Last updated: 3 August 2026
This policy explains how we collect, use, share and protect personal data in connection with the Investment Readiness Protocol 360°, the Preliminary Readiness Screening and any enquiry made through this site. It is written to meet Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”) and Greek Law 4624/2019.
An investment readiness assessment is document-intensive by nature. Please read section 3 carefully: it describes the categories of material we ask for, and section 5 explains how we handle the sensitive checks that anti-money-laundering law requires of us.
1. Who is responsible for your data
Aggelakakis & Associates · Global Group (“we”, “us”, “our”) is the data controller for the processing described here. We operate advisory hubs in Athens, Thessaloniki, Munich, New Jersey, Mumbai and Melbourne.
For any question about this policy, or to exercise the rights described in section 12, write to readiness@aggelakakis.gr with “Data protection” in the subject line.
2. What this policy covers
This policy covers personal data processed through this website, through the Preliminary Readiness Screening, during the assessment of whether a mandate is suitable, and during the performance of an accepted mandate. It does not cover the separate privacy practices of any third party whose site we link to.
3. The personal data we process
Data you provide directly:
- Identification data — full name, date of birth, nationality, identity or passport details, tax identification number, proof of address.
- Contact data — email address, telephone number, postal address, country, preferred language.
- Professional and corporate data — company name and role, ownership and control structure, ultimate beneficial ownership, directorships, group structure charts.
- Financial and source-of-funds data — bank references, financial statements, evidence of the origin of the funds intended for the investment, funding commitments.
- Mandate material — any document, model, projection, permit, contract or correspondence you submit as evidence against a Pillar criterion.
- Enquiry content — anything you choose to write to us in a message or say during a screening call.
4. Data we generate or obtain from others
- Assessment records — our verification notes, criterion scores, Pillar scores, the Investment Readiness Index™ result, the remediation plan and the reviewers’ conclusions.
- Public register data — company registries, land and permit registries, insolvency and litigation records, and equivalent official sources in the relevant jurisdiction.
- Screening data — results of sanctions, politically-exposed-person and adverse-media checks obtained from specialist providers.
- Technical data — IP address, browser and device type, pages viewed and time of visit, generated automatically by our web server for security and availability purposes.
5. Why we process it, and our legal basis
We rely on the following bases under Article 6(1) GDPR:
- To answer your enquiry and assess whether a mandate is suitable — steps taken at your request prior to entering a contract, Article 6(1)(b).
- To perform an accepted mandate, produce the assessment and issue the decision file — performance of a contract, Article 6(1)(b).
- To meet our customer due diligence, record-keeping and reporting duties under anti-money-laundering and counter-terrorist-financing law — legal obligation, Article 6(1)(c).
- To keep our own records, defend or establish legal claims, and secure our systems — legitimate interests, Article 6(1)(f), balanced against your rights and freedoms.
- To send professional updates where you have asked for them, and to place non-essential cookies — consent, Article 6(1)(a), which you may withdraw at any time.
6. Special categories and criminal-offence data
Sanctions, politically-exposed-person and adverse-media screening can reveal data relating to criminal convictions or offences, alleged offences, or in rare cases political opinions. We process such data only to the extent required to discharge our legal obligations, on the basis of Article 10 GDPR read with Article 9(2)(g) where applicable, and under the conditions set out in Greek Law 4624/2019. Access is restricted to the assessment team and the reviewing Managing Partner.
7. Automated decision-making
The Investment Readiness Index™ is calculated from criterion scores using predefined weighting factors. The score is not, however, produced by automated means alone: every assessment is subject to dual senior review under the four-eyes principle, with at least one reviewer being a Managing Partner, and the decision grade is theirs. We therefore do not carry out decision-making based solely on automated processing within the meaning of Article 22 GDPR, and we do not profile you for marketing purposes.
8. Who we share it with
We do not sell personal data, and we do not share it for anyone else’s marketing. We disclose it only to:
- Members of the assessment team and the reviewing partners within the group, on a need-to-know basis.
- External certified professionals — lawyers, tax advisers, auditors, notaries — where a formal opinion outside the scope of the 360° is required, and with your knowledge.
- Service providers acting on our documented instructions as processors, under Article 28 contracts: hosting and infrastructure, email, secure document exchange, and screening data providers.
- Competent authorities, supervisory bodies or courts, where we are legally required to disclose. Where anti-money-laundering law obliges us to report a suspicion, we may be prohibited by law from informing you of that report.
9. International transfers
Our hubs in New Jersey, Mumbai and Melbourne sit outside the European Economic Area. Where personal data is transferred to them, or to a processor outside the EEA, we rely on an adequacy decision of the European Commission where one exists, and otherwise on the Commission’s Standard Contractual Clauses together with a transfer impact assessment and any supplementary technical measures that assessment identifies. A copy of the safeguards in place is available on request.
10. How long we keep it
We retain personal data only for as long as the purpose requires, and then delete or anonymise it:
- Enquiries that do not lead to a mandate — up to 12 months from the last contact, then deleted.
- Preliminary Readiness Screening submissions — up to 12 months, so we can refer back to your zone if you return.
- Customer due diligence records and supporting evidence — five years from the end of the business relationship or the occasional transaction, as required by anti-money-laundering law, and longer only where a competent authority so directs.
- Assessment files, the decision file and the IRI™ result — ten years, reflecting the limitation period for professional liability claims.
- Accounting and invoicing records — as required by applicable tax law.
- Server and security logs — up to six months.
11. How we protect it
We apply access control on a need-to-know basis, encryption in transit, secure document exchange rather than ordinary email attachments for mandate material, written confidentiality undertakings binding every person on the assessment team, segregation of assessment from implementation under our Separation Policy, and dual senior review of conclusions. We review these measures periodically and after any material change to our systems.
12. Your rights
Subject to the conditions and exceptions in the GDPR, you have the right to:
- Be informed about, and obtain a copy of, the personal data we hold about you (Articles 13–15).
- Have inaccurate data corrected and incomplete data completed (Article 16).
- Have data erased where we no longer have a lawful reason to keep it (Article 17). This right does not extend to records we are legally obliged to retain, such as customer due diligence files.
- Restrict processing while an issue is investigated (Article 18).
- Receive data you provided in a portable, machine-readable form, or have it transmitted to another controller (Article 20).
- Object to processing carried out on the basis of our legitimate interests (Article 21).
- Withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
13. Making a request or a complaint
Write to readiness@aggelakakis.gr. We respond within one month, extendable by two further months for complex or numerous requests, in which case we will tell you within the first month and explain why. We may need to verify your identity before acting.
If you are not satisfied, you may lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), 1–3 Kifissias Avenue, 115 23 Athens, www.dpa.gr — or with the supervisory authority of the EU Member State where you live or work.
14. Providing data, and what happens if you do not
You are not obliged to give us personal data. However, identification, beneficial ownership and source-of-funds evidence are conditions of accepting any mandate, both under law and under our own methodology. Where that evidence cannot be provided, we are unable to open or continue an engagement — which is why “investors unable to evidence UBO, source of funds or basic financials” fall outside the scope of the Protocol.
15. Changes to this policy
We may update this policy to reflect changes in law, in our services or in our systems. The date at the top shows when it was last revised. Where a change materially affects how we use your data, we will bring it to your attention directly.
Last updated: 3 August 2026
These terms govern your use of this website and of the material describing the Investment Readiness Protocol 360°. By using the site you accept them. If you do not accept them, please do not use the site. The site is operated by Aggelakakis & Associates · Global Group.
1. Definitions
- “Protocol” or “360°” — the Investment Readiness Protocol 360°, our structured investment readiness assessment framework across 10 Pillars and more than 400 control points.
- “Index™” or “IRI™” — the Investment Readiness Index™, the weighted 0–100 score produced exclusively through a full mandate.
- “Screening” — the Preliminary Readiness Screening, a free orientation tool based on self-declared information.
- “Mandate” — an accepted, written engagement to perform the Protocol for a client.
2. The content of this site is informational
Everything on this site is provided for general information about our methodology. It does not constitute legal, tax, audit, accounting, investment or financing advice, and it must not be relied upon as such. It is not an offer, a solicitation, a recommendation or an inducement to acquire, dispose of or subscribe for any investment, security or interest, in any jurisdiction.
Nothing on this site creates a client relationship. A relationship arises only under a signed engagement letter.
3. The Preliminary Readiness Screening
The Screening is a free preliminary orientation tool based on self-declared information that we do not verify. It does not constitute an assessment, a score, or the Investment Readiness Index™. It does not constitute legal, tax or audit advice and does not guarantee approval, financing or a decision by any authority. Only Pillar 01 is shown in open detail; Pillars 02–10 appear in structure only and are unlocked within a full mandate.
4. What the IRI™ is, and what it is not
The IRI™ expresses the documented level of investment readiness under the assumptions, the evidence and the conditions applicable on the assessment date. It is a statement about the state of preparation of a specific investor and a specific deal at a specific moment, tied to explicit assumptions, sources and a date.
It is not a valuation, a credit rating, an audit opinion, a fairness opinion, a legal or tax opinion, a forecast of returns, or a prediction of any outcome. It does not replace asset-specific or transaction-specific due diligence. Scores obtained on one date do not carry forward: circumstances, law and markets change.
5. Separation Policy and the documented No-Go
Assessment and implementation are separated under a written policy. A documented No-Go conclusion constitutes full performance of the assessment mandate; it is not a failure to deliver and does not reduce or refund the assessment fee. This separation is the basis on which the conclusion can be relied upon as independent.
6. No guarantee of outcome
We do not guarantee the approval of financing, subsidies, permits, licences or residence rights, nor the decision of any bank, fund, authority or counterparty, nor the commercial success of any investment. All investment carries risk, including the risk of total loss of capital.
7. Mandate acceptance
Not every mandate is accepted. We assess fit before an engagement begins and may decline without giving reasons. We do not accept requests solely for subsidies without an investment strategy, investments below €250,000 absent a specific strategic exception, investors unable to evidence ultimate beneficial ownership, source of funds or basic financials, or cases seeking a predetermined positive conclusion.
8. Intellectual property
All content on this site, the Protocol methodology, the Pillar structure, the control points, the weighting model, the report formats and the Investment Readiness Index™ and IRI™ marks are the property of Aggelakakis & Associates · Global Group or its licensors, and are protected by copyright, trademark and trade-secret law.
You may view the site and print or download extracts for your own internal, non-commercial reference. You may not otherwise reproduce, republish, adapt, distribute, licence, sell or exploit any part of it, nor remove any proprietary notice, without our prior written consent.
9. Acceptable use
You agree not to:
- Use the site for any unlawful, fraudulent or misleading purpose, or to submit information you know to be false.
- Attempt to gain unauthorised access to the site, its server, or any connected system or database.
- Introduce malicious code, or subject the site to a denial-of-service attack or to any load that interferes with its operation.
- Scrape, mine, harvest or systematically extract content, including for the training of machine-learning models, without our prior written consent.
- Present the Protocol, the IRI™ or any of our conclusions as your own, or use them to imply an endorsement we have not given.
10. Material you send us
You are responsible for the accuracy, completeness and lawfulness of everything you submit, and you confirm that you are entitled to disclose it to us. We treat mandate material as confidential and handle personal data as described in our Privacy Policy. Please do not send us material you are not permitted to share, and do not send sensitive documents through unsecured channels when a secure exchange has been provided.
11. Third-party links
Where we link to a third-party site, we do so for convenience. We do not control those sites, do not endorse them, and accept no responsibility for their content, their accuracy or their privacy practices.
12. Availability
We do not warrant that the site will be uninterrupted or error-free. We may change, suspend or withdraw all or part of it, temporarily or permanently, without notice.
13. Limitation of liability
To the fullest extent permitted by law, we exclude liability for any loss of profit, loss of opportunity, loss of anticipated saving, loss of goodwill, or any indirect or consequential loss, arising from your use of this site or from reliance on its content. Nothing in these terms excludes or limits liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any liability that cannot lawfully be excluded.
Our liability in connection with an accepted mandate is governed by the engagement letter for that mandate, not by these terms.
14. Governing law and jurisdiction
These terms, and any dispute or claim arising out of or in connection with them or their subject matter, are governed by Greek law. The courts of Thessaloniki have exclusive jurisdiction, save that if you are a consumer you retain the protection of the mandatory provisions of the law of your country of residence and may bring proceedings there.
15. Changes, severability and contact
We may revise these terms at any time; the version published here governs your use of the site. If any provision is held invalid, the remainder continues in effect. Questions about these terms may be sent to info@aggelakakis.gr.
Last updated: 3 August 2026
This policy explains the cookies and similar technologies used on this site, what each is for, and how to control them. It should be read with our Privacy Policy. We apply Article 5(3) of the ePrivacy Directive as transposed into Greek law, and the consent standard of the GDPR.
1. What these technologies are
A cookie is a small text file placed on your device by a website. Similar technologies — local storage, session storage and pixels — achieve comparable results. Throughout this policy “cookie” covers all of them.
2. Categories we use
- Strictly necessary — required for the site to function and for security. These do not require consent and cannot be switched off.
- Preference — remember a choice you have made, such as your answer to the cookie banner.
- Analytics — help us understand which sections are read and where visitors leave. These are optional and are set only with your consent.
3. What this site actually stores
We keep this deliberately short, and it reflects the site as it stands today:
- om_cookie_consent — preference, stored in your browser’s local storage rather than as a cookie. It records whether you accepted or declined non-essential cookies, so the banner is not shown again. It stays until you clear your browser’s site data.
- WordPress session and authentication cookies — strictly necessary, and set only if you log in to administer the site. An ordinary visitor never receives them.
- No advertising or cross-site tracking cookie is set by this site, and no cookie is used to build an advertising profile of you.
4. Third-party content
The site loads the Ubuntu typeface from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Making that request discloses your IP address and browser details to Google, which may process them outside the European Economic Area. Google does not set a cookie for this request. If you would prefer no request to leave your browser at all, the typeface can be served from our own servers instead — write to us and we will arrange it.
Should we later add analytics, embedded video or a mapping service, this section will be updated to name each provider before it is enabled.
5. Your choices
On your first visit a banner asks whether you accept non-essential cookies. You can accept or decline, and declining leaves the site fully usable — nothing on this page is gated behind consent.
To change your answer later, clear this site’s data in your browser; the banner will appear again on your next visit. You can also block or delete cookies through your browser settings, and most browsers offer a private-browsing mode that discards them when the window closes. Blocking strictly necessary cookies may stop parts of the site from working.
6. Changes to this policy
We update this policy whenever the technologies on the site change. The date at the top shows when it was last revised.
