Privacy Policy
How we process personal data in connection with this website and with enquiries made through it. Issued under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Law 4624/2019.
How we process personal data in connection with this website and with enquiries made through it. Issued under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Law 4624/2019.
| Controller | Πανταζής και Συνεργάτες Εταιρία Δικηγόρων (Pantazis & Associates), a law firm constituted under Articles 49 et seq. of Law 4194/2013 |
|---|---|
| Address | Leoforos Alexandras 71–73, 114 73 Athens, Greece |
| info@pantazis-law.com | |
| Telephone | +30 210 36 33 694 |
| Data Protection Officer | We have not appointed a DPO. We are not required to do so under Article 37 GDPR: we are not a public authority, our core activities do not consist of large-scale regular and systematic monitoring, and we do not process special category data on a large scale. Data protection queries should be addressed to the contact above. |
Processing carried out in the course of an existing retainer is governed additionally by our engagement terms and by the professional secrecy obligations of the Code of Lawyers (Law 4194/2013), which take precedence where they impose a stricter standard, as contemplated by Article 90 GDPR.
The data we hold falls into two broad categories: information you actively give us, and information your browser transmits automatically when you visit the site. Both are described below.
Data: first and last name, telephone number, email address, how you heard of us, the content of your message and any further information you choose to include, together with the date and time of submission.
Purposes: responding to your enquiry; carrying out conflict-of-interest checks; deciding whether we are able to act; and, where relevant, preparing an engagement.
Legal bases: Article 6(1)(b) GDPR — steps taken at your request prior to entering into a contract; and Article 6(1)(f) GDPR — our legitimate interest in running conflict checks, keeping a record of enquiries received and declined, and defending against later claims. We do not rely on consent for this processing, which is why the form asks you to acknowledge this notice rather than to tick a consent box.
Where an enquiry unavoidably contains special category data (Article 9 GDPR) or data relating to criminal convictions and offences (Article 10 GDPR), we process it under Article 9(2)(f) GDPR, for the establishment, exercise or defence of legal claims. Please do not include such data in a first, unsolicited enquiry unless it is genuinely necessary.
Providing this data is not a legal requirement, but without it we cannot respond to you.
Data: IP address, date and time of request, page requested, HTTP status, referring URL, browser and operating system identifiers.
Purpose: delivering the site, maintaining its security and integrity, detecting and investigating abuse, and diagnosing faults.
Legal basis: Article 6(1)(f) GDPR — our legitimate interest in the secure and reliable operation of the site.
We use Google Analytics 4, provided by Google Ireland Limited, to understand how the site is used and which content is useful.
Data: a randomly generated identifier stored in a cookie, truncated IP address, pages viewed, approximate location at country or city level, device and browser characteristics, and referral source.
Legal basis: Article 6(1)(a) GDPR — your consent, given through our cookie banner. No analytics cookie is set and no analytics script is loaded before you accept. The banner offers accept and reject with equal prominence; continuing to browse, scrolling or closing it is not treated as consent. You may withdraw consent at any time, with effect for the future, using the Cookie settings control in the footer of every page.
We have configured the property with IP anonymisation, with Google Signals disabled and with advertising personalisation disabled, so the data is not used to build advertising audiences. We do not run Google Ads or any remarketing tag. Details of the specific cookies are in the Cookie Policy.
Where we are engaged, we process personal data relating to clients, their counterparties, witnesses and other individuals connected with the matter, on the following bases: Article 6(1)(b) (performance of the engagement); Article 6(1)(c) (legal obligations, notably client identification and record-keeping under Law 4557/2018 and tax and accounting obligations); Article 6(1)(f) (conduct of the matter, including processing of third-party data necessary to advise); and, for special category and criminal offence data, Article 9(2)(f) and Article 10 GDPR.
Individuals who are not our clients but whose data appears in a matter should note that our ability to provide information about that processing is constrained by professional secrecy and by Article 14(5)(d) GDPR.
Business card exchanges, professional networking contact and correspondence in the ordinary course of professional activity are processed under Article 6(1)(f) GDPR for the purpose of maintaining professional relationships.
We do not operate a marketing newsletter. We do not send unsolicited commercial communications, and we do not sell or rent personal data.
We disclose personal data only where necessary, and only to:
| Recipient | Purpose | Location |
|---|---|---|
| Our website hosting provider | Site hosting and server logs | EU / EEA or, where outside, under Standard Contractual Clauses |
| Google Ireland Limited (Google Workspace) | Business email: delivery and storage of enquiries sent through the contact form and subsequent correspondence | EU, with support access from Google LLC (USA) |
| Google Ireland Limited (Google Analytics 4) | Website analytics, only where you have accepted analytics cookies | EU, with processing by Google LLC (USA) |
| Instructed correspondent lawyers, counsel, experts, translators | Conduct of a specific matter, on instruction | Case-dependent |
| Courts, arbitral tribunals, opposing parties | Where required for the conduct of a matter | Case-dependent |
| Accountants, auditors, banks, supervisory and tax authorities | Legal and regulatory obligations | Greece / EU |
Providers acting on our instructions do so under Article 28 GDPR data processing agreements.
The contact form is processed on our own server-side handler and the resulting message is delivered to a Google Workspace mailbox operated by Google Ireland Limited. No analytics or advertising provider receives the content of your enquiry.
Where analytics consent is given, analytics data is processed by Google Ireland Limited and may be transferred to Google LLC in the United States. Those transfers rely on Google's certification under the EU–US Data Privacy Framework and on the Standard Contractual Clauses incorporated in Google's data processing terms. The same applies to support access to our Google Workspace mailbox.
In the conduct of a specific matter, personal data may be transferred to lawyers, tribunals or parties outside the EEA where necessary for the establishment, exercise or defence of legal claims (Article 49(1)(e) GDPR) or for the performance of a contract concluded in the interest of the data subject (Article 49(1)(c) GDPR). You may request a copy of the relevant safeguards by writing to the contact address in section 1.
| Data | Retention period |
|---|---|
| Enquiries that do not result in an engagement | 24 months, after which they are deleted. A minimal conflicts record — names and a short matter description only — is kept for 5 years |
| Server logs | 30 days, unless retained longer to investigate a specific incident |
| Client files | 5 years from completion of the work, or longer where a limitation period, an ongoing dispute or a professional obligation requires it |
| Client identification records (Law 4557/2018) | 5 years from the end of the business relationship |
| Accounting and tax records | As required by Greek tax legislation |
Under Articles 15 to 22 GDPR you have the right to request access to your personal data, rectification of inaccurate data, erasure, restriction of processing, and portability of data you provided where processing is based on consent or contract and carried out by automated means. You may object at any time to processing based on Article 6(1)(f), on grounds relating to your particular situation.
These rights are subject to the exemptions in the GDPR and Law 4624/2019. In particular, professional secrecy and the duty of confidentiality owed to our clients may prevent us from disclosing information, or from erasing or restricting data held in a client file. We will explain the basis of any restriction we apply.
To exercise a right, write to info@pantazis-law.com. We respond within one month, extendable by two further months for complex requests. We may ask for information to verify your identity.
We do not carry out automated decision-making producing legal or similarly significant effects within the meaning of Article 22 GDPR.
If you consider that our processing infringes data protection law, you may lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1–3, 115 23 Athens, Greece — www.dpa.gr.
You may also complain to the supervisory authority of your habitual residence or place of work, and you have a right to an effective judicial remedy.
We apply technical and organisational measures appropriate to the risk, including TLS encryption in transit, access controls and confidentiality undertakings binding on everyone working with the firm. No transmission over the internet is entirely secure. Please telephone us rather than use the form for genuinely sensitive material before an engagement is in place.
This website is directed at businesses and professional clients and is not intended for children. We do not knowingly collect data from persons under 15 years of age, the age set for consent to information society services in Greece.
We may update this policy. The current version is always published on this page under the date shown above. Material changes affecting you will be notified where we hold contact details and are permitted to use them.