Personal Data Protection Policy

1. Data Controller

The controller of the personal data collected and processed in the context of the activities described in this Policy is:

The Company has assessed its obligations under Article 37 GDPR and, at the time of issuing this Policy, has not appointed a Data Protection Officer (DPO), as the conditions that would make such an appointment mandatory are not met. For any matter relating to the processing of your personal data you may contact the Company using the details above.

2. Categories of personal data we collect

Depending on the nature of your interaction with the Company, we may collect and process the following categories of data:

• Identification and contact details, such as full name, telephone number and email address.
• Information about the property or residence you are interested in, such as the type of residence or the number of bedrooms, as well as any other information you choose to share with us.
• Data relating to telephone communications, such as the number from which the call is made and the date, time and duration of the call. The Company does not record telephone calls.
• Data transmitted to the Company through Google advertising services, when you complete a related form or place a call through an advertisement.
• Technical data while you browse the website, such as IP address, device type, browser type and version, and data about the pages you visit.
• Data arising from the use of cookies and similar technologies, to the extent these are used on the basis of your consent or another lawful basis.

The Company applies the principle of data minimisation and does not seek to collect special categories of personal data within the meaning of Article 9 GDPR, such as health data, religious beliefs or other similar data.

3. Sources from which data is collected

Personal data may be collected:

• directly from you, when you contact us, complete an expression of interest form, send an email or call the Company;
• through the use of the website and the technical means necessary for its operation and security;
• through Google services and advertising tools, when you interact with related advertisements or forms.

4. Purposes of processing and legal bases

The Company processes personal data only for specified, explicit and legitimate purposes and to the extent necessary to achieve them. In particular:

Where processing is based on the Company's legitimate interest, the Company takes into account the rights and reasonable expectations of data subjects and ensures that its legitimate interest does not override their fundamental rights and freedoms.

5. Cookies and similar technologies

The website uses cookies and similar technologies. Strictly necessary cookies, which are required for the secure and proper operation of the website, are used in accordance with applicable legislation.

Measurement cookies, advertising cookies or other technologies that are not strictly necessary for the operation of the website are set only after you have given the required consent. You can change or withdraw your choices through the “Cookie settings” link on the website.

The website is displayed and promoted through Google Ads. For information about the processing of data by Google, please refer to the relevant Google policies and settings.

6. Recipients and processors

The Company does not sell personal data. Data is disclosed to third parties only to the extent necessary for the purposes set out above, for the provision of services to the Company or for compliance with a legal obligation.

• Netlify, Inc., as the hosting provider of the website.
• The Company's email service provider.
• Google Ireland Limited and, where applicable, other companies of the Google group, in the context of Google Ads services and related advertising forms.
• Lawyers, notaries, accountants, banks and other professionals or partners, where necessary in the context of a transaction or purchase.
• Public, judicial, tax or other competent authorities, where disclosure is required by applicable legislation or is necessary for the exercise or defence of legal claims.

Where third parties process personal data on behalf of the Company and under its instructions, the Company takes the measures required to ensure compliance with Article 28 GDPR, including, where required, entering into a data processing agreement.

7. Transfers of personal data outside the EEA

Certain service providers may process personal data outside the European Economic Area (the “EEA”), including, as the case may be, the United States of America.

Where personal data is transferred outside the EEA, the Company ensures that the transfer is carried out in accordance with Chapter V GDPR and relies on an appropriate transfer mechanism, such as an adequacy decision of the European Commission or, where required, the European Commission's Standard Contractual Clauses together with any supplementary measures required by applicable legislation.

8. Retention period

The Company retains personal data only for as long as necessary to achieve the purposes for which it was collected, unless a longer retention period is required or permitted by applicable legislation.

• Expressions of interest that do not lead to a purchase: up to 24 months from the last substantive contact, subject to the need for a shorter or longer period where required by the circumstances or by applicable legislation.
• Updates about new projects: until consent is withdrawn, unless another lawful basis for retention applies.
• Buyers/contracting parties: for the duration of the contractual relationship and thereafter for as long as required by tax, accounting or other mandatory legislation, or for the establishment, exercise or defence of legal claims.
• Cookies: for the periods stated in the relevant cookie policy/management tool and, for the specific cookies currently described, no longer than 13 months.

After the relevant retention period has elapsed, the data is deleted or, where technically and organisationally feasible and appropriate, anonymised.

9. Security of personal data

The Company implements appropriate technical and organisational measures, taking into account the nature, scope, context and purposes of the processing, as well as the risks to the rights and freedoms of natural persons, in accordance with Article 32 GDPR.

These measures include, among others, encrypted HTTPS connections, restriction of access to personal data on a need-to-know basis, appropriate contractual confidentiality commitments and measures to protect information systems.

10. Automated decision-making and profiling

The Company does not make decisions that produce legal effects concerning data subjects or similarly significantly affect them and that are based solely on automated processing within the meaning of Article 22 GDPR.

11. Your rights

Subject to the conditions and limitations provided for in the GDPR, you have in particular the following rights:

• the right of access to your personal data and to obtain a copy of it (Article 15),
• the right to rectification of inaccurate data or completion of incomplete data (Article 16),
• the right to erasure of data (“right to be forgotten”) (Article 17),
• the right to restriction of processing (Article 18),
• the right to data portability, where the conditions of Article 20 are met,
• the right to object to processing based on Article 6(1)(e) or (f), in accordance with Article 21,
• the right to object at any time to processing for direct marketing purposes, including profiling to the extent that it is related to such marketing,
• the right to withdraw your consent at any time, where processing is based on consent. Withdrawal does not affect the lawfulness of processing carried out before it.

To exercise your rights you may contact enciex@enciex.gr. The Company examines requests without undue delay and, in any event, within one (1) month of receipt, in accordance with Article 12(3) GDPR. This period may be extended by two (2) further months where necessary due to the complexity or number of requests, in accordance with the GDPR. The Company may request additional information to confirm the identity of the requester, where this is necessary and proportionate.

12. Right to lodge a complaint

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a competent supervisory authority, in particular the Hellenic Data Protection Authority, if you consider that the processing of your personal data infringes the GDPR or applicable legislation.

Where possible, you are encouraged to contact the Company first, so that the matter can be investigated and resolved.

13. Amendments to the Policy

The Company may amend or update this Policy, in particular where the purposes or means of processing, the technologies used or the applicable legal and regulatory framework change.

The date of the latest update is shown at the top of the Policy. In the event of material amendments affecting the rights or obligations of data subjects, the Company will take appropriate steps to inform them, where required by applicable legislation.