Privacy Statement: How the House Handles Your Data

In this Policy the following terms shall have the following meanings:

• "Account" means an account required to access and/or use certain areas and features of Our Site;
• "Cookie" means a small text file placed on your computer or device by Our Site when you visit certain parts of Our Site and/or when you use certain features of Our Site;
• "Our Site" means this website, https://greekconcierge.com;
• "UK and EU Cookie Law" means the relevant parts of the Privacy and Electronic Communications Regulations 2003;
• "We/Us/Our" means Greek Concierge, the private network of advisors and specialists in Greece, under whose business name Our Site is controlled and maintained

Depending upon your use of Our Site, we may collect and hold some or all of the personal data set out below, using the methods also set out below. Please also see section 14 for more information about our use of Cookies and similar technologies.

• Identity Information: We collect identity information such as your name, title, date of birth, and gender directly from you when you register on Our Site, write to us with a brief, or take up a standing as a Friend of the House, and from third parties.
• Enquiry Information: When you write to us with a brief, we collect what you tell us about it, so that we can introduce you to an Advisor in our network who suits it.
• Contact Information: Your contact information, including address, email, social media profiles, and phone number, is collected directly from you as well as from third-party sources.
• Payment Information: The only payment taken through Our Site is a contribution as a Friend of the House, described below. We never receive your card or bank account details.
• Marketing Preferences: If you opt-in to receive marketing communications from us, we collect your preferences for email, SMS, and postal marketing directly from you.
• Newsletter Subscription: When you subscribe to Letters from Greece, our occasional newsletter, we collect your email address and, as a record that you consented, the date and time of your subscription, your IP address, the page you subscribed from, and basic technical details of the browser you used. Submitting the subscription form is itself the consent — no confirmation step is required — and each letter carries a link by which you may withdraw it.
• Friends of the House Information: When you become a Friend of the House, we collect your email address, your first and last name, your billing country, a record of your contributions, and whether you agree to be named publicly. Stripe takes your card details, and they never reach our servers. If you become a Friend through another Friend's personal link, we also record which Friend introduced you. We hold that record in our legitimate interest in knowing how our community grows.
• Friends of the House Details: In your account, under Your details, you may tell us more about yourself. Your first and last name are the only details you must give, so that we can write to you by name. Everything else is optional: a mobile number, your Instagram and LinkedIn names, a photo, your gender, your age band, the languages you speak, the country you live in and a second country, and the interests you choose from our list. We use these details to know you better, and to make introductions and suggest writing that suit you. Your photo is shown to you in your account and to our team, and is never published. If you agree to receive news by text message or WhatsApp, we record the date you agreed and the wording you agreed to. If you turn on notices in the app installed on your device, we keep the address your device gives us for those notices, the kind of device, and the topics you chose.
• Recruitment Information: When you apply for a position through Our Site, we collect what you enter on the application form, including your name, contact details, country, languages, any profiles you share, and your answers to its questions. We also record when and from which page you applied, your IP address, and basic details of your browser. We do not ask for a CV, and Our Site provides no way to attach one.

We will only keep your personal data for as long as necessary for the purposes for which it was collected, including to meet any legal, regulatory, accounting or reporting requirements.

In general, we keep:

• Identity & Contact Data: While you have an active Account/relationship with us
• Payment & Transaction Data: For 6 years after transaction for tax/legal purposes
• Marketing Preferences: Until you withdraw consent/opt-out
• Newsletter Subscription: Until you unsubscribe. We then retain a minimal record that you unsubscribed, so that we do not write to you again.
• Friends of the House Data: While your standing is current, and for 12 months after it ends, so that you may take it up again without starting afresh. We then erase the personal fields: your email address, your first and last name, every detail you added in your account, your photo, your text-message consent, the devices registered for notices, and any reason recorded against the standing. We also withdraw your entry from The Pantheon. Until then, you may remove any optional detail or your photo in your account at any time, and we delete it at once. The record of what you contributed is kept for 6 years as a financial record, as at Payment & Transaction Data above, with no name attached to it. You may ask us to erase it sooner, using the details in Part 15, and we will. When we erase the personal fields, we also erase your personal link and the record of which Friend introduced you. A Friend who introduced you sees only how many Friends they have introduced, never your name or anything else about you.
• Recruitment Data: For 12 months after we reach a decision on your application, so that we may consider you for a position that opens in the meantime and answer any question about how your application was handled. Where we go on to engage you, your application is kept for as long as that engagement lasts instead. You may ask us to erase it at any point, using the details in Part 15, and we will.

We share your personal data with the service providers that operate our business. Each acts on our instructions, under a written agreement, and may use your data only as necessary to provide its service to us. They fall into the following categories: website hosting and infrastructure; hosted database and authentication; transactional email delivery; secure storage of documents and images; and, where we are required to carry out screening checks, sanctions and politically-exposed-persons screening. Where you hold a standing as a Friend of the House, we also use a payment processor: Stripe, which takes your payment, holds your card details in place of us, and tells us only that a payment was made, refunded or disputed.

If you turn on notices in the app installed on your device, each notice passes through the push service run by the maker of your browser or device. That service receives the notice and the address your device gave us for it, and nothing else about you.

We will tell you which providers we use in any of those categories if you ask us, using the details in Part 15.

When you accept an introduction to an Advisor in our network, we pass that Advisor your contact details and the details of your brief, so that they can contact you directly. We pass nothing to an Advisor before you accept. The Advisor then holds that data as a controller in its own right, under its own privacy notice.

We may also share your data with other companies in our corporate group, or disclose data to legal/regulatory authorities if required.

In the event we sell or reorganise our business, your data may be transferred to the successor organisation.

Where we share data with third parties, we put contractual and security measures in place to protect your data and ensure compliance with data protection law.

If you want to know what personal data we have about you, you can ask us for details by making a "subject access request". All such requests should be made in writing and sent to the email or postal addresses shown in Part 15.

There is normally no charge for a subject access request. However, if your request is 'manifestly unfounded or excessive' (for example, if you make repetitive requests) a fee may be charged to cover our administrative costs.

We aim to respond to subject access requests within one month of receiving them, although in some cases we may need more time depending on the complexity of the request.

We take a privacy-first approach to cookies. Our Site only uses essential cookies that are strictly necessary for the website to function properly. We do not use any tracking cookies, analytics cookies, or advertising cookies.

Because we only use essential cookies, there is no cookie consent banner on Our Site. Essential cookies are required for the website to function and do not require consent under privacy regulations like GDPR.

You can control and disable cookies through your browser settings. Most browsers allow you to reject cookies, although this may impact your ability to access certain features of Our Site. For more information, refer to your browser's help menu.

You can find out more information about cookies on Our Site by referring to our Cookies Policy.

For any enquiries related to your personal data and data protection, including making a subject access request, please write to us exclusively via email. To ensure that we can address your request efficiently and comply with data protection laws, kindly provide the following information in your correspondence:

• Your Full Name: So we can verify your identity and locate your data in our system.
• Contact Information: Including your email address and phone number, if applicable, for any follow-up communication.
• Details of Your Request: Clearly state whether you're seeking access to your data, wish to correct or delete your data, or have other data protection concerns. The more specific you are, the better we can assist you.
• Any Relevant Dates: If your request relates to specific interactions or time periods, please include this information to help us narrow down our search.

Please submit your detailed request through our contact form, selecting "Other" as the occasion and including "Data Protection Request" in your message.

We take your privacy seriously and will endeavour to respond to your inquiry as promptly as possible, and in accordance with applicable data protection laws.