Governance
& Business Responsibility

The Code of Conduct serves as a central reference point for all Group employees and partners (including suppliers, contractors, and subcontractors), establishing the core principles and values expected to guide their professional behavior. The Code reflects the Group’s corporate culture, fundamental beliefs, business ethics, and voluntary commitments, placing the prevention of corruption and bribery at its core. Its content is fully aligned with the principles of international regulations and conventions, as well as with internationally recognized standards, including ISO 9001, ISO 14001, ISO 45001, ISO 37001, ISO 37301, ISO 50001, and SA 8000.

The Code is applied universally: it covers all companies and subsidiaries of the Group at national and international level, extends to every area of activity and is taken into account in partnerships and joint ventures in which the Group participates.

The Code is complemented by a set of specialized policies, which form the Group’s transparent and agreed operating framework:

The Group adopts a zero-tolerance policy toward any form of irregular or inappropriate conduct that contravenes the values and principles of the Code of Conduct. Through the Code, as well as all relevant policies, the prevention of conduct that conflicts with the Group’s fundamental business principles is ensured, while the expectations and responsibilities of employees are clearly defined. In this context, a comprehensive training program is implemented with the aim of raising awareness on compliance with the Code of Conduct, as well as preventing bribery and corruption at all levels of the Group’s operations.

The fight against corruption and bribery is not only a central pillar of the Code but also an integral element of the Group’s business strategy. Following systematic risk assessment, targeted control measures are developed covering all activities. The Group implements a certified Anti-Corruption and Anti-Bribery Management System, in accordance with the requirements of ISO 37001, with the corresponding anti-corruption and anti-bribery policy communicated to both external and internal stakeholders.

In addition, the Code of Conduct makes clear that every employee has the responsibility to report any action or situation that violates or may violate its principles, strengthening the culture of integrity and accountability across the organization. At the same time, it provides clear, transparent and accessible procedures for the submission and management of relevant reports, both by employees and by other stakeholders, ensuring their timely and responsible handling.

The Code of Conduct constitutes the Group’s core framework of principles, addressing matters related to labour and human rights while guiding conduct across the full spectrum of its business operations. To strengthen this framework, the Group has implemented a dedicated Whistleblowing Policy, developed in full compliance with the European and national legislative framework, as well as internationally recognized standards ISO 37001 and ISO 37301.

Through this Policy and the associated procedures, the Group has established clear and reliable reporting and grievance mechanisms available to employees as well as partners and suppliers. Stakeholders are given the opportunity to report or raise concerns regarding the implementation of the Code of Conduct to the appointed Regulatory Compliance Officer, who also serves as the designated Receiving and Monitoring of Reports Officer, either on a named or anonymous basis, through the following communication channels:

All reports are recorded, evaluated and addressed consistently, transparently and objectively, while ensuring confidentiality and the protection of the personal data of the individuals involved. The available communication channels, as well as the Whistleblowing Policy, are also available on the Company’s official website. In 2025, 13 reports were submitted through the reporting mechanism, all of which were handled in accordance with the procedure established under the policy.

The Group remains firmly committed to safeguarding the trust it has built with stakeholders and local communities in the areas where it operates. As part of its responsible corporate governance practices, it implements a Conflict of Interest Policy, as well as related procedures, aiming at the timely identification, assessment and effective management of potential conflicts of interest.

The Group ensures that business decisions are made with objectivity and independence, free from personal or external interests, and always in the best interests of the organization and its stakeholders. In this context, employees are actively encouraged to seek guidance in cases of potential conflict of interest, to ensure proper assessment and oversight of such situations. At the same time, roles with high level of responsibility are subject to regular reviews by the Regulatory Compliance Unit, with the aim of preventing and managing related risks.

In cases where the Group or its subsidiaries engage in transactions involving members of the Board of Directors, senior executives, significant shareholders, or their affiliates, strict internal procedures are applied to safeguard transparency, accountability, and integrity.

The effective composition of the Board of Directors, aligned with the Group’s strategy and long-term business objectives, is supported through the implementation of the Suitability Policy. The Policy sets specific individual and collective suitability criteria that all BoD members must meet.

In addition, the Training Policy for BoD members and Senior Executives ensures their continuous training and awareness-raising on Environmental, Social and Governance (ESG) matters. The main thematic areas of the annual training sessions include:

Transparency and trust in the operations of Senior Management are reinforced through an annual performance evaluation process, which covers the following levels:

The Group has established and implements a Remuneration Policy that sets out the framework of principles and rules relating to the remuneration of the members of the Board of Directors, as well as of General Managers and Senior Executive Officers. The Policy ensures transparency, integrity and consistency in the application of remuneration, as well as its alignment with the Group’s strategy, business objectives and values.

The Remuneration Policy is founded on the following guiding principles:

The Remuneration Policy is reviewed regularly to remain current and aligned with the evolving needs of the Group and best governance practices.

The Group’s business activities entail the processing of personal data relating to individuals for whom identifiable data is obtained, including, indicatively, customers, suppliers, shareholders, investors and users of the corporate website. Such processing is carried out in full compliance with European legislation, in particular the General Data Protection Regulation (GDPR – Regulation (EU) 2016/679), as well as Law 4624/2019.

To further strengthen information protection, the Group has developed and implemented an Information Security Management System (ISMS), certified in accordance with the international standard ISO/IEC 27001. To ensure the integrity and confidentiality of the data managed, a designated Information Security Management System Officer has been appointed, working in close cooperation with the Group’s Chief Information Security Officer (CISO).

The Board of Directors is regularly informed on data security matters in the context of its meetings. In 2025, one personal data breach incident was recorded, which was promptly investigated and addressed, in full compliance with the applicable regulatory framework and the Group’s internal policies.

In the context of certification according to ISO 22301 and in alignment with the approved Business Continuity Policy, the Group’s parent company applies the following procedures:

To ensure the availability of information systems and data, an active cloud services agreement is in place for an IT Disaster Recovery Plan, which forms an integral part of the Business Continuity System, to provide the necessary support for the operation of critical applications. In this context, an alternative information systems recovery site has been developed, while DR tests are conducted annually to confirm compliance with the recovery times identified during the Business Impact Analysis.

The familiarization of personnel with the Group’s preventive measures and the strengthening of the System’s readiness are supported by a comprehensive continuous training programme, which includes on an annual basis:

The creation of a safe and resilient working environment requires immediate and effective management of emergency situations, with the aim of protecting the Group’s employees, associates and infrastructure.

Through this cohesive approach, the Group’s overall resilience is strengthened, ensuring a timely and coordinated response to any potential scenario. In 2025, at Group level, the annual Disaster Recovery Test was carried out, confirming the operational readiness of critical systems and the effectiveness of recovery procedures.

In total, 78 emergency preparedness exercises were carried out during 2025, including the simulation of various emergency scenarios and the assessment of the Group’s response.

At Group level, two specialized exercises were also conducted focusing on cyberattack scenarios and system recovery procedures, further strengthening digital security and the ability for rapid restoration of critical systems. Overall, these exercises made a significant contribution to validating the adequacy of business continuity plans across all areas of operation, strengthening compliance with regulatory requirements and ensuring the uninterrupted operation of the Group.