Personal Data Protection Policy
At KLC we respect your right to privacy and we are committed to protecting the personal data you provide us through the Website or otherwise in accordance with applicable European and Greek law (indicatively, in accordance with the General Data Protection Regulation 2016/679/EE – also known as GDPR, Laws No. 4624/2019, 3471/2006 etc.). For this reason, we have put in place this Personal Data Protection Policy (the “Policy”), which provides clarification on the purpose of our processing and protection of your personal data.
Access to and use of the Website is governed by this Personal Data Protection Policy and by the Terms & Conditions of our Website and should be read in conjunction with them. Any use of our Website implies your reading and understanding of this Policy on your behalf and your unconditional acceptance of our Terms & Conditions. Please read this Policy carefully in order to inform yourself about the processing of your personal data by us. If, for any reason, you are in doubt or do not wish your data to be processed in accordance with the terms of this Policy, please immediately refrain from any use or attempted use of our Website and providing personal data to KLC.
Your personal data includes any information that identifies or may lead directly or indirectly to the identification of a natural person. Indicatively, personal data includes information such as a person’s identity, contact details, technical data related to their web browsing activity, and data that may reveal information about a person’s interests or physical, physiological, genetic, mental, economic, cultural or social identity.
This Policy sets out how we process personal data of the following categories of persons:
- Visitors to our Website (“Users“)
- Candidate Employees or employees in any employment relationship (“Candidate Employees“)
- Clients, Prospective Clients or Former Clients (“Clients“)
- Third parties whose data we collect in the context of providing our legal services
- Third party partners (e.g. service providers)
For the above purposes, KLC is in principle considered to be the Data Controller of the personal data it processes. For any clarification in relation to this Policy, you may contact us at the contact details below:
T. +30 210 7264 500
11, Vasilissis Sofias Ave.
Arvanitis Building, 1st floor
10671 Athens, Greece
The personal data we process about you are collected either directly from you, when you submit them to us (e.g. identity data, contact data, professional data, demographic data, data that you freely submit to us through the contact form, data concerning your case) or through third parties (e.g. when you interact with our newsletter, when we verify your professional data). We may also process some of your data in automated ways, such as when you browse our Website (in which case we collect technical data, cookie data, etc.).
CATEGORIES OF PERSONAL DATA, PURPOSE AND LEGAL BASIS OF PROCESSING
Below is a description of how we process your data, i.e. the categories of your personal data that are processed, the purpose for which KLC processes them, and the legal basis of processing on which we rely for their processing.
A. Users of the Website
Browsing the Website and extracting statistics
Purpose: We process the personal data resulting from your use of our Website when you browse it.
Data: Demographic data (country of IP address) Technical data (browser type and version, operating system and platform, etc.), Data via cookies*
*please refer also to our cookie policy
Legal Basis for Processing: Legitimate Interest
We process your browsing data: (a) in order to provide you with the features and enable you to use the full functionality of our Website; (b) to improve the operation of our Website by collecting statistics about its use (e.g. which pages are most visited by our Users); and (c) to protect the security of our communications and systems and to prevent and detect security breaches and malicious activities.
Our legitimate interest in processing your data is reasonably balanced against your privacy rights and freedoms.
Submit a Request via our Contact Form
Purpose: We process the data you submit to us when you use the contact form available on the Website in order to contact us.
Data: Identification Data (full name), Contact Data (email), Data contained in your message
Legal Basis for Processing: Consent
We process your data solely on the basis of your consent in order to respond to your contact requests.
Please do not send us any information that you or anyone else consider confidential or privileged, unless we have previously agreed to take the case as your lawyers. Please note that sending any information on your behalf does not create an attorney-client relationship with us.
You have the right to withdraw your consent by sending us an email to: info@klclawfirm.com. Please note that when you withdraw your consent in the context of some processing activities, we will not be able to serve your request.
Subscribe to our Newsletter
Purpose: We process the data you submit to us when you subscribe to our newsletter
Data: contact details (email)
Legal Basis for Processing: Consent
We process your data solely on the basis of your consent in order to register you on mailing list and send you our Newsletter. You have the right to withdraw your consent to receive our commercial communication by clicking “Unsubscribe” in any of the newsletters you receive from us. Please note that if you respond to a no-reply communication or if you otherwise send us a message, this will not create an attorney-client relationship with us.
Β. Job or Associate Candidates
Declaration of Job Interest at KLC
Purpose: We process the data you submit to us when you express an interest in working at KLC or working with us in any way
Data: Identification Data (full name), Contact Data (email, phone, address), Professional Data (previous work experience, letters of reference, certifications, academic record, bar association registrations and other data contained in your CV), demographic data (gender, age)
Legal Basis for Processing: Performance of a Contract (pre-contractual stage)
We process the personal data you submit to us in order to take the necessary steps to evaluate the conclusion of an employment contract or cooperation with you. The processing of such data does not bind KLC or you to enter into such a contract.
C. Clients, Prospective Clients and Former Clients
Conflict of interest and KYC control and compliance with relevant legal obligations
Purpose: We process the data you submit to us in order to examine the possibility of a conflict of interest and to identify you (Know Your Client – KYC).
Data: Identification Data (full name, VAT number, KEFODE, ID card data), Contact Data (email, phone, address), Professional Data (profession)
Legal Basis for Processing: Compliance with our legal obligations
Our legal obligations arise from the Lawyers Code (Law 4194/2013, as in force), the Code of Conduct of the Athens Bar Association and the Presidential Decree 81/2005 on Law Firms, as well as from the legislation on the prevention and suppression of money laundering and the financing of terrorism (Anti-money laundering legislation – AML, Law 4557/2018, as in force) and the Decree 28226/2021. In this context, in order to comply with the above obligations, we may process, among others, data of natural persons who constitute legal representatives or shareholders (UBO) of your company in order to comply with the above obligations.
Handling your legal case
Purpose: We process the data you provide to us in order to represent you in the context of the mandate we receive from you to handle your legal case, to register you as a Client and to invoice you.
To the extent that we have not yet received a mandate to act for you, we process the data you submit to us in order to evaluate your case and our potential cooperation on it, to submit our financial offer to you or to contact you before we start our cooperation.
Data: Identification Data (full name), Contact Data (email, phone, address), Data related to your case, Financial Data (TIN, KEFODE, bank account)
Legal Basis for Processing: Performance of a Contract (at the stage when we evaluate our potential cooperation processing is performed at a pre-contractual stage)
We process your data in order to fulfil our contractual obligations arising from our contractual relationship.
In case we are at a pre-contractual stage, we process your data in order to take the necessary steps to evaluate our potential cooperation and your case or to invoice you for the collection of any advance payment.
In addition, we will retain certain of your data which we determine based on the nature of the case and in accordance with our legitimate interest as evidence for the establishment, exercise or defence of legal claims.
In the event that the processing of data of the Client’s employees is necessary for the provision of our legal services and the management of our mandate to act on your behalf, the responsibility for the prior notification of the subjects lies solely with the Client.
Note for Former Clients: To the extent that our partnership has ended, we only process as much of your data as is necessary for tax or filing purposes in accordance with the law.
Note for Prospective Clients: To the extent that you do not entrust your case to us, we only process as much data as is necessary for the purposes of complying with internal organisational measures and for the defence or exercise of legal claims.
Communication to inform you about legal developments
Purpose: We process the contact and identification data we have collected under the mandate we have received from you in order to contact you to inform you about other services we offer, for conferences and seminars that we organize or to which we participate, as well as for actions and initiatives that we undertake
Legal Basis for Processing: Legitimate Interest
Data: Identification Data (full name), Contact Data (email)
Based on our legitimate interest, we reserve the right to contact you by email to inform you about conferences, lectures and to send you our Newsletter. If you do not wish to receive such communications from us, you can unsubscribe from our Newsletter by clicking “Unsusbscribe” on any of the message you receive from us via email, contact us at the contact details from which you received the communication or email us at info@klclawfirm.com.
D. Third parties
Handling of a Client’s Mandate
Purpose: We may process data that a Client provides to us about you in the context of the mandate we receive from them to handle their case, to the extent necessary to fulfill our legal mandate arising from our contract.
Data: Identification Data, Contact Data, Case-Related Data
Legal Basis for Processing: Legitimate interest
We may process the personal data of third parties in the context of defending the rights of our Client, to the extent that the rights and freedoms of third parties are not overridden.
Legal Basis for Processing: Performance of a Contract (even at the pre-contractual stage)
We process your data in the context of the execution of the mandate we receive from our Client, for the provision of our legal services.
Legal Basis for Processing: Legal obligation
We process your data when the processing is necessary to comply with our legal obligations, such as compliance with ethical rules or the obligation to provide information to judicial or administrative authorities.
Legal Basis for Processing: Exercising legal claims or defending rights concerning sensitive data
We may process special categories of data (e.g. health, criminal records) if this is assessed as necessary for the establishment, exercise or defence of legal claims.
In the event that personal data of employees of the Clients are processed, the responsibility for the prior notification of the subjects lies solely with the Clients.
Ε. Third-Party Partners
Provision of Third-Party Services to us
Purpose: We process data of third-party partners who provide services to us (e.g. accountants, marketing service providers, IT support services, etc.) for the purpose of invoicing, issuing and receiving reports, supporting the administrative functions of our office.
Data: Identification Data (e.g. individual business name), Contact Data (email, telephone), Financial Data (invoicing data, bank account) and anything else that may be required for the provision of the third-party services to us.
In case we process data of relevant service providers’ employees, the service provider must inform the employees about this Policy.
Processing Legal Basis: Performance of a Contract
We process the data provided to us by the service provider in order to fulfil our obligations under the relevant service contract we have concluded with them.
In case personal data of employees of the relevant partners are processed, the responsibility for prior notification of the data subjects lies solely with the third-party partner.
Please note that where your consent is the legal basis for processing your data, you have the right to withdraw it at any time. The withdrawal of your consent will be valid for the future and will not affect the lawfulness of the processing up until the point of its withdrawal.
Where legitimate interest is the legal basis for processing your data, you have the right to request that we do not process your data at any time. However, where KLC’s legitimate interest in processing your data, reasonably considered in the light of your privacy, happens to outweigh your rights and freedoms, we reserve the right not to stop the processing. In any case, however, you have the right to oppose any data processing that takes place on the basis of our legitimate interest when it concerns any commercial communication.
DATA RETENTION PERIOD
Your personal data is retained by us for as long as necessary to fulfil its purpose. In order to determine the time for which it is necessary to keep your data, we take into account the type and nature of the data, the quantity, the purposes of processing and the security measures In place.
Regarding your data retained in relation to the use of our Website, your data is retained for a period of one (1) year or until the necessary reports/reports are extracted.
The data you submit via our contact form is retained for two (2) years from our last email exchange.
The data we keep for sending our newsletter is kept for three (3) years from the last interaction you had with it or with our Company in any capacity.
Regarding Potential Customers, we retain the data you have provided us with for a period of three (3) years, except for any data we have collected for compliance purposes (conflict of interest check, KYC), which will soon be deleted.
Regarding our Clients’ personal data, the data is retained for a period equal to the duration of our mandate, and for a period of twenty (20) years from the expiry of our mandate. Your data is kept archived for the purpose of reviving your case should this be required in order to be able to establish and exercise your legal rights and any claims that have arisen under or in connection with the mandate.
Third-party partners’ personal data is kept for a period equal to the service provision period and for at least ten (10) years after the cooperation has ended, in order to be able to comply with our tax obligations.
Potential employees’ personal data is kept for a period of three (3) years from the last contact we had with you.
RECIPIENTS OF YOUR DATA
We may transfer your data to third parties in order to be able to provide you with the Website and/or the services mentioned herein. Recipients of your data include our third party legal partners, third party service providers, such as information systems support services, website support and hosting services, digital platforms we use to manage our clients and files, digital platforms that third parties provide us with for use in connection with specific tasks and legal projects, cloud computing services, digital marketing services, bailiffs, courier services, translators, archiving services and other services any other similar services that are necessary for conducting our internal and administrative services as well as supporting our Clients in the management of their case, if applicable.
In addition, in order to carry out our contractual mandate or in the context of fulfilling our legal obligations, we may transfer your data to public authorities and administrative authorities (e.g. tax, judicial, police and prosecution authorities).
We take all reasonable steps to ensure that such transfers take place securely and in accordance with the data protection guarantees provided by the relevant legislation.
Your data will in principle be processed within the European Economic Area (EEA). In rare cases where your data may be transferred to third countries, for which no Adequacy Decision has been issued by the European Commission, we will duly inform you before any transfer takes place and will proceed with your consent to do so. In this context, in relation to third party data included in the transfer, the responsibility for informing the data subjects in advance (where lawful and feasible) rests solely with whoever provided it.
YOUR RIGHTS AND YOUR PREFERENCES
Please note that all your rights below are without prejudice to the confidentiality obligations arising from the relevant legal framework governing the practice of the legal profession and the provision of legal services.
Right of Access: you can request:
- Confirmation that KLC processes your personal data.
- Access to any personal data that you do not already possess.
- Information about your personal data, such as the data KLC holds, what purpose they are used for, who they may transfer it to, whether they transfer it abroad, how it protects it, for how long it retains it, what your rights are as a data subject, the complaints procedure, and the data sources (to the extent that this information is not already provided in this Policy)
Right to rectification: you can request the rectification of inaccurate personal data.
KLC may seek to verify the accuracy of the data before correcting it.
Right of Deletion: You may request KLC to delete your personal data if you have withdrawn your consent, if it is no longer necessary for the purposes for which it was collected, if it was collected unlawfully, or if you object to its processing (or you have opted out). KLC is not obliged to comply with a deletion request if the processing is necessary to comply with a legal obligation, to achieve another legitimate aim or legal basis, or to establish, exercise or defend legal claims.
Restriction of Processing: You may request restriction of processing (i.e. storage but not processing) of your personal data where the accuracy of the data is contested in order to verify its accuracy, the personal data has been unlawfully processed but you object to its deletion, it is no longer necessary for the purposes for which it was collected but you need it for the establishment, exercise or defence of legal claims or there is another legitimate basis for processing or where you have exercised your right to object and are awaiting confirmation.
Right to object: You can object at any time to the processing of your personal data based on KLC’s legitimate interest or the performance of a task of public interest. KLC may continue to process your data if it is able to demonstrate compelling and legitimate grounds that override your rights and freedoms, but without affecting your fundamental rights.
Right not to be subject to Automated Decision Making: KLC does not make decisions based solely on automated processing of your personal data for the purposes of its Services. In any case, you have the right not to be subject to a decision based solely on automated processing, including profiling, if it has legal or other significant implications for you.
Right to withdraw consent: You can withdraw your consent at any time, if the processing is based on it. Withdrawal is valid for the future and does not affect the lawfulness of the processing carried out prior to it.
Right to lodge a complaint with the competent supervisory authority: You have the right to lodge a complaint with the local competent supervisory authority about any issue related to the processing of your personal data by KLC. However, as your privacy is a priority for us, we recommend that you contact us first about any issue you are experiencing. We will be happy to find an amicable solution to your request.
In order to exercise the above rights, you must provide us with specific, accurate and truthful information in order for us to respond to your request. KLC is not responsible for errors beyond its control. We reserve the right to reject requests that are groundless, excessive or malicious. In addition, we may request proof of identity in order to enable us to fulfil your rights. Exercising your rights is free of charge, unless otherwise specified by law or the request is excessive, in which case there may be a reasonable charge. We aim to respond to all valid requests within one (1) month, unless they are particularly complex or there are multiple requests, in which case the response may be extended up to three (3) months. In such a case, we will inform you in a timely manner.
TECHNICAL AND ORGANISATIONAL SECURITY MEASURES
All of our associate attorneys who manage our clients’ cases are subject to legal professional privilege and are bound by contractual confidentiality clauses. In addition, KLC takes all necessary security measures to ensure that your personal data is processed only by specifically authorized employees under our control and instructions, who have the necessary professional skills to provide the appropriate guarantees in terms of technical knowledge and personal integrity to ensure the protection of personal data.
We take the necessary technical and organisational measures so that the processing that takes place in our workplaces and on the professional devices of our employees and associates within our workplace and on digital platforms under our control is carried out safely and securely. To the extent that the processing of data takes place in an environment outside our control, such as in the case of the use of third parties’ computer, information or cloud systems, we cannot guarantee the uninterrupted, error-free operation of these systems, as they are beyond our control and responsibility. At the same time, we are not responsible for the processing of data in cases where there are technical or other network weaknesses or circumstances beyond the security measures we undertake or beyond our control or due to reasons of force majeure or accident.
REVISIONS TO THIS POLICY
We reserve the right to revise this Policy, for example to comply with new requirements imposed by law or in the event that we revise our procedures or practices. Any revisions to our Policy will be posted on the Website, so please check this page periodically. Should you require any clarification or information regarding the changes, you may contact us at the details listed above. Any information/clarification provided to you in accordance with the above regarding any changes to this Policy does not constitute a replacement, substitution or any revision of this Policy.
COOKIE POLICY
We use “cookies” to ensure the proper functioning of our Website. Cookies are data files that may be stored on your computer, on your mobile device by our Website server when you visit a website and are used to identify your device. Your browser may in this case store them on your system based on the preferences you have made in relation to cookies.
The cookies placed by the Website are called “first-party cookies”. Cookies placed by others are called “third-party cookies” and enable third-party features or functionality (such as analytics, advertising and video) to be provided on or through our Website.
Necessary cookies: They are necessary for the smooth operation of our Website and collect information about your operating system including, among other things, your browser type, and your Internet Protocol (IP) address. They allow you to browse the Website and use its basic functions. For example, they allow you to move from one page to another and to specify the default language of the Site through your IP address. KLC uses this information for the purposes of analysing the traffic on its Website, monitoring visits to its pages and the duration of navigation on each page, in order to improve the Website, advertise its services and carry out anonymous statistics. The use of this information is not for the purpose of personally identifying the user. This information is held by KLC Law Firm through Google Analytics in an aggregated and anonymous form.
Functionality Cookies: These cookies enable certain features of the Website, such as the correct display of content depending on the device you are using, and certain access features. For example, they remember your preferred language or local settings and apply them automatically, so you don’t have to enter them every time you change pages on the Site. In some cases, they may be used to view a video or enable certain features of social networking platforms. These cookies do not track your browsing session (on our Website or in your browser). If you do not allow these cookies, certain features of the Website may not be provided correctly or access to some content may be restricted. For example, you may not be able to play a video.
Statistics: These cookies collect information about the use of the Website by its visitors (e.g. which pages they visit, what problems they encounter while browsing, etc.) These cookies are used for statistical purposes and help us to improve the operation and performance of our website.We do not use cookies for marketing purposes.
You have the option to accept or reject all or some of the cookies when you enter the Website. Please note that if you reject some cookies, you may not be able to use all of the features available on the Website. In addition, you have the option to adjust the settings in your browser so that you are notified when you receive a cookie file, giving you the opportunity to decide whether or not to accept it.