Personal Data Protection Policy

The Company “HELLENIC JUICE INDUSTRY - ASPIS S.A. C. DEDES” with the distinctive title “ASPIS S.A.” (hereinafter referred to as the “Company”) respects your privacy andis committed to protecting your personal data. For this reason, the Company has taken all those necessary technical and organizational measures which ensure that your personal data are absolutely safe and confidential.

Therefore, since the main activity of the “Company” is the processing of fruits for the production of juices (puree and mixtures too), as well as the standardization and packaging of these fruit and juices, in addition to the production of fruit molasses for feeds, we have composed the present “Personal Data Protection Policy” to inform you about the method of collection, use and disclosure of your data as a customer, potential client, user of our website. Our company informs you that only if you wish so, it is possible that we processes your data, which you entrust to us in the course of our professional activity, always in accordance with the current Greek law and the provisions of the General Data Protection Regulation (GDPR) 2016/679 (EU) of the European Parliament and of the Council of 27April 2016 on the protection of natural persons with regard to the processing of personal dataand on the free movement of such data.

The collection, use and disclosure of your information on our behalf are based on your consent and in any circumstance, as determined by the applicable law.The present privacy statement describes the principles under which the personal data concerning you, are collected by us or are provided by you, in the context of our services, pursuant to the applicable regulatory framework for the Personal Data Protection and the Protection Policy of the Company.

Please read the following information carefully:

Ι. Our Company

The company under the name “HELLENIC JUICE INDUSTRY - ASPIS S.A. C. DEDES” with the distinctive title “ASPIS S.A.” is responsible for the personal data that you provide us. Wherever the terms “Company”, “to us”, “our” or “we” are mentioned, they refer exclusively to the said company. “ASPIS S.A.” is the “Controller” for the purposes of the applicable data protection privacy laws.

The present Policy is applicable in regard to the operation of the Company and applies to all its production units.

The present Policy applies to every service or function provided by us and is mentioned in the Policy or refers to it (hereinafter collectively referred to as our “Services”) for the present website, for any web site or online application, every online as well as offline promotion of the - 2 - Company, for access to our Services, either any electronic medium or other device is used, as well as during providing our Services, without the use of the above electronic media.

ΙI. What are Personal Data? (Definition):

Personal data are every information referring to and describing a person, such as identification data (full name, age, residence, profession, marital status etc.), physical characteristics, education, employment (work experience, work behavior etc.), financial status (income, assets, financial behavior), interests, activities, habits. The person (natural person) to whom the data are referring is called the data subject.These include, of course, the ones referred to as “sensitive personal data” of a person, which refer to the person’s racial or ethnic ancestry, political beliefs, religious or philosophical beliefs, involvement in a trade union, health, social welfare, love affairs, criminal prosecutions and convictions. as well as involvement in such people-related unions.

ΙΙΙ. Personal data collection methods

We collect personal data about you every time you use our services, or when you visit our company’s headquarters in Argos or our production unit in Zervohori, Imathia or wherever else, as well as when you use our website or when you use our call centers or our mobile apps. In addition, information concerning you are collected by us:

Though the cookies of the browser that you use during your browsing in our Website, in order to respond, promote and accurately route your request.

When you use the contact form https://www.aspis.gr in order to ask for more information about our products, make your order , submit a request for a job position or post a comment.

ΙV. How do we use personal data? What are the purposes of collecting them?

We proceed each time in the collection of your data, only when necessary, to be able to provide you with the services you have requested and in order to improve their level. In particular, we collect data for the following purposes:

Your personal data are processed by authorized personnel of our company,which recognizes the responsibility to ensure the confidentiality and protection of your data and processes them uniquely and solely for the purposes that they are provided.

Generally, your personal data may be the subject of processing for the purpose of providing services, as follows:

Data of the visitors in our facilities (managerial support offices, production packaging and storage plants for the products of our company): They are provided by the visitors during their arrival at the entrance (gate) of our headquarters and the plants of our company.

Corporate Offers: We collect and store the data of our corporate customers and potential corporate customers provided to us by the contact person of the corporate customer - 3 - who contacts us(e.g. company name, name of the contact person, e-mail address (of the company or individual), company telephone number and fax, contact mobile phone). These data are recorded in electronic or physical records which are kept, are accessible and protected against unauthorized access in accordance with our Quality Procedures.

Newsletters/Promotional Communications: We give you the ability to choose to receive newsletters and promotional material on the e-mail you have given us representing your company or as a natural person.

Replying to requests: We use your data to respond to requests/questions you make on our website or in our corporate e-mails.

Customer Satisfaction Surveys: We process data, which you provide to us to participate in surveys. You have the option to fill in all fields or not of the relevant questionnaires we send you.

Evaluating job applications: We evaluate job applications and CVs we receive from candidates either by post or by e-mail or through our website for possible collaboration with our company. We store all CVs in a protected electronic archive and the evaluation of applications is carried out only by authorized personnel. We keep our candidates' CVs strictly for 1 year and then permanently delete them. We can keep your CV for less time if you request it.

V. What personal data do we collect?

Depending on the purpose of your visit and the service you wish to receive through our website, the type of personal data we collect shall include information such as your full name, address, e-mail address, telephone number, vehicle plate number, while in some cases we may also need to collect sensitive personal data, such as medical data, so that we canmeet your specific needs (e.g. potential allergies).

Furthermore, we reserve the right to collect, store and process different types of data for your person and specifically:Customer ID,billing information (e.g. TIN, payment card number). Information regarding individuals under the age of 18 are limited to full name, nationality and date of birth, and they are provided to us only by the parent.When providing our services, it is possible that you create accounts/profiles, for which we may ask you to provide us with information, such as full name or email.

In addition, our company reserves the right, when ordering a product or service, to request information from you for the processing of your order.

VI. Retention period of Personal Data

Our Company "ASPIS S.A." retains your personal data only for the period needed so as to fulfill the purposes for which we collected them, e.g. fulfilling a legal obligation.Additionally, depending on the quantity, nature and sensitivity of personal data, as well as the purposes for which we process them, we determine the appropriate data retention period.

VII. Third Party Access to your Personal Data

Our basic principle is that we will not disclose your information to third parties (other than those listed below) for their own independent business purposes or marketing promotion purposes, without your consent.

Aiming, however, to provide you with the best services, we giveaccess to your personal data or part of them to our responsible staff and mainly to the fewest members of itpossible (human resources department, IT department, marketingdepartment, legal department, medical services, if necessary),as well as to the following third parties:

Partners providing services on our behalf: In cases that your personal data will need to be provided to our suppliers and partners (e.g. transport services).Our partners are located within the EU, as well as other third countries, and all legal procedures for the disclosure of data are followed. We demand, however, from those partners their commitmenton the protection of the data disclosed to them.

Authorities: such as Police, Fire Brigade and Tax Office.

Banks: Disclosure of the necessary information of our employees for payroll purposes.

Insurance companies: Disclosure of the necessary information of our employees for insurance purposes. Confidentiality and privacy data protection agreements shall bind the insurance companies and our company, too.

Certified Accountants: Disclosure of any personal data for audit purposes.

Our company “ASPIS S.A.” will not sell or transfer your personal data to a third party to use them directly for marketing purposes.

Our company staff will use your data to contact you on any matter regarding the provision of services, changes in servicesor notification about services or promotions.These data will be used until you notify us that you no longer wish to receive these updates or until we consider that it is no longer necessary to keep them up to date, whichever of these two is briefer.

VIII. Your rights

Respecting the right to privacy, your rights to control your personal data are as follows:

• Right to information: You have the right to receive clear, transparent and understandable information about how we use your personal data, as well as on your rights as such.
• Right of access - communication of the subject with the DPO: You have the right to access the personal data we keep about you, subject to certain restrictions by the Law, as well as the right to contact the DPO, whose data are listed below.
• Right to withdraw consent: In any case, you have the right to withdraw your consent to the processing of your data by us, when such processing is based on your consent and not on a law enforcement processing.
• Right to Data Correction: In the case of incorrect and / or not updated and / or incomplete data, you have the right to request the correction of personal data.
• Right to delete the data from our records: In some cases, you have the right to request the deletion of your personal data, subject to legal or valid reasons for retaining it.
• Right to limit the processing of data: You have the right to request that we limit the processing of your data in the following cases and especially when: i) the accuracy of personal data is being questioned by the data subject (i.e. by you) for a period of time that allows the Controller to verify the accuracy of your personal data, ii) processing is illegal and the data subject (i.e. you) opposes to the deletion of personal data and asks instead for the restriction of their use, iii) the Controller no longer requires personal data for the purpose of processing, but they are required by the data subject to establish, perform or support legal claims, iv) the data subject (i.e. you) objects to the processing for as long as it is expected for the verification of whether the legitimate reasons of the Controller prevail over those of the data subject.

Please note that as long as you ask us to limit your data processing according to the above, we save them, but we can neither use them nor process them further.

• Right to oppose to the way data are processed: You have the right to oppose to receiving direct marketing notifications, as well as when personal data processingis based on our legitimate interest and you have reasons to wish to oppose to such processing, as you consider that it affects your fundamental rights and freedoms.
• Right to portability: You have the right to copy or move data from our database to another, when you have provided us with the data with your consent or when processing is based on a contract and such processing is performed by automated means.

In order to manage your requests in accordance with the above, we may ask for a confirmation of your identity

ΙΧ. CONTACT DETAILS

For any question or concern, please contact our company by sending an e-mail at https://www.aspis.gr or send a letter to the following address:

DPO processing personal data

Full name or Title: HELLENIC JUICE INDUSTRY “ASPIS S.A.” C. DEDES

Address: 4th Km National Road Argos - Korinthos

Tel.: 2751 0 28000,

e-mail.: hr@aspis.gr

In order to constantly improve the protection and security of your personal data during collection and processing by our Company, the present Policy may be revised regularly.

Date of last review: 3.08.2019

PERSONAL DATA RETENTION POLICY

The following paragraphs provide a preview of the company's data retention policy “Aspis S.A.”, hereinafter referred to as "the Company".

1. Preview

Retention policy is important to ensure that the company's data retention guidelines are consistently applied throughout the company.

2. Scope

The scope of this policy covers all company datastored in systems and media owned by the company, leased by the company or provided by the company in any other way,regardless of the location.

Please note that the need to retain certain information may be required by applicable local law and / or regulations and legislations applicable to the particular field, in which the company operates and is in compliance with the European General Data Protection Regulation.

3. Policy

3.1 Principles of Retention

The Company retains personal data in an identifiable form only for the necessary period of time, as determined by the processing purposes for which the data are being collected.

The Company must not retain personal data for longer than it is necessary to fulfill the legitimate business purposes established or for as long as required by the applicable law.

The Company establishes a period of retention of personal data in accordance with the relevant laws and regulations as part of the processing activities archive.

The Company must justify the conditions and reasons for the retention of personal data for periods longer than the maximum retention period imposed according to business and regulatory requirements, if required.

Certain data must be retained so as to protect the company's interests, maintain evidence and generally ensure compliance with good business practices. Some reasons for data retention include:

Legal disputes

Investigation of accidents

Investigation of security incidents

Regulatory requirements

Protection of intellectual property

3.2 Retention Conditions

This section defines the guidelines for retaining the different types of company data in Greece.

File/Data Type - Retention Time

• Visitor of the Website/Customer /Candidate Customer

Up to 12 months, respectively: since the visit to the website, unless a longer period of data retention is required by the law or other specific legitimate reasons.

• Candidates' documents of the successful candidate, such as job applications, curriculum vitae, test results, reference letters, interview records.

Έως 20 έτη after the end of the employment relationship

• Photos/Videos

Throughout the employment or contractual relationship, in which the photos/videos have been taken. If there is a specific agreement/consent or special purpose, they would be retained for a longer period, depending on the purpose or agreement/ consent granted.

• List of participants, non-workers, in events and / or non-work activities

For the duration of the event oractivity organization and up to 3 months after the end of this. If there is a specific agreement/consent or special purpose, they would be retained for a longer period, depending on the purpose or agreement/ consent granted.

• Incoming people list (non-working)

Up to 3 months, unless the data subjects have given special consent for specific purposes, allowing data to be retained for longer.

• Contracts

Up to 20 years after the end of the contractual relationship.

• Electronic messages, letters and tickets

Up to 20 years.

• Orders / Work Table / Purchasing Documents

Up to 20 years after the end of the contractual relationship which they are linked in.

PERSONAL DATA PROCESSING NOTICE FOR CANDIDATES

1. INTRODUCTION

1.1 In order to process your job application, “ASPIS S.A” will collect, use and/or disclose your personal data that you provide to the Company, either by filling an expression of interest application in paper form, or by submitting it electronically, especially through the online application form on the company website and your CV, as well as other relevant documents and data provided to the Company by third party employment agencies or job search websites, if applicable .

1.2 The present Notice aims at providing you with information on how the Company handles your personal data, as well as about your rights as data subjects.

2. Controller

2.1 In the present Notice, the Company under the name “ASPIS S.A”, which is based in Argos, on the 4th km National Road “Argos-Korinthos” (postcode 23100), is referred to as the “Company” and/or “We” and/or “ASPIS S.A”. The Company is the Controller within the meaning of law and the purposes, as well as the manner in which your personal data are collected, used and/or possibly disclosed to third parties by the Company are specified in the present Candidate Notice.

3. LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA

3.1 The processing of your personal data is necessary for the investigation of the recruitment ability by the Company/

4. TYPE OF PERSONAL DATA AND PROCESSING METHOD

4.1 The types of personal data that we process, regarding our candidates, are determined by the applicable legislation and include, among others, the following: name, surname, telephone number (landline and/or mobile phone), email address, postal address, date of birth, work experience and previous employment, education and skills (e.g. foreign languages) as well as any other information included in your CV and/or cover letter to the Company.

4.2 In case you are invited for an interview, we may also collect some other personal data, since it is absolutely necessary to evaluate your suitability for specific job positions. Also, we may maintain the information we received from the people who interviewed you.

4.3 Data that may have been provided by you to the Company regarding other persons (e.g. your partners, dependent persons etc.) will be processed by us in accordance with the terms of the present Notice. You are responsible for the accuracy of these data and information, and you must also ensure that the above entities are aware of the personal data provided by you, as well as the manner in which the data will be processed by the Company.

5. HOW WE USE YOUR PERSONAL DATA

5.1 We will use your personal data to determine your suitability for the job position you applied, including the evaluation and classification of your skills and experience, as well as to keep you updated about your progress.

5.2 Under certain circumstance, you have the right to object to the said processing of your personal data by contacting us at our email address: hr@aspis.gr. If your request is approved, we will use your personal data for human resources purposes, as well as within the framework of necessary checks, particularly for the verification of your information and your history.

5.3 The Company is also able to use your personal data for internal operational and IT services or for statistical and historical reasons.

6. WHOM ARE YOUR PERSONAL DATA SHARED WITH

6.1 Your personal data will be made available only to authorized Company personnel, who are responsible for human resources management tasks.

6.2 Within the framework of our business operations, we may disclose your information to service providers, such as telecommunication and IT service providers, for system development and technical support purposes. We prohibit these recipients from using the above information or disclosing it for any purpose other than to provide services on our behalf

6.3 In exceptional circumstances, we may disclose your personal data to third parties, including the competent police and prosecuting authorities only if there is a relevant legal obligation to do so or we are obliged by a judicial, regulatory or public authority decision/order.

7. OVER WHAT PERIOD OF TIME ARE YOUR PERSONAL DATA STORED

7.1 We will store your personal data for that period of time that is absolutely necessary to achieve the purpose for which they were collected, as well as according to the relevant legislation, unless a different retention time period is required for the fulfilment of our statutory or contractual obligations or for the establishment, exercise or defense of any legal claims. Where your personal data are not required for the above purposes, they will be erased safely by the Company. In any case, the retention time period of your personal data is provided by the “Retention Policy” of personal data that the Company has adopted.

7.2 If you accept a proposal to cooperate with us, the personal data collected prior to your recruitment will be part of your personal file to us and will be maintained throughout the duration of your employment within the Company, as well as for some additional years following the termination of our cooperation, according to the applicable legislation and in any event in accordance with what is provided by the “Retention Policy” of personal data that the Company has adopted.

8. YOUR RIGHTS

8.1 Without prejudice to the applicable legislation, you have the right of access, i.e. at your request to know whether or not your personal data are being processed and receive further information on itYou may and must modify the personal data stored by us, in case your qualifications are altered and/or the particular circumstances. Furthermore, provided that the legal requirements are met, you have the right to erasure, the right to restriction of processing, the right to data portability and the right to object to the processing of your personal data.

8.2 Lastly, you can submit a complaint to the Data Protection Authority in charge (Head Office: Kifissias 1-3, Postcode 115 23, Athens, Call Center: +30-210 6475600, Fax: +30-210 6475628). For the competence of the Authority and the way to submit a complaint, the candidate can visit its website (www.dpa.gr => Citizen Rights => Complaint to the Hellenic DPA), where detailed information exists.

8.3 You can exercise the above rights by contacting us at our email: hr@aspis.gr

8.4 If such a request results in a breach of the obligations stemming from the laws, regulations or the Company’s codes of practice or in case that information disclosure would result in the disclosure of another person’s personal data, we may not be able to satisfy your - 12 - request, but in any case you may request that the further processing of your personal data be restricted.

9. SECURITY OF DATA

9.1 We use technical and organizational security measures to protect the integrity and security of all our information, including the personal data stored by us.

10. CONTACT DETAILS – DATA PROTECTION OFFICER (DPO)

10.1 The Company has assigned to the Data Protection officer (DPO) the supervision of the compliance of the Company with the general data protection regulation, whom you can contact at hr@aspis.gr in case you have any questions or queries regarding data processing or if you wish to exercise one of the rights you have as a data subject.