Data Privacy Notices

DATA PRIVACY NOTICE REGARDING THE PROCESSING OF YOUR PERSONAL DATA AT www.frogmobile.gr

The OTE Group attaches particular importance to protecting your personal data and complies with the transparency principle regarding data processing. If you wish to learn more about how OTE process your personal data, please read the General Data Privacy Notice, which can be found here.

This text provides more specific information about how your personal data is processed when you are browsing www.frogmobile.gr.

1. Who is the data controller and how can you contact them?

The data controller is OTE - TELECOMMUNICATIONS S.A. (“OTE”), with registered office in Maroussi, Attica (99, Kifissias Avenue), tel. 13888 for household customers or 13818 for business customers.

2. Who can you contact about data privacy issues?

For information regarding your data privacy, you can call the Household Customer Service at 13888 or the Business Customer Service at 13818, or you can fill out the online contact form at www.OTE.gr/contact_us.

3. What categories of personal data do we collect and process and for what purpose?

In order to provide our services through www.frogmobile.gr, we collect and/or process the following data:

(i) Data necessary for the fulfillment of our contractual obligations (the legal basis is art. 6(1)(b) GDPR – contract fulfillment):

Data that you fill in for the preparation of a new contract for the provision of our services, namely: First and last name, telephone number, father's name, identity document number, date and country of birth, residential address, SIM package shipping address, renewal amount.

Data that you fill in in the portability form, namely: First and last name, mobile phone number and mobile phone company, contact phone number, identity document number, date and country of birth, DYO, VAT number, residential address, SIM package shipping address, renewal amount.

(ii) Data that we collect based on your consent (the legal basis is art. 6(1)(a) GDPR – consent)

Data derived from the use of shortcuts to the following social media: Facebook, Twitter, Instagram and Youtube. You can use these shortcuts to recommend our products to your friends.

4. How long do we retain your personal data?

OTE retains your personal data, mentioned in paragraph 3 above, for as long as you have an active OTE prepaid connection and for a period of 14 months after your Frog connection is deactivated.
You may find more detailed information on data retention periods here.

5. Will OTE also process your data for other purposes?

Your personal data may be sent to:
o • Financial institutions via which your airtime balance is topped up.
o • Third party companies we collaborate with to provide and support the Application namely:
◦ BOLD OGILVY S.A. which supports the service. It is based in Greece.

Those third party companies are sub-processors acting on OTE’s behalf, which is to say associates of OTE which have undertaken to perform a certain task by following our instructions and by implementing the OTE Group’s strict personal data processing procedures. In these cases OTE continues to be responsible for the processing of your personal data as Data Processor.

Your personal data is primarily processed by our associates for those purposes in Greece and the European Union (EU). If we collaborate with companies outside the EU, they will process your data only on our instructions and only if there is an adequacy decision from the European Commission or if they agree to appropriate terms which ensure a high level of safety when your personal data is being processed.

Other than processing via BOLD OGILVY S.A., OTE does not process or make public your personal data to third parties, save for cases where notification/dispatch is required by the applicable legislation.

7. What are your rights as a user of the Service in relation to the processing of your personal data?

The rights you can exercise include:

Right of access: You are entitled to receive information about your personal data which we process (such as the purposes of the processing, the data types, the recipients it is sent to, the retention period) and to obtain copies of that data.
Right of rectification: You can ask for your data to be corrected (to have a wrong address or wrong contact details or ID Card No. corrected, for example).
Right of erasure:You can ask for your personal data to be erased if it is no longer needed in relation to the purpose for which it processed or where you withdraw the consent which was the basis for us collecting and processing it.
Right to restrict processing: You are entitled to limit the processing to a specific purpose (for example you can say “I don’t want to receive email updates for marketing purposes”).
Right to data portability:You are entitled to obtain the personal data you have provided to the company, in a structured, commonly used, readable format (for example you can request data held in the cloud).
Right to object to processing of your personal data in cases where you do not want your personal data to be processed.

To exercise your rights you can:
o ▪ Send an email to customerprivacy@OTE.gr or

o ▪ Fax to 2102511888 or

o ▪ Letter to OTE Customer Care, 99, Kifissias, Ave., Marousi, GR-15124, marked "Exercise of personal data rights"

stating your name-surname and mobile or landline number.

In case you think that we have not sufficiently satisfied your request and the protection of your personal data is affected in any way, you can submit a complaint through a special web portal to the Data Protection Authority (Athens, 1-3 Kifissias Avenue , PC 115 23 | tel : +30 210 6475600). Detailed instructions for submitting a complaint are provided on the website of the Authority.
OTE will promptly respond to your requests free of charge, within one month of receiving the request. In exceptional cases, that deadline may be extended by 2 months if necessitated by the complexity of your request. In all events, we will let you know about the extension and the reason for the delay.

If we consider that your request is manifestly unfounded or excessive we reserve the right to ask you to pay a reasonable fee to have it examined, taking into account the administrative costs of doing so, or even to refuse to pursue the matter further.

8. What type of measures are taken to protect your personal data?

OTE implements appropriate technical and organizational measures to protect personal data against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure or access and any other form of unlawful processing.

More information on this issue can be found in the General Data Privacy Notice.

Last modified at 04/01/2024.

Partner - Data Recipient	Service	Purpose of Processing	Responsibilities	Processed Data	Retention Period	Processing in Third Countries	Transfers under appropriate safeguards / Exceptions
Purpose of processing: Necessary and functional
Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland	Google Tag Manager	Adding and managing tracking scripts on the website. It checks the user's choices in the tracking categories and activates these trackers based on their consent.	OTE S.A. is responsible for data protection. Google Ireland Ltd. acts on behalf of OTE S.A.	User options regarding tracker consent.	Session
Imperva Inc, 3400 Bridge Parkway, Redwood Shores, CA 94065, United States of America	Incapsula	We use Imperva as a WAF and caching service, providing protection against attacks and improving the performance of our applications through advanced security and content caching.	OTE S.A. is responsible for data protection. Imperva acts on behalf of OTE S.A.	We use Imperva's services to protect our website from malicious attacks and enhance security. At the same time, Imperva improves the website's performance through content caching. The data collected is used for detecting and preventing malicious actions, as well as optimizing the user browsing experience.	Session	Imperva Inc, 3400 Bridge Parkway, Redwood Shores, CA 94065, United States of America	Incapsula
OTE S.A. Kifisias Avenue 99, 15124 Marousi	Tracker consent management.	The Cookie_Consent_Set is used to store your choices regarding tracker consent.	ΟΤΕ S.A	User options regarding tracker consent.	3 months
Purpose of processing: Performance (for the purposes of OTE S.A.)
Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.	Google Analytics	Google Analytics collects data from websites to create reports that provide business insights, such as how many users visited a page or purchased a product. Google Analytics uses a JavaScript tracking code added to the pages of the digital service to collect pseudonymous information about how users interact with a page.	OTE S.A. is responsible for data protection. Google Ireland Ltd. acts on behalf of OTE S.A.	Statistics on the number of users, session statistics, approximate geographical location, browser and device information, interactions (events) with the website such as pages visited, files downloaded, Age, Gender, Interests.	The data retention period at the user level is 14 months. The data retention period for event data is 26 months. The data retention period for age, gender, and interests data is 2 months.	Your online usage data is processed in Argentina, Israel, Japan, Canada, New Zealand, Switzerland, the United States of America, and the United Kingdom. The European Commission has issued an adequacy decision for these countries (https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en). Based on your consent, your online usage data will also be processed in the following non-secure third countries: Australia, Brazil, Chile, India, Kenya, Colombia, Malaysia, Mexico, Peru, Philippines, Singapore, South Africa, Taiwan, Turkey, and the United Arab Emirates. There is no adequacy decision from the European Commission (https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en) for these countries. OTE S.A. cannot, therefore, ensure that the European level of data protection is maintained for these data processing activities. It cannot be ruled out that local authorities may have access to your online usage data, or that the exercise of your rights as a data subject may be restricted or excluded.	EU adequacy decision or - Standard Contractual Clauses (SCC) with TIA or - Consent in accordance with Article 49 of the GDPR.
Purpose of processing: Advertising through partners
Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland	Google Ads, Campaign Manager, Display& Video 360, Search Ads 360 plus Consent Mode and Floodlight features	Google Ads: This online service tracks and documents website visits and measures the success of ads to optimize advertising spend. It uses cookies, pixels, and a local storage entry.	OTE S.A. and Google Ireland Ltd. act as independent controllers. You can find more information about data processing by Google in the privacy policy of Google Ireland Ltd.	Cookie ID, IP Address and device identifiers, Location, Client IDs, Information about the operating system, Referrer URL, Browser information.	13 months	Your online usage data is processed in Argentina, Israel, Japan, Canada, New Zealand, Switzerland, the United States of America, and the United Kingdom. The European Commission has issued an adequacy decision for these countries (https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en). Based on your consent, your online usage data will also be processed in the following non-safe third countries: Australia, Brazil, Chile, India, Kenya, Colombia, Malaysia, Mexico, Peru, the Philippines, Singapore, South Africa, Taiwan, Turkey, and the United Arab Emirates. There is no adequacy decision from the European Commission (https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en) for these countries. Therefore, OTE S.A. cannot guarantee that European-level data protection is adhered to for these data processing activities. It cannot be ruled out that local authorities may have access to your online usage data, or that the exercise of your rights as a data subject may be limited or excluded.	EU adequacy decision or - Standard Contractual Clauses (SCC) with TIA or - Consent in accordance with Article 49 of the GDPR.
Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland	For the publication of our campaigns, we use Meta Business tools. The Meta Pixel is used to measure the success and analyze advertising campaigns on Facebook, as well as for retargeting them on Meta's platforms.	Campaign Manager: This online service is used to measure the success and optimize advertising campaigns. It uses cookies to collect information for Google Marketing Platform services (CampaignManager360, DisplayVideo360, SearchAds360). Google Consent Mode is a feature used in combination with Display & Video 360, Google Ads, and GMP Floodlight services, allowing us to transmit information about your consent to the above services. This information is used for forecasts to improve the statistical evaluation of our ad success.	OTE S.A. and Meta Platforms Ireland Limited are jointly responsible for this. You can find more information about data processing in Meta's privacy policy.	IP address, browser information, page views, user, device information, geographic location, referrer URL, date and time of visit, ads displayed, items clicked, products and services purchased or searched, usage data, device ID, browser ID (fbq), event ID, pixel ID, cookie ID, Facebook ID.	12 months	Your data will be processed in the following third country: United States of America. The European Commission has issued an adequacy decision for this country.	EU adequacy decision or - Standard Contractual Clauses (SCC) with TIA or - Consent in accordance with Article 49 of the GDPR.