Privacy Policy
Last updated: 6 November 2026
Papapolitis & Papapolitis (hereinafter referred to as “Papapolitis & Papapolitis”, or “we” or “us” or “our”) takes privacy seriously. This privacy policy (the “Policy”) explains what personal data we collect, what we do with it and why. We have tried to keep it readable rather than technical. As a law firm, we recognise the importance of confidentiality and the protection of personal information shared with us in connection with our legal practice. We are committed to handling personal data responsibly, securely and in accordance with applicable data protection laws.
We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (the “GDPR”), Greek Law 4624/2019, Greek Law 3471/2006 and the decisions and guidelines of the Hellenic Data Protection Authority.
- Who we are
This Policy covers Papapolitis & Papapolitis, a law firm established in 1898, with its office in Athens, Greece. Papapolitis & Papapolitis is the controller of your personal data.
Address: 268 Kifisias Avenue, Chalandri 15232, Athens, Greece. Telephone +30 210 3615544.
In this Policy, “our websites” means papapolitis.com, any associated sites, and our social media pages.
2. Whose personal data we process
We may collect and process personal data relating to the following categories of individuals:
- Visitors to our website;
- Individuals who contact us or otherwise communicate with us;
- Individuals who subscribe to our newsletters, legal updates and other publications;
- Our clients and prospective clients, including their directors, officers, employees, representatives and other contact persons;
- Individuals involved in or otherwise connected with the legal matters we handle, including counterparties, legal advisers, beneficial owners, witnesses, experts and other relevant third parties;
- Individuals who apply for employment, internships or other professional opportunities with us, including applicants to our Summer Internship Programme;
- Individuals who participate in events, seminars or other activities organised by us; and
- Representatives, employees and other contact persons of our suppliers, service providers and business partners.
Information we receive in the course of providing legal services is subject to our duty of client confidentiality and may be protected by legal professional privilege.
3. What we collect, and how
We collect personal data when you give it to us directly, by email, telephone or through our websites; when we receive it in the course of acting on a matter, from clients, counterparties, courts, public registries and publicly available sources; and automatically when you browse our websites.
Depending on the circumstances, in which we process your personal data , we may collect and process the following categories of information:
- Identification and contact information: such as your name, address, email address, telephone number, employer, job title and, where necessary, identification documents and details.
- Client and matter-related information: including information provided by or on behalf of our clients, documents and correspondence relating to legal matters, information necessary for conflict-of-interest checks, client identification and verification, anti-money laundering compliance and other applicable legal or professional obligations, as well as information obtained or generated in the course of providing legal services or conducting legal proceedings.
- Financial and billing information: including payment details, invoicing information and other financial information relevant to our professional relationship or the legal matters we handle.
- Recruitment information: including CVs, educational qualifications, professional experience, references, interview notes and other information provided or collected during recruitment and selection processes, including applications to our Summer Internship Programme.
- Event-related information: including registration and attendance details and, with your consent, photographs or audiovisual material in which you appear, collected during events organised by us.
- Website and technical information: including IP addresses, device and browser information, browsing activity, pages visited and other information collected through cookies and similar technologies, as further described in our Cookie Policy.
We may process special category data, for example health information, or data relating to criminal convictions and offences, only where necessary and permitted under applicable law, in particular on the basis of your explicit consent or where necessary for the establishment, exercise or defence of legal claims. Such processing is subject to appropriate safeguards
If you withhold information we have asked for, we may be unable to respond to your enquiry, accept your instructions, provide the service you have requested, or process your job application.
4. Why we process it, and on what basis
| Purpose | Legal basis |
| Responding to your enquiry | Taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR), where applicable, or our legitimate interests in responding to enquiries and requests addressed to our firm (Article 6(1)(f) GDPR).
|
| Providing legal services, and managing and improving the firm | Performance of a contract (Article 6(1)(b) GDPR), where applicable, or our legitimate interests in providing legal services, managing client relationships and ensuring the effective operation and improvement of our firm (Article 6(1)(f) GDPR). |
| Client and third party due diligence, anti-money-laundering checks, conflicts checking, and the prevention and detection of crime | Compliance with our legal and professional obligations (Article 6(1)(c) GDPR), including applicable anti-money laundering legislation, or our legitimate interests in protecting the firm against fraud and other unlawful activities, and in establishing, exercising or defending legal claims (Article 6(1)(f).
|
| Sending legal updates and marketing | Your consent Article 6(1)(a) GDPR. For existing clients, we may also send updates about similar legal services, on the basis of legitimate interests (Article 6(1)(f) GDPR), as permitted by Article 11(3) of Greek Law 3471/2006. You may withdraw consent or object at any time
|
| Assessing job applications | Taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR), where applicable, or our legitimate interests in managing recruitment and evaluating candidates (Article 6(1)(f) GDPR). Your consent (Article 6(1)(a) GDPR) where we retain your application for future opportunities
|
| Organizing events and seminars, and managing attendance | Taking steps at your request when you register (Article 6(1)(b) GDPR), our legitimate interests in organising events (Article 6(1)(f) GDPR), and your consent (Article 6(1)(a) GDPR) for photographs or audiovisual recordings in which you appear
|
| Operating, securing and improving our websites | Our legitimate interests in maintaining secure, functional and effective website, (Article 6(1)(f) GDPR for strictly necessary cookies. Your prior consent (Article 6(1)(a) GDPR) for all other cookies and similar technologies , including analytics, as explained in our Cookie Policy
|
| Managing our suppliers, and the security of our systems and premises | Performance of a contract (Article 6(1)(b) GDPR), where applicable, compliance with our legal obligations (Article 6(1)(c) GDPR), or our legitimate interests in managing business relationships and protecting our systems, premises and operations (Article 6(1)(f) GDPR)
|
| Complying with court orders, regulatory requests and our professional obligations, and establishing, exercising or defending legal claims | Compliance with our legal obligations (Article 6(1)(c) GDPR), where applicable, or our legitimate interests in protecting and enforcing our legal rights and interests (Article 6(1)(f) GDPR
|
5. Personal data you give us about other people
If you give us personal data about someone else, you must be entitled to do so, and you must have given that person the information data protection law requires, including making them aware of this Policy, who we are, why we hold their data and what rights they have.
6. Who we share it with
We share personal data only where necessary, and with: other professional advisers instructed on a matter, including foreign counsel, notaries, accountants, tax advisers and experts; courts, tribunals, arbitral bodies, regulators and public authorities, including tax authorities and pubic registries; counterparties and their advisers where the matter requires it; court bailiffs, translators, interpreters, mediators and arbitrators; our IT, hosting, email, document management and analytics providers; courier, archiving and confidential waste disposal providers; our auditors, insurers and bankers; and identity verification providers used for due diligence.
Details of the service providers we use are available on request.
We require everyone who processes personal data on our behalf to act on our instructions, to keep it secure, and not to use it for their own purposes. We do not sell personal data, and we do not share it for other organisations’ marketing.
7. Legal updates and how we track them
If you subscribe, we will use your details to send you legal updates. You can unsubscribe at any time through the link in any email or by writing to us. Unsubscribing does not affect the lawfulness of any processing before it.
With your consent, our emails contain tracking elements that tell us whether a message has been opened, which links have been followed, and which parts of our website are visited afterwards. We use this to understand which of our updates are useful. You can withdraw your consent at any time, without unsubscribing, through [the preference link in each email] or by contacting us.
8. Data rooms, online platforms and e-signature
In the course of a matter you may be invited to use a virtual data room, a document sharing platform or an electronic signature service. Where we process personal data through those services we do so in line with this Policy, and you should also read the information provided by the operator of the platform.
9. Social media
Our social media pages are hosted by platforms that process personal data under their own terms. In some circumstances we act as joint controller with the platform. If you wish to exercise your rights in relation to data processed there, contact us and we will tell you whether another controller should also be approached.
10. Storage and international transfers
Personal data is held on systems operated by us and by the service providers we engage and is processed in the countries where we and they operate.
Some of our service providers, including providers of website analytics such as Google where you have consented to analytics cookies, may process personal data in the United States. Such transfers rely on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework where the provider is certified under it, or otherwise on the Standard Contractual Clauses. Where we transfer personal data to any other country without an adequacy decision, we do so only with the safeguards required by Articles 44 and following of the GDPR, normally the Standard Contractual Clauses approved by the European Commission. Contact us if you would like details of the safeguards applied to a particular transfer.
11. How long we keep it
We keep personal data only for as long as necessary for the purpose it was collected for, for any period required by law or regulatory guidance. Where it is necessary to process your personal data for the establishment, exercise or defence of legal claims, we may retain such data for longer periods, namely for up to twenty (20) years or, where legal proceedings are pending, until such proceedings have been conclusively terminated, whether by a judgment that is no longer subject to any ordinary or extraordinary legal remedy (irrevocable judgment), by settlement, withdrawal or otherwise, whichever is later, in accordance with applicable law.
Records we are required to keep for anti-money-laundering purposes are retained for five (5) years from the end of the business relationship or the completion of the transaction, as Law 4557/2018 requires, and for longer where the authorities require it.
Unsuccessful job applications are kept for six months from the end of the recruitment process, or for one year where you have consented to us retaining your application for future opportunities.
Your subscription details are kept until you unsubscribe. Cookie data is kept for the periods set out in our Cookie Policy.
If you have a question about how long we hold something, please ask us.
12. Your rights
You have the right to be told how we use your data, to obtain a copy of it, to have inaccurate data corrected, to have data erased, to restrict how we use it, to receive it in a portable format, to object to processing based on our legitimate interests, to object to direct marketing at any time, and to withdraw consent where we rely on it, without affecting the lawfulness of processing before withdrawal. Not all of these rights apply in every situation. We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects.
To exercise any of them, email athens@papapolitis.com. We will respond within one month and will tell you within that month if a complex request needs longer. We may ask you to verify your identity.
We may decline a request, as a whole or in part, where the law allows, where a request is manifestly unfounded or excessive, or where the data is needed to establish, exercise or defend legal claims. We may also be unable to comply where the information is confidential to a client or privileged, or where our professional duty of confidentiality under the Code of Lawyers (Law 4194/2013, as in force) applies. Where that happens, we will tell you and explain why so far as we are able to.
13. Security
We apply technical and organisational measures to protect personal data against unauthorised access, loss, misuse and destruction, and we require our service providers to do the same. Access is limited to those who need it, and everyone at the firm is bound by confidentiality obligations both under their contract and as a matter of professional duty.
We have procedures for handling suspected personal data breaches and will notify you and the relevant supervisory authority where we are required to.
No transmission over the internet is entirely secure, and we cannot guarantee the security of data before it reaches us. Email in particular is not a secure medium, and we would ask you not to send confidential material to us unencrypted.
14. Cookies and other websites
Our use of cookies and similar technologies, including the categories we use, the consent we ask for and how you can change your choices, is explained in our Cookie Policy.
Our websites link to sites operated by others. Those sites have their own privacy policies, which we are not responsible for. Please read them before submitting any personal data.
15. Complaints
If you are concerned about how we have handled your personal data, please contact us first at papapolitislawfirm@papapolitis.com so that we can try to put it right.
You may also lodge a complaint with a supervisory authority, in particular in the EU Member State where you live, where you work, or where you believe the problem occurred. In Greece, this is the Hellenic Data Protection Authority.
Hellenic Data Protection Authority
1-3 Kifisias Avenue, 11523 Athens, Greece
Telephone: +30 210 6475600
www.dpa.gr
16. Changes to this policy
We may update this policy. Changes will be posted on this page and the date at the top updated. Where a change is material, we will give prominent notice on our website before it takes effect and, where it affects processing based on your consent, we will ask for your consent again.
17. Contact
Papapolitis & Papapolitis
268 Kifisias Avenue, Chalandri 15232, Athens, Greece