LEGAL INFORMATION
Privacy policy
English draft for review · 20 October 2026
1. Who is responsible for your personal data?
Christina Dimopoulou, a lawyer practising in Greece under the name CDIP Law Firm (the “Law Office”, “we” or “us”), is the controller of the personal data processed for the purposes described in this policy. Contact: cdim.lawfirm@yahoo.gr. Our professional particulars are set out in the legal notice.
This policy explains how we handle information about website visitors, prospective clients, clients and individuals involved in matters on which we advise. An engagement may be accompanied by more specific privacy information.
2. What information do we process?
Enquiries: your name, email address, company and role, any telephone number you choose to provide, the subject of your request and related correspondence. Please initially provide only the information needed to describe your enquiry.
Client matters and billing: where relevant, identification and contact details, engagement and billing information, instructions and correspondence needed to advise or represent you. The private accounting system stores client particulars, quotes, invoice drafts and payment records. It currently has no case-document upload facility; this does not mean that received emails or accounting records are not kept. If case documents are later handled through other channels, this policy and the relevant engagement information will need review.
Technical information: the hosting and communication services may process IP addresses, device and browser information, access times and security logs as required to deliver and protect their services. Provider-specific arrangements remain to be confirmed.
Information is usually provided by you. In client matters it may also come from clients, representatives, counterparties, professional advisers, authorities, public registers or publicly available sources. Where required, we provide further information about indirect collection, taking account of applicable professional secrecy obligations.
3. Why do we process data, and on what legal basis?
| Purpose | Legal basis under the GDPR |
|---|---|
| Respond to a request for legal services and discuss a possible engagement with you as an individual. | Steps at your request before entering into a contract — Article 6(1)(b). |
| Handle general enquiries and communicate with representatives of a prospective or existing corporate client. | Legitimate interests in responding to correspondence and establishing and administering professional relationships — Article 6(1)(f), subject to the required balancing assessment. |
| Provide agreed legal services to you as an individual client and administer your engagement. | Performance of the engagement contract — Article 6(1)(b). |
| Provide services to an organisation and process information about its representatives or other individuals involved in a matter. | Legitimate interests in providing legal advice, representing clients and managing matters — Article 6(1)(f), or a specific applicable legal obligation under Article 6(1)(c). The client’s contract is not, by itself, a contractual basis for processing every third party’s data. |
| Meet applicable tax, accounting, professional and other statutory duties, including identity checks where legally required. | Compliance with the relevant legal obligations — Article 6(1)(c). |
| Conduct conflict checks, protect communications and systems, and establish, exercise or defend legal claims. | Applicable legal obligations — Article 6(1)(c) — and/or legitimate interests in professional independence, security and protecting legal rights — Article 6(1)(f), as appropriate to the activity. |
| Enable optional tracking or send communications requiring consent, if introduced. | Consent — Article 6(1)(a) — where required. Such activities are not enabled in this draft and require separate information and an appropriate consent mechanism before activation. |
We do not treat visiting the website, reading this policy or sending an enquiry as consent to unrelated processing or marketing.
4. Sensitive information and criminal-offence data
We ask you not to include sensitive personal information or extensive case documents in an initial website enquiry. Where a matter requires special-category data, we identify both an Article 6 basis and an applicable Article 9 condition, which may include necessity for legal claims under Article 9(2)(f). Criminal-conviction and offence data are processed only where permitted under Article 10 and applicable law. A legal-services contract alone does not satisfy these additional requirements.
5. Is providing information compulsory?
You choose whether to contact us. We need sufficient contact information and a description of your request to respond. Information necessary for an engagement or a legal obligation will be identified when requested; without it, we may be unable to accept instructions, provide the requested service or meet the relevant requirement.
6. Who may receive your information?
Access is limited to those who need the information for the relevant purpose. Depending on the matter, recipients may include authorised personnel, IT and email providers, accountants, instructed lawyers or specialists, insurers, courts, competent authorities and parties to proceedings or transactions where disclosure is necessary and lawful.
We take account of professional secrecy, confidentiality and data-protection requirements when disclosing information. Providers processing data on our behalf must be subject to appropriate contractual arrangements. Some professional advisers and authorities act as independent controllers.
Website configuration to confirm: the site uses OVHcloud web hosting. The contact form sends your enquiry to the private owner inbox on the accounting subdomain; the owner can review, archive or delete it. The contracted hosting entity, provider roles, log retention and any international transfers remain to be confirmed.
7. International transfers
The OVHcloud web-hosting cluster used for this website and private accounting system is in Beauharnois, Canada, outside the European Economic Area. The European Commission recognises Canada as providing adequate protection for transfers to commercial organisations covered by its decision. The practice must confirm the applicable OVHcloud contract, any onward access or transfers, and the Yahoo email service’s transfer arrangements before this draft is finalised. Other transfers, if any, require an applicable adequacy decision or appropriate safeguards such as standard contractual clauses and any necessary additional measures. You may request information about applicable safeguards or a copy, subject to lawful redactions, using the contact details above.
8. How long is information retained?
Enquiries not leading to an engagement: no fixed deletion period has yet been adopted. Correspondence is kept while the request and reasonably anticipated follow-up are being handled, then should be deleted or minimised unless a documented legal or professional reason justifies further retention. A limited conflict-check record may be kept where justified. The practice must establish and apply a review schedule.
Client and accounting records: no single fixed period currently applies. Retention depends on the duration and nature of the engagement, professional record-keeping duties, relevant limitation periods and actual or reasonably anticipated claims. Billing and tax records are kept for applicable statutory periods. Where a legal hold applies, relevant records may be kept until it is lifted. The practice must document and apply a retention schedule for these categories.
Technical logs: retention must be limited to what is necessary for operation and security and aligned with the selected provider’s verified settings. The provider’s actual log-retention period remains to be confirmed.
9. Security and confidentiality
Appropriate technical and organisational measures must be maintained to protect personal data, including proportionate access restrictions and secure handling of matter files. No online transmission method is entirely secure. Please contact us before sending particularly sensitive documents so that an appropriate channel can be agreed.
10. Cookies, Ask CDIP and the enquiry form
This website’s own code installs no analytics or advertising trackers. Ask CDIP gives curated general answers in the browser by default; its questions are not saved in the accounting database. Live online search remains unavailable until the practice configures an external AI provider. If you actively select online search, your question and up to four recent exchanges are sent through the accounting server to that provider, which searches selected official websites and returns an answer with source links. Do not include names, confidential facts, documents or sensitive data. Provider identity, terms, location, retention and any transfers must be reviewed before this mode is enabled. When you ask to contact the practice, a draft is stored in this browser tab’s session storage to fill the contact form; it is removed when the form loads and ignored after 30 minutes. When you press Send, the form transmits your name, email, company, topic and message to the private owner inbox on the accounting subdomain. Browser autofill operates according to your browser settings.
The cookie banner stores your choice in local storage for up to 180 days so it need not ask on every page. If you allow the optional language preference, it also remembers the language you select and uses it when you next visit the home page. “Restricted” lets you choose this preference; “Don’t accept” leaves it off. You can change or withdraw your choice at any time using Cookie settings in the footer. The separate, private accounting subdomain uses an essential session cookie for owner sign-in. Hosting and access-control services may use necessary technologies. No optional analytics or advertising technology is currently active.
11. Your rights
Subject to the conditions and exceptions in the GDPR, you may request access, rectification, erasure or restriction of processing. Portability applies where processing is automated and based on consent or a contract. You may object on grounds relating to your particular situation where we rely on legitimate interests; you may object to direct marketing at any time.
Where processing relies on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. Rights must be considered alongside applicable professional secrecy, legal obligations and the rights of others.
To exercise your rights, write to cdim.lawfirm@yahoo.gr. We may request proportionate information to verify your identity where necessary. Requests are normally answered within one month. Where permitted, this may be extended by up to two further months, with notice and reasons provided within the first month. Requests are normally free of charge.
You may lodge a complaint with the Hellenic Data Protection Authority or another competent supervisory authority, including in the EU Member State of your habitual residence, place of work or the alleged infringement. You do not have to contact us first.
12. Automated decisions and changes to this policy
The website does not make decisions producing legal or similarly significant effects through solely automated processing. Any future materially different use of data will require the appropriate assessment and privacy information.
We may update this policy to reflect changes in the practice or its processing activities. The current version and its date will appear here, and material changes will be communicated as required. An update does not itself provide consent for a new purpose.