Privacy Policy
Data controller
The law office ‘Ralli & Skafida’ (RS Law), 43 Stadiou Street, 105 59 Athens, Greece, info@rslaw.gr. Please write to the same address with any question about your personal data.
What we collect
Through the contact form we collect only what you send us: your name, your email address, a telephone number if you choose to give one, the text of your message, and the language you wrote in, so that we reply in the same one. The website asks for nothing else, creates no user accounts and keeps no database of its own about visitors. We do not use your details for advertising, we send no newsletters, and we take no automated decisions and build no profiles.
The legal basis for each purpose
One basis per purpose, not several stacked together:
- To reply to your message: your consent, which you give with the tick box on the form (Article 6(1)(a) GDPR). You may withdraw it at any time by writing to info@rslaw.gr. Withdrawal takes effect for the future and does not affect the lawfulness of processing already carried out on the basis of that consent.
- If we then take on your matter: performance of the engagement (Article 6(1)(b)) and the legal obligations that bind a lawyer (Article 6(1)(c)). From that point the processing no longer rests on consent, so withdrawing consent does not stop it.
- To run and protect the website: our legitimate interest in delivering the pages and keeping the site safe from abuse (Article 6(1)(f)). For that purpose our hosting provider processes your IP address.
Whether you have to provide your data
You do not. No statute and no contract requires you to give it. Your name, your email address and your message are nonetheless necessary if we are to answer: without them the form will not send, and we have nowhere to reply to. The telephone number is optional and we ask for it only in case a call is easier than writing. You can always ring us, or write straight to info@rslaw.gr, without using the form at all.
How long we keep it
An enquiry that does not lead to an engagement is deleted at the latest twelve months after we last corresponded. If we do act for you, the file is kept for as long as the engagement lasts and for five years after it ends, which is what our tax and professional obligations require. Anything longer applies only where the law expressly demands it, or while a dispute is pending for the establishment, exercise or defence of which the data is needed.
Who can see it
Your message is read by the lawyers of this firm. We do not sell data and we do not pass it to third parties for their own purposes. Getting the message to us does, however, involve the providers below, which act solely on our instructions as our processors and are bound by a contract under Article 28 GDPR:
- Cloudflare: hosts the website and runs the small program that receives the form. That program stores your message in no database; it forwards it immediately and keeps no copy. If delivery fails technically, the failure is written to the operational logs, not the contents of your message.
- Resend: the service that turns your submission into an email and delivers it to the office mailbox.
- Instatok: the company that built and maintains the website, for technical support.
- The provider of the mailbox in which the message finally arrives and is kept.
Transfers outside the European Economic Area
These providers are established, or hold infrastructure, in the United States and run networks of servers in many countries. Your data may therefore be processed outside the European Economic Area, in a country that does not by itself offer a level of protection equivalent to the GDPR. Such transfers are made under the safeguards in Chapter V of the GDPR: standard contractual clauses approved by the European Commission or, where it applies to the particular provider, an adequacy decision (the EU and US Data Privacy Framework). You may ask for a copy of the safeguards in place for any of them at info@rslaw.gr.
Security
Visiting the website and submitting the form both take place over an encrypted connection (HTTPS). Your message is not stored on the website: it exists only as an email in the office mailbox, to which only our lawyers have access.
Professional confidentiality
Beyond data protection law, everything you entrust to us is covered by the duty of professional secrecy that the Greek Lawyers’ Code (Law 4194/2013) places on us. That duty is a matter of Greek law. It is not the English doctrine of legal professional privilege, and its scope, its holder and its exceptions are settled by Greek law and by the rules of the Athens Bar Association rather than by English authority.
Your rights
Under the EU General Data Protection Regulation and Greek data protection law you have the right of access, rectification, erasure, restriction of processing, objection and portability, and you may withdraw your consent at any time. To exercise any of these, write to info@rslaw.gr; we answer within one month at the latest. Where the law or our professional obligations as lawyers require us to keep a record, a request for erasure is met only so far as it does not conflict with those obligations.
Complaints and access to the courts
If you believe the processing of your data breaches the law, you may complain to the Hellenic Data Protection Authority, the supervisory authority in Greece (1 and 3 Kifisias Avenue, 115 23 Athens, dpa.gr). Complaining does not close the courts to you: you also have the right to an effective judicial remedy before the competent Greek courts, both against a decision of the Authority and against the controller or the processor (Articles 78 and 79 GDPR).