Privacy Notice on the Processing of Personal Data by the Auxiliary Fund

(In accordance with the General Data Protection Regulation EU 2016/679)

The Auxiliary Fund for Motor Accidents Liability Insurance, abbreviated as "AUXILIARY FUND" (A.F.), is a Legal Entity under Private Law (N.P.I.D.) based in Athens, which is supervised by the Bank of Greece. It was established by Law 489/76, as codified by Presidential Decree (p.d.) 237/86, regarding compulsory motor vehicle third-party liability insurance, and its operation is fully harmonized with European Union Directives. Its members are, compulsorily and by operation of law, all insurance undertakings operating in Greece in the Motor Third-Party Liability Insurance Branch arising from the circulation of motor vehicles.

The AUXILIARY FUND respects your concerns regarding the privacy of the personal data you provide to us; therefore, we consider it important to inform you about how these are processed within the Organization.

Purpose of this Notice:

This notice concerns all personal data that are either provided by you for your service by the services of the A.F. or are obtained from third parties, natural or legal persons—such as other parties involved in the accident, foreign compensation bodies, insurance or reinsurance companies, police and other public authorities—and which are necessary for the processing of your submitted motor vehicle accident claim settlement request.

The Auxiliary Fund operates as the Data Controller for the entirety of your personal data processed exclusively within the framework of the following processing purposes.

Definitions:

What is personal data: The term "personal data", as used in this Notice, refers to information of natural persons, whether individuals or professionals, such as full name, postal address, email address, contact telephone number, police identity card number, tax registration number (AFM), Social Security Number (AMKA), passport number, driving license number, gender, marital status, date and place of birth, employer details, employment history, etc., which identify or can be used to identify the identity of a natural person.

What constitutes Processing of Personal Data: Processing of Personal Data means the collection, recording, organization, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission to third parties, dissemination, alignment, combination, restriction, erasure, and destruction of personal data of a natural person.

Purpose of Data Processing:

The purposes of the operation of the A.F., which also determine its individual processing purposes, derive from Articles 19 et seq. of Presidential Decree 237/86 and are the following:

Payment of insurance compensation for civil liability arising from motor vehicle accidents due to death, personal injury, or property damage when:

• the person liable remains unknown (in this case, however, there is no obligation to compensate for property damage, unless personal injuries requiring hospital care were simultaneously caused, provided that a police authority has intervened and this care lasted for a period of at least five days in a public hospital or private clinic),
• a valid third-party liability insurance contract has not been concluded (however, persons who voluntarily entered the vehicle that caused the damage are excluded from compensation, provided that the Auxiliary Fund proves that they knew the vehicle was uninsured),
• the insurer went bankrupt or enforcement against them proved fruitless, or the operating license of the insurance undertaking was revoked due to a violation of law.

Categories of Data We Process:

These data may concern, indicatively and not restrictively: motor insurance, car ownership, movements, family and financial data, health, social welfare, criminal prosecutions, and court decisions.

Legal Basis for Processing:

According to the applicable legislation on the protection of personal data, the processing of data is necessary for the performance of a task carried out in the public interest and in the exercise of official authority legally vested in the Auxiliary Fund.

Recipients:

Your personal data will be accessible only by our departments responsible for the respective service provided, e.g., for the settlement of a motor vehicle accident claim for which we are competent. Indicatively, we mention the Claims Department, the Legal Service, the Financial Services Directorate, the Management, the Information Center, the IT Department, and legal or natural persons contracting with the A.F. under any form of cooperation within the scope of their competencies for the fulfillment of the purposes of the A.F.

Your personal data are not transmitted to third parties, beyond the competent public and other supervisory and cooperating authorities when provided by law (legal obligation of the A.F.). In cases of exceptional data transmissions (e.g., to archiving and data retention companies on behalf of the A.F., insurance intermediaries, independent investigators/loss adjusters, software provider companies), the A.F. enters into contracts containing the appropriate terms and clauses on personal data protection to ensure the handling of data by third parties/processors on behalf of the A.F.

Transfers Outside the EEA:

A transfer outside the EEA may take place in cases where foreign compensation bodies are involved in the accident (third countries of the Green Card System, a foreign Auxiliary Fund or Compensation Body, foreign insurance companies involved in the settlement, insurance funds, police and other public authorities and services, as well as courts). In this case, the A.F. undertakes that its partners are under its control and act only on its instructions, have been specifically authorized for this purpose, and are fully bound by confidentiality and the obligations provided for in the legislation regarding the collection and processing of the above data, while at the same time ensuring the provisions of Articles 44 to 46 of the GDPR.

Data Retention Period:

How long does the A.F. retain and process your personal data? The personal data mentioned above are stored in the databases of the A.F. as well as in a hard-copy archive and are processed for a period no longer than what is required for the fulfillment of each processing purpose and/or as required for our compliance with any obligation for record-keeping provided for by the applicable legislation.

How Do We Safeguard Your Data?

We recognize our responsibility to protect the data you provide to us. The Auxiliary Fund has taken a series of technical security measures to protect your data, including secure servers, VPNs, firewalls, access controls, and encryption where applicable. We commit to keeping your data updated and accurate, storing and deleting it securely, not collecting and retaining data that are not necessary for us, protecting your data from loss, misuse, unauthorized access, or disclosure thereof, and generally ensuring the existence of appropriate technical and organizational measures for their protection and, finally, informing you in the event of a data breach.

Exercise of Rights According to the GDPR:

You have the ability to exercise your rights at any time as provided for in the relevant articles (13 to 22) of the GDPR, and specifically to request access to the personal data held by the A.F. about you, to request rectification of inaccurate personal data, erasure/right to be forgotten, portability of your data, restriction of processing, and objection to their processing. The entirety of the above rights may be satisfied by the Auxiliary Fund, without prejudice to any more specific provision/commitment deriving from other national legislation and/or other compelling reasons that may override your right. If you wish to exercise any of your above rights, you may do so by contacting us via email at: dpo@epikef.gr. The A.F. will ensure to respond to this request within a period of thirty (30) days from the date of submission of the relevant request, either by immediate satisfaction thereof or by detailed information on the reasons why it may not be possible to satisfy your request.

Contact for Information/Complaints:

For any matter concerning the processing of your data, you may contact the Data Protection Officer's office of the Auxiliary Fund at the email: dpo@epikef.gr

Also, you can always address a relevant query/complaint/grievance to the Hellenic Personal Data Protection Authority, 1-3 Kifissias Ave., P.C. 115 23, Athens, by registering on the online portal: www.dpa.gr.

This Notice may occasionally be amended. We reserve the right to change or modify this Notice at any time. The effective date of this Notice is stated at the beginning of the text. Please check it periodically and especially before providing any new personal data.