Privacy Policy

Update on Personal Data Processing

Introduction

We would like to assure you that for ODOS KENTRIKIS ELLADAS S.A. the protection of our customers’ personal data is of paramount importance. That is why we are taking appropriate steps to protect the personal data we process and to ensure that the processing of personal data is always carried out in accordance with the obligations laid down by the legal framework, both by the company itself and by third parties who may process personal data on behalf of the company.

Joint Data Controllers – Data Protection Officer (DPO)

The company under the name “AFTOKINITODROMOS KENTRIKIS ELLADAS Concession Société Anonyme” and the trade name “ODOS KENTRIKIS ELLADAS S.A.” (hereinafter referred to as “Kentriki Odos” or Company) having its registered office in Lamia, 13rd km of Central Greece Motorway , 351 00, and offices in Nea Erythraia, 19 Neas Erythraias Ave., 146 71, General Commercial Registry no. 22510254000, TAX identification no. 998437175, informs that, for the purposes of the Project assigned to it by the Greek State based on the relevant Concession Agreement, processes motorway users personal data in accordance with the applicable national law and the European Regulation 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, hereinafter referred to as the “Regulation”) as it is currently in force.

Furthermore, the Company informs that the Operation and Maintenance of the Concession Project have been assigned, under the 05.03.2021 Operation and Maintenance Agreement (hereinafter referred to as the “O&M Agreement”), which has been approved by the Greek State, to the company GEK -TERNA S.A. headquartered in Athens on 85 Mesogeion Avenue, PO 115 26, General Commercial Registry no. 000253001000, TAX identification no. 094005751, (hereinafter “the Operator”). Pursuant to the terms of the O&M Agreement, the Operator has undertaken to perform the day-to-day operation and maintenance of the Concession Project and in particular has undertaken, inter alia, the traffic management, routine maintenance and the periodic inspection of the Concession Project, the users and subscribers customer service, as well as the toll collection in the name and on behalf of the Company as its proxy and direct trustee. Therefore, the Operator also processes, in the context of the provision of its services and under the O&M Agreement only, the absolutely necessary personal data of the motorway users and the subscription program subscribers and is jointly responsible for the processing of the above data with the Company.

KENTRIKI ODOS and Operator’s contact details (hereinafter referred to as “Joint Data Controllers”): email: info@kentrikiodos.gr, tel: +30 210 344 7300.

For any matter concerning the processing of personal data, you may contact the Joint Data Controllers’ Data Protection Officer directly (DPO) at the following contact details:

Name: PISTIOLIS – TRIANTAFYLLOS & ASSOCIATES LAW FIRM (ANDERSEN LEGAL), Postal address: 19 Neas Erythraias Ave., 146 71, Nea Erythraia, email: dpo@kentrikiodos.gr.

Which personal data do we process?

The Joint Data Controllers process the personal data you provide (such as name/trade name of sole proprietorship, father’s name, identity card or passport number, status/professional activity, email, mobile/fixed telephone, address details, vehicle registration number, VAT number, tax office, image files, passage data, etc.), only when they have legal grounds to do so.

What are the purposes of processing your personal data and what are the related legal bases?

1. a) The management of motorways and their infrastructure under the Concession Agreement and the O&M Agreement, and in performance of a public service ratified by law, and in this context the use of transponders and/or other toll payment devices, the provision of information regarding the terms of passage of overweight/oversized/heavy machinery vehicles on the motorway, the recording of accident data for which the Joint Data Controllers are informed, the recording of exemptions from the obligation to pay tolls, etc.,
2. b) The compliance with any statutory obligations of the Joint Data Controllers (e.g. payment of tolls charged to motorway users, compliance with Article 62 paragraph 4 of Law 5177/2025 and Administrative Decision A1066/5.5.2025 of the Governor of the Independent Authority for Public Revenue (AADE), other tax obligations, management and response to GDPR requests, etc.),
3. c) The execution of the agreement you maintain with the Company, including the pre-contractual stage (e.g. for the purpose of paid-subscription passes on the motorways managed by the latter, through subscription programs via the completion via the completion of the “Subscriber Registration Application Form”). It is noted that paid-subscription passes by the toll stations are electronically recorded for safety reasons, billing purposes, the protection of the Company’s legal interests and as proof of their making in case of doubt.
4. d) The securing and protection of legitimate interests, both yours and ours. Thus, for example, i) we use closed-circuit television (CCTV) and security cameras, in order to be able to protect the safety of natural persons, assets, and other facilities of the Company, as well as for the purposes of regulating and managing vehicle traffic, and defending the interests of the Company, ii) we record the details of visitors entering the premises and/or the offices of the Joint Data Controllers, in order to be served or carry out projects we have respectively assigned, etc., and possibly provide them access cards to the premises, iii) we manage legal cases involving the Company (establishment, exercise, support of legal claims), iv) we handle your requests/complaints/claims within the framework of the proper provision of our services and your best possible service, etc.
5. e) The consent you provide under the specific circumstances set by the applicable legal framework (e.g., for your subscription to newsletters and the sending of related updates and offers).

Special Cases:

• Recording of telephone conversations: In the event of a telephone communication with customer service, the communication is recorded for reasons of proving commercial transaction elements or other commercial communication, as well as for quality assurance purposes. The Company informs with a recorded message right before the start of the conversation about the purpose of the recording, in accordance with the applicable legislation.
• Call to the 4-digit Emergency Number (1075): The call is recorded to achieve the effective management of reported incidents. Additionally, in case of reporting an incident during the call, we inform you that your phone number from which you made the call will be retained, as well as any other information you provide that may be useful for the investigation of the incident by us or the competent state authorities (e.g., vehicle license plate number, incident details, etc.). This processing is necessary for the legitimate interests pursued by the Joint Data Controllers for the protection of persons and property, and in some cases may also be necessary for the protection of the vital interests of the data subject or another natural person, if the data subject is physically or legally incapable of giving consent.
• Special Disability Exemption Form: It is being filled out for the purpose of issuing a free electronic passage card for people with disabilities (PwDs), which exclusively concerns beneficiaries of the PwD Parking Permit and War Disabled Individuals, so that the latter can pass toll stations managed by the Joint Data Controllers free of charge. In this context, and due to the nature of this activity, the Joint Data Controllers process only the absolutely necessary personal, data such as the full name of the PwD driver, the full name of the driver (if the driver is not the PwD passenger), the registration number of the parking permit, the vehicle license plate number, the vehicle category, and the signature of the user.
• Inability to Pay Toll Fees Form: It is being filled out for the purpose of recording users who declare an inability to pay when passing through a toll station. In this context, and due to the nature of this activity, the Joint Data Controllers process only the absolutely necessary personal data such as the full name of the user/company name, residential address, vehicle license plate number, vehicle category, receipt number of the due amount, time of passage, toll lane number of passage, the toll fee due and the user’s signature. This processing is necessary for the legitimate interests pursued by the Joint Data Controllers, which specifically consist in the establishment, exercise, and support of legal claims.
• Virtual VMS: If you have specifically granted access to your location data for the MyOdos app, you may receive a pop-up notification on your device if you are within a pre-defined geographic range of the motorway affected by an incident. This processing of your location data takes place locally on the device on which you have the application installed, without their transmission to ODOS KENTRIKIS ELLADAS S.A..
• Video Surveillance Systems: For a more detailed information regarding the processing of your personal data through the video surveillance system, please visit the following link https://www.kentrikiodos.gr/policycttvko/.

Recipients of personal data

The Joint Data Controllers send personal data to third parties to whom they have assigned the processing of personal data on their behalf, to the extent that is necessary for the provision of the relevant services third parties have undertaken.

Initially, pursuant to the Subcontracting Agreement dated 30.01.2025 for part of the Operation and Maintenance Services of the Concession Project between «GEK TERNA S.A.» and the company under the name «GEK SERVICES SINGLE MEMBER SOCIETE ANONYME COMMERCIAL AND TECHNICAL COMPANY», with the trade name «GEK Services S.M.S.A.» based in Athens, 124 Kifisias Ave. and 2 Iatridou Str., Postal Code 115 26, with VAT number 094497243 and General Commercial Registry number 002517401000, «GEK Services S.M.S.A.» has undertaken to perform the daily operation and maintenance of the Concession Project and specifically has taken on, amongst others, traffic management, routine maintenance, and periodic inspection of the Concession Project. Consequently, «GEK Services S.M.S.A.» also processes, within the framework of providing services under the Subcontracting Agreement for part of the Operation and Maintenance Services and only, the absolutely necessary personal data of the motorway users and may, within this context, become a recipient of your personal data.

Additionally, the recipients of your personal data are:

1. a) Competent governmental authorities when required by the applicable legal framework and for the performance of their duties in the public interest or in the exercise of the public authority entrusted to them, such as when necessary for the collection of toll charges, and/or when necessary to identify any violations of the Highway Code and generally of Greek Law.
2. b) The other road infrastructure concession companies with tolls within the framework of interoperability of the Greek motorways (see below in the section ‘Interoperability’).
3. c) The company that has undertaken the provision of billing services (statements) to subscribers of the multi-route service (fast-pass) and the provision of related services.”
4. d) The company that has undertaken the storage of personal data generated during the execution of the subscription passage contract.
5. e) The company that has undertaken the provision of receipt, archiving, and registration services of archival material.
6. f) Information technology companies that provide related services (such as IT system maintenance services and security systems).
7. g) The company that has undertaken the provision of Cash Management Solutions services (compusafe services, cash transport, cash processing).
8. h) The Independent Authority for Public Revenue (AADE) regularly receives, not exceeding one week, an encrypted electronic file with the license plate numbers of vehicles passing through the tolls per day as well as the Unique Passage Number. Additionally, upon request, it receives from the Company an encrypted file with the date and time of passage, the toll station through which they passed, as well as photos of the vehicle plates, in accordance with the provisions of decision no. A1066/5.5.2025 of the Independent Authority for Public Revenue (AADE) Governor.

In these cases, the Company and the Operator (as the case may be) remain Joint Data Controllers for the processing of your personal data and define the specific elements of the processing, and they sign a special contract with the third parties to whom they assign the execution of processing activities, in order to ensure the processing is carried out in accordance with the applicable legal framework and that every natural person can freely and unhindered exercise their rights.

Interoperability

In the context of the Greek Motorways Interoperability and the consequent option provided to subscribers’ authorized vehicles to pay toll fees at toll stations on all Greek motorways by use of an electronic device of one single Provider (“interoperability”), Toll Management Authorities, Motorway Operators and Transponder Providers maintain the right to transfer amongst them data regarding their subscribers for the purposes of investigating incidents and/or solving problems or complaints made by Subscribers concerning transactions that occurred whilst making use of Interoperability. Such transfer shall be permitted only between the Provider and the particular Management Authority that the case involves.

With regard to the above processing of personal data carried out in the context of Interoperability, Providers, Toll Management Authorities and Operating Companies are jointly responsible for data processing and comply with the provisions of the General Data Protection Regulation (EU) 2016/679 (GDPR) and Law 4624/2019. The Subscriber may exercise his/her rights to the respective Provider with whom he has entered an agreement; the latter may, if deemed necessary, forward it to the competent Toll Management Authority.

Storage time

The data storage time is decided on the basis of the following specific criteria, as appropriate on each case:

• When processing is required as a necessity under provisions of the applicable legal framework, your personal data will be stored for as long as required by the relevant provisions.
• When processing is done on the basis of a contractual relationship, your personal data will be stored for as long as is necessary to perform the contract and for the foundation, exercise, and/or support of legal claims under the contract, as well as for the Company’s compliance with its legal obligations (e.g., compliance with tax legislation).
• When the processing is carried out for promotional and marketing purposes based on your consent, your personal data is retained until your consent is withdrawn. Withdrawal of your consent can be done by you at any time and it does not affect the legality of consent-based processing in the period before its revocation.

To withdraw your consent, you may contact the Data Protection Officer (DPO) at the following contact details:

DPO’s name: PISTIOLIS – TRIANTAFYLLOS & ASSOCIATES LAW FIRM(ANDERSEN LEGAL), Postal address: 19 Neas Erythraias Ave., 146 71, Nea Erythraia, email: dpo@kentrikiodos.gr

You may also use the de-registration options by following (clicking) the corresponding link in our online communications.

Automated decision-making – Profiling

We inform you that no automated decision-making, including profiling, is carried out by us.

What are your rights with respect to your personal data

Any natural person whose data is being processed enjoys the following rights:

Right of Access:

You have the right to be aware and verify the legitimacy of the processing. Therefore, you have the right to access the data and get additional information about how your data is processed.

Right to Rectification:

You have the right to study, correct, update or modify your personal data.

Right to Erasure (“Right to be forgotten”):

You have the right to request the erasure of your personal data only if the Joint Data Controllers process it based on your consent or in order to protect their legitimate interests. In all other cases (such as, for example, where there is a contract, due to an obligation to process personal data required by law, for reasons of public interest), this right is subject to specific restrictions or and may not apply, depending on the case.

Right to Restriction of Processing:

You have the right to request a restriction on the processing of your personal data in the following cases: (a) when the accuracy of the personal data is questioned and until such accuracy is verified; (b) when you oppose the erasure of personal data and request (instead of erasure) the limitation of its use; c) when personal data is not needed for processing purposes, but is, however, indispensable for the foundation, exercise, support of legal claims; and (d) when you object to the processing and until it is verified that there are legitimate reasons that concern the Joint Data Controllers and supersede the reasons for which you oppose processing.

Right to Oppose Processing:

You have the right to oppose at any time the processing of your personal data where, as described above, such processing is necessary for the purposes of legitimate interests the Joint Data Controllers seek, as well as for processing for direct marketing and consumer profiling.

Right to Data Portability:

You have the right to receive your personal data free of charge in a format that allows you to access, use, and edit them, using commonly used editing methods. You also have the right to ask the Joint Data Controllers, if technically feasible, to pass the data directly to another processor. This right exists for the data you have provided to the Joint Data Controllers and is processed by automated means based on your consent or for the performance of a relevant contract.

In order to exercise any of the above-mentioned rights and for any relevant information you may refer to the Data Protection Officer (DPO): PISTIOLIS – TRIANTAFYLLOS & ASSOCIATES LAW FIRM (ANDERSEN LEGAL), Postal address: 19 Neas Erythraias Ave., 146 71, Nea Erythraia, email: dpo@kentrikiodos.gr.

Right to file a complaint with the Data Protection Authority

You have the right to file a complaint with the Hellenic Data Protection Authority via the Authority’s website (https://eservices.dpa.gr).

PERSONAL DATA SECURITY

Joint Data Controllers implement appropriate technical and organizational measures aimed at the safe processing of personal data and the prevention of accidental loss or destruction and/or unauthorized access to them, use, modification or disclosure thereof. To ensure the appropriate level of security against risks and to select appropriate technical and organizational measures, the Joint Data Controllers take into account the latest technological and other developments, the cost of implementation, the nature, the scope and purposes of the processing, as well as on the one hand, the likelihood and risk of occurrences of accidental loss or destruction and unauthorized and/or illegal access to personal data, use, modification or disclosure thereof and, on the other hand, the severity of the consequences for the rights and freedoms of natural persons.