Menu Close
Close
Linkedin
Your MDR/IVDR Navigator
Your MDR/IVDR Navigator

Last updated: April 2026

  1. Introduction

Michalopoulou & Associates Lawgroup (“Lawgroup”, “the Firm”, “we”) takes data protection and information security seriously. The Firm collects and processes personal data concerning clients, prospective clients, suppliers, business contacts, employees, candidates and other individuals with whom the Firm interacts in the course of its activities.

This Privacy Policy explains the Firm’s approach to the personal data it collects, the purposes of processing, the legal bases relied upon, the rights of data subjects and the safeguards in place. It applies to processing carried out under Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR) and Greek Law 4624/2019 implementing the GDPR in Greece, as well as Greek Law 3471/2006 on the protection of personal data and privacy in the electronic communications sector.

The Policy applies in parallel to lawyer client privilege and confidentiality obligations under the Greek Code of Lawyers (Law 4194/2013) and the Code of Conduct for Lawyers. The obligations of confidentiality deriving from the security principle under Article 32 GDPR are subject to and complement the privileges and confidentiality duties owed by lawyers.

  1. Scope

This Policy applies to:

  1. the offices of Lawgroup;
  2. all partners, lawyers, trainees, paralegals and staff of Lawgroup;
  3. all contractors, freelancers, suppliers and any other individuals acting on behalf of Lawgroup.

The Policy ensures that Lawgroup complies with applicable data protection law and follows good practices, protects the rights of clients, staff, partners and associates, and protects itself from the risks associated with personal data processing.

  1. Data Controller

The data controller is Michalopoulou & Associates Lawgroup, with registered office at 40 Ag. Konstantinou Street, “Aithrio” Business Centre (A 16 to 18), 15124 Marousi, Athens, Greece. Telephone: +30 210 33 05 230. Email: privacy@lawgroup.gr.

Where the Firm processes personal data exclusively on documented instructions of a client (for example as part of the rendering of legal services on the client’s data), the Firm may act as a data processor within the meaning of Article 4(8) GDPR.

  1. Categories of Personal Data Processed

We may process the following categories of personal data:

  1. identification data (full name, date of birth, ID or passport details where strictly necessary);
  2. contact data (postal address, email address, telephone number);
  3. professional data (job title, employer, professional registration number);
  4. financial data (banking information, tax registration number, billing details);
  5. data relating to the matters entrusted to us, which may include data on opposing parties, witnesses, employees of clients and other third parties;
  6. special categories of personal data within the meaning of Article 9 GDPR (including health data, judicial data, data relating to political opinions, religious beliefs, sexual orientation or trade union membership), where strictly necessary for the legitimate purposes set out in Section 5.
  1. Purposes and Legal Bases

The Firm processes personal data on the following legal bases under Article 6 GDPR:

  1. consent of the data subject under Article 6(1)(a) GDPR (for example for newsletter subscription, CV submission, marketing communications);
  2. performance of a contract under Article 6(1)(b) GDPR;
  3. compliance with legal and regulatory obligations under Article 6(1)(c) GDPR (including book keeping, tax obligations, anti money laundering obligations under Law 4557/2018 and obligations under the Code of Lawyers);
  4. legitimate interests of the Firm or third parties under Article 6(1)(f) GDPR (including the establishment, exercise or defence of legal claims, prevention of fraud, security of premises and information systems, business continuity, internal administration);
  5. protection of vital interests of the data subject or another natural person under Article 6(1)(d) GDPR.

Special categories of personal data are processed only to the extent strictly necessary on one of the legal bases under Article 9(2) GDPR, in particular Article 9(2)(a) (explicit consent), Article 9(2)(b) (employment and social security law), Article 9(2)(f) (establishment, exercise or defence of legal claims) and Article 9(2)(g) (substantial public interest), in conjunction with the conditions of Articles 22 and 24 of Law 4624/2019.

  1. Cookies

Information about visits to our website may be obtained through the use of cookies. The placement and reading of cookies is governed by Article 4(5) of Law 3471/2006 and by the Hellenic Data Protection Authority Decisions 1/2020 and 2/2020. Please see our Cookie Policy at https://lawgroup.gr/cookie-policy for full information on the cookies we use, their purpose, retention and how to manage them.

  1. Confidentiality and Security

The Firm maintains appropriate technical and organizational measures under Article 32 GDPR to protect personal data against unauthorized access, misuse, disclosure, unauthorized alteration, unlawful destruction or accidental loss. These measures include access controls, encryption in transit and at rest where appropriate, pseudonymization, access logging, regular backups, business continuity planning and ongoing staff training on data protection.

Information systems are not absolutely secure. The Firm cannot guarantee the absolute security of personal data and accepts no responsibility for the security of data in transit over networks not under its control.

All processors and recipients to whom personal data are disclosed are bound by obligations under this Policy and applicable data protection law.

  1. Data Recipients

The Firm may disclose personal data to:

  1. employees, partners and associates of the Firm on a need-to-know basis;
  2. processors acting on behalf of the Firm under a Data Processing Agreement compliant with Article 28 GDPR (including IT service providers, hosting providers, cloud service providers, accounting firms);
  3. competent courts, public authorities, supervisory authorities and law enforcement bodies, where required by applicable law;
  4. opposing counsel, courts, mediators, arbitrators and other parties to the extent strictly necessary for the conduct of the matter;
  5. third parties to whom the data subject has consented or instructed disclosure.
  1. International Data Transfers

Where personal data are transferred outside the European Economic Area, the Firm relies on appropriate safeguards under Chapter V GDPR, in particular adequacy decisions of the European Commission under Article 45 GDPR, Standard Contractual Clauses approved by the Commission under Article 46(2)(c) GDPR, or any other lawful transfer mechanism. The Firm conducts Transfer Impact Assessments where required and applies supplementary measures under EDPB Recommendations 01/2020 where applicable.

  1. Retention Periods

Personal data are retained for the period strictly necessary for the purposes for which they were collected, taking into account the legal basis, applicable statutes of limitation, accounting and tax obligations and professional indemnity insurance requirements. Indicatively:

  1. for prospective clients and website visitors: up to three years from the last interaction;
  2. for clients: up to twenty years from the conclusion of the matter, in line with the prescription periods under Greek civil law and the obligations under the Code of Lawyers;
  3. for newsletter subscribers: until withdrawal of consent;
  4. for accounting and tax purposes: as required by applicable Greek tax law (currently up to ten years).

After expiration of the retention period the data are securely deleted or anonymised.

  1. Data Subject Rights

Under Articles 15 to 22 GDPR data subjects have the following rights:

  1. right of access (Article 15);
  2. right to rectification (Article 16);
  3. right to erasure or right to be forgotten (Article 17);
  4. right to restriction of processing (Article 18);
  5. right to data portability (Article 20);
  6. right to object (Article 21);
  7. right not to be subject to automated decision making, including profiling (Article 22);
  8. right to withdraw consent at any time, without affecting the lawfulness of prior processing (Article 7(3));
  9. right to lodge a complaint with the Hellenic Data Protection Authority (Kifisias 1 to 3, 11523, Athens, Greece, telephone +30 210 6475600, www.dpa.gr) or with the supervisory authority of the data subject’s habitual residence under Article 77 GDPR.

These rights may be subject to limitations under Articles 28 to 35 of Law 4624/2019 and under the obligations of professional secrecy of lawyers.

  1. Exercising Data Subject Rights

Requests for the exercise of data subject rights should be addressed to privacy@lawgroup.gr. The Firm will respond within one month of receipt of the request. This period may be extended by a further two months where necessary, considering the complexity and the number of requests, in which case the data subject will be informed within one month of the receipt of the request, with the reasons for the delay.

The Firm will verify the identity of any person making a request before disclosing personal data.

  1. Personal Data Breach Notification

In the event of a personal data breach the Firm will notify the Hellenic Data Protection Authority without undue delay and where feasible within 72 hours of becoming aware of the breach, in accordance with Article 33 GDPR, unless the breach is unlikely to result in a risk to individuals’ rights and freedoms. If the breach is expected to pose a significant risk to individuals’ rights and freedoms, the Firm will promptly inform the affected data subjects in accordance with Article 34 of the GDPR.

  1. Disclosure to Public Authorities

In limited circumstances permitted under the GDPR and Greek law, personal data may be disclosed to public authorities, including law enforcement agencies, without the consent of the data subject. The Firm will verify the legal basis and the legitimacy of any such request before disclosure and will challenge unlawful or disproportionate requests.

  1. Participation in Seminars

Lawgroup periodically invites clients and other interested parties to seminars and events. The Firm processes the name, job title, company and email address of registrants on the basis of legitimate interest under Article 6(1)(f) GDPR for the purposes of organising the event, communicating with participants and inviting registrants to future events. Data subjects may object to such processing at any time. Where attendance lists are shared with other participants, this is done on the basis of consent under Article 6(1)(a) GDPR.

  1. Changes to this Policy

The Firm may update this Privacy Policy from time to time to reflect changes in processing or in the applicable legal framework. The current version is published on our website with the date of last update. Material changes will be notified by email to data subjects with active relationships with the Firm.

  1. Contact

For any question or request relating to the processing of personal data by the Firm, please contact us at:
Michalopoulou & Associates Lawgroup
40 Ag. Konstantinou Street, “Aithrio” Business Centre (A 16 to 18)
15124 Marousi, Athens, Greece
Tel: +30 210 33 05 230
Email: privacy@lawgroup.gr