Privacy and Personal Data Protection Policy

The protection of personal data is an important obligation of WANTACAR.

This Privacy and Personal Data Protection Policy (the “Policy”) describes how personal data are collected, used, stored, disclosed and otherwise processed in connection with the operation of the website wantacar.gr (the “Website”) and WANTACAR's services.

Processing is carried out in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), applicable Greek legislation and any other personal data protection and privacy provisions applicable from time to time.

This Policy applies, among others, to Website visitors, prospective and existing customers, prospective vehicle buyers or lessees, persons interested in selling or trading in a vehicle, and persons who communicate with WANTACAR.

The controller of personal data is: ARGYRIOS KATSANTONIS LIMITED LIABILITY COMPANY Trade name: WANTACAR Registered office: 160 Liosion Street, Athens VAT No.: 997780569 Tax Authority: Athens A' Telephone: +30 211 444 2306 Email: info@wantacar.gr

For any matter concerning the processing of personal data or the exercise of data protection rights, the interested person may contact WANTACAR at the above email address.

Depending on how a user interacts with the Website and WANTACAR and on the service in which the user is interested, the following categories of personal data may be processed.

3.1 Identification and contact details The following information may be collected:

• full name
• telephone number
• email address
• residential or business address, where required
• identity card or passport details, where required for the relevant transaction or service
• other information provided by the interested person when communicating with WANTACAR

3.2 Driving licence details In connection with Flexible Operating Leasing, driving licence details and, where necessary, a copy or proof thereof may be requested in order to assess the request, verify the legal ability to drive and prepare or perform the relevant agreement.

3.3 Vehicle purchase information Where a person expresses interest in purchasing a vehicle, the following may be processed:

• contact details
• the vehicle in which interest was expressed
• information regarding the interested person's preferences
• related communications and requests
• information necessary for the preparation and completion of the transaction

3.4 Flexible Operating Leasing information For the submission, assessment and management of a Flexible Operating Leasing request and, if it proceeds, for the preparation and performance of the relevant agreement, identification and contact details, driving licence information and any other information or supporting documents necessary for the process may be collected. WANTACAR may carry out an internal assessment of the request before deciding whether to proceed with a specific offer and agreement. The relevant decision is made by authorised WANTACAR personnel and is not based solely on automated processing that produces legal effects or similarly significantly affects the interested person.

3.5 Vehicle sale or trade-in information When an interested person uses the “Sell your car”, trade-in or similar service, the following may be collected:

• contact details
• vehicle make and model
• year or first registration date
• mileage
• version and technical specifications
• information regarding the condition and history of the vehicle
• vehicle photographs
• ownership information and vehicle documents, where required at a later stage
• information regarding any legal or other restrictions on transfer
• any other information necessary for the assessment and, where agreed, completion of the transaction

3.6 Information relating to financing interest WANTACAR does not itself provide credit or loans. Where a user indicates an interest in possible financing for the purchase of a vehicle, WANTACAR may process basic contact information and the relevant expression of interest in order to facilitate communication regarding financing options. The Website is not used to submit a complete financing application to WANTACAR and, through the relevant online functionality, WANTACAR does not request financial or tax documentation for a creditworthiness assessment. Any financing application, assessment and approval process is carried out by the relevant cooperating licensed credit or banking institution, in accordance with its own terms and personal data protection obligations.

3.7 Communication data When a person contacts WANTACAR through a form, telephone, email or another available channel, communication details and the content of the relevant request may be retained to the extent necessary to handle, monitor and document the request.

3.8 Technical data During use of the Website, technical data may be collected, including:

• IP address
• device type
• operating system
• browser type and version
• date and time of access
• technical logs
• security and operational data
• information regarding how the user interacts with the Website

The collection and use of data through cookies and similar technologies are described in more detail in the Cookies Policy.

WANTACAR mainly collects personal data:

• directly from the data subject
• through Website forms
• during telephone, electronic or in-person communication
• during the sale, purchase, trade-in or leasing of a vehicle
• through documents and supporting documentation provided by the interested person
• through the Website's technical systems, where permitted
• from third parties or publicly/lawfully accessible sources, only where a lawful basis exists and this is necessary for a specific purpose

WANTACAR processes personal data only where an appropriate lawful basis exists.

5.1 Management of expressions of interest Information submitted through forms is used for:

• receiving and assessing the request
• communicating with the interested person
• providing the requested information
• preparing a possible offer or transaction

Processing is carried out, as applicable, in order to take steps at the interested person's request before entering into a contract or on the basis of WANTACAR's legitimate interest in managing requests addressed to it.

5.2 Vehicle purchase and sale Where a transaction proceeds, the necessary data are processed for the preparation, conclusion and performance of the agreement and for compliance with WANTACAR's legal obligations.

5.3 Flexible Operating Leasing Personal data are used for:

• assessing the request
• verifying the required conditions
• preparing an offer
• preparing and performing the leasing agreement
• managing the contractual relationship
• protecting WANTACAR's property and legitimate interests
• complying with legal obligations

Depending on the circumstances, such processing is based on taking pre-contractual steps, performance of a contract, compliance with a legal obligation or WANTACAR's legitimate interests.

5.4 Sale or trade-in of a customer's vehicle The interested person's and vehicle's data are used for:

• the initial assessment of the vehicle
• communication with the owner
• scheduling an inspection
• preparing a possible offer
• checking the necessary information before transfer
• completing the transaction, where agreed

Processing is carried out mainly in order to take pre-contractual steps at the interested person's request and, where a contract is concluded, for its performance and compliance with related legal obligations.

5.5 Accounting, tax and other legal obligations Where required, data are retained and processed in order to comply with WANTACAR's tax, accounting, regulatory, judicial or other legal obligations.

5.6 Establishment, exercise and defence of legal claims WANTACAR may retain and use data where necessary for the establishment, exercise or defence of legal claims, the protection of its rights or the handling of disputes.

5.7 Systems security and prevention of abuse Technical data and logs may be used for the security of the Website and information systems, the prevention of fraud or malicious use and the investigation of security incidents. Such processing is based on WANTACAR's legitimate interest in protecting its systems, services, property and users.

Requests submitted to WANTACAR may be recorded in the Company's internal customer relationship management system (CRM).

The record may concern vehicle purchase requests, Flexible Operating Leasing, vehicle sale or trade-in requests and other communications.

The CRM is used for the organised management of requests, communication with the interested person, monitoring the progress of the case and, where the transaction proceeds, supporting the related pre-contractual and contractual processes.

Recording a request in the CRM does not automatically subscribe the interested person to marketing communications.

WANTACAR may, where permitted by applicable law, send updates, news, offers and other marketing communications by email, SMS, telephone or other appropriate channels.

Where consent is required, marketing communications are sent only where the data subject has provided valid consent.

Consent to marketing is optional and is not a condition for submitting a request relating to the purchase, sale, trade-in or leasing of a vehicle.

Consent may be withdrawn at any time, without affecting the lawfulness of processing carried out before its withdrawal.

The recipient may also use the unsubscribe mechanism included in the relevant electronic communications, where available.

WANTACAR may use analytics, advertising, retargeting and conversion-measurement technologies, including services provided by third-party providers.

These technologies may be used to measure traffic, understand use of the Website, measure the effectiveness of advertising activities and, where selected by the user, personalise or target advertisements.

Where storing or accessing information on the user's device or the associated processing requires prior consent, the relevant technologies are not activated before the required consent has been provided.

Further information is provided in the Cookies Policy.

Access to personal data is limited to persons and entities for whom such access is necessary for a specific and lawful purpose.

Depending on the circumstances, personal data may be disclosed or made accessible to:

• authorised WANTACAR personnel and associates
• hosting and technical infrastructure providers
• information systems development, maintenance and support providers
• CRM and database infrastructure providers
• email, communications and other technical service providers
• analytics and advertising service providers, where the relevant technologies have been lawfully activated
• accountants, legal advisers, insurance companies and other professional advisers, where required
• cooperating licensed credit or banking institutions, solely where necessary for a financing process and where an appropriate lawful basis exists
• competent public, administrative, tax, police, judicial or other authorities where disclosure is required or permitted by law

Partners acting as processors on behalf of WANTACAR are bound by the applicable confidentiality, security and personal data protection obligations.

For the operation of its internal CRM and other technical systems, WANTACAR uses technical infrastructure and database services provided by third parties, including Supabase.

Such providers may process data on behalf of WANTACAR to the extent necessary to provide the relevant technical services.

WANTACAR takes appropriate contractual and organisational measures to ensure that processors provide sufficient guarantees for the protection of data in accordance with applicable law.

Certain technology, cloud, analytics, advertising or other service providers used by WANTACAR may be established, or may have infrastructure, group companies or subcontractors, outside the European Economic Area.

Where personal data are transferred to a country outside the European Economic Area, WANTACAR ensures that the transfer is carried out in accordance with applicable legal requirements.

Depending on the circumstances, this may include transfers to a country for which a valid adequacy decision has been issued or the use of appropriate safeguards, such as approved Standard Contractual Clauses, together with supplementary measures where required.

WANTACAR does not retain personal data for longer than is necessary for the purpose for which they were collected, unless longer retention is required or permitted by law.

The retention period is determined taking into account:

• the nature and purpose of the processing
• whether the request resulted in a transaction or contract
• the duration of the contractual relationship
• tax, accounting and other legal obligations
• applicable limitation periods
• the need to establish, exercise or defend legal claims
• any valid consent for marketing

When data are no longer necessary, they are deleted, anonymised or placed outside active use in accordance with the applicable retention and deletion procedures.

WANTACAR applies appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, access or other unlawful processing.

Measures are selected taking into account the nature, scope, context and purposes of processing and the associated risks.

Despite security measures, no information system or internet-based data transmission system can be considered completely free from all risk.

The provision of certain personal data is necessary for the processing of a specific request or for entering into and performing a specific agreement.

Where information is mandatory, failure to provide it may make it impossible to assess the request, issue an offer, enter into an agreement or provide the relevant service.

The data requested at each stage must be limited to what is appropriate, relevant and necessary in relation to the specific purpose.

Through the Website, WANTACAR does not make decisions based solely on automated processing that produce legal effects concerning a data subject or similarly significantly affect them.

In particular, the internal assessment of Flexible Operating Leasing requests is completed through human assessment and decision-making.

If, in the future, a solely automated decision-making process falling within the relevant regulatory framework is introduced, this Policy will be updated accordingly.

Subject to the conditions of applicable law, every data subject has the right to:

• Access: to be informed whether WANTACAR processes personal data concerning them and to receive the information and copy of the data provided for by law.
• Rectification: to request correction of inaccurate data and completion of incomplete data.
• Erasure: to request deletion of personal data where the applicable legal conditions are met.
• Restriction of processing: to request restriction of processing in the circumstances provided for by law.
• Data portability: to receive data concerning them in a structured, commonly used and machine-readable format and, where technically feasible and the legal conditions are met, request that the data be transmitted to another controller.
• Objection: to object, on grounds relating to their particular situation, to processing based on legitimate interests, subject to the conditions provided for by law.

Where personal data are used for direct marketing purposes, the data subject has the right to object at any time to processing for that purpose.

Withdrawal of consent: where processing is based on consent, consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

The above rights are not absolute and may be subject to restrictions or exceptions provided for by applicable law.

To exercise any right or ask a question regarding the processing of personal data, the interested person may contact: info@wantacar.gr

The request should describe with sufficient clarity the right the person wishes to exercise.

Where there are reasonable doubts concerning the identity of the person making the request, WANTACAR may request additional information necessary to confirm their identity in a manner proportionate to the relevant risk.

WANTACAR responds to requests within the time limits provided for by applicable law.

The exercise of rights is in principle free of charge. In the case of manifestly unfounded or excessive requests, the provisions of applicable law apply.

If a data subject considers that the processing of personal data concerning them infringes applicable law, they have the right to lodge a complaint with the competent data protection supervisory authority.

For Greece, the competent supervisory authority is the Hellenic Data Protection Authority.

The ability to lodge a complaint does not limit any other administrative or judicial right of the data subject.

If a user provides WANTACAR with personal data relating to a third party, the user must ensure that they are legally entitled to disclose those data for the specific purpose and, where required, that the third party has been appropriately informed.

Users should not submit through the Website personal data of third parties that are not necessary for the relevant request.

WANTACAR's vehicle sale, purchase, trade-in and leasing services are not intended for minors who do not have the legal capacity to enter into the relevant transaction.

WANTACAR does not seek through the relevant forms to collect personal data of minors for the above purposes.

If it is established that a minor's personal data have been submitted without an appropriate lawful basis, appropriate measures are taken in accordance with applicable law.

The Website uses or may use cookies and similar technologies for technical operation, security, storage of preferences, statistical analysis, performance measurement and advertising purposes.

Strictly necessary cookies are used to the extent necessary to provide the Website and the functions requested by the user.

Cookies and analytics, advertising, remarketing or similar tracking technologies that require consent are activated only after the user has provided the required consent through the Website's preference-management mechanism.

The user may change or withdraw their choices in accordance with the options provided through the relevant mechanism.

Further information is provided in the Cookies Policy.

The Website may contain links to third-party websites or services.

This Policy applies to personal data processing for which WANTACAR is the controller and does not govern independent processing carried out by independent third parties.

Users are encouraged to review the privacy policies of the relevant third-party services.

WANTACAR may amend this Policy where required due to changes in legislation, its activities, its services, its information systems or the manner in which personal data are processed.

The version currently in force is published on the Website and includes the date of its latest update.

In the event of a material change in the way personal data are processed, WANTACAR takes appropriate steps to inform data subjects where required.

For questions, requests or the exercise of rights relating to personal data: ARGYRIOS KATSANTONIS LIMITED LIABILITY COMPANY Trade name: WANTACAR Registered office: 160 Liosion Street, Athens VAT No.: 997780569 Tax Authority: Athens A' Telephone: +30 211 444 2306 Email: info@wantacar.gr