Privacy Policy

HereGreece

HereGreece is a service of Leptokaridou Law Firm, a licensed law firm regulated in Germany and Greece.

All legal services are overseen by Eleftheria Leptokaridou, a senior lawyer admitted to practice in both Germany and Greece and registered with the Berlin and Thessaloniki Bar Associations.

The provision and invoicing of all legal services are carried out exclusively by the firm’s German branch.

Data Controller

Leptokaridou Law Firm (German branch), represented by Eleftheria A. Leptokaridou
LL.M. (Munich), LL.M. (ISDE Madrid), Executive MBA (International Hellenic University)

Unter den Linden 10, 10117 Berlin, Germany

For privacy-specific enquiries, please contact: privacy@heregreece.com.

Our website runs on a managed server provided by xCloud Hosting, LLC, 124 Broadkill Rd #599, Milton, DE 19968, USA, on infrastructure of Vultr Holdings, LLC (USA), in a data centre in Frankfurt am Main, Germany.

When you open a page, the server records technical data in log files: your IP address, the date and time, the page requested, the referring page, and your browser and operating system. This is necessary to deliver the website and to protect it against misuse and attacks (Article 6(1)(f) GDPR, legitimate interest). Log files are kept only as long as needed for these purposes and are then deleted.

Both providers are based in the United States. Where they may access data from there (for example for maintenance or support), this takes place on the basis of the EU Standard Contractual Clauses (Article 46(2)(c) GDPR).

The website’s domain name is managed with Cloudflare, Inc. (DNS): Cloudflare only points our address to our server. Your visit itself does not pass through Cloudflare.

All data transmissions between your browser and our website are encrypted using SSL/TLS technology.

Website and plugins

The website runs on WordPress with our own theme; it uses no page builder. Fonts, styles, images and the website’s own scripts come from our own server, and no maps or videos are embedded. The only services loaded from other providers are the spam protection of our forms and, with your consent, the Google services and the live chat described below.

The plugins and services of the website that process personal data are described in the following sections: the contact and service request forms (Fluent Forms, with the spam protection of CleanTalk and e-mail delivery by Resend), the cookie consent (our own tool) and, only with your consent, website statistics and advertising measurement (Google Tag Manager, Google Analytics, Google Ads) and the live chat (tawk.to). The other plugins (search engine settings, page speed, frequently asked questions, table of contents, site map) do not process personal data of visitors.

We use cookies and similar technologies to ensure the proper functioning of our website and, with your consent, to analyse its use, to measure our advertising and to offer the live chat. The cookies, their purpose and how long they are kept are listed in our Cookie Policy.

For cookie consent we use our own tool, which runs on our server and passes no data to third parties. When you first visit our website, you can accept all cookies, allow only the necessary ones or choose them one by one in the cookie banner. Your choice is stored in a cookie on your device for 12 months. So that we can demonstrate your consent (Article 7(1) GDPR), we also keep every choice on our server: date and time, a randomly generated consent ID, the categories chosen, the banner version and the language, without your IP address or data about your browser (Article 6(1)(c) GDPR). We delete these records after 3 years.

Cookies that are technically necessary, such as the one that stores your consent choice, are set on the basis of § 25(2) No. 2 TDDDG and Article 6(1)(f) GDPR; they cannot be disabled. Statistics and marketing cookies (Google Analytics, Google Ads, the live chat) are set only with your consent (§ 25(1) TDDDG and Article 6(1)(a) GDPR).

You may withdraw or change your consent at any time with effect for the future, in the cookie settings available on every page and in our Cookie Policy.

We use Fluent Forms, a form plugin that runs on our own server, to provide contact forms and service request forms on our website.

When you submit a form, we process the following categories of personal data, depending on the information provided by you:

• first name and surname;
• e-mail address;
• telephone number;
• country of residence;
• your message or the information about your property or case;
• for a service request, the service and package you chose.

The data is processed for the purpose of responding to your enquiry, handling service requests and, where applicable, taking steps prior to entering into a contract, in accordance with Article 6(1)(b) GDPR.

Form submissions are stored in the website’s database and sent to our e-mail inbox for internal processing and documentation purposes. The e-mails the website sends (the notification to us and, where applicable, the confirmation to you) are delivered through Resend, an e-mail delivery service acting as our processor.

Personal data submitted via forms is stored for up to two (2) years, unless a longer retention period is required due to statutory retention obligations, the establishment or performance of an ongoing service relationship, or the assertion, exercise or defence of legal claims.

Spam protection

To protect our forms against spam and automated submissions, we use Anti-Spam by CleanTalk (CleanTalk Inc.). When you submit a form, CleanTalk receives your IP address, your e-mail address, the text and the values of the form fields, together with technical signals of your browser, and checks whether the submission is spam. This is done solely to prevent spam (Article 6(1)(f) GDPR). CleanTalk keeps these checks in its logs for a short period only and then deletes them; its servers are located in the EU and the USA (Standard Contractual Clauses).

We offer a live chat with tawk.to, a service of tawk.to inc. (USA). Until you consent to marketing cookies, our website shows only a chat button of its own and loads nothing from tawk.to.

With your consent (§ 25(1) TDDDG and Article 6(1)(a) GDPR), the chat is loaded: tawk.to receives your IP address and technical data of your browser, sets cookies on your device and processes the messages you write, in order to deliver them to us. tawk.to is certified under the EU-U.S. Data Privacy Framework.

We delete chat conversations immediately after the chat has ended. You may withdraw your consent at any time with effect for the future in the cookie settings.

Google Tag Manager, Google Analytics and Google Ads are services of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics and Google Ads run only after you have given your consent in the cookie banner (§ 25(1) TDDDG and Article 6(1)(a) GDPR); you may withdraw your consent at any time with effect for the future in the cookie settings. Data may be transferred to Google LLC in the United States; Google LLC is certified under the EU-U.S. Data Privacy Framework.

Google Tag Manager

We use Google Tag Manager to manage the analytics and advertising tags of the website. It is loaded only after you have consented to statistics or marketing; before that, your browser does not connect to Google. Tag Manager itself sets no cookies and creates no profiles; it fires the tags described below only as your consent choice allows (§ 25(1) TDDDG and Article 6(1)(a) GDPR).

Google Analytics

We use Google Analytics 4 to analyse how visitors use our website and to improve its content, structure and performance. Google Analytics uses cookies and processes technical usage data, including browser information, device information and interaction data. Google Analytics 4 does not store IP addresses. The data is used exclusively for statistical analysis; it is not used to identify individual users.

Google Ads

We advertise our services with Google Ads. With your consent, Google Ads conversion measurement records whether a visit that started with one of our ads leads to an enquiry (for example, when the thank-you page after our form is reached). Google uses cookies for this; we receive only aggregated figures, not data that identifies you.

Google Search Console

We use Google Search Console to monitor the technical performance and visibility of our website in search engines. Google Search Console does not process personal data of website visitors and is used solely for aggregated search performance analysis.

When clients engage Leptokaridou Law Firm through HereGreece for legal or due diligence services, we collect and process personal and property-related data that is necessary for the performance of the contract and for compliance with legal and professional obligations, in accordance with Article 6(1)(b) and Article 6(1)(c) GDPR.

The processed data may include, in particular:

• identification and KYC documents;
• property titles, deeds and registry extracts;
• contracts, powers of attorney and related transaction documents;
• correspondence and communications relevant to the engagement.

Client data is stored and processed in secure systems, including our e-mail and document storage (Google Workspace), using data storage locations within the European Union where available and appropriate security safeguards.

Where required by law or necessary for the performance of the agreed services, personal data may be shared with trusted third parties, including in particular locally admitted lawyers, Greek notaries and competent public authorities (such as land registries, tax authorities or cadastral offices).

We do not intentionally transfer client personal data outside the European Union or the European Economic Area (EU/EEA). Where the use of service providers may involve access from third countries, such processing is subject to appropriate safeguards in accordance with Chapter V GDPR.

Client-related data is kept for the periods set out under Data Retention.

We implement appropriate technical and organisational measures to protect personal data in accordance with Article 32 GDPR against unauthorised access, accidental or unlawful loss, alteration or disclosure.

These measures include, in particular:

• SSL/TLS encryption for all website communications;
• password-protected systems with restricted, role-based user access;
• regular security updates and data backups to ensure the integrity and availability of the system.

Our security measures are regularly reviewed and updated in line with technological developments and risk assessments.

We retain personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy or as required by applicable legal, professional or regulatory obligations.

Unless a longer retention period is required or permitted by law, the following retention periods apply:

• Contact and enquiry data (forms): up to two (2) years.
• Client and service-related data: ten (10) years, in accordance with statutory, professional and legal retention obligations.
• Live chat conversations: deleted immediately after the chat has ended.
• Cookie and analytics data: as set out in our Cookie Policy, or until you withdraw your consent, whichever occurs first.
• Server log files: only as long as needed to deliver and protect the website.

Upon expiry of the applicable retention periods, personal data is securely deleted or anonymised, unless continued retention is necessary for the establishment, exercise or defence of legal claims.

As a data subject, you have the following rights under the EU General Data Protection Regulation (GDPR):

• right of access (Article 15 GDPR);
• right to rectification (Article 16 GDPR);
• right to erasure (“right to be forgotten”) (Article 17 GDPR);
• right to restriction of processing (Article 18 GDPR);
• right to data portability (Article 20 GDPR);
• right to object to processing (Article 21 GDPR);
• right to withdraw consent at any time, where processing is based on consent (Article 7(3) GDPR).

You may exercise your rights at any time by contacting us at privacy@heregreece.com. Requests will be handled without undue delay and within the statutory time limits set out in the GDPR. Where necessary, we may request additional information to verify your identity before processing a request.

You also have the right to lodge a complaint with a supervisory authority (Article 77 GDPR), in particular in the EU member state where you live or work. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany.

Our website and services are not intended for use by children under the age of 16. We do not knowingly collect or process personal data relating to children. If we become aware that personal data of a child has been collected without an appropriate legal basis, such data will be deleted without undue delay.

For the operation of our website and the provision of our services, we use selected external service providers who act as data processors within the meaning of Article 28 GDPR, bound by data processing terms.

The processors used include, in particular:

• xCloud Hosting, LLC (USA), on infrastructure of Vultr Holdings, LLC (USA), server in Frankfurt am Main – website hosting;
• upgrowme UG (haftungsbeschränkt), Germany – technical operation of the website;
• CleanTalk Inc. – spam protection of the forms;
• Resend – delivery of the e-mails the website sends;
• tawk.to inc. (USA) – live chat, only with your consent;
• Google Ireland Limited – e-mail and secure document storage (Google Workspace) and, only with your consent, Google Analytics and Google Ads conversion measurement through Google Tag Manager.

The forms (Fluent Forms) and the cookie consent (our own tool) run on our own server: they do not pass your data to their makers. Cloudflare manages our domain name (DNS) only and receives no data of your visit.

Personal data is processed within the European Union or, where processing may involve access from third countries, on the basis of appropriate safeguards: the EU Standard Contractual Clauses (SCCs) or the EU-U.S. Data Privacy Framework, in accordance with Articles 44 et seq. GDPR.

We process personal data only where permitted under the EU General Data Protection Regulation (GDPR). Depending on the purpose of processing, the following legal bases apply:

• Website operation and security: processing necessary to ensure the secure, stable and technically reliable operation of the website, including protection against misuse and attacks, is based on Article 6(1)(f) GDPR (legitimate interest).
• Responding to enquiries and service requests: processing necessary to respond to enquiries, handle service requests and take steps prior to entering into a contract is based on Article 6(1)(b) GDPR (performance of a contract or pre-contractual measures).
• Legal compliance and professional obligations: processing required to comply with statutory, regulatory or professional obligations (including legal retention and documentation duties) is based on Article 6(1)(c) GDPR (legal obligation).
• Technically necessary cookies: § 25(2) No. 2 TDDDG and Article 6(1)(f) GDPR.
• Spam protection of the forms: Article 6(1)(f) GDPR (legitimate interest in protecting our forms against misuse).
• Website analytics, advertising measurement, the live chat and other non-essential cookies: only with your consent, § 25(1) TDDDG and Article 6(1)(a) GDPR, which may be given and withdrawn at any time in the cookie settings.

Where processing is based on legitimate interests, those interests are carefully balanced against the rights and freedoms of data subjects.

All legal relationships and engagements are governed by the laws of the Federal Republic of Germany, unless expressly agreed otherwise. Mandatory consumer protection or conflict-of-law rules remain unaffected. Place of jurisdiction is Berlin, Germany, where legally permissible.

We may update this Privacy Policy from time to time to reflect changes in applicable law, regulatory requirements or technical developments. The current version of this Privacy Policy is always available on this page and applies at the time of your visit.

Last updated: October 2026