Personal Data Protection Policy

This Personal Data Protection Policy provides the information required by Article 13 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter the "GDPR"). It concerns the processing of personal data collected through the website www.krclaw.gr and the appointment booking form (book.krclaw.gr). The processing of our clients' data in the course of providing legal services is the subject of separate information. This Policy may be amended. The version in force at any time is posted on the website, stating the date of its last update. In the event of a material amendment, you will be informed appropriately.

Data Controller

Petros Karachristou, Lawyer, 3 Kleisthenous Street, 10552 Athens, Greece, tel. +30 211 0154707, info@krclaw.gr

Appointment booking

Browsing the website does not require you to provide any personal data. However, if you book an appointment through the form (book.krclaw.gr), we process:

• your full name and telephone number,
• your email address, if you provide it (optional), to send you a confirmation email with a link to cancel the appointment,
• the date and time of the appointment you select,
• any information you choose to share with us about the subject of the appointment. This may include special categories of data (e.g. health or religious beliefs). Please provide only what is necessary.

The data you submit through the form are processed solely to schedule the appointment and to communicate with you about it, including its cancellation. The processing is necessary to handle your appointment request, at the pre-contractual stage in view of a possible engagement for legal services (Article 6(1)(b) GDPR). Any special categories of data (Article 9(1) GDPR) that you choose to share with us are processed only with your explicit consent (Article 9(2)(a) GDPR). This consent is given by selecting the relevant field of the form and may be withdrawn at any time, insofar as the processing is based on it.

To protect the form from automated or malicious use, we also automatically process your IP address and technical details of your browser (request rate limiting and an anti-bot check). The legal basis is our legitimate interest in the security of the form (Article 6(1)(f) GDPR).

All information you provide to us is kept confidential, in accordance with Article 38 of the Code of Lawyers (Law 4194/2013).

The data are kept for six (6) months from their submission, after which your personal data are deleted. Their retention is extended for as long as necessary if, within that period, you contact us again or instruct us to handle a case, in which case any further processing is governed by the separate information provided to our clients.

Recipients and transfers

To operate the booking form we use the following processors:

• Render Services, Inc. (USA): hosting of the application and the database, where all form details are stored,
• Cloudflare, Inc. (USA): anti-bot check, using your IP address and technical details of your browser,
• Microsoft (Microsoft 365, EU): sending the confirmation email, using your full name and email address,
• Google (Google Calendar, USA): entering the appointment in the firm's calendar, using only your full name and telephone number. The content of your message is not transferred to Google.

Transfers of data to the United States are based on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, under which the above recipients in the United States are certified, and additionally on the European Commission's Standard Contractual Clauses.

Cookies

The website uses the Google Analytics 4 service of Google Ireland Ltd for the statistical analysis of visits. Google Analytics runs only on www.krclaw.gr. The appointment booking page (book.krclaw.gr) does not use analytics cookies or any other trackers. Google Analytics cookies are placed on your device only if you click "Accept" in the relevant message. If you click "Reject", no such cookie is placed and you can continue browsing normally.

Cookie	Purpose	Duration
_ga	Distinguishing visitors	1 year
_ga_48KBEWM649	Maintaining session state	1 year

The legal basis is your consent (Article 4(5) of Law 3471/2006 and Article 6(1)(a) GDPR).

Google may transfer data to the United States. The transfer is based on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework, under which Google LLC is certified.

Your choice (accept or reject) is stored in your browser for one (1) year, so that you are not asked on every visit. This storage is strictly necessary and does not require consent. After one year, your consent is requested again. You can change or withdraw your consent at any time through the "Cookie settings" link at the bottom of every page. Withdrawal does not affect the lawfulness of processing before it.

Your rights

Subject to the conditions of the GDPR, you have the following rights:

• Access (Article 15): to be informed about the data we hold about you and to receive a free copy of them. A reasonable fee may be charged for further copies.
• Rectification (Article 16) of inaccurate or incomplete data.
• Erasure (Article 17), unless retention is necessary for compliance with a legal obligation or for legal claims.
• Restriction of processing (Article 18).
• Objection (Article 21) to processing based on legitimate interest.
• Portability (Article 20): to receive the data you provided to us in a structured, commonly used and machine-readable format. You may also ask for them to be transmitted to another controller, where technically feasible. This right applies where processing is based on consent or contract.
• Withdrawal of consent, at any time, without affecting the lawfulness of prior processing.

To exercise your rights, contact us at info@krclaw.gr. We will reply within one (1) month. This period may be extended by two (2) months where necessary, in which case you will be informed.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (1-3 Kifisias Avenue, 11523 Athens, www.dpa.gr).