COMPLAINTS MANAGEMENT POLICY

Table of Contents

1. Purpose 3

2. Regulatory Framework 3

3. Definitions / Concepts 4

4. Organisational Requirements 5

5. Principles for Handling Complaints 6

6. Record Keeping 7

7. General Information to Customers on the Complaint-Handling Procedure 7

8. Procedure for Handling Written or Oral Complaints 8

9. Submission of Data & Reports to the Bank of Greece 8

10. Complaint-Management Rules and Procedures 8

11. Analysis and Disclosures 10

12. Information Regarding Personal Data 11

Annex A 13

Annex B 14

Annex C 16

Purpose

The purpose of this Policy is the clear and detailed documentation of the handling of complaints submitted by customers dealing with the microfinance institution under Law 4701/2020, Oriva Microfinance S.A. (hereinafter the “Institution”), with the aim of resolving them. In particular, the objectives of this Policy include:

• • Guiding and raising the awareness of staff so as to avoid acts that could lead to sanctions or harm the Institution’s reputation.
  • Avoiding lawsuits from customers, as well as potential disciplinary proceedings by the Authorities.
  • Improving the Institution’s internal procedures and strengthening the prevention of omissions and errors.
  • Ensuring a high standard of customer service and the Institution’s consistency in general.
  • Improving the services provided through the analysis and use of the information arising from complaint management.
  • Qualitatively upgrading customer relationships by reinforcing a culture of regulatory compliance among the Institution’s staff.
  • Faster and less costly settlement of disputes through out-of-court resolution.
  • Ensuring the complete and proper provision of supervisory information.
  • Ensuring transparency of transactions and protecting the interests of the Institution’s customers, and generally strengthening compliance.

Regulatory Framework

This Policy has been formulated in compliance with:

• Executive Committee Act (ECA) 157/1/02.04.2019 “Adoption of the guidelines of the Joint Committee of the European Supervisory Authorities on the handling of complaints submitted by customers to supervised institutions” (Government Gazette B’ 1613/10-05-2019), as supplemented by Executive Committee Act 187/8.4.2021 adding Microfinance Institutions to the relevant supervisory framework,
• Executive Committee Act 193/27.09.2021 “Rules for the prudential supervision of leasing companies, credit-granting companies, factoring companies and Microfinance Institutions under Law 4701/2020”, which establishes the prudential supervision regime for Microfinance Institutions,
• the Operating Regulation of the Hellenic Financial Ombudsman,
• the founding law of the Independent Authority of the Consumer Ombudsman: Law 3297/2004

“Consumer Ombudsman – Regulation of matters of the Ministry of Development and other provisions”,

• Presidential Decree 116/2014 (Government Gazette 185 A’): “Organisation of the Ministry of Development and Competitiveness”,
• decision 122/3/15.12.2014 “Examination of Claims by Insurance Intermediaries” of the EPATH – “Insurance Affairs Committee of the Bank of Greece”,
• Law 2251/1994 “Consumer Protection” (as amended by Law 3587/2007),
• Joint Ministerial Decision 70330 oik/2015 “Provisions on the adaptation of Greek legislation in compliance with Directive 2013/11/EU of the European Parliament and of the Council of 21 May 2013 on alternative dispute resolution for consumer disputes and amending Regulation (EC) No 2006/2004 and Directive 2009/22/EC (ADR Directive), and the adoption of supplementary national measures implementing Regulation 524/2013 of the European Parliament and of the Council of 21 May 2013 on online dispute resolution for consumer disputes”,
• Article 16(2) of Directive 2014/65/EU of the European Parliament and of the Council and Article 26 of Delegated Regulation (EU) 2017/565,
• the provisions of Law 4537/2018 “Transposition of Directive 2015/2366/EU on payment services and other provisions”,

Any change to legislative provisions and, more generally, to the regulatory framework and the related individual activities prevails and is deemed to be automatically incorporated into this Policy until it is officially updated.

Definitions / Concepts

Complaint: Any oral or written statement of dissatisfaction addressed to the Institution in relation to the activities under Law 4701/2020. A complaint may concern matters such as the quality of services, the conduct of employees, delays in the provision of services, failure to comply with agreed terms, etc.

Whether a submitted statement or request is characterised as a complaint is determined by its content.

Indicatively and without limitation, complaints include statements of dissatisfaction, requests or reports concerning the following:

– Acts or omissions of the Institution’s officers

– Weaknesses in the Institution’s systems

– Operational weaknesses of the Institution

– Acts contrary to the Institution’s Code of Ethics and Conduct (corruption, theft, fraud)

– Wilful non-application of the Institution’s internal policies

– Matters relating to the provision of services and the satisfaction of customer requests

– Anything that could harm the Bank’s reputation,

– Any attempt to conceal the above.

Complainant: a natural or legal person who submits a complaint to the Institution.

Response Letter: the Institution’s official written response submitted to the complainant.

Business Owner of the Complaint: The Division of the Institution referred to in the complaint, or to which the function or officer that is the subject of the statement of dissatisfaction belongs.

Types of Complaints

• Oral Complaints: the customer submits their complaint either by telephone, using the relevant number published by the Institution, or by reporting it to an employee or external associate working at the Institution’s service point.
• Written Complaints: the customer submits their complaint by letter through post, fax, electronic message (e-mail) or via the Complaints Form.
• Complaints submitted by a natural or legal person to a competent body or Supervisory Authority: Such complaints are received through institutional bodies (e.g. the Bank of Greece, the Ministry of Development, the Consumer Ombudsman, the Hellenic Financial Ombudsman – a Civil Non-Profit Alternative Dispute Resolution Company, etc.), given that the customer addresses their request through such bodies / Supervisory Authorities.
• Complaints with extrajudicial notices: These are complaints expressed through the service of extrajudicial statements/protests to the Institution. Such cases are examined by the Legal Service.
• Complaints submitted to it concerning services provided by an entity other than itself: Such complaints are submitted to the Institution regarding services provided by another entity (i.e. not provided by the Institution itself).

Organisational Requirements

Complaints Management Policy

This Policy describes the framework of rules for the effective management of complaints submitted to the Institution, either directly by the customers themselves or through the competent bodies, in relation to the service and the services offered to them.

The Policy is determined and adopted by the Board of Directors, which bears responsibility for its implementation and for monitoring compliance with it. More specifically, the Board of Directors is responsible for its approval, periodic assessment and updating, with the aim of appropriately addressing the complaints that may arise during the provision of products and services, as well as its correct application.

Accordingly, the Institution makes the documented and approved Policy known to all relevant staff and keeps it permanently available to them through the appropriate internal channel chosen by Management (e.g. internal intranet), together with its updated version.

In order to ensure the correct application of this Policy, training presentations and seminars are held at regular intervals, so that every complaint is handled in a fair, objective and impartial manner, guided by promptness and confidentiality.

The Head of Internal Audit includes in its audit programme the inspection of the application of the principles of this Policy.

Complaints Management Function

The Institution maintains a Complaints Management Function for the purpose of implementing this Policy, ensuring that complaints are investigated impartially and resolved while minimising potential conflicts of interest. It has been designated as the Institution’s competent unit for receiving and assessing complaints and sending a written response to complainants within the applicable time limit.

In exercising its responsibilities, the Complaints Management Function has the following duties:

– Receiving and monitoring complaints

– Coordinating the required actions, in cooperation with the Institution’s involved functions, for the objective investigation and the timely sending of a response

– Preparing and submitting the prescribed supervisory reports to the Bank of Greece

– Recommending corrective measures to the Institution’s functions where deemed necessary, in order to avoid future complaints

– Notifying the Risk Management Unit of operational risks arising, or of operational-risk events, from the complaints submitted

– Informing the Institution’s Internal Audit Unit in the event of omissions or indications of unlawful acts

In the current version of the Policy, the Complaints Management Function and the related responsibilities, based on the principle of proportionality, are placed within the Regulatory Compliance Unit, while the person who assumes the duties of Head of the Complaints Management Function is, accordingly, the Head of the Institution’s Regulatory Compliance Unit.

Other Units Responsible for Complaint Management

The business units that manage customer communication and relationships must cooperate with and provide information to the Complaints Management Function during the examination of the complaints being handled, with the aim of collecting all the information required to identify the problem that created/caused the complaint, so as to resolve it promptly.

The Institution’s Internal Audit participates, where applicable, in conducting investigations into the respective complaints.

Principles for Handling Complaints

• The Institution has established a complaint-handling procedure addressed to customers in an easily accessible manner, so that they are informed about:
  • the actions required to submit a complaint
  • the procedure that the Institution follows when handling the complaint
  • other bodies that are able to address the resolution of the complaint.
• Complaints are managed in accordance with the applicable regulatory framework concerning the examination and handling of complaints, as well as the provision of information to the competent bodies regarding incoming complaints and their handling.
• The Institution informs customers about the complaint-handling procedure by providing written information about this procedure, either when issuing an acknowledgement of receipt or at the customer’s request.
• The Institution ensures the collection and investigation of all evidence and information related to each complaint submitted, in a fair and merit-based manner, with the aim of providing a reasonably substantiated response.
• The Institution handles all complaints confidentially.
• Where complaints concern services provided by an entity other than itself, and the Institution has no responsibility arising from its legislative or regulatory operating framework for the provision of the relevant service, the Institution responds to the complaint by informing the customer of its non-involvement and, where possible, by providing the details of the entity responsible for handling the complaint.
• Where a complaint refers to specific persons, those persons are entitled, in exercising their rights of access, information and objection, to be informed of the complaint and all related evidence. Where the complaint refers to natural persons, it should not contain information constituting sensitive personal data (data relating to racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, health, social welfare and sex life, or relating to criminal prosecutions or convictions).
• The Institution ensures, in all cases, the protection of the person against whom a complaint is made, in accordance with its Whistleblowing Policy. In particular, where a named complaint is submitted, the Institution takes all appropriate measures so that there are no adverse consequences for the person submitting the complaint. Likewise, where an anonymous complaint is submitted, the Institution is obliged to take all appropriate measures so that it is not possible to identify the complainant.
• The Institution ensures that all communication with the complainant is conducted in plain and comprehensible language.
• The Complaints Manager, all the Institution’s employees and external customer-service associates must inform customers that, in addition to written complaints, they may also submit oral complaints, in accordance with the procedures of this Policy.
• The Institution analyses, on an ongoing basis, the data relating to complaint handling, so as to ensure that any recurring problems, as well as potential legal and operational risks, are identified, with the aim of taking corrective measures and avoiding similar irregularities/errors. The analysis includes, indicatively:

1. examining each complaint separately and grouping by type of claim, in order to identify any common root cause,
2. investigating whether the aforementioned root causes also affect other procedures or products/services, including those to which a submitted complaint does not directly refer.

(iii) the continuous observance of the basic principles of protection and management of personal data, in accordance with the General Data Protection Regulation (EU) 2016/679 and national legislation.

• It is noted that the Institution has also established a procedure for recording and monitoring the progress of complaint resolution.

Record Keeping

The Institution maintains, in either electronic or paper form, a dedicated file as a Complaints Register, with the necessary security specifications, which includes all the complaints it receives, as well as the documents related to each case, from the time of their submission and for a minimum period of five (5) years from the date on which each item came into its possession, unless otherwise provided by other provisions.

More specifically, the Complaints Manager keeps a detailed record of all complaints submitted in the relevant “Complaints Management Register”, classified by category of products and services provided by the Institution, indicating how they were handled, as well as any other data and information required by the applicable legislative and regulatory framework.

In particular, the data kept in the complaints file are as follows:

• The complainant’s details,
• a brief description of the complaint submitted,
• the method of submission,
• the progress of the complaint,
• the Institution’s Divisions concerned,
• third-party bodies that the complainant has contacted (Bank of Greece, Hellenic Financial Ombudsman, etc.),
• the actions taken to investigate and resolve the complaint,
• the responses given to the complainant,
• the method of responding to the complainant,
• relevant documents,
• the other matters and material disclosed,
• the total processing time and the measures taken.

General Information to Customers on the Complaint-Handling Procedure

The Institution makes available to customers information on how to submit complaints, the complaint-handling procedure it applies and the “Complaints Submission Form” (set out in Annex 1 hereto), in clear wording, documented both in printed form (available at its offices) and in electronic form, through posting on its website.

The above information contains clear, accurate and up-to-date information on the complaint-handling procedure, including at least:

(a) a detailed description of the actions required for the customer to submit a complaint (such as, indicatively, the type of information they must provide, the contact details of the competent person or service of the Institution to which the complaint should be addressed, etc.).

(b) the provision of written information on the complaint-handling procedure, either when issuing an acknowledgement of receipt or at the customer’s request, referring at least to the general information.

(c) a description of the procedure that the Institution follows when handling the complaint (such as, indicatively, when and how receipt of the complaint is confirmed, the investigation timetable and the provision of a written response), as well as a reference to other bodies competent to address it (e.g. the Consumer Ombudsman or another alternative/out-of-court dispute resolution mechanism).

(d) notification of alternative options in the event that the complainant considers that the complaint has not been resolved.

(e) informing customers about the procedure for submitting and examining written and oral complaints by the employee working at the Institution’s customer-service points (including those of associates), as well as by the Complaints Manager.

Procedure for Handling Written or Oral Complaints

Upon receipt of each complaint, whether oral or written, the Institution provides the complainant with an acknowledgement of receipt, in accordance with the procedures set out in the sections below. In addition, at the written or oral request of the complainant, the Institution provides information on the progress of the examination of their case. In this context, the complaint-management procedure ensures that its steps and related actions – such as receipt, recording in the file, provision of an acknowledgement of receipt, collection of information and investigation, as well as provision of a written response and analysis of the data – are followed for the handling of all complaints received by the Institution.

The Institution provides the complainant with a written response within a maximum of forty-five (45) calendar days from the submission of the complaint. Where, for a significant reason, it is not possible to provide a response within the above period, the Institution must, on its own initiative, inform the complainant of the reason for the delay and indicate the period within which the investigation of the complaint is expected to be completed and a written response provided. During this period, the Institution provides, at the complainant’s request, written information on the progress of the examination of their case. Where the final response given does not fully satisfy the complainant, the Institution includes in the response a detailed justification and an explicit reference to the complainant’s right to address an alternative/out-of-court dispute resolution mechanism and/or the competent Authority, as applicable, should they persist with their complaint.

In all cases, the Institution’s officers and primarily the Complaints Manager ensure that the response provided to the complainant is reasonably substantiated, on the condition that all evidence and information related to the complaint have first been collected and investigated.

In addition to the above, the time limit for the obligation to send a response letter to the complainant varies depending on the body to which the response must be addressed:

• Within 10 days from the date of receipt of the complaint, if the complaint is submitted through the Bank of Greece.
• Within 15 days from the date of receipt of the complaint, if the complaint is submitted through the General Secretariat for Consumer Affairs, Ministry of Labour & Social Security.
• Within 10 working days from the date of receipt of the complaint, if the complaint is submitted through the Hellenic Financial Ombudsman.

Submission of Data & Reports to the Bank of Greece

The Institution completes the “Complaints Handling” Annex to ECA 157/2.4.2019, as part of its obligation to disclose to the Bank of Greece all relevant information regarding the operation and management of the Institution’s complaints and, thereafter, within thirty (30) calendar days from the end of each year.

Where data and information submitted change during the year, the relevant change is disclosed to the Bank of Greece at the latest within one month.

The person responsible for preparing and submitting the supervisory reports is the head of the Complaints Management Department.

Complaint-Management Rules and Procedures

10A. Submission of Complaints by Customers

Written or oral complaints from customers are submitted as follows:

• in writing (either by ordinary letter or using the special “CUSTOMER COMPLAINTS SUBMISSION FORM” – attached in the annex), at the Institution’s customer-service points (whether of the Institution or of associated credit institutions), duly signed.
• orally, either by telephone or by reporting to an employee or external associate working at the Institution’s service point.
• by communicating orally by telephone with the Complaints Manager on tel. +30 210 260 2751
• by e-mail to “complaintsoffice@orivafinance.com”, with an initial confirmation of receipt of the message.
• via the website “www.Orivafinance.com”, by completing the special electronic form posted on the website.
• to the postal address: Nestoros 1, Chalandri, P.C. 15231, for the attention of the Complaints Manager.
• through competent bodies (e.g. the Bank of Greece, the Consumer Ombudsman and Consumer Organisations) where the complainant has addressed them.

Where the natural or legal person initially reports their complaint in person at a customer-service point with which the Institution cooperates, the officer who receives a complaint forwards it to the Institution’s Complaints Manager by completing the “Oral Customer Complaints Recording Form” set out in the annex to this Policy. The staff of any cooperating legal entities that handle the Institution’s customers may help the complainant record their complaint on the standard form, based on the oral communication with the customer, solely in cases where the complainant is unable to complete the forms themselves.

Every employee of the cooperating Institution, or the Complaints Manager, must inform the customer fully and patiently about the procedure for submitting and examining complaints, which provides that the natural or legal person should send their complaint in writing and signed. The Institution’s Complaints Manager ensures the handling, resolution and written response to the complaint within the prescribed time limits.

After the complaint is successfully recorded, an acknowledgement of receipt of the complaint is delivered, bearing a unique reference number (protocol number or relevant digital identifier). In particular, for complaints received by post or by e-mail, the Institution sends (either by physical or electronic correspondence) an acknowledgement of receipt of the complaint to the address (electronic or postal) or fax number indicated by the complainant.

10B. Receipt of Complaints

Upon receipt of complaints, whether in writing or orally, the following competent officers are informed:

• Complaints Manager
• Legal Service
• Data Protection Officer (DPO), where deemed necessary for matters relating to their activities

It is noted that the Institution’s Complaints Manager may receive complaints through the Consumer Ombudsman and other bodies or Consumer Organisations (with the exception of the Hellenic Financial Ombudsman) without these having previously been disclosed to and handled by the Institution, where the natural or legal person has submitted their complaint directly to the Ombudsman requesting an immediate mediation request.

The Institution has designated as the customers’ “Data Protection Officer” the competent officer of the Legal Services department, whom the complainant may also contact on matters relating to personal data by all the aforementioned means, as well as through the e-mail address

“dpo@orivafinance.com”.

Where the complaint concerns a member of the Board of Directors or Senior Management of the Institution, the case is referred to the Institution’s Audit Committee.

10C. Complaint Handling

Settlement and resolution of complaints

Depending on the nature of the problem, the Complaints Manager assesses the complainant’s claims and requests additional data and clarifications from the heads of the organisational units involved, seeking ways to resolve the problem that arose from the complaint. The manner of handling is recorded in the complaints register. A complaint is considered resolved once the results of the examination of the case and the Institution’s relevant position are communicated to the complainant:

• • in writing by letter, by ordinary or registered post or by hand delivery, with a response to the complainant or the body by the case handler.
  • orally, through recorded telephone communication, for oral complaints submitted by telephone.
  • by the de facto resolution of the complainant’s problem at the level of the Transaction/Service Unit, which is evidenced by written notification to the Complaints Department from the competent Transaction/Service Unit.

The primary purpose and objective of the above procedure is the investigation, analysis and recording of the cause giving rise to the customer’s complaint. Where the complaint is not settled at the first level of customer handling and/or the natural or legal person is not satisfied with the response of the Institution’s Complaints Manager, or the prescribed response deadline elapses, the complainant may address the Hellenic Financial Ombudsman in writing, who must mediate in the effort to reach an out-of-court resolution between the natural or legal person and the Institution.

In the context of customer service, it is expected that both the Institution’s officers and any cooperating service networks make an effort to settle any matter that has arisen.

It is noted that, for the immediate settlement of a customer complaint (whether written or oral) to be acceptable, the following must apply:

1. The complaint can be settled immediately by providing oral clarifications, without any actions being required beyond the clarifications.
2. The customer expressly accepts the oral settlement of their complaint in a manner that is indisputably evidenced (recorded conversation and/or a signed document with a certain date).

10D. Submission of the Response Letter

Based on the previous actions and regardless of whether or not the customer’s complaint is resolved, the Head of the Complaints Function prepares a response letter to the complainant, exercising due care in the structure and wording of the response, so that it is given clearly and in comprehensible wording, in a substantiated, objective and transparent manner. The Head of the Complaints Function may, where deemed necessary, request the assistance of the Legal Service, both in drafting the response and for its final review.

Where the response received by the complainant does not satisfy them, they may address the Hellenic Financial Ombudsman (H.F.O.). It is noted that every employee of the Institution must inform complainants fully and patiently about the procedure for examining their complaints, as well as about the institution of the H.F.O.

Analysis and Disclosures

Based on the requirements set by the Bank of Greece and in accordance with the COR30 table of the technical reporting standards for complaints statistics, the Complaints Manager keeps a relevant file in which complaints are monitored and which includes all the complaint categories of the template, according to the following general categories, for both written and oral complaints:

• The category of the product/service to which the complaint refers
• The subject of the complaint, in the categories set out in Annex C hereto (COR30 report)
• The status of the complaint
• Any recourse to third parties (based on COR30)
• Average complaint response time.

In addition, after collecting the necessary statistical data from the above COR30 table, the Institution’s Complaints Manager is able to derive further statistical analysis of indicators, which may indicatively report the following:

a. Complaints per year/month

b. Percentage of complaints handled

c. Reasons for complaints and frequency of occurrence.

d. analysis by type of borrower (natural persons, legal persons)

The Institution provides information on complaints and their handling, upon relevant request, to the competent national Supervisory and other Authorities. In addition, through the Regulatory Compliance Unit, the Institution provides the Supervisory and other Authorities, whenever requested, with any kind of information or written briefing on the examination of complaints concerning the Organisation.

Within the same framework, the Regulatory Compliance Unit ensures the monitoring of the timely and proper submission of reports relating to complaints on a regular basis.

At the end of each month, a statement is produced with the total complaints for the month for the purposes of control, monitoring and filing, which is communicated to the Institution’s Management.

The Complaints Manager submits a quarterly review of their work to the Institution’s Board of Directors. The reports aim to provide information regarding:

• the manner of handling complaints
• the nature of the complaints and the areas they concern
• the points requiring improvement and the implementation of corrective and preventive actions

These internal reports present all the complaint cases submitted to the Function since the beginning of the year and include information regarding:

• the categorisation of complaints (in accordance with the categories and subcategories defined by the Bank of Greece)
• their origin
• statistical data on the progress of cases, as well as a qualitative analysis of the matters

The Institution highlights complaints as a source of information through which it identifies points requiring intervention, which may concern:

• Procedures and Instructions/Circulars
• Product and service features
• Systems

In this direction, improvements are initiated in the corresponding areas so that the Institution upgrades the level of service to its Customers and maintains its reputation and good image towards its associates, shareholders, Customers and any other stakeholder.

Information Regarding Personal Data

The collection and processing of customers’ personal data, in the context of ECA 157/1/2.4.2019, is carried out by the Institution’s competent, authorised and specially trained employees, and concerns the data provided both during the complaint-submission procedure and any additional data that may be requested solely for the handling of the complaint submitted.

The personal data processed in the context of investigating and handling the complaint are not disclosed or transmitted to third parties. Exceptions are cases where disclosure to third parties is provided for by the applicable legislation (e.g. supervisory authorities or public-sector bodies).

Such personal data are kept for a period of at least five (5) years from the date on which each item came into the Institution’s possession.

The Institution informs complainants, in the context of processing the complaints they submit, in a clear and appropriate manner of at least the following:

• the contact details of the Data Protection Officer,
• the purpose of the processing, namely the handling of the resolution/settlement of the complaint,
• the recipients or categories of recipients of the data if the data are disclosed,
• the retention period for the data or the criteria set for determining the Institution’s response to the complaint,
• instructions regarding the rights of the data subject. In particular, the Institution informs, in a clear and respectful manner, of the ancillary rights that data subjects are entitled to exercise regarding:

1. Right of access: the complainant may be informed of the type of personal data being processed by the Institution.
2. Right to rectification: the complainant may request the correction or completion of personal data that are inaccurate or incomplete.
3. Right to erasure: erasure of personal data may be requested if they are no longer necessary in relation to the purposes of their collection and processing, provided that their erasure is not prohibited under obligations arising for the Institution from the legislation.
4. Right to restriction: restriction of the further processing of the complainant’s personal data may be requested for as long as there is a dispute regarding their processing.
5. Right to data portability: the complainant may request to receive their personal data in a commonly used and machine-readable format, or request that they be transmitted by the Institution to another service provider.

Where the rights to rectification, erasure and restriction of customers’ data are exercised, these requests may also be transmitted to the third-party recipients to whom the data were disclosed (e.g. supervisory authorities or public-sector bodies).

Annex A

FORM NO. 1

CUSTOMER COMPLAINTS SUBMISSION FORM

Please complete this form.

If you encounter difficulty completing it, call us on +30 210 260 2751

Fields marked with * are mandatory

PROBLEM DESCRIPTION

I have been informed of the Notice on the processing of personal data⁽¹⁾.

Please indicate every relevant document that you intend to attach: 1)…………………………………………………

2)…………………………………………………

We solemnly declare, being aware of the legal consequences of a false declaration, that all the information stated in this application is complete and accurate, and that Oriva Microfinance S.A. has the right to verify it at its discretion.

Place & Date…………………………………………..

Signature …………………………………………………………….

Annex B

FORM NO. 2

SUBJECT DESCRIPTION – CUSTOMER REQUEST – *Mandatory fields to be completed

SUBJECT DESCRIPTION

CUSTOMER REQUEST

I have been informed of the Notice on the processing of personal data⁽¹⁾.

ACTIONS

……………………………………………………………………………………………………………………………………………………….

……………………………………………………………………………………………………………………………………………………….

Employee Name: Complainant Name:

Signature: Signature:

Place & Date

1. Oriva Microfinance S.A., having its registered seat at Nestoros 1, Chalandri, Attica 15231 (tel. 210 260 2751), informs you, in accordance with Regulation (EU) 2016/679 and the relevant provisions of the applicable personal-data protection legislation, in its capacity as data controller, that for the investigation of the complaint/request you have submitted and the formulation of the Institution’s response thereto, in compliance with the requirements of the Bank of Greece, it keeps a file and processes the personal data you provide to us herewith, as well as the data directly or indirectly related to your specific complaint/request.

The above personal data of yours may be transmitted to the following persons:

• • To the Institution’s employees who are competent for the processing of your complaint.
  • To bodies to which the Institution assigns the performance of specific tasks on its behalf (data processors), such as lawyers, law firms, experts and assessors.
  • To independent supervisory, judicial, public and/or other authorities within the framework of their competences. The above are kept by the Institution for at least five (5) years from the submission of the complaint.

You have the following rights for the protection of your personal data:

• To know which personal data of yours the Institution keeps and processes, their origin, the purposes of their processing, their recipients, as well as their retention period (right of access).
• To request the correction and/or completion of your personal data, so that they are complete and accurate (right to rectification). In such cases, you must provide every necessary document evidencing the need for the relevant correction or completion.
• To request the restriction of the processing of your data (right to restriction).
• To refuse and/or object to any further processing of your personal data (right to object).
• To request the erasure of your personal data from the Institution’s files (right to be forgotten).

The Institution has, in any event, the right to refuse to satisfy your request for restriction of, or objection to, the processing of personal data, or their erasure, if the processing or retention thereof is necessary for the processing of your complaint.

Annex C

STATISTICAL DATA ON COMPLAINTS SUBMITTED TO SUPERVISED INSTITUTIONS – CATEGORIES OF INFORMATION AND REPORTING DATA