Data Privacy Notices
NOTICE ON THE PROCESSING OF YOUR PERSONAL DATA THROUGH THE WEBSITE www.frogmobile.gr
LAST UPDATED: 19-10-2026
OTE attaches particular importance to the protection of your personal data and adheres to the principle of transparency in relation to its processing.
This notice is intended to inform you specifically about the processing of your personal data when you use the website www.frogmobile.gr (the “Website”). The Website allows you to browse its content and to order a SIM card.
For general information on how OTE processes your personal data, please read the General Data Privacy Notice, which you can find here.
Contents
1. Who is the data controller and how can you contact them?
| DATA CONTROLLER | REGISTERED OFFICE | CONTACT DETAILS |
|---|---|---|
| HELLENIC TELECOMMUNICATIONS ORGANIZATION S.A. (hereinafter the “Company”) | 99 Kifisias Ave., Marousi | 13888 for residential customers 13818 for business customers |
2. What categories of personal data do we process?
| DATA CATEGORIES | EXAMPLES |
|---|---|
| Identification data | Full name, father’s full name, identity document number, date and country of birth, Tax Identification Number (AFM), competent Tax Office (DOY) |
| Contact details | E-mail address, telephone number, home address |
| Product / service data | SIM card, delivery address (prefecture, city, area/street, number/address description, postal code), mobile number and mobile network operator |
| Payment data | Payment method Credit card details |
| Data resulting from the use of cookies and similar technologies | You can find information on the use of cookies and similar technologies in the “Cookie Settings” menu in the footer of the Website. |
| Data from social media (Facebook, Twitter, Tik Tok, Instagram) and the video-sharing platform YouTube | Data from the use of sharing shortcuts |
3. For what purposes do we process your data and on what legal basis?
To provide services through the Website (Legal Basis: Performance of a Contract)
| PURPOSE OF PROCESSING | DATA CATEGORIES | RETENTION PERIOD |
|---|---|---|
| To order a SIM card / obtain a new connection. | Identification data Contact details Product/service data Payment data | For as long as your prepaid mobile connection remains active and for a period of 14 months following deactivation of your Frog connection. |
| To manage your number portability request | Identification data Contact details Product / service data | For as long as your prepaid mobile connection remains active and for a period of 14 months following deactivation of your Frog connection. |
Based on your consent
| PURPOSE OF PROCESSING | DATA CATEGORIES | RETENTION PERIOD |
|---|---|---|
| To share content on social media or video-sharing platforms. You may use sharing shortcuts to recommend products to your friends. In this case, the respective platform will act as Data Controller. | Data from social media (Facebook, Twitter, Tik Tok, Instagram) and the video-sharing platform YouTube | The retention period is determined by the respective platform. |
4. How do we communicate with you?
| PURPOSE OF PROCESSING | MEANS OF COMMUNICATION | LEGAL BASIS | OPT-OUT AVAILABLE |
|---|---|---|---|
| To keep you informed about the status of your order | email/SMS | Performance of a contract | NO |
5. Who are the recipients of your personal data and for what purpose is it disclosed to them?
Recipients of your personal data may include third-party companies we work with that operate in the following sectors:
- Financial institutions through which online purchases of products and/or services are made.
- IT systems development and technical support
- Advertising and marketing
- Consulting services
- Customer care services
In these cases, such third-party companies act as processors on behalf of OTE,
i.e. OTE partners that undertake the performance of a specific task following our instructions and applying the strict procedures of the OTE Group regarding the processing of your personal data. In these cases, OTE remains responsible for the processing of your personal data.
The processing of your personal data for the above purposes by our partners takes place mainly within Greece and the European Union (EU). Where we work with companies outside the EU, they will process your data only on our instructions and only where there is an adequacy decision of the European Commission or appropriate clauses have been agreed that ensure a high level of security in relation to the processing of your personal data.
Apart from the above companies, OTE does not process or disclose your personal data to third parties, except where such disclosure/transfer is required by applicable law.
6. What are your rights regarding the processing of your personal data?
The rights you may exercise include:
| Right of Access | You have the right to be informed about the processing of your data and to obtain copies of it. |
|---|---|
| Right to Rectification | You have the right to request the rectification of inaccurate data (e.g. correction of your address or contact details) as well as the completion of incomplete data. |
| Right to Erasure | You have the right to request the erasure of your personal data where it is no longer necessary in relation to the purposes for which it was processed, or where you have withdrawn the consent on the basis of which we collected and processed it. |
| Right to Restriction of Processing | You have the right to request the restriction of processing for a specific purpose (e.g. the sending of promotional messages). |
| Right to Data Portability | You have the right to receive the personal data you have provided to the Company in a structured, commonly used and machine-readable format |
| Right to Object | You have the right to object to the processing of your personal data where you do not wish it to be processed, provided that the processing is based on legitimate interest and/or involves profiling. |
To exercise your rights and/or contact the Data Protection Officer, you may:
- send an e-mail to customerprivacy@telekom.gr or
- send a letter to “Customer Service, 99 Kifisias Ave., 15124, Marousi” with the subject line “Exercise of personal data rights”, stating your full name and a contact telephone number.
If you believe that we have not adequately addressed your request, you may lodge a complaint via the dedicated online portal of the Hellenic Data Protection Authority (1-3 Kifisias Ave., 115 23 Athens | tel.: +30 210 6475600). Detailed instructions on how to lodge a complaint are available on the Authority’s website.
OTE will respond to your requests free of charge and without undue delay, within one month of receipt of the request. In exceptional cases, this period may be extended by two (2) further months where necessary, taking into account the complexity of your request. In any event, we will inform you of any such extension and the reasons for the delay.
Where we consider your request to be manifestly unfounded or excessive, we reserve the right to charge a reasonable fee, taking into account the administrative costs of handling it, or to refuse to act on your request.
7. Which trackers (cookies) are used on the Website?
We use cookies and similar technologies on our Website to store, retrieve and process information on your device. In this way, we improve your experience, analyse website traffic and show you content and advertisements that are relevant to you. For this purpose, user profiles are created per website and per device. Our partners also use these technologies.
Tracker data is processed:
- For the “Necessary and Functional” category, on the Legal Basis of: Performance of a Contract
- For all other tracker categories, on the Legal Basis of: Consent
Further information on the categories of trackers is available via the “Cookie Settings” link in the footer of the Website, while the detailed list of trackers and of the partners-recipients is set out in the section “List of partners-recipients and trackers used on the Website” of this notice.
List of partners-recipients and trackers used on the Website
| Partner - data recipient | Service | Purpose of processing | Responsibilities | Data processed | Storage period | Processing in third countries | Transfers subject to appropriate safeguards / Derogations |
|---|---|---|---|---|---|---|---|
| Purpose of processing: Necessary and functional | |||||||
| Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland | Google Tag Manager | Adding and managing tracker scripts on the website. It checks the user’s choices for each tracker category and, based on the user’s consent, activates those trackers | OTE S.A. is responsible for data protection. Google Ireland Ltd. acts on behalf of OTE S.A. | User choices regarding consent to trackers | Session | ||
| Imperva Inc, 3400 Bridge Parkway, Redwood Shores, CA 94065, United States of America | Incapsula | We use Imperva as a WAF and caching service, providing protection against attacks and improving the performance of our applications through advanced security and content caching. | OTE S.A. is responsible for data protection. Imperva acts on behalf of OTE S.A. | We use Imperva’s services to protect our website against malicious attacks and to enhance security. Imperva also improves website performance through content caching. The data collected is used to detect and prevent malicious activity and to optimise users’ browsing experience. | Session | Imperva Inc, 3400 Bridge Parkway, Redwood Shores, CA 94065, United States of America | Incapsula |
| OTE S.A., 99 Kifisias Ave., 15124 Marousi | Tracker consent management | Cookie_Consent_Set is used to store your choices regarding consent to trackers | OTE S.A. | User choices regarding consent to trackers | 3 months | ||
| Purpose of processing: Performance (for the purposes of OTE S.A.) | |||||||
| Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. | Google Analytics | Google Analytics collects data from websites to generate reports that provide business insights, e.g. how many users visited a page or purchased a product. Google Analytics uses a JavaScript measurement code added to the pages of the digital service to collect pseudonymised information about how users interact with a page. | OTE S.A. is responsible for data protection. Google Ireland Ltd. acts on behalf of OTE S.A. | User count statistics, session statistics, approximate geolocation, browser and device information, interactions (events) with the website such as pages visited and files downloaded, age, gender, interests | The user-level data retention period is 14 months. The event data retention period is 26 months. The retention period for age, gender and interests data is 2 months. | Your online usage data is processed in Argentina, Israel, Japan, Canada, New Zealand, Switzerland, the United States of America and the United Kingdom. The European Commission has adopted an adequacy decision for these countries (https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en). Based on your consent, your online usage data will also be processed in the following non-secure third countries: Australia, Brazil, Chile, India, Kenya, Colombia, Malaysia, Mexico, Peru, the Philippines, Singapore, South Africa, Taiwan, Turkey and the United Arab Emirates. There is no adequacy decision of the European Commission (https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en) for these countries. OTE S.A. therefore cannot ensure that the European level of data protection is maintained for these processing operations. It cannot be ruled out that local authorities may access your online usage data or that the exercise of your rights as a data subject may be restricted or excluded. | EU adequacy decision or - Standard Contractual Clauses (SCCs) with TIA or - Consent pursuant to Article 49 GDPR |
| Purpose of processing: Advertising through partners | |||||||
| Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland | Google Ads, Campaign Manager, Display & Video 360, Search Ads 360 plus Consent Mode and Floodlight features | Google Ads: This web service identifies and records visits to websites and measures advertising success in order to optimise advertising spend. It uses cookies, pixels and a local storage entry. Campaign Manager: This web service is used to measure the success of and optimise advertising campaigns. It uses cookies to collect information for Google Marketing Platformservices (CampaignManager360, DisplayVideo360, SearchAds360). Google Consent Mode is a feature used in combination with the Display & Video 360, Google Ads and GMP Floodlight web services, which allows us to pass information about your consent to the above web services. This information is used for modelling in order to improve the statistical assessment of the success of our advertising. | OTE S.A. and Google Ireland Ltd. act as independent controllers. You can find more information on data processing by Google in the privacy policy of Google Ireland Ltd. | Cookie ID, IP address and device identifiers, location, Client IDs, operating system information, referrer URL, browser information | 13 months | Your online usage data is processed in Argentina, Israel, Japan, Canada, New Zealand, Switzerland, the United States of America and the United Kingdom. The European Commission has adopted an adequacy decision for these countries (https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en). Based on your consent, your online usage data will also be processed in the following non-secure third countries: Australia, Brazil, Chile, India, Kenya, Colombia, Malaysia, Mexico, Peru, the Philippines, Singapore, South Africa, Taiwan, Turkey and the United Arab Emirates. There is no adequacy decision of the European Commission (https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en) for these countries. OTE S.A. therefore cannot ensure that the European level of data protection is maintained for these processing operations. It cannot be ruled out that local authorities may access your online usage data or that the exercise of your rights as a data subject may be restricted or excluded. | EU adequacy decision or - Standard Contractual Clauses (SCCs) with TIA or - Consent pursuant to Article 49 GDPR |
| Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland | We use Meta Business tools to publish our campaigns. The Meta Pixel is used to measure the success of and analyse advertising campaigns on Facebook, as well as for retargeting on Meta platforms. | Meta’s services are used to display relevant advertisements. We do this so that the content of the advertisements is tailored to you. We share information about which products interest you, so that we can suggest products and services on Facebook that may be of interest to you. The data we share with Meta also helps us monitor and analyse the success of our marketing efforts. This information is used to optimise ad delivery in order to ensure high effectiveness. | OTE S.A. and Meta Platforms Ireland Limited are joint controllers for this processing. You can find more information on data processing in Meta’s privacy policy. | IP address, browser information, page views, user, device information, geolocation, referrer URL, date and time of visit, advertisements displayed, items clicked, products and services purchased or searched for, usage data, device ID, browser ID (fbq), event ID, pixel ID, cookie ID, Facebook ID | 12 months | Your data will be processed in the following third countries: the United States of America. The European Commission has adopted an adequacy decision for this country. | EU adequacy decision or - Standard Contractual Clauses (SCCs) with TIA or - Consent pursuant to Article 49 GDPR |
8. What measures are in place to protect your personal data?
OTE implements appropriate organisational and technical measures to ensure the security of your data and to protect it against accidental or unlawful destruction, accidental loss, alteration, unauthorised disclosure or access, and any other form of unlawful processing.
For further information on this matter, please refer to the General Data Privacy Notice.