Company”), as data controller under the General Data Protection Regulation (Regulation (EU) 2016/679) which entered into force on 25.5.2018, and as in force from time to time (hereinafter the “GDPR”) and in the context of Law 4624/2019 on personal data (hereinafter the “Law”) and the legislative and regulatory framework in force from time to time, hereby provides you with the following notice about the processing of your personal data and your rights as a data subject.

This notice is addressed to individuals (“natural persons”) who, under a loan agreement or generally a credit agreement entered into with one or more Greek banks (hereinafter the “Banks”), are involved in the capacity of debtor and/or co-debtor and/or co-borrower and/or guarantor and/or provider of real collateral for claims, including their heirs (hereinafter the "Debtors"), in loan/credit claims arising from non-performing loans transferred to the Company under relevant loan and credit claims transfer agreements (hereinafter the "Portfolio"), in accordance with Law 4354/2015. Through such transfer the Company became the beneficiary of all manner of claims and rights deriving from the loan agreements included in the Portfolio, as well as the Controller of the personal data deriving from those agreements. The loan agreements are managed on behalf of the Company by the Claims Management Company with the corporate name doValue Greece Loan and Credit Claims Management Co. S.A., whose registered offices are at the junction of 27 Kyprou St. and Archimidous St., Moschato, Attica, Tax Reg. No. 099755919 / Piraeus FAE Tax Office, General Commercial Register No. 121602601000, as duly represented (hereinafter the "Manager"), licensed and supervised by the Bank of Greece in accordance with the provisions of Law 4354/2015 (Decision No. 220/1/13.03.2017 of the Credit and Insurance Committee, published in Government Gazette 880/16.3.2017). This notice is also addressed to any third parties (natural persons) connected with the Debtors and/or the claims, including but not limited to: family members, legal representatives, authorised attorneys at law, process agents, other authorised persons, employees, associates, legal representatives, shareholders and beneficial owners of debtors who are legal persons or entities. It should be noted that in the event that the debtor and/or co-debtor and/or co-borrower and/or guarantor and/or the provider of real collateral for the claims is a legal person or legal entity, this notice is addressed to the administrators, representatives, agents, partners and management bodies, employees, authorised attorneys at law, process agents, shareholders and beneficial owners of the personal data processed by the Company.

The processing of personal data consists in the collection, recording, organisation, structuring, storage, alteration, retrieval, consultation, use, transmission, restriction or erasure of personal data that have been or will be made known to the Company either in the context of the transfer of the Portfolio from the Banks, or in the context of the agreement for assignment of management of the claims to the Manager, or in the context of information the Company receives from a third party, whether a natural or legal person, or public sector body, when the legal rights of that party or of the Company itself are being exercised.

In compliance with the applicable legislative framework, the Company has taken all steps required, implementing appropriate technical and organisational measures for the lawful retention, processing and safekeeping of the personal data file, committing itself to ensuring and protecting in any manner the processing of your personal data from loss or leak, alteration, transmission or unlawful processing thereof in any other manner.

The data we process

The Company processes your personal data, which have been received by it under the above agreements for the transfer of the Portfolio from the Banks, or under the agreement for assignment of management of the claims to the Manager, and which are necessary for the smooth execution of the above business relations and the management of your debts.
The Company also processes your personal data which it receives or becomes aware of from a third party, whether a natural or legal person or public body, which is necessary either to achieve the legitimate interests of the Company itself or of a third party, or to perform duties carried out in the public interest (e.g. tax and social security providers).

In order to protect commercial credit and transactions, to assess your creditworthiness and the financial and credit risks assumed, and to limit fraud, the Company has access to your data that may be included in the files kept by the company with the corporate name BANKING INFORMATION SYSTEMS S.A., trading as TIRESIAS S.A. TIRESIAS S.A. keeps the following records: a) a Mortgage - Mortgage Prenotation Defaults data file; b) a Risk Control file; c) a Credit Consolidation file; d) a Lost/ Stolen ID Card - Passport file; e) a Terminated Merchants System file; f) an Assigned Claims from Public Works Contracts/Performance Certifications file; and g) a Credit Scoring System file. It is possible for us to access to the above files without your prior consent, provided that the relevant processing is deemed necessary for the commencement or maintenance of a business relationship between you and the Company (e.g. assessment of a debt repayment plan / debt restructuring request, proposal for revision of the credit limit). Detailed information about the above files, the data, which includes their origin, the period for which they are retained by Tiresias S.A. per file or in their entirety, and the exercise of your rights vis-à-vis Tiresias S.A. in the context of the GDPR and the Law, is provided directly by Tiresias S.A. (the Data Processor) whose registered offices are at 1 Alamanas St., Marousi GR-15125 (tel. 210-3676700) or via the website http//www.tiresias.gr.

The Company may also process data collected from publicly accessible third parties (e.g. Land Registries/Cadastral Offices, commercial registers, the internet) where that data is necessary for the purposes of processing.

The Company, through the Manager, collects and processes the following minimum personal data: name-surname, father's name, mother's name, ID card/passport number or other official identification document, permanent place of residence, home address, correspondence address, email address, business and work address, financial data (e.g. statement of tax payable issued by the tax office), tax residence, tax registration number, telephone number (fixed and/or mobile) and sample of signature (physical or electronic), account number, bank account details, Tax Reg. No. Where appropriate, additional information may be requested, provided that such information is a condition for commencing or maintaining a specific business relationship.

In the context of evaluating your financial capabilities, for the purpose of finding an optimal solution to settle/restructure your debts and/or collect them, the Company may collect and process the following data via the Manager, including but not limited to: financial data (e.g. tax returns, statements of tax payable issued by the tax office, ENFIA property tax, financial data of a sole trader enterprise) or other sources of income, your credit rating data, credit profiling and credit scoring data, as well as data on breach of your financial obligations, valuation of assets, details of financed property or property used as collateral, insurance policies (e.g. to cover Fire/Earthquake risks), details of Share and Securities Account in the Dematerialised Securities System operated by AthexCSD in the HELEX Group, as well as additional information - in the context of implementing the applicable provisions on markets in financial instruments.

The collection and processing of your personal data by the Company is necessary for the commencement, execution and smooth management of your debts.

Special categories of personal data:

The Company does not process personal data of yours such as data relating to your racial or ethnic origin, political opinions, religious or philosophical beliefs or membership of a trade union, genetic or biometric data for the purpose of identifying you as a data subject, and health data or data relating to your sexual life or sexual orientation unless: a) you have expressly consented to this for a specific purpose; b) the processing is necessary for the performance of your or the Company's obligations and the exercise of specific rights in the field of social security and social protection law, in accordance with applicable European or national law and providing appropriate safeguards for your fundamental rights and interests as a data subject; c) the data has been clearly made public by you; d) the processing is necessary to establish, exercise or defend your legal claims and those of the Company as Controller; e) processing is necessary for reasons of substantial public interest (investigation of a criminal offence prosecuted in the context of the law on the prevention and suppression of money laundering and terrorist financing). In all events the Company has taken all necessary technical and organisational measures to ensure the safe retention and processing of your personal data which falls into these special categories.

Legal bases for processing

The Company lawfully processes personal data where the processing:

- is necessary to comply with its obligations under Law 4354/2015;

- is necessary for the Manager to manage your claims deriving from the loan or credit agreement(s) which have been transferred to it and for which you are liable in your capacity as debtor and/or co-debtor and/or guarantor and/or provider of real collateral;

- is necessary for the Company to comply with its legal obligation or to pursue its legitimate interests deriving from your business dealings with the Company or from other rights deriving from the law;

- is necessary to discharge its duties in the public interest in the context of the legislative and regulatory framework applicable from time to time;

- is based on your prior consent where processing is not based on any of the aforementioned legal bases for processing.
In cases where the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of the processing based on it until its withdrawal or the lawfulness of processing based on another lawful basis. The withdrawal of your consent may be submitted to the Manager, in accordance with the relevant provisions of Section 8 below.

Purposes of processing

Your personal data is processed:

- to manage claims transferred to the Company under the loan or credit agreement(s) in which you are involved in your capacity as debtor and/or co-debtor and/or guarantor and/or provider of real collateral or with which you are associated as a third party in accordance with the above, which has been assigned to the Manager, to ensure the proper performance of transactions within the Company’s scope, to perform the Company's obligations as Controller and to exercise its legal and contractual rights;

- to carry out checks required by the applicable legislative and regulatory framework, to transmit your data related to your financial conduct, to check your solvency and to search for your financial conduct data (e.g. from the interbank file held by TIRESIAS S.A.).

- to record, enter and file all manner of orders given to the Company in writing, electronically or by phone for the purpose of entering into transactions and in order to protect transactions;

- to discharge the company’s legal obligations deriving from the applicable legislative and regulatory framework (e.g. legislation on the prevention and suppression of money laundering and the fight against terrorism, tax and social security provisions);

- to defend the Company’s legitimate interests which are associated with: a) pursuit of its legitimate claims and the claims under management before the competent judicial authorities or other out-of-court/alternative dispute resolution bodies; b) the prevention of fraud and other criminal offences; c) evaluating and optimising security procedures and information systems; d) the management of the Company's operational and financial risks; e) the physical security and protection of persons and property (e.g. video surveillance).

Automated decision-making and profiling

The Company does not take decisions based exclusively on automated processing of personal data. However, it may lawfully take such decisions, including profiling, for the purpose of monitoring and preventing fraud and tax evasion against you, or against it or a third party (e.g. malware protection) as well as if such processing is necessary for the conclusion or performance of a contract (e.g. credit scoring) which is based on personal data obtained directly from you or from a search in the financial conduct database based on the records held by TIRESIAS S.A. and for which the criteria taken into account are the income of the data subject, their financial obligations, their profession, compliance with their contractual obligations in the context of previous financing which they have received from a financial institution, for the purpose of assessing your creditworthiness in order for steps to be taken within the context of the Company's activities).

Retention period for personal data

The Company retains your personal data for the time period specified in each case by the legislative and regulatory framework in force from time to time and in all events for a period of 7 years from the last calendar day of the year in which your business relationship with the Company ends, unless a longer statute-barring period is specified. Where any request for collaboration between you and the Company is not accepted and the contract is not entered into, the data shall be held for a period of 5 years. In the case of litigation, the personal data relating to you shall be held in all events until the lis pendens expires, even if the said period of 7 years is exceeded.

Recipients of personal data

Employees of the Manager's business and operational units have access to your personal data within their remit, in the context of proper performance and discharge of their contractual, legal and regulatory obligations, as do the certified public accountants from time to time.

The Company does not transfer or disclose personal data to third parties apart from in the following cases:

- Enterprises (domestic and foreign) to which it has assigned, in whole or in part, the processing of your personal data on its behalf, and which have undertaken a commitment to maintain confidentiality towards the Company; or a) in the context of a contractual relationship between them which sets out the scope, purpose, duration of processing, type of personal data processed and the Company's rights or b) as part of their regulatory obligation to maintain confidentiality, such as:
i. Debtor information companies under Law 3758/2009, as in force from time to time, which are entered in the relevant register, for the purpose of informing you as Debtor with further information and negotiating the time, manner and other terms for repayment of your overdue debt.
ii. Payment service and payment processing companies/organisations (e.g. DIAS, ISA, Mastercard)
iii. Credit institutions, payment institutions
iv. Associated enterprises, such as: Investment Firms, Mutual Fund Management Companies, other Financial Institutions or Bodies or other Authorities (e.g. Central Securities Depository, Stock Exchanges, Hellenic Capital Market Commission) in the framework of serving your business relations.
v. Loan and Credit Claims Management Companies in accordance with the provisions of Law 4354/2015 as in force from time to time.
vi. Transmission required for the commencement of a business relationship or the performance of a contract, or for the collection of the receivables to be managed in case of non-fulfilment of your contractual obligations (e.g. transmission to associated lawyers, law firms and bailiffs, notaries, engineers and valuers, auditors and accountants, insurance companies).
vii. Companies engaged in the digitisation and management (warehousing, destruction) of physical files.
viii. Bill issuing and dispatch companies.
ix. Companies that submit declarations of rights in rem over real estate that constitute or will constitute collateral for the claims under management in areas already cadastrally mapped or in the process of being cadastrally mapped.
x. Cloud computing support, processing and storage systems and web development and support companies.

The Company has lawfully ensured that processors on its behalf meet the conditions and provide adequate assurances about the implementation of suitable technical and organisational measures so that the processing of your personal data ensures that your rights are protected.

- Enterprises / companies affiliated to it.

- TIRESIAS S.A. for the purpose of protecting credit, restructuring transactions and limiting fraud, as well as ascertaining the creditworthiness of the Customer/Debtor of the claims to be managed.

- Transmission or notification required by the applicable regulatory, legislative and general regulatory framework or court ruling (e.g. transmission to judicial authorities, tax authorities, supervisory bodies, intermediation bodies) in compliance with the provisions on banking secrecy.

- Judicial authorities and public sector bodies in the context of exercising their powers.

- The Bank of Greece, other national central banks of the Eurosystem and the European Central Bank or other supervisory or auditing bodies in the context of their lawful competences.

The Company does not directly transfer your personal data to third countries or international organisations unless such transfer is required by the applicable regulatory or legislative framework. By way of example, the national authorities may send your personal data in the context of implementing the legislation on the Common Reporting Standard developed by the Organisation for Economic Cooperation and Development (OECD) or in the context of the law on tax compliance for foreign accounts by US citizens or US residents who have foreign accounts (FATCA- Foreign Account Tax Compliance Act).

Rights of data subjects

As a data subject, you retain the following rights:

i. The right of access to personal data relating to you, where they are processed by the Company as data controller, its purposes, categories of data and recipients or categories of recipients thereof (Article 15 of the GDPR).

ii. The right to correct inaccurate data and to supplement incomplete data (Article 16 of GDPR).

iii. The right to erase your personal data subject to the Company’s obligations and legal rights to retain such data based on the applicable legislative and regulatory provisions in force from time to time (Article 17 of the GDPR).

iv. The right to restrict processing of your personal data where either the accuracy of such data is contested or the processing is unlawful or the purpose of processing is absent, provided that there are no lawful grounds for retaining such data (Article 18 of the GDPR).

v. The right to portability of your personal data to another controller, provided that processing is based on your consent and is done using automated means. Satisfaction of this right is without prejudice to the legal rights and obligations of the Company to retain data and perform its duties in the public interest (Article 20 of the GDPR).

vi. The right to object on grounds relating to your particular situation in the case where your personal data is processed to perform a task carried out in the public interest or for the purposes of the legitimate interests pursued by the Company or a third party.

Any request relating to your personal data and the exercise of your rights, including your right to withdraw your consent, where required, must be addressed in writing to the Manager's Customer Service and Complaint Handling Unit at the junction of 27 Kyprou St. & Archimidous St., Moschato, Greece GR-18346 or by email to [email protected]. A special form for exercising your rights is available at https://eservices.dovaluegreece.gr/wizard-form?debtor=1

The corresponding notice from the Manager, acting as a separate and independent controller regarding the personal data of the Debtors, and the full details of the Data Protection Officer (DPO) can be found on the website https://dovaluegreece.gr/enimerosi-gia-tin-epexergasia-prosopikon-dedomenon-apo-tin-dovalue-greece

Refusal by the Company to satisfy or unjustified delay in satisfying your requests when exercising your rights entitles you to seek recourse to the Hellenic Data Protection Authority as the competent supervisory authority for implementing the GDPR. In all events, you continue to have the right to lodge a complaint with the competent supervisory authority if you consider that your personal data has been processed in breach of the applicable legislation from time to time. For more information visit the website www.dpa.gr.

Amendments

Based on its data protection policy in force from time to time and in the context of the legislative and regulatory framework in force from time to time, the Company may revise or amend this notice, which will always be available on the Manager's website.

Last update: 03/04/2023