This Policy was published by the Company on 16/10/2023 and is subject to periodic improvement and revision.

Privacy and Personal Data Protection Policy

The company under the name, “REPATH P.C.” and the distinctive title “REPATH”, whose registered office is in Athens Greece, at 12 Thiseos Str., with Tax Identification Number: 801341377 of the Tax Office AMAROUSIOU, (hereinafter referred to as the “Company”), considers it of great importance the lawful processing, security and protection of your personal data, in any capacity you communicate or cooperate with us, such as potential or active customers, representatives and legal representatives of companies, partners and collaborators of our customers or our potential customers, visitors of the Company’s website, employees, suppliers, external collaborators of the Company. The Company is a Premium Partner of Zoho and offers resale services for Zoho products, including licenses. We tailor clients’ Zoho applications to meet specific requirements and develop integrations between Zoho applications and third-party online services., You may communicate with the Company at the email: [email protected] The Company’s website is: www.repathsolutions.com

Please read these terms and conditions carefully and the relevant Privacy and Personal Data Protection Policy. By signing and accepting this in printed form or by submitting the relevant statement of consent while using our website, you unconditionally accept the practices described herein, the terms of which govern our contractual relationship and are incorporated into the terms of the use of our services.

1. What is your personal data?

Your personal data includes any information in print or electronic media, which may lead, either directly or in combination with others, to your unique identification or to the possibility of your identification as a natural person. This category includes, as the case may be, information such as name, ID number, Tax number, your physical and email addresses, telephone numbers, gender, citizenship, IP, cookies and special categories of personal data such as video, voice and photo recordings and any other information that allows your unique identification, according to the provisions of the General Data Protection Regulation 2016/679 (“GDPR”), οf law 4624/2019, the current Greek and European legislation and the decisions of the Personal Data Protection Authority.

2. What is the Processing of Personal Data?

Any operation or series of operations performed whether or not by automatic means, on personal data or on personal data sets, such as collection, registration, organization, structure, storage, adaptation or alteration, retrieval , the search for information, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction

3. What personal data do we collect?

We process personal data that you provide to us when you fill out applications and expressions of interest for our services, when you contact us for questions about the services we provide, when you browse our website and when you sign a contract with our Company and use our services, either yourself or for the legal or natural persons you are legally representing. The data we collect, indicatively and not restrictively, are:

a) Basic Personal Data: Name, Surname, father’s name, mother’s name, details and photocopy of ID, date of birth, gender, citizenship, family status, etc.

b) Contact details: Home address, work address, contact telephone numbers (home, work, mobile), Emails, etc.

c) Professional profile: Status, Occupation, position in a company, responsibilities and duties, educational level, work experience, etc.

d) Financial data: Tax number, Social Security number (AMKA), Tax Office, Social Security Organization, bank account, IBAN, debts to the Company, payments, social security contributions, payroll etc

e) Image data: audiovisual material, photographs and videos, recorded in the context of meetings organized by the Company and for the purpose of providing its services.

f) Health data: sick leave of employees, medical opinions, etc.

d) Other kind of personal data, provided by clients in tables, CRM data, SQL files or any other kind, to customize Zoho products and applications.

We also automatically collect information sent to us from your computer, mobile device and browsers that you use in order to access our services through our website www.repathsolutions.com (“Automatic Data”). These include, for example, your IP address, statistics on the use of our services, information on how to access our services, and data collected through Cookies, Pixel Tags, and other similar technologies. You can find more information about this in the Cookies Policy Statement section. We may also receive information from other sources, such as social networks (Linkedin, Facebook, etc.) and from other companies’ websites.

We process and protect your personal data in accordance with the law, when you contact us and / or purchase our services directly by concluding a contract with us, when you call our numbers to provide you with information about our services, or when you request online information through our website or via our email address.

4. Legal processing

The Company will use your information for the following legal and specific processing purposes (according to the relevant articles of the GDPR), as the case may be, with your explicit consent which you can freely withdraw at any time, or for the execution of a contract or pre-contractual relationship with you, or for the service of our legal interest or for the defense of your vital interest, or the vital interest of our employees and our associates, as well as for the service of the legal interests of our company, namely:

For employees and job applicants:

• for the conclusion and execution of the contract of employment, for the compliance with the labor, social security and tax legislation in general, for the compliance with the rules and regulations for safety and hygiene at work, for the protection of their vital interests, and in general for the exercise of the managerial right of the Company.

Regarding clients, prospective clients, their partners and their legal representatives:

• for the preparation and execution of the contract concluded by the Company with its customers and suppliers, for the provision of its services
• for the service, support and monitoring of your contractual relations with the Company and the good performance of the contract between us,
• for the costing of the Company’s services
• for the Company’s compliance with its tax and social security obligations
• for the Company’s compliance with the applicable legal and regulatory framework

• • in order to safeguard the legal interests of the Company,
  • in order to safeguard the vital interests of the Company’s employees and goods,

• for the purpose of providing our services to our customers and of Zoho applications & products customization or/and integration to third-party services.
• in order to manage your calls for information in relation to our services, to fulfill your requests and to improve our services,
• for communication and information purposes, such as sending you an email, sms and / or newsletter in relation to the activities and services of our Company that may interest you, provided you have given us your consent (Opt-in). You can withdraw your consent (opt-out) whenever you wish.
• for the promotion of the Company’s services on social media and professional networking pages managed by it, provided that you have given explicit consent to it
• for our internal operations and analysis, such as internal management, fraud prevention, use of management, pricing, accounting, billing and control information systems as well as compliance with tax regulations.

Regarding external collaborators and suppliers:

• for the preparation and execution of the contracts that the Company concludes with them for the purchase of products or the provision of services
• for compliance with tax legislation,
• for the necessary communication either at a pre-contractual stage or during the performance of the contract,

Regarding the visitors of the Company’s website:

• for the needs of electronic communication and service through the website as analyzed in the terms of use of the website
• In any case, you can change your preferences at any time by sending an email to the email address info@ repathsolutions.com

5. What are the principles of collection and processing

This Privacy and Personal Data Protection Policy intends to inform you of the terms of collection, processing and transmission of your personal data, which we may collect as Controller of the Personal Data or Processor of the Personal Data. The Company and its trained staff, complies with the ten Processing Principles of GDPR 2016/679 (legality, objectivity, transparency, purpose limitation, data minimization, accuracy, limitation of storage time, integrity, confidentiality and accountability). The Company protects and ensures your eight Rights regarding the use of your Personal Data (information, access, rectification, erasure, restriction of processing, notification, data portability, objection and non-automated decision-making based on profile, as specified in Greek law). The above applies without discrimination and applies to all processing we perform and all services we provide.

6. Which are the ways of collecting your personal data

The Company collects your personal data by accepting the terms of use of each of our services, such as:

• when you call our numbers, when you email us, or fill out an application for us to provide our services to you or to your collaborators.
• when you draw up and sign a contract with us for the provision of our services to you, in the framework of which you voluntarily provide us with your personal data and the personal data of your partners or legal representatives or your employees or collaborators or suppliers
• when contacting our offices or customer service staff, and our call center, either to provide services or to express your opinion, complaints, or comments.
• when you participate in the brief meetings we organize and your image and voice are recorded and the image and voice of your partners, employees, associates and legal representatives, as well as our employees are recorded in the brief meetings we organize, for the purpose of providing our services, for example giving us guides and fully brief for customization of your CRM, getting training video from us, etc
• when you send us the postal address and other details for issuing or sending an invoice or proof of provision of services.
• when you voluntarily subscribe to our newsletter
• when you visit our website through which we collect, with your explicit consent, through cookies, information from your terminal device, such as your Internet Protocol (IP) address, the operating system you use, the type and version of your browser (browser) etc.
• when we receive your Curriculum Vitae with your consent through Linkedin or our website
• when we receive documents, requests, orders, petitions, warrants, etc. of third parties, such as supervisory, prosecutorial, judicial, tax authorities, in order to investigate crimes and to protect your family and your, our employees and our Company, to combat any form of crime and prevent the infringement of legal property.

7. Minimize, save and delete your data

The Company will always ask you for the minimum required by law personal data in order to provide you with our services, and for you to contact us.

Our Company keeps your personal data only for as long as required by the contractual terms of each service, in combination with the current social security, tax, labor and general legislation, based on the respective processing purpose, while then anonymizes or destroys them. The personal data of the employee are kept for at least five (5) years from the end of the year in which the employee left the Company in any way. After the

expiration of the above period of time, and if permitted by the relevant legislation (tax, etc.), such personal data will be destroyed if kept in printed form or will be deleted or anonymized if kept in electronic form.

The video recordings and the recordings in audiovisual material in the context of the execution of our services that constitute personal data (visual image, sound of the voice, movements, etc.), are kept for a period of six (6) months from their receipt, except of brief meeting recordings that are kept as long as required by the contractual terms of each service.

You can ask us and find out what data we collect about you and correct or delete it, by completing a relevant application that we have available here, unless required to be retained by law for tax, social security, probation or judicial purposes and for the prosecution of illegal acts.

8. Cookies Policy on our website

According to the European Directive E-privacy 2009/136 / ΣΕ (which will be replaced by the ePrivacy Regulation) and Instructions dated 25.2.2020 of the Personal Data Protection Authority, our website www.repathsolutions.com accepts the use of “cookies”. These are online tools for collecting and analyzing information from social networking platforms or partner third party websites, in order to measure traffic, improve the operation, content and overall appearance of our website and adapt it to the needs of our customers. They are divided into 4 four categories: 1. Necessary cookies (First party) which are important to be activated during the browsing, in order for the properly function of the isotope. These essential cookies are whitelisted and excluded from GDPR consent. 2. Preference cookies that remember user options such as language, currency or color settings. 3. Statistics cookies that come from third party services, such as Google Analytics and monitor traffic and isotope statistics. 4. Marketing cookies that come from technology companies or third party advertising (Third party) for the purpose of displaying advertisements to visitors or collecting personal data from them, for future marketing purposes.

When using our website, your personal data is first processed by third parties (“third party cookies”), such as social networks and search engines, e.g. Google Analytics, Facebook social plug-ins, Facebook Pixel, Zoho Pixels etc., without any involvement, influence or control by the Company and are transmitted either inside or outside the European Economic Area (27 EU Member States plus Iceland, Liechtenstein and Norway) , for which these third parties are solely responsible. If you do not wish third parties, such as (Google, Facebook, Instagram, etc.) to receive information from your browser, when you visit the Company’s websites you can opt out of the terms provided by the respective User Policy exists on the website of any such third party. Although most browsers automatically accept the use of cookies, you can always change the settings on your computer by choosing not to accept cookies, or you may be asked to accept each of them separately. But you should know that this will limit the range of browsing capabilities available to you on any web site and user experience.

9. Transfer your data to third parties

As a rule, our Company does not transfer your personal data to third parties, except to the extent that it is required to provide you with our services, to fulfill requests for the services we provide, and if required by the applicable legal framework.

In particular, the absolute necessary Company’s staff (employees / associates /collaborators) for the fulfillment of the above purpose, has access to your personal data and the ability to process them, and is committed to maintaining confidentiality.

Your personal data may be disclosed and transferred:

to the competent Public Authorities due to the legal obligations of the Company (Tax Office, EFKA, etc.) as independent Controllers of processing personal data, to accountants, computer engineers, information systems technicians, suppliers, Zoho Applications & Products, Google Workspace applications, Hetzner – hosting provider, Zoom or Teams electronic platforms, etc. who collaborate with the Company on independent service contracts, and who are jointly responsible as Processors of personal data, with the Company, and are committed to maintaining professional confidentiality, to the Company’s customers, who are independent Controllers of processing personal data and are not affiliated with the Company, In addition, such independent third parties may be official state and supervisory bodies (eg prosecutors, Cybercrime Prosecutοrs, the Personal Data Protection Authority, Tax Authority, supervisor Authorities) when we are asked to comply with the law and to prevent harm to you and to our Company from illegal actions.

In our Company we select reliable providers and we try to impose contractual restrictions on third parties who receive your personal data, in order to ensure their use in compliance with the law. All our associates and employees are bound by a confidentiality agreement and an obligation of confidentiality and professional discretion.

In order to process your data, we may need to store, transfer and process it in other countries, including countries basically within the European Economic Area (EEA) based on EU adequacy decisions, corporate binding rules, standard contracts and approved codes of conduct.

10. Security of your personal data

In any case, we take the appropriate technical and organizational measures to ensure the confidentiality, integrity and availability of your data. Οur aim is to ensure that your personal data is transferred, stored and processed in accordance with adequate international security standards and procedures. At our Company we have trained and liable staff, while we recognize the importance of protecting your privacy and all your personal data. For this purpose, we have appropriate security policies and use the appropriate technical and operational tools, such as anonymization, pseudonymization, data encryption, use of firewalls, establishment of access levels, authorized staff and associates, staff training, periodic security audits, compliance to international security standards in order to protect personal data from unauthorized or unlawful processing, accidental destruction, damage or loss.

Any of our partners has access to the above information and your personal data, as executor of the processing, uses them exclusively for the above purposes. We share the information you provide to us exclusively in the ways described in this Policy and in accordance with your express and specific consent per type of processing which you can at any time and freely revoke by contacting us.

11. How do we ensure that our Processors of Personal Data respect your personal data and the personal data of your partners, collaborators etc?

The Processors of personal data on behalf of the Company, have agreed in writing and contractually undertaken to:

maintain confidentiality, and commit to their respective obligations and staff if they are external partners, do not pass on personal data to third parties without our written permission, take organizational and technical security measures for Data protection, inform us of any incident involving the breach of your personal data,

delete and / or return your personal data to us, upon termination of our contract, comply with the legal framework for the protection of personal data and in particular with the General Regulation on Data Protection (GDPR) and the relevant legislation in general, as well as with the decisions of the Personal Data Protection Authority.

12. Displation of targeted advertisements

Once you have given us written consent we may use your personal data along with other data we have collected, after human intervention by our marketing department, to display advertisement related to your apparent preferences on our website or any other website.

However, we do not use automated tools to track and evaluate your consumer profile and your general preferences with other personal information (such as your email address) to display advertisements or send you personalized offers, unless you have accepted marketing cookies. In addition, we do not share your personal data with third parties, so that they may send you relevant advertisements, unless you have expressly consented in writing to them. If you wish to stop sending us updates, emails or newsletters, you can use the unsubscribe link at the end of each email or newsletter you may have received from us (unsubscribe).

13. Links to third party websites

Our Company website contains links that lead to other websites of third parties, independent entities, which operate and are maintained exclusively by them, and which we do not control, as mentioned above. We therefore have absolutely no responsibility for the content, actions or policies of these websites. Please read the corresponding data protection policies carefully on the websites you visit, as they may differ significantly from ours.

14. Unsolicited commercial communication

The Company does not allow the use of our services or our website for the transmission of mass or unsolicited commercial e-mails (spam). We also do not allow the sending of messages to/and from our customers, which use or contain invalid or falsified headings, invalid or non-existent domain names, techniques for hiding the origin of each message, false or misleading information or violate the terms of use of websites. We do not allow in any way the collection of e-mail addresses or general information of our customers, through our services of our website. We do not allow or authorize any attempt to use our services in a way that could harm, disable, encumber any part of our services or prevent anyone wishing to use our services lawfully.

In relation to our website www.repathsolutions.com and our email address [email protected], if we consider that there is any unauthorized or inappropriate use of data in any of our services, we can, without notice, at our sole discretion, take appropriate action to block messages from a specific web space (domain), email server, or IP address. We have the ability to immediately delete any account that uses our services, which at our sole discretion, transmits or is associated with the transmission of any messages that violate this policy.

15. Subjects’ rights and communication for questions or comments According to the legislation of personal data protection and the GDPR you have the following rights:

• Right to information and access to your data: The right to know if your data is being processed, how and for what purpose.
• Right to correct your data: The right to request correction of your personal data if it is inaccurate or incomplete.
• Right to delete your data (“right to be forgotten”): The right to request the deletion or abolition of your personal data, subject to certain conditions.
• Right to restrict the processing of your data: The right to request the restriction on the processing of your personal data when certain conditions are met.
• Right to the portability of your data: Your right to request transmission of your data to a third party.

Requests for the exercise of these rights you can following this link https://repathsolutions.com/gdpr-rights-exercise-form, as well as questions or comments regarding this Privacy Policy or if you believe that we have not followed the principles set out in it, may be submitted electronically to the Deputy for the Security and Processing of personal data of our Company, Otar Peradze, in the following email: [email protected] with the indication: “to Deputy for the personal data processing”. In case of exercising any of the above mentioned rights, the Company will respond to you within (1) month from the receipt of your request, while this deadline may be extended for (2) months depending on the complexity of the request and the number of requests.

Finally, you have the right to submit a complaint to the Personal Data Protection Authority (www.dpa.gr ) 1-3 Kifissias Ave., PC 115 23, Athens + 30 210 6475600, contact email [email protected], if you consider that the processing of your Personal Data violates the applicable national and regulatory law for the protection of personal data.

16. Which is the applicable law during the processing of your Data by us?

Applicable Law is the Greek Law, as formulated according to the General Regulation for the Protection of Personal Data (GDPR) 2016/679 / EU, and in general the current national and European legislative and regulatory framework for the protection of personal data. The Courts of Athens in Greece are the sole competent courts for any disputes arising from the processing of your Personal Data.

17. Validity of Security Policy and Personal Data Protection

This Policy was published by the Company on 16/10/2023 and is subject to periodic improvement and revision.