PERSONAL DATA PROTECTION POLICY

The protection of your personal data is important to us.

Please take a moment to read this Personal Data Protection Policy (hereinafter the "Policy") and inform yourself about the manner in which the company under the trade name "SPORTFM KENTRIKI DIACHEIRISI ATHLITIKON DIKAIOMATON SINGLE MEMBER S.A.", having its registered office in ETHNARCHOU MAKARIOU STR. AND 2, FALIREOS STR, 18547, PIRAEUS, registered with the General Commercial Registry (G.E.MH.) under No. 194363907000 and Tax NUM. 803312562, tel. 210-4800000, e-mail address: skai-legalsec@skai.gr (hereinafter referred to as the "Company" or "we" or "us" or "our"), acting as the Data Controller, collects, stores, uses, and generally processes your personal data when you visit or use our website www.sportfmtv.gr.

For any queries you may have regarding this Policy, you may contact us at the contact details provided above.

1. What is personal data?

The term "personal data" refers to information of natural persons, such as full name, postal address, e-mail address, contact telephone number, etc., which identifies or can identify your identity, hereinafter referred to as "Personal Data" or "Data".

2. What is Processing of Personal Data?

Any operation or set of operations performed on Personal Data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

3. What Data do we collect from you?

We collect only your absolutely necessary Data, which are appropriate and clear for their intended purpose.

Specifically, we may collect:

a) Identity data (e.g., first name, last name, age)
b) Contact data (e.g., telephone number, e-mail address)
c) Activity details (e.g., profession)

We do not collect data from minor users, and in the event that we establish that any personal information has been collected from a minor, we proceed to its erasure.

Data collected by Cookies are deleted by us in accordance with the Cookies Policy.

4. For what purpose do we collect your Data?

We collect your Data in order to:
a) communicate with you to resolve your queries
b) process your request to advertise through the Company
c) send you our newsletter
d) manage the website and connected applications
e) provide third parties with statistical information concerning the use of the website, without the identification of individual users being possible
f) keep the website and connected applications secure and prevent fraud
g) facilitate your participation in "Oloi Mazi Boroume" and "Me ena CL1CK Boreis"
h) enable you to express your interest in participating in all kinds of shows and TV game shows produced by the Company
i) enable you to submit your comments.

5. What is the lawful basis for the processing of your Data by the Company?
The processing of your Data is carried out in accordance with:

• the terms of our contractual relationship, namely the sale of services and/or products,
• your consent, where required,
• the statutory obligations of the Company arising from the law (e.g., tax legislation),
• the legitimate interest of the Company.

6. Who are the recipients of your Data?

Access to your Data is granted strictly to the absolutely necessary personnel of the Company, who are bound by confidentiality obligations.

Additionally, we may disclose your Data to cooperating service providers for the development, maintenance, and hosting of the website, as well as for the management and distribution of the newsletter, who act as Data Processors.

7. How do we ensure that Data Processors respect your Data?

The Processors processing data on our behalf have agreed and contractually committed to:

• maintain confidentiality,
• not send your Data to third parties without the Company's permission,
• take appropriate security measures,
• comply with the legal framework for the protection of personal data, and in particular Regulation (EU) 2016/679 (otherwise GDPR).

8. Do we transfer your Data outside the E.U.?

Your Personal Data are subject to storage and processing only within the E.U.
We do not transfer your Data outside the E.U., with the exception of:

1. the management and distribution of the newsletter which is carried out through Google's Feedburner, and consequently your electronic communication address is transferred outside the European Union, subject to appropriate safeguards, as confirmed by the latter's participation in the Privacy Shield framework,
2. the Data you fill out when commenting on an article posted on our website, as this function is provided by the online platform https://disqus.com/ owned by Disqus Inc. In this case, appropriate safeguards for data transfer are maintained, as Disqus Inc. holds a Privacy Shield certification.
   (Note: Please review the legal note below regarding the "Privacy Shield" mechanism).

9. When do we delete your Data?

The Data provided by you will be retained/stored by the Company only for as long as required to fulfill the purpose for which you have disclosed your Data to us, unless an extension of this period is required due to legal claims or our statutory obligations. At the end of this retention period, your Data will be fully erased or anonymized so that they can be used in a non-identifiable manner for statistical analysis and business planning.
Your declaration of consent for sending newsletters is retained for as long as the newsletter is sent to you by the Company, and in any case for no longer than six months from the termination of its distribution.
You can inform yourself about the retention period of Data collected via Cookies from the Cookies Policy.

10. Is your Data secure?

Recognizing the importance of the security of your Personal Data, we have implemented all appropriate organizational and technical measures for the security and protection of your Data against any unauthorized access, misuse, alteration, prohibited dissemination, disclosure, loss or accidental/unlawful destruction, and any other form of unfair processing. The said measures are reviewed and amended whenever deemed necessary.

11. What are your rights?

You have the right of:

• access
• rectification
• erasure / right to be forgotten
• data portability
• restriction of processing
• objection / withdrawal of consent

12. How can you exercise your rights?

You may exercise your rights by submitting a relevant request, sent either to the Company's postal address (2 Ethnarchou Makariou & Falireos Str., Neo Faliro, Attica) or to its e-mail address (dpo@skai.gr).

13. When do we respond to your Requests?

We respond to your Requests free of charge and without delay, and in any event within one (1) month from the receipt of your request. If, however, your Request is complex or there is a large volume of Requests, we will inform you within the month if we need to obtain an extension of another two (2) months, within which we will respond to you.

If your Requests are manifestly unfounded or excessive, in particular because of their repetitive character, the Company may either charge a reasonable fee, taking into account the administrative costs of providing the information or taking the action requested, or refuse to act on the Request, providing a reasoned response to you.

In the event that you do not receive a response within the aforementioned prescribed deadline, or the response you received was not satisfactory, or your issue has not been resolved, you may lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

14. Do we use automated decision-making / including profiling when processing your Data?
We do not make decisions, nor do we engage in profiling, based on automated processing of your Data, except in the case of using "cookies" on our website, always following your notification and consent.

15. What is the applicable law during the processing of your Data by us?
Applicable Law is Greek Law, as formulated in accordance with the General Data Protection Regulation (EU) 2016/679, and generally the current national and European legislative and regulatory framework for the protection of personal data. The Courts of Athens shall have exclusive jurisdiction over any arising disputes related to your Data.

16. How will you be informed about any amendments to this Policy?
We update this Policy whenever necessary. If there are significant changes to the Policy or to the manner in which we use your Data, we will post the update of this Policy on our website before the changes take effect, and we will notify you by any appropriate means.

We encourage you to read this Policy at regular intervals to be aware of how your Data is protected.