Privacy Policy

1. Controller

The controller is George Geranakis, Attorney at Law, member of the Athens Bar Association (reg. no. 40446), with offices at Finikes Commercial Centre, Livadia, Parikia, Paros 844 00, Greece. You can reach us at ggeranakis@gmail.com or on 22840 26095. No data protection officer has been appointed, as the nature and scale of the processing do not require one (Article 37 GDPR).

2. What we process and why

• Contacting us. When you call us, email us or use the contact form, we process the details you choose to give us (name, telephone, email address, the content of your message) in order to respond to your request and to prepare any engagement. The form sends and stores nothing through the website: it opens your own email application with the message ready, and what you send reaches us as an email. Legal basis: Article 6(1)(b) GDPR (steps prior to entering into a contract) and Article 6(1)(f) (our legitimate interest in answering those who write to us).
• Technical visit data. When you visit, the hosting provider automatically records technical information (IP address, device and browser type, date and time, page requested) for the security and proper operation of the website. Legal basis: Article 6(1)(f) GDPR.
• Google map. The map in the Contact section loads only if you choose to load it. Google then receives your IP address and may set cookies. Legal basis: your consent (Article 6(1)(a) GDPR), which you can withdraw at any time from the cookie settings.
• Nothing else. The website uses no analytics and no advertising cookies, and it does not store what you type into the contact form. Fonts are served from the website itself and are not requested from third parties.

3. Recipients and transfers

The website's hosting provider (Cloudflare, Inc., USA) has access to the technical visit data as a processor, under a contract that includes the European Commission's standard contractual clauses for transfers outside the EEA. Cloudflare also states that it is certified under the EU–US Data Privacy Framework (European Commission adequacy decision of 10 July 2023). See Cloudflare's Privacy Policy.

The office's email is held on Google's email service (Google Ireland Limited), in accordance with Google's Privacy Policy. Data are also transmitted to Google if you choose to load the map; the map is provided by Google Ireland Limited and data may be transferred to Google LLC in the USA, which is certified under the EU–US Data Privacy Framework.

We do not sell or share personal data with third parties for advertising. Disclosure to public or judicial authorities takes place only where the law requires it.

4. Retention

Messages and the details of those who contact us are kept for as long as needed to reply and are deleted no later than twelve months after the last contact. If a matter is entrusted to us, you are informed separately, at engagement, about the processing of your data in the course of the engagement. The hosting provider's technical logs are deleted automatically after a short period.

5. Your rights

You have the right (Articles 15–22 GDPR) to:

• access the data concerning you and obtain a copy,
• have inaccurate data corrected or incomplete data completed,
• erasure, where there is no longer a reason to keep the data,
• restriction of processing, and to object to processing based on legitimate interest,
• portability of the data you provided to us,
• withdraw your consent at any time, without affecting the lawfulness of prior processing.

Right to object. You may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Article 21 GDPR). We then stop the processing unless we demonstrate compelling legitimate grounds that override your interests.

Providing your details is voluntary; without them, however, we cannot answer your request. We take no automated decisions and do no profiling.

To exercise your rights, email ggeranakis@gmail.com or write to our office address. We reply within one month at the latest; for particularly complex requests the period may be extended by up to two further months, in which case we will let you know in time. If you believe the processing breaches the law, you may lodge a complaint with the Hellenic Data Protection Authority (1-3 Kifissias Ave., 115 23 Athens, tel. +30 210 6475600, contact@dpa.gr, www.dpa.gr).

6. Professional secrecy

Whatever you entrust to us is covered by the lawyer's duty of confidentiality under the Code of Lawyers (Law 4194/2013). This duty applies whether or not your matter is ultimately taken on.

7. Security

We apply appropriate technical and organisational measures to protect data against accidental or unlawful destruction, loss, alteration and unauthorised access or disclosure. The website is served exclusively over an encrypted connection (HTTPS) and collects the minimum data necessary. Email correspondence is kept on access-controlled systems with encryption in transit, and only the lawyer has access to it.

8. Minors

The website is intended for adults and not for persons under 18. We do not knowingly collect data from minors.

9. Changes to this policy

This policy may be updated when the website or the law changes. The date of the latest update is shown at the top of the page.