PRIVACY POLICY

Zoulovits – Kontogeorgou Law Firm (“ZK Law Firm” or “We” or “Our Law Firm”) is a boutique law firm with unique expertise. Our Law Firm offers legal services and advice on the fields of Corporate Law and Digital Transformation Law in the European Union. Please, feel free to browse our website to learn more about Us and our work.

With regards to the processing of your personal data, ZK Law Firm shall be considered the Controller, the entity responsible for the processing of your data when:

1. you visit the Website and
2. we provide our services to you, as a client.

* There might be exceptional cases where we act as Processors with regards to the processing of your personal data; in such an occasion, we shall be bound by data processing agreements (DPAs) with the respective Controller, on behalf of whom we process said data.

In a nutshell, this privacy notice concerns:

1. all Users of our website, meaning the people who browse our website and interact with us (the “Users”)
2. our prospect, existing and former Clients; either in the process of evaluating a possible co-operation for the provision of our legal services to you or in case you are already a Client receiving our legal services within the context of your mandate or when we have already provided our legal services to you in the past former Client (the “Clients”).
3. third parties, whose data we may collect and process within the course of our legal services within the context of a client mandate. Indicatively third parties could be our clients’ personnel, their counterparties, their opposing parties, their clients, witnesses, their suppliers etc where necessary for the execution of our services within the framework of our mandate for the provision of our services (“ThirdParties”).

This Privacy Policy serves the purpose of a data protection notice, with the aim of informing you about our privacy practices. This Policy will let you know how we process personal information about data subjects in the course of the provision of our services and/or during their visit to our website; it applies to persons whose data we obtain either directly by them, by a third party or by legitimate publicly available sources. Therefore, this Privacy Policy serves the purposes of a direct/personal information notice under article 13 of the GDPR and/or of a public notice according to article 32 par. 2 of Greek law 4624/2019 and Art 14 par. 5 of GDPR.

An introduction:

• Personal Data is any information that relates to a natural person whose identity is known through reference to name or can be identified through reference to telephone number, address etc.
• Anonymized data and every information that is not structured in a filing system is not considered as Personal Data (e.g. the oral information you share when you have an appointment in our office).
• We process your Personal Data when we carry out any operation or set of operations on Personal Data or on sets of Personal Data, whether by automated means or not, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• In principle, we do not collect any sensitive data (like health data, political views, sex, gender etc). There may be cases, however, that it is absolutely necessary for us to collect such data, when it is needed for a legal claim (according to article 9 (f) GDPR) or if you give us your free consent. Financial data are not considered sensitive data in the context of GDPR; they are, however, crucial, so we take additional safety measures for their protected processing.

What you need to know:

• Our Law Firm works with multiple clients. Most of them are legal persons, whose data, in principle, are not considered personal according to GDPR, except for their e-mail address (e.g company@…….gr ) according to Law 3471/2006. However, if you are a partner of an “Single Member Limited Liability Company” or a “General Partnership” and your name appears in the company’s name, the data related to these companies can be referred as Personal Data. In addition, if your name appears on your professional email address (g.ioannis.papadopoulos@company.gr) it is considered to be Personal Data. Also, if you are the member of a BoD or other body of the management of a legal person and/or a shareholder of a legal person, we might collect and process your data as our Client, under the mandate of the legal person you represent/manage. In case that you fall in any of the above categories or you are a natural person and a client of ours, we may collect data that may refer to you.

Due to the wide range of cases handled, ZK Law Firm collects different types of Personal Data from multiple sources in order to duly provide its legal services (depending on our mandate with our Clients and the nature of the case).

In a nutshell, we indicatively collect data from the following sources:

• Directly from you when you submit the data to us:

For your identification • to send you an offer regarding your case/request • for the provision of our services to you • for billing, tax or other related purposes • by providing us with your business card and contact information in conferences or seminars we and/or our associates/employees, are (co-)organizing and/or attending

• From third parties (clients, witnesses, other legal professionals, counter parties, public authorities, legitimate public sources) when:

• we must conduct a background check on behalf of our client in order to avoid any possible conflict of interest
• we receive Personal Data from our Clients in order to handle their case, to which you may be a legal representative, member of the BoD, an opponent or interested third party, counterparty, in which cases we process your data for providing our services to them, under their legal order mandate to carry out their case.
• we receive your information and Personal Data because you are an employee, vendor, supplier, client and/or a consumer/buyer of our Client’s service(s) or product(s), associate or party to a contract with our Client, and the information is relevant to the case in progress.
• we receive data from other law firms regarding a case we may co-operate on or dispute on, to which you may be an opponent/adversary, defendant/plaintiff of claimant, interested third party, legal representative of a legal entity, witness, expert etc
• we access lawful publicly available sources, such as Court decisions, relevant lawsuits and other legal document or deed, land registry files, credit reference agencies etc. A publicly available source can be any source that aims to extract information from anyone. (eg from a legal record maintained by judicial or other authorities or public services, Chambers, directory sources, Courts, the Land Registry, the Municipality services, the Urban Planning Services, search engines, websites, Linkedin etc.). We collect data for legal purposes compatible to those of their disclosure, that have been published in legal public-available sources.
• third parties provide us with your information for billing, mailing, tax or other related purposes
• you interact with us on social media at your request

Important Notice: If you are a person providing data to us regarding any third party you warrant that:

1. that those data have been lawfully collected by you and that you are allowed to transfer or allow access to them to our Law Firm for the provision of our services within the context of the case we have been appointed to handle by our Client
2. that you transfer or allow access to us only to those personal data that are absolutely necessary for the fulfillment of the purpose of the assignment of the case under a Client mandate
3. that you will implement all appropriate measures (such as anonymization) to delete / erase personal data of third parties from documents that are note absolutely necessary as above, prior to the transfer or access to it by our Law Firm
4. that information transferred or provided access to are correct, true and up-to-date data and information
5. that you use of secure means and safeguards to transfer or allow access to the data
6. that you have provided appropriate privacy notice to any third party you provide us with his/her data, including but not limited to your employees that their data are transferred to ZK Law Firm in order to communicate with them in the context of our legal services and/or in the context of our marketing activities as laid down in the present policy.

Our Law Firm has the obligation as a Controller to keep your data accurate and up to date, so we urge you to contact us using our contact means referred above in case that your data have changed or you have provided us with wrong data by mistake.

In the table below, you can find information about the different types of personal data and relevant information we process.

* Regarding data collection from third parties: Within the course of the provision of our services under our mandate with our Client, and subject to the nature of the legal services and the case appointed to us, it might be necessary to process certain third-party data that are relevant to the legal services and to the case we are handling. In this context, it might be necessary to collect and process several types of personal data that are necessary for us to appropriately execute our legal services under the ethics and the rules of the applicable laws and the Lawyer’s Code of Conduct that apply to our profession. As a result, we might process the following third -party data, subject to the nature of our legal services and the case we are handling.

KYC information: In cases you are a client or a former client, we have an obligation by law to collect information and personal data about you when we have a legal mandate with you.

Financial Data: When we have a mandate (i.e. when you are a client of ours), some financial data are necessary for us in order to process payments and manage the invoicing of our services. If you are a former client of ours, we may keep some financial information about you in case it is necessary for the establishment, exercise or defense of legal claims and for the payment and invoicing of our services.

We process your Personal Data when you use our website and when you provide for the legal reasons mentioned below:

**General Notes on the above

• Withdrawing your consent shall be valid for the future (i.e. data processing that took part during and for the time that your consent was given, shall not be considered illegal).
• We take all necessary steps and safeguards, where our legitimate interest is the legal bases for the processing, to override your privacy without affecting your fundamental rights and freedoms. In any case you can object to that processing subject to the provisions laid down in article 10 below.

In the framework of the proper management of our Law Firm we collaborate with certain suppliers. Depending on their role in the processing of personal data (Joint Controllers or Processors) we have signed Data Processing Engagements or Agreements and taken all the appropriate safety measures during the transfer of your data to ensure the protection of your Personal Data. Some examples of ZK Law Firm’s suppliers (and recipients of certain categories of your personal data) include:

• External accountants
• IT specialists and technical support
• Translators
• Bailiffs
• Courier companies
• Cloud service providers (your data may be transferred to them when we save a document that may include your Personal Data)
• Platform for announcing Job openings and collecting CVs from candidates
• Other law firms and/or lawyers we co-operate with in order to provide our services, subject to our mandate
• Public Authorities and Administrative Bodies: Tax Offices, Judicial authorities, the Police and prosecutorial authorities in case of criminal acts or legal claims

We make sure that all data processing takes place within the European Union and we take all the appropriate technical and organizational measures to comply with the principles of GDPR regarding safe data transfer to third countries. However, ZK Law Firm may need to transfer your data to the UK by using service providers to support its professional activity (for example, we use digital platforms that are situated in the UK). For now, the processing of your Personal Data is taking place within the European Economic Area and is subject to GDPR. However, please note that after 1.1.2021, the UK is considered a third country to the European Union. In that case, we will make sure to take all necessary measures to ensure your data will be transferred outside of Greece safely and according to the principles of GDPR. Additionally, we use service providers situated in the USA (e.g. cloud service providers) after having taken all special measures for international transfers to countries outside the EU that do not offer an adequate level of data protection. In some cases, in order to transfer your data to the USA or other non-EU/EEA country, we might need to rely on your consent, after you have carefully considered the potential risks to your privacy. In any case of transfer outside the EU/EEA, we will apply all appropriate and necessary safeguards, including Standard Contractual Clauses, to make sure that we have taken adequate measures to protect all data transferred.

We retain your Personal Data for as long as it is absolutely necessary, in order to carry out the respective processing purpose, as described in this Policy to carry out our mandate with our clients, to comply with tax and legal obligations or for archiving purposes, taking into account any applicable law (European or National) regarding the protection of Personal Data. To determine the retention time of Personal Data, our Law Firm takes into account the nature of Personal Data, the quantity, the purpose of their processing, their security, etc., always respecting the data minimization principle.

Indicatively, ZK Law Firm may keep your data for α maximum period of 20 years, to cover the possibility of exercising or countervailing any legal claim. After this period, we only retain the data needed that are relevant to pending legal claims or may affect pending lawsuits or proceedings relevant to claims or other rights.

You have the right to request that we delete any data that we have collected for you, provided that the legal rights of our Law Firm are not affected and/or provided that there is no legal obligation or us to retain your information. In any event, for as long as we retain your data, such information is securely stored, in accordance with the security measures set forth in Section 11 below. If personal information is only useful for a short period of time, we may delete it.

Our Law Firm fully respects your privacy rights. If you wish to communicate with us regarding issues relating to our handling of your personal data, please send us an e-mail at info@zklawfirm.gr so that we are able to manage your request as soon as possible and respond to your issues about your privacy. Please note that your application should clearly and as accurately as possible refer to the issue raised and must be exercised under the following conditions:

Please follow the procedure mentioned below to exercise your rights:

ZK Law Firm implements the appropriate technical and organizational measures and strict security procedures, for the protection of your Personal Data and information to prevent their unauthorized disclosure, use, conversion or destruction.

Personal Data we collect are processed exclusively by specifically authorized personnel under our control and instructions. We appoint to specialists with the respective professional skills to provide appropriate safeguards in terms of technical knowledge and personal integrity to ensure privacy and protection of Personal Data. We abide by the Legal Professional Privilege of lawyers in addition to our respective contractual commitments and implement all necessary security measures to protect and ensure privacy and confidentiality, as well as integrity of Personal Data.

In the context of remote work we have instructed our associates about appropriate procedures taking into account, in each case, the nature and severity of risks to the protection of personal data arising from remote work.

The technical and organizational measures we have taken enable restoration of access and availability of Personal Data in a timely manner in the event of physical or technical incident. In any case, the security of your Personal Data in the digital environment is subject to reasons that go beyond the sphere of influence of our company and the extraordinary circumstances, as well as the reasons due to technical or other weakness of the network or conditions created beyond the security measures taken or not controlled by our company or reasons of force majeure or accidents.

This Privacy Policy enters into force on the date of its issuance. In case it is necessary to comply with new requirements imposed by applicable laws, guidelines or technical requirements or in the course of a revision in our Law Firm’s processes and practices, we reserve the right to amend this Privacy Policy. Any amendments due to changes in the regulatory framework, will be subject to this.