LAMDA Prime Properties S.M.S.A Privacy Notice

Privacy Notice

1.1 Introduction

We would like to assure you that for “LAMDA Prime Properties S.M.S.A.” (hereinafter the “Company” or “LPP”), member of Lamda Development Group (hereinafter the “Group”), the protection of personal data of natural persons and sole proprietorships that come into contact or transact with us in any way is of primary importance. For this reason, we take appropriate measures to safeguard the personal data we process and to ensure that their collection and processing is always carried out in accordance with the obligations set out in the General Data Protection Regulation (EU Regulation 2016/679) and the applicable Greek legislation (hereinafter the “applicable legislation”).

Through this notice, the Company wishes to inform prospective and existing customers, suppliers, external partners, and any other natural person or sole proprietorship that comes into contact or transacts with it (e.g., contact persons or representatives of prospective or existing customers, users of its digital communication channels) about the way in which their personal data is processed in the context of its business activities.

1.2 Data Controller

The Company under the name “LAMDA Prime Properties Monoprosopi Anonymi Ktimatiki Etaireia” and the distinctive title “LAMDA Prime Properties S.M.S.A.”, headquartered in 37 Maroussi, Attica, at 37A Kifisias Avenue.

1.3 Data Protection Officer (DPO)

For any issue related to the processing of personal data, you may contact the Company’s Data Protection Officer (DPO) directly at: personaldata@lamdadev.com.

1.4 How do we collect your personal data?

We collect the personal information you provide to the Company either directly or through third parties (e.g., partners, property owners, or our clients), when:

• You express your interest in our properties and services, or in collaborating with us, in any way, such as, indicatively, when:
• you complete the contact, or interest forms available on the Company’s website, on the websites of other Lamda Development Group companies, or on the websites of other companies with which LPP cooperates for the provision of its services,
• you get in touch with our partners (e.g., real estate agents/brokers, marketing and advertising service providers), our clients, or third parties, expressing your interest to them, following which we receive a relevant referral for you,
• you interact with our employees during events or other forms of communication,
• you contact the Company in any other way, e.g., through our call center, email, visits to our offices, etc.
• You complete questionnaires we send you (e.g., via newsletters) relating to our properties and services.
• You provide us with information in the context of communications, meetings and negotiations concerning partnerships, the purchase or lease of properties, or related services.
• You create an account to register and log in to the websites of Lamda Development Group companies or other companies with which LPP cooperates, to facilitate your experience regarding the properties and services we offer.
• You provide us with your feedback on your experience with our services.
• You provide us with information in the context of transactions for the sale or lease of properties, for the provision of related services, or within the framework of any kind of professional cooperation.
• You contact us for any reason, e.g., by submitting requests via websites and social media managed by the Company.

1.5 How and why do we use personal data?

Our Company processes your personal data for the following purposes:

• Creating and managing contacts with prospective customers and partners who express interest in our properties or services.
• Providing customer service and support at the stage of expressing interest, including property presentations, arranging visits, responding to inquiries, and handling preliminary negotiations.
• Managing pre-contractual and contractual relationships, such as preparing, signing, and managing any type of contractual documentation (e.g., reservations, final sale contracts, lease agreements), coordinating involved parties (banks, notaries, technical and legal advisors, etc.), monitoring payments, and providing post-transaction support.
• Organizing and managing appointments, communications, and customer files to deliver personalized services tailored to your needs and preferences.
• Assessing and managing collaborations with real estate agents, partners, or other service providers, as well as monitoring the performance and effectiveness of such collaborations.
• Promoting services and corporate activities by sending informational or promotional material, organizing events, or other communication actions (based on your consent where required).
• Evaluating your experience and satisfaction to continually improve the quality of our services.
• Managing communications via call center, websites, email, social media, or other digital channels, and responding to your requests, complaints, or inquiries.
• Maintaining professional relationships and communication with customers and partners (e.g., sending greeting messages or expressions of appreciation).
• Facilitating transactions and providing property management services, including cooperation with third parties (e.g., banks, loan intermediaries, furnishing companies, interior designers, or technical service providers).
• Complying with the Company’s legal and regulatory obligations (e.g., tax, accounting, regulatory requirements).

Regarding, especially, the promotion of services and corporate activities through the sending of informational or promotional material, the organization of events, or other communication actions, please note that LPP processes the personal data necessary for this purpose jointly with “HELLINIKON S.M.S.A.”, headquartered in Maroussi, Attica, at 37A Kifisias Avenue, which is also a member of the Group.

1.6 What personal data do we process?

The Company processes only the personal data that are strictly necessary, depending on the nature of the relationship it maintains with each individual. Indicatively, the personal data that may be collected and processed, on a case-by-case basis and depending on the processing purposes listed in section 1.5, include the following:

• Identification & contact details (e.g. full name, gender, date of birth, email, telephone number, postal address)
• Demographic & professional information (e.g. nationality/citizenship, country of residence, preferred language, professional capacity/title, details of the company you work for or represent, your position within that company, business sector, professional profile details on online platforms)
• Preferences and interests regarding current and future properties (e.g. interest in purchasing/leasing a property for yourself or on behalf of a third party, type of property, intended use -primary or holiday home- areas of interest in Greece or abroad, within or outside The Ellinikon, project/complex, property size, number of bedrooms, floor/view, orientation, features and amenities such as parking spaces, desired services such as security, cleaning, concierge, valet, property management, etc.), financial information such as indicative budget / available investment range, type of financing -own funds, bank loan- interest in tax or investment incentives, availability/timeline for investment/transaction - e.g. interest in off-plan or ready-to-move-in properties, interest in immediate vs. long-term transactions, statistical data such as number of meetings or interactions with us, frequency of expressing interest in properties)
• Financial and credit-worthiness information (e.g. tax profile, tax residency, intention or ability to obtain bank financing or other types of funding)
• If you are a sole proprietorship seeking a commercial partnership with us (e.g. leasing our retail spaces): corporate details such as business name, brand name, registered office, markets of activity, number of properties sold in the last 2 years, approach to potential customers, and any personal data contained in the business presentation or business plan you submit to us
• If you are a sole proprietorship wishing to collaborate with us (e.g. as a broker, marketing company): personal data such as business name, country of registration in the relevant business registries, business activity sector, website/social media details, countries/regions of commercial activity, number of properties sold in the last 2 years, personal data included in KYP documents, including articles of incorporation, certificate of representation, “Good Standing” certificate, company registry extract or “Certificate of Incumbency”, etc.
• Personal data related to the organization and management of our appointments (e.g. location, date, time, and duration)
• Data relating to your evaluations of our services (e.g. rating of content and duration of presentations), your level of interest in purchasing/leasing after the appointment, etc.
• Any personal data you disclose to us during communications, negotiations, or meetings with the Company
• Personal data included in the PIF/KYC form (e.g. identification and contact details such as full name, father’s name, phone number, email, postal address, demographic details such as date and place of birth, nationality, ID details such as ID/passport number and tax identification number and issuing authority, professional capacity, status as a connected person to the Lamda Development Group, if the client is a sole proprietorship: legal entity details such as business name/brand name, registered office, date of establishment, tax number and issuing authority, business registry number, business activity sector, if the client is a legal entity: details of the contact person such as identification and contact details, job position, etc.)
• Payment and banking information, e.g. IBAN certificate, beneficiary details, bank details
• Any personal data included in buyer’s documents and supporting documentation required for the transaction (e.g. proof of tax number, bank certificate, General Commercial Registry representation certificates, powers of attorney, notarial authorizations, Single Property Tax certificates, property transfer tax certificates)
• Information related to financing and the financial settlement of the transaction (e.g. loan approvals/pre-approvals, lending institution, details of bank letters, payment progress -proof of payment details- information on encumbrances or liens)

1.7. What are the lawful bases for processing personal data?

Under the applicable legislation, there are specific legal bases that allow us to process your personal data. These are:

1. Performance of a contract

Processing is lawful when it is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract, particularly to fulfil the pre-contractual and contractual obligations we have undertaken towards you.

In this context, we process personal data, for example, to manage the pre-contractual and contractual relationship with prospective and existing clients, including the signing of reservation agreements and final transaction contracts, lease agreements, coordination of involved parties, payment monitoring, and providing post-transaction support and communication for any matter related to your transaction. We also process data to manage our network of prospective and existing partners.

2. Legitimate interests

Processing is lawful when it is necessary for the purposes of the legitimate interests pursued by the Company, provided that such interests do not override your rights and interests. Our legitimate interests may include, among other things:

• Confirming and monitoring your interest in the properties and services we manage and improving your overall experience during interactions with us.
• Developing and effectively managing our portfolio of clients and partners by improving appointment organization, communication, and service processes.
• Strengthening and maintaining relationships of trust with clients and partners and continuously improving the quality of our services.
• Ensuring the proper and secure execution of transactions, preventing incidents of fraud or conflicts of interest, and demonstrating the creditworthiness of the parties involved.
• Enhancing the Company’s commercial presence and public profile through targeted promotional actions and optimization of our partner network.

3. Consent

In specific cases, we process your personal data only when you have given your explicit consent, such as when registering to the newsletter for receiving updates, news, event invitations and other promotional communications.

Furthermore, these promotional communications -depending on the consent you provide- may be general or personalized based on your preferences, interests and needs related to the properties and services of LPP and HELLINIKON S.M.S.A. If you wish to receive personalized promotional communications, the Company and HELLINIKON S.M.S.A will use the following categories of your personal data, as described in detail in section 1.6 above:

• Identification & contact details
• Demographic & professional information
• Preferences and interests regarding existing and future properties in Greece or abroad, within or outside The Ellinikon, as well as regarding our services
• Financial and creditworthiness information
• Any additional information you choose to share with us directly or via third parties when expressing interest in our activities, in any way, as described in detail in section 1.4 above

4. Compliance with legal obligations

We are required to use your personal data whenever this is expressly mandated by law or falls within the Company’s regulatory compliance obligations. For example, to comply with tax and accounting legislation, legislation on conflict-of-interest controls, anti-money laundering legislation, as well as civil and commercial law requirements for the proper and secure execution of transactions, and the lawful representation of legal entities.

1.8 For how long do we retain your personal data?

When the processing of your personal data is based on the performance of our contract, the data is retained for as long as necessary to execute the contract and provide the services we have undertaken, or for as long as required by law for the establishment, exercise, and/or defense of legal claims arising from the contract.

For the promotional purposes pursued by our Company and HELLINIKON S.M.S.A. (marketing activities), your personal data is retained until you withdraw your consent. You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing based on consent prior to its withdrawal.

When processing is mandatory under applicable legislation, your personal data will be stored for the period specified by the relevant provisions applicable in each case.

1.9 Who may be the recipients of your data?

The Company may transfer personal data to third parties, within the scope of its lawful activities, when this is necessary for the fulfilment of a specific processing purpose or when required by law.

Depending on the case, recipients may include providers of data hosting and IT support services, providers of accounting, legal, or real estate services, marketing service providers, statistical analysis or customer/partner satisfaction survey providers, technical, legal, or financial advisors, notaries, architects, banks, credit intermediaries, insurance companies or other financial institutions, providers of furnishing, equipment, and interior design services for residential properties, public or independent authorities (tax, social security, regulatory, judicial), law enforcement bodies, as well as other companies of the Lamda Development Group that assist us in fulfilling the aforementioned processing purposes.

In some of the above cases, third parties act as processors on behalf of the Company, and the Company remains responsible for the processing of your personal data. The Company signs Data Processing Agreements with such third parties to ensure that processing is carried out in accordance with the applicable legal framework and that every data subject can freely and without restriction exercise their rights.

For promotional activities specifically, the recipient of your data is HELLINIKON S.M.S.A., in its capacity as Joint Controller with LPP, for the fulfilment of the aforementioned purpose. Both companies ensure compliance with data protection legislation, having explicitly determined their respective roles and obligations under the agreements governing their cooperation.

1.10 Transfers of data to third parties

Please note that the processing of your personal data takes place within the European Union. However, in the event that your personal data needs to be transferred to third countries, meaning countries outside the European Economic Area, for the fulfilment of the aforementioned processing purposes, such transfer will occur only to countries that ensure an adequate level of data protection, based on an adequacy decision of the European Commission and/or in accordance with the appropriate safeguards provided under EU Regulation 679/2016.

1.11 What are your rights regarding your personal data?

Every natural person whose data is processed by the Company enjoys the following rights:

Right of access:
You have the right to be informed and to verify the lawfulness of the processing. You may therefore access the data concerning you and obtain supplementary information regarding its processing.

Right to rectification:
You have the right to review, correct, update, or modify your personal data by contacting the Data Protection Officer (DPO).

Right to erasure:
You have the right to request the deletion of your personal data, subject to the conditions set out in Article 17 of the Regulation.

Right to rectification of processing:
You have the right to request the restriction of processing of your personal data in the following cases:
(a) when you contest the accuracy of the personal data and until verification is completed,
(b) when you oppose the deletion of personal data and request the restriction of its use instead,
(c) when the personal data is no longer necessary for the purposes of processing but is required by you for the establishment, exercise, or defense of legal claims, and
(d) when you object to the processing and until verification is completed as to whether there are compelling legitimate grounds that override your reasons for objecting.

Right to object to processing:
You have the right to object at any time to the processing of your personal data in cases where, as described above, the processing is necessary for the purposes of the legitimate interests pursued by us as controllers.

Right to data portability:
You have the right to receive your personal data free of charge in a format that allows you to access, use, and process it through commonly used processing methods.
You also have the right to request, where technically feasible, that we transfer the data directly to another controller. This right applies to data you have provided to us and which is processed by automated means based on your consent or in the performance of a contract.

Right to withdraw consent:
If we rely on your consent to process your personal data for certain activities, you may withdraw your consent at any time and we will cease processing your data for the purpose for which consent was given, unless we determine that another legal basis exists that justifies continued processing, in which case we will inform you accordingly.
For this purpose, you may use the “unsubscribe” option found at the bottom of every promotional communication you receive, which allows you to deactivate the receipt of newsletters and other promotional communications.

To exercise any of the above rights, you may contact the Company’s Data Protection Officer (DPO) at: personaldata@lamdadev.com. You may also use the same email address for any matter related to the processing of your personal data for the performance of promotional activities by LPP and HELLINIKON S.M.S.A.

Right to lodge a complaint with the Hellenic Data Protection Authority
If you believe that the processing carried out by our Company violates applicable law, you have the right to lodge a complaint with the Hellenic Data Protection Authority through its online portal (https://eservices.dpa.gr/). For more information, you can consult the website of the Hellenic Data Protection Authority (www.dpa.gr).

1.12 Personal Data Security

The Company implements appropriate technical and organizational measures to ensure the secure processing of personal data and to prevent accidental loss or destruction, as well as unauthorized and/or unlawful access, use, alteration, or disclosure. In order to ensure an adequate level of security against risks and to select the appropriate technical and organizational measures, the Company takes into account the latest technological and other developments, implementation costs, the nature, context, and purposes of processing, as well as the likelihood and severity of risks related to accidental loss or destruction, unauthorized and/or unlawful access, use, alteration, or disclosure of personal data, and the potential consequences for the rights and freedoms of individuals.

1.13 Changes to the Personal Data Processing Notice

This notice reflects the Company’s current policy regarding personal data processing as applied at the time of its publication.

The Company may modify or update this notice if there are significant changes in processing activities, applicable legislation, or its business processes.

Last revision: December 2025