DATA PROTECTION NOTICE FOR CUSTOMERS & SUPPLIERS

Protecting your personal data is a priority for us. Learn more about how your personal data is processed by XENOS Packaging S.A.

XENOS Packaging S.A. (hereinafter referred to as the “Company” or “we”), within the scope
of our collaboration, collects and retains the following data about you:

• First name, last name (for sole proprietorships)
• Contact information (address, phone, mobile, fax, email)
• Contact person details
• Tax ID, Tax Office, profession
• Banking details (IBAN, account holder)
• Financial data

We process your data for the purpose of entering into and executing contracts with you. Specifically, we process your data solely for the following purposes:

2.1. Contractual Obligations
In the course of our business transaction, we collect, process, and store the data you provide to us that is necessary for the conclusion and execution of contracts between us. We use your data to maintain a supplier and customer registry and for managing and reconciling account balances.

2.2. Pre-Contractual Assessment
Before entering into a contract, we may use your data to check your creditworthiness through relevant information systems, such as TIRESIAS. This processing is based on our legitimate interest in conducting business with financially reliable customers and suppliers.

2.3. Legal Obligations & Claims
When legally required, we will provide your data to the competent authorities. We will retain and process your data to the extent necessary to establish, exercise, or defend legal claims.

Only appropriately authorized employees or external partners acting on our behalf and providing us with IT and technical support services, or conducting audits in compliance with our legal obligations, will have access to your data, as required by applicable law.

We will retain your data for ten (10) years after the termination of the contract with the Company or for ten (10) years from the last transaction (if no contract exists). After this period, your data will be deleted. If no collaboration takes place, we will retain your data for two (2) years from the date of our last communication.

• Our company ensures your rights regarding the protection of your personal data and makes it easy for you to exercise them. You have the right to request:
• Correction of your personal data if it is inaccurate or incomplete.
• Deletion of your personal data or its transfer to a third party, provided the
  conditions set forth by national and European legislation for exercising such rights
  are met.
• Restriction of the processing of your personal data for specific purposes only.
• Data portability, meaning you can receive the data you have provided in a
  structured, commonly used format, or request its transfer to a third party of your
  choice.

If you have any requests or wish to exercise any of your rights regarding your personal data, you can contact us at the following details:

Thessaloniki, VIPE Sindos, 57022

[email protected]

In any case, if you believe your rights are being violated, you have the right to file a complaint
with the Hellenic Data Protection Authority (www.dpa.gr).

Last review: December 2023