Privacy Notice

Updated: April 2024

This Privacy Notice describes how Ballas Pelecanos & Associates L.P.C. (“Ballas Pelecanos Law”) (10 Solonos Street, Kolonaki, 106 73 Athens, Greece, +30 210 36 25 943), a limited liability professional partnership (hereinafter “Firm”, “we”, “us”, “our”) collects, uses, shares and otherwise processes Personal Data (defined below) in its capacity as data controller.

This Privacy Notice applies to (i) clients, prospective and former clients of the Firm or their contact persons, including transaction counterparties and litigants other than our clients, (ii) persons who access our website www.ballas-pelecanos.com (the "Website"), (iii) job candidates, (iv) suppliers or (v) any other individuals whose Personal Data are being processed by the Firm.

References in this Privacy Notice to “you” or “your” are references to individuals whose Personal Data we process. In this Privacy Notice, "Personal Data" means any information that (either in isolation or in combination with other information processed by the Firm) enables you to be identified or recognized, directly or indirectly, as an individual. We are committed to respecting and protecting your privacy.

1. The types of Personal Data we collect

The types of Personal Data that we collect depend on the context of your interaction with us. As applicable and depending on the specific purpose for which we need your Personal Data, we may collect the following categories of Personal Data:

Basic identification and contact data	Name, title, organization, phone number, email address and other contact details.
IT and device data	Information about your use of our Website, including data collected using cookies and other tracking technologies (e.g. IP address, browser type and version, time zone setting and location, operating system of your device, etc.).
Legal service-related data	Personal data necessary for the performance of our legal services, which may be contained in documents, correspondence and other materials processed for the needs of handling assigned files and cases for clients.
Financial data	Bank account and other billing and payment details.
Marketing and communications data	Marketing and communication preferences and information that you provide when subscribing to our newsletter (name, position, email address).
Job applicant data	Data provided by job applicants in connection with employment opportunities in the Firm.
CCTV data	CCTV footage and other information obtained through use of premises entry control CCTV system.

2. How Personal Data are collected

We collect Personal Data directly from you or automatically or from third parties, as follows:

2.1. Personal Data collected directly from you

We collect Personal Data directly from you in cases where:

1. You communicate with us, filling-in forms on our Website, by email or post, or speaking to us in person or over the telephone, e.g., in order to enquire about our services or in order to apply for a job opening;
2. You assign a project or a case to us;
3. You subscribe to our newsletter;
4. You provide supplier services to us.

2.2. Personal Data collected automatically

We automatically collect certain IT and device data when you use or interact with our Website. In addition, we collect CCTV data when you visit our premises.

2.3. Personal Data collected from third parties

We collect Personal Data from third parties (e.g., clients, counter parties, public authorities, public registers and other publicly availably sources) when:

1. We access publicly available sources, such as judicial or other authorities or public services (chambers, directory sources, courts, the land registry, search engines, websites, etc.) data for legal purposes compatible to those of their disclosure;
2. We conduct a background check on behalf of our client in order to avoid any possible conflict of interest;
3. We receive Personal Data from our clients in order to handle their cases, to which you may be a legal representative, an opponent, a counterparty, etc., in which cases we process your Personal Data for the provision of our services to them;
4. We receive your Personal Data because you are an employee, vendor, supplier, client and/or a consumer/buyer of our client’s service(s) or product(s), associate or party to a contract with our client, and the information is relevant to the case in progress.

2.4. Personal Data regarding third parties collected from you

In case you provide us with Personal Data regarding any individual, you warrant the following:

1. that those Personal Data have been lawfully collected by you and that you are allowed to disclose them to the Firm for the provision of our services within the context of the project or the case that we have been appointed to handle; and
2. that you share with us only the Personal Data that are absolutely necessary for the provision of our services.

3. How we use your Personal Data

We process your Personal Data in accordance with applicable data protection legislation (including, but not limited to, the GDPR, Greek Law 4624/2019 and ePrivacy Law 3471/2006) where we have a legal basis for processing, only if and to the extent that at least one of the following applies:

1. processing is necessary for the performance of a contract which we are about to enter into or have entered into with you as a party or in order to take steps at your request prior to entering such contract (“Contract”);
2. processing is necessary for compliance with a legal obligation to which we are subject (“Legal obligation”);
3. processing is necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or fundamental rights and freedoms which require protection of personal data (“Legitimate interests”);
4. where you have provided your consent to processing of your Personal Data; this is, mainly, when you request that we make marketing communication with you, or when you subscribe to newsletters and legal alerts, also in order to use certain cookies and tracking technologies (“Consent”)

In the table below you can review the purposes for which we use your personal data and the legal bases that we rely upon to do so:

Purpose of processing	Types of Personal Data	Legal basis for processing
To contract with you and provide legal services to you; also, in order to administer our relationship with you as a client. This may also include processing of personal data of transaction counterparties and litigants other than our clients.	- Basic identification and contact data - Legal service-related data - Financial data	- Contract - Legal obligation - Overriding legitimate interests (conflict of interest checks, securing payment of fees and debts, notifications to you, e.g., regarding changes in this Privacy Notice)
To respond to your inquiries or communications.	- Basic identification and contact data - Legal service-related data - Any other data included in your inquiry	- Overriding legitimate interests (handling your inquiry and ensuring that we offer best client services)
To comply with our legal obligations, e.g., with the Firm's tax reporting obligations, “know your client” obligations, etc.; also, to respond to legal process or requests for information issued by government/ judicial/ police authorities.	- Basic identification and contact data - Legal service-related data - Financial data - CCTV data	- Legal obligation - Overriding legitimate interests of the government/ judicial/ police authorities
To recruit associates and other personnel.	- Basic identification and contact data - Job applicant data	- Contract - Overriding legitimate interests
To send newsletters, legal alerts, marketing communications and other information or materials that may interest you.	- Marketing and communications data	- Consent - Overriding legitimate interest in case you are an existing client or your customer data were gathered when you expressed interest in our services and you have not opted-out for such communications (“soft opt-in”)
To monitor how you use the Website. For more information, please visit our Cookie Policy.	- IT and device data	- Consent
To exercise, establish or defend our legal rights (including before Courts)	- Basic identification and contact data - IT and device data - Legal service-related data - Financial data - CCTV data	- Overriding legitimate interest
To contract with you as a new supplier and manage our relationship with you	- Basic identification and contact data - Financial data	- Contract - Legal obligation

Where we have a statutory duty to collect your Personal Data (for instance, for compliance with “know your customer” legislation) or under the terms of a contract that we have with you and you fail to provide the Personal Data when requested, we may not be able to perform the contract and offer you our legal services. Not providing your Personal Data may also result in other types of disadvantages for you, e.g., we may not be able to respond to your request or question or provide you with marketing communication that we believe you would find valuable. We do not use automated decision-making without human intervention, including profiling, in a way that produces legal effects concerning you or otherwise significantly affects you.

4. Sharing your Personal Data

We do not share your Personal Data with third parties, other than as follows:

1. Suppliers and service providers: We engage external service providers to provide certain services to the Firm, including IT and system administration services, for instance, website service providers (hosting and administration), IT support service providers, and translation service providers. When providing such services, said external service providers may process your Personal Data.
2. Sharing of Personal Data in the course of the legal services we provide: We may share your Personal Data, as and to the extent needed, with third parties engaged in the course of the services we provide to clients, including court bailiffs, notaries, opposing parties and their legal counsels, technical experts/ advisors, court experts and witnesses. We may also share your Personal Data with other law firms and affiliated lawyers to provide you with legal services.
3. Other recipients of Personal Data: We may share, in compliance with applicable data protection laws, Personal Data with law enforcement authorities, governmental authorities, competent independent regulatory/ supervising authorities, competent courts and other judicial authorities, our professional external advisers, counsels or consultants, including lawyers, auditors, accountants and insurers providing relevant services to us. We may also share your Personal Data with third party organizations and entities for the purposes of obtaining feedback or references in relation to legal services provided to you (for instance, legal directories like “The Legal 500”).

5. International transfers of Personal Data

We transfer Personal Data in accordance with applicable laws. To the extent that, in the context of and for the needs of the above-mentioned purposes, your Personal Data need to be transferred outside the EU/EEA, such data transfer will take place in accordance with applicable law and we will ensure an adequate level of data protection. By way of entering into appropriate data transfer agreements based on Standard Contractual Clauses, which are accessible upon request at [email protected], or taking other measures to provide an adequate level of data protection, we have established or confirmed that all data recipients will provide an adequate level of protection for your Personal Data. Any onward transfer will be subject to appropriate onward transfer requirements, as required by applicable law.

6. Data retention

Your Personal Data will be retained for as long as necessary to fulfil the purposes that we collected them for, e.g., for as long as necessary to provide you with the legal services requested or until you unsubscribe from receiving our newsletters. Once the data processing purpose is completed, we will either delete your personal data or anonymize your personal data, unless statutory retention requirements apply (e.g., in order to comply with regulatory and accounting requirements, or for the establishment or defence of legal claims).
If you would like to know more about the retention periods that we apply to your Personal Data, please contact us at [email protected].

7. Security of your Personal Data

Considering the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk of processing.

8. Your Rights

Under the conditions provided in the relevant legislation, you have the following rights regarding the protection of your Personal Data:

1. Right of access: You may contact us in order to provide to you information on whether or not we process your Personal Data, the categories of such data, as well as about how we process them. You can also request a copy of your Personal Data which we process.
2. Right to rectification: If you believe that your Personal Data are inaccurate or are missing, you have the right to request the rectification or the completion thereof.
3. Right to erasure: Under appropriate circumstances, such as, when the Personal Data are no longer necessary or if you have withdrawn your consent, you can request us to proceed with erasure of such Personal Data.
4. Right to restriction: If you believe that your Personal Data are inaccurate or that processing is unlawful or that we no longer need the Personal Data or if you have objections to the automated processing (if applicable), you have the right to request the restriction of processing.
5. Right to object: You may object to the processing of your Personal Data by the Firm on grounds relating to your particular situation, except if there are, inter alia, compelling legitimate grounds for the processing which override your interests, rights and freedoms. If applicable, you also have the right to object when you are subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (statutory exceptions apply).
6. Right to data portability: You may request to receive your Personal Data in a structured, commonly used and machine-readable format, as well as to transfer those data to another organization (controller), which you will indicate to us.
7. Right to withdraw your consent: Where the processing of the Personal Data is based on your consent, you have the right to withdraw your consent at any time. With regard to your consent provided for electronic marketing purposes, you may also withdraw it by following the unsubscribe instructions in such marketing materials.
8. Right to lodge a complaint before the HDPA: You have the right to lodge a complaint before the competent Hellenic Data Protection Authority (HDPA) on matters relating to the processing of your Personal Data. The HDPA is located in Athens (Kifisias 1-3, P.C. 11523).

More detailed information on your rights is available on the website of the HDPA (here), which we encourage you to visit.

9. How to contact us

If you have concerns or questions regarding this Privacy Notice or if you want to exercise any of your rights regarding the processing of your Personal Data by the Firm, please contact us at [email protected].

10. Changes to this Privacy Notice

We may update this Privacy Notice (e.g., in order to reflect a change in the applicable legal framework or a change in our practices) and will revise the date at the top of this document to reflect the date when such update occurred.