Contact

1. Who is responsible for your data

Aggelakakis & Associates · Global Group (“we”, “us”, “our”) is the data controller for the processing described here. We operate advisory hubs in Athens, Thessaloniki, Munich, New Jersey, Mumbai and Melbourne.

For any question about this policy, or to exercise the rights described in section 12, write to readiness@aggelakakis.gr with “Data protection” in the subject line.

2. What this policy covers

This policy covers personal data processed through this website, through the Preliminary Readiness Screening, during the assessment of whether a mandate is suitable, and during the performance of an accepted mandate. It does not cover the separate privacy practices of any third party whose site we link to.

3. The personal data we process

Data you provide directly:

Identification data — full name, date of birth, nationality, identity or passport details, tax identification number, proof of address.
Contact data — email address, telephone number, postal address, country, preferred language.
Professional and corporate data — company name and role, ownership and control structure, ultimate beneficial ownership, directorships, group structure charts.
Financial and source-of-funds data — bank references, financial statements, evidence of the origin of the funds intended for the investment, funding commitments.
Mandate material — any document, model, projection, permit, contract or correspondence you submit as evidence against a Pillar criterion.
Enquiry content — anything you choose to write to us in a message or say during a screening call.

4. Data we generate or obtain from others

Assessment records — our verification notes, criterion scores, Pillar scores, the Investment Readiness Index™ result, the remediation plan and the reviewers’ conclusions.
Public register data — company registries, land and permit registries, insolvency and litigation records, and equivalent official sources in the relevant jurisdiction.
Screening data — results of sanctions, politically-exposed-person and adverse-media checks obtained from specialist providers.
Technical data — IP address, browser and device type, pages viewed and time of visit, generated automatically by our web server for security and availability purposes.

5. Why we process it, and our legal basis

We rely on the following bases under Article 6(1) GDPR:

To answer your enquiry and assess whether a mandate is suitable — steps taken at your request prior to entering a contract, Article 6(1)(b).
To perform an accepted mandate, produce the assessment and issue the decision file — performance of a contract, Article 6(1)(b).
To meet our customer due diligence, record-keeping and reporting duties under anti-money-laundering and counter-terrorist-financing law — legal obligation, Article 6(1)(c).
To keep our own records, defend or establish legal claims, and secure our systems — legitimate interests, Article 6(1)(f), balanced against your rights and freedoms.
To send professional updates where you have asked for them, and to place non-essential cookies — consent, Article 6(1)(a), which you may withdraw at any time.

6. Special categories and criminal-offence data

Sanctions, politically-exposed-person and adverse-media screening can reveal data relating to criminal convictions or offences, alleged offences, or in rare cases political opinions. We process such data only to the extent required to discharge our legal obligations, on the basis of Article 10 GDPR read with Article 9(2)(g) where applicable, and under the conditions set out in Greek Law 4624/2019. Access is restricted to the assessment team and the reviewing Managing Partner.

7. Automated decision-making

The Investment Readiness Index™ is calculated from criterion scores using predefined weighting factors. The score is not, however, produced by automated means alone: every assessment is subject to dual senior review under the four-eyes principle, with at least one reviewer being a Managing Partner, and the decision grade is theirs. We therefore do not carry out decision-making based solely on automated processing within the meaning of Article 22 GDPR, and we do not profile you for marketing purposes.

8. Who we share it with

We do not sell personal data, and we do not share it for anyone else’s marketing. We disclose it only to:

Members of the assessment team and the reviewing partners within the group, on a need-to-know basis.
External certified professionals — lawyers, tax advisers, auditors, notaries — where a formal opinion outside the scope of the 360° is required, and with your knowledge.
Service providers acting on our documented instructions as processors, under Article 28 contracts: hosting and infrastructure, email, secure document exchange, and screening data providers.
Competent authorities, supervisory bodies or courts, where we are legally required to disclose. Where anti-money-laundering law obliges us to report a suspicion, we may be prohibited by law from informing you of that report.

9. International transfers

Our hubs in New Jersey, Mumbai and Melbourne sit outside the European Economic Area. Where personal data is transferred to them, or to a processor outside the EEA, we rely on an adequacy decision of the European Commission where one exists, and otherwise on the Commission’s Standard Contractual Clauses together with a transfer impact assessment and any supplementary technical measures that assessment identifies. A copy of the safeguards in place is available on request.

10. How long we keep it

We retain personal data only for as long as the purpose requires, and then delete or anonymise it:

Enquiries that do not lead to a mandate — up to 12 months from the last contact, then deleted.
Preliminary Readiness Screening submissions — up to 12 months, so we can refer back to your zone if you return.
Customer due diligence records and supporting evidence — five years from the end of the business relationship or the occasional transaction, as required by anti-money-laundering law, and longer only where a competent authority so directs.
Assessment files, the decision file and the IRI™ result — ten years, reflecting the limitation period for professional liability claims.
Accounting and invoicing records — as required by applicable tax law.
Server and security logs — up to six months.

11. How we protect it

We apply access control on a need-to-know basis, encryption in transit, secure document exchange rather than ordinary email attachments for mandate material, written confidentiality undertakings binding every person on the assessment team, segregation of assessment from implementation under our Separation Policy, and dual senior review of conclusions. We review these measures periodically and after any material change to our systems.

12. Your rights

Subject to the conditions and exceptions in the GDPR, you have the right to:

Be informed about, and obtain a copy of, the personal data we hold about you (Articles 13–15).
Have inaccurate data corrected and incomplete data completed (Article 16).
Have data erased where we no longer have a lawful reason to keep it (Article 17). This right does not extend to records we are legally obliged to retain, such as customer due diligence files.
Restrict processing while an issue is investigated (Article 18).
Receive data you provided in a portable, machine-readable form, or have it transmitted to another controller (Article 20).
Object to processing carried out on the basis of our legitimate interests (Article 21).
Withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

13. Making a request or a complaint

Write to readiness@aggelakakis.gr. We respond within one month, extendable by two further months for complex or numerous requests, in which case we will tell you within the first month and explain why. We may need to verify your identity before acting.

If you are not satisfied, you may lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), 1–3 Kifissias Avenue, 115 23 Athens, www.dpa.gr — or with the supervisory authority of the EU Member State where you live or work.

14. Providing data, and what happens if you do not

You are not obliged to give us personal data. However, identification, beneficial ownership and source-of-funds evidence are conditions of accepting any mandate, both under law and under our own methodology. Where that evidence cannot be provided, we are unable to open or continue an engagement — which is why “investors unable to evidence UBO, source of funds or basic financials” fall outside the scope of the Protocol.

15. Changes to this policy

We may update this policy to reflect changes in law, in our services or in our systems. The date at the top shows when it was last revised. Where a change materially affects how we use your data, we will bring it to your attention directly.

Contact form

Peace of mind before capital.