Privacy Notice

1. Introduction

Lamnidis Law Firm (the “Firm”, “we”, “us”, or “our”) is committed to protecting the privacy and personal data of individuals in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, “GDPR”) and applicable Greek data protection legislation.

This Privacy Notice explains how we collect, use, store, and protect personal data in the context of our professional legal services and related activities.

2. Controller Information

The Firm acts as a data controller in respect of personal data processed in the context of professional activities.

For any questions regarding this Privacy Notice or the processing of personal data, individuals may contact us at: office@lamnidislaw.eu.

The competent supervisory authority is the Hellenic Data Protection Authority (HDPA). The Firm has not appointed a Data Protection Officer, as it does not fall within any of the categories set out in Article 37(1) GDPR: it is not a public authority or body; its core activities do not consist of large-scale, regular and systematic monitoring of individuals; and its core activities do not consist of large-scale processing of special category data within the meaning of Article 9 GDPR.

3. Categories of Personal Data We Process

In the context of providing legal services, we may process personal data relating to clients, representatives of corporate clients, opposing parties, witnesses, and other individuals involved in legal matters.

The personal data processed may include identification details (such as identity cards or passports where provided), contact information, professional or financial information relevant to the matter at hand, and documentation forming part of case files or professional correspondence. In the course of handling certain legal matters, documentation submitted by or on behalf of clients may incidentally contain special category data within the meaning of Article 9 GDPR. Such data is processed exclusively to the extent necessary for the establishment, exercise, or defence of legal claims, in accordance with Article 9(2)(f) GDPR, and is not sought or retained beyond the requirements of the relevant matter.

We also process personal data relating to employees and trainees for the purposes of managing employment relationships and complying with applicable labour, tax, and social security obligations.

4. Purposes and Legal Bases for Processing

We process personal data for the purpose of providing legal advice, representation, litigation support, contract drafting, negotiation, and related professional services.

Such processing is based on Article 6(1)(b) GDPR where necessary for the performance of a contract with a client, Article 6(1)(c) GDPR where processing is necessary to comply with legal obligations, and Article 6(1)(f) GDPR where processing is necessary for the Firm’s legitimate interests, including the establishment, exercise, or defence of legal claims and the conduct of professional communications. Where processing is based on Article 6(1)(f) GDPR, a Legitimate Interests Assessment has been conducted and is available for inspection upon request. The Firm has determined that its legitimate interests are not overridden by the interests or fundamental rights and freedoms of the data subjects concerned, having regard to the nature of the data processed, the reasonable expectations of individuals in the context of a professional legal relationship, and the safeguards applied to such processing.

5. Recipients of Personal Data

Personal data is accessible only to authorised members of the Firm.

Where necessary for the handling of a specific legal matter, personal data may be shared with collaborating external lawyers acting as independent controllers, as well as with courts, public authorities, or opposing counsel, strictly within the scope required for the conduct of the relevant legal matter.

We do not sell personal data or disclose it to third parties for marketing purposes.

6. International Transfers

The Firm does not engage in systematic transfers of personal data outside the European Union or the European Economic Area.

Email and document storage services are provided through Microsoft 365 infrastructure hosted within the European Union.

7. Data Retention

Client files and related personal data are retained for a period of twenty (20) years from the closure of the relevant matter, corresponding to the general limitation period under Greek civil law (Article 249 of the Greek Civil Code). Where a shorter limitation period applies to the specific type of matter, the Firm shall assess on a case-by-case basis whether continued retention is justified. Upon expiry of the applicable period, personal data are reviewed and, where no justification for continued retention exists, deleted or securely destroyed.

Employment-related personal data are retained in accordance with applicable labour and tax legislation. Retention periods for such data are determined by reference to applicable statutory requirements, which generally require retention for a minimum of five (5) years from the end of the relevant tax year or the termination of the employment relationship, subject to any longer period required by specific legislation.

8. Data Security

The Firm implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or disclosure. These measures include secure cloud-based storage within the European Union, individual user credentials, role-based access restrictions, and internal procedures for incident management.

9. Data Subject Rights

Individuals whose personal data are processed by the Firm have the right, subject to applicable legal limitations, to request access to their personal data, rectification of inaccurate data, erasure of data where appropriate, restriction of processing, and objection to processing based on legitimate interests.

Where processing is based on consent, individuals have the right to withdraw their consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal.

Requests relating to data protection rights may be submitted to the contact email provided above.

Individuals also have the right to lodge a complaint with the Hellenic Data Protection Authority.

10. Updates to this Notice

This Privacy Notice may be updated from time to time to reflect changes in legal requirements or the Firm’s processing practices. The most recent version will be made available upon request. This Notice is provided to clients at the outset of the professional relationship, as part of or together with the Firm’s engagement documentation. Where the Firm processes personal data relating to individuals who are not clients (such as opposing parties or witnesses), this Notice is provided at or around the time of first contact, to the extent required under Article 14 GDPR.