Notice on the Processing of Personal Data

“ALPHA BANK S.A.”, having its registered seat in Athens (40 Stadiou Street, 105 64, General Commercial Registry Number (G.E.MI.) 159029160000 and hereinafter the "Bank"), under its capacity as Data Controller, informs hereby pursuant to the General Data Protection Regulation (Regulation (E.U.) 2016/679 and hereinafter referred to as "G.D.P.R."), institutional investors and analysts  (hereinafter  "you") that in the context of the Alpha Bank Investor Day 2026 which will be held on 5.11.2026 (hereinafter "Event"), it will process your personal data, according to the following:    

Ι. As part of your registration and participation in the Event, the personal data that the Bank will process are your name, surname and your e-mail address (corporate e-mail), having as legal basis Bank's legitimate interest for organizing the Event (article 6, paragraph 1(f), G.D.P.R.), as also your actual consent, which is provided through your registration and presence at the Event (article 6, paragraph 1a, G.D.P.R.). 
Your participation in the Event is optional, and you can attend it either in person, or remotely, by watching the Event on-line (live webcast), via a relevant platform.   
It is noted that in case of attending the Event on-line (live webcast), any comments and/or statements you may submit will be made available to the rest of the attendees of the Event, as also your name, surname and the organization/ company in which you are employed.   

ΙΙ. Additionally, the Bank informs you that it will photograph, video-record and/or sound-record the Event and will process the image and/or the voice of those participating in the Event in person, with the purpose of publishing the relevant material, in order to promote Bank’s corporate activities on Alpha Bank's internal electronic network (Intranet) and on other Mass Media or Social Media means. The legal basis of such processing is your actual consent, which is provided through your participation at the Event (Article 6, par.1a, G.D.P.R.) and the legitimate interest of the Bank for promoting this action (Article 6, par. 1f, G.D.P.R.).
It should be noted that the Bank provides the option to those who do not wish to have the above-mentioned personal data (image and/or voice) processed, to attend the Event online via a relevant

platform (live webcast), as mentioned above. 

ΙΙΙ. Recipients of your personal data are the companies "Yard Project M.E.P.E." and "Chorus Call Hellas S.A.", which will process your personal data on behalf of the Bank.

 

ΙV. Your personal data, processed by the Bank for the above-mentioned purposes, will be kept for a period of five (5) years, after which it will be deleted. 

V. In the context of the above processing, you retain the following rights, subject to the terms and conditions of the G.D.P.R.: 

 

a) To be aware of the personal data concerning you that is held and processed by the Bank, as well as their origin (right of access). 

 

b) To request their correction and/or completion, in order to be complete and accurate, providing any document necessary in order to prove the need for completion or correction (right of rectification).

 

c) To request restriction of your data processing (right of restriction). 

 

d) To refuse and/or object to any further processing of your personal data held by the Bank (right to object). 

 

e) To request erasure of your data from Bank's records (right to be forgotten). 

 

f) To withdraw your consent at any time, without prejudice to the lawfulness of the processing based on the consent prior to its withdrawal.