LEGAL

Privacy Policy

How Athestate collects and protects your data per GDPR, Greek Law 4624/2019, and applicable EU regulations.

Privacy Policy

Last updated: January 2026

Athestate (“we”, “us”, “our”), a real estate brokerage registered in Athens, Greece, operates the website ath.estate. This Privacy Policy informs you of how we collect, use, disclose, and protect your personal data when you use our Service, in compliance with Regulation (EU) 2016/679 (“GDPR”) and Greek Law 4624/2019 on the Protection of Personal Data.

1. Data Controller

The data controller responsible for your personal data is:

Athestate I.K.E. (Private Company)
Agiou Konstantinou 6
104 31 Athens, Greece
Email: contact@athestate.com
Phone: +30 694 037 0753
Tax Registration (AFM/VAT): 803357033 — Athens Tax Authority (DOY)

2. Information We Collect

a) Personal Data you provide directly

  • Identity data: name, surname, nationality, date of birth
  • Contact data: email address, phone number, postal address
  • Property criteria: budget, preferred neighborhoods (Athens Riviera, Kolonaki, Kifisia, Glyfada, etc.), property type, intended use
  • Financial information relevant to Golden Visa eligibility (investment capacity)
  • Identity documents required by Greek AML/KYC law (passport, AFM/TIN, proof of address, source of funds)

b) Usage Data (collected automatically)

  • IP address, browser type and version, operating system
  • Pages visited, time spent, referring URL
  • Cookies and similar tracking technologies (see Section 8)

3. How We Use Your Data (Purposes & Legal Basis)

We process your personal data on the following legal bases, in accordance with Articles 6 and 9 of the GDPR:

  • Performance of a contract (Art. 6.1.b): to provide real estate brokerage services, organize property viewings, prepare offers
  • Legal obligation (Art. 6.1.c): to comply with Greek tax law (Law 4174/2013), AML/KYC obligations (Law 4557/2018), and Golden Visa reporting requirements
  • Legitimate interests (Art. 6.1.f): to improve our services, send service-related communications, prevent fraud
  • Consent (Art. 6.1.a): for marketing communications, newsletter, non-essential cookies. You may withdraw consent at any time.

4. Data Retention

We retain personal data only as long as necessary for the purposes set out in this Policy:

  • Active prospects: 24 months from last contact
  • Clients (post-transaction): 5 years per Greek tax law (Law 4174/2013, Art. 36 — books and records)
  • AML/KYC records: 5 years after the end of the business relationship (Law 4557/2018, Art. 11)
  • Tax-relevant documents (Golden Visa files): 5 years minimum
  • Marketing list: until consent is withdrawn

5. Your Rights Under GDPR

You have the following rights regarding your personal data:

  • Right of access (Art. 15) — obtain a copy of your data
  • Right to rectification (Art. 16) — correct inaccurate data
  • Right to erasure (Art. 17, “right to be forgotten”)
  • Right to restrict processing (Art. 18)
  • Right to data portability (Art. 20) — receive your data in a machine-readable format
  • Right to object (Art. 21) — including objection to direct marketing
  • Right to withdraw consent (Art. 7.3) — at any time, without retroactive effect
  • Right to lodge a complaint with the Hellenic Data Protection Authority (HDPA / APDPX) at dpa.gr

To exercise any of these rights, contact us at contact@athestate.com. We will respond within 30 days.

6. Data Security

We implement appropriate technical and organizational measures to protect your personal data, in line with Art. 32 GDPR. These include encryption of data in transit (TLS/SSL), restricted access on a need-to-know basis, secure backups, and staff training on data protection. However, no method of transmission over the Internet or electronic storage is 100% secure.

7. International Transfers

Some of our service providers (e.g., email, analytics) may be located outside the EEA. Where personal data is transferred outside the EEA, we use appropriate safeguards in line with Chapter V of the GDPR, including Standard Contractual Clauses (SCCs) adopted by the European Commission, or transfers to countries with adequacy decisions.

8. Cookies

We use cookies and similar tracking technologies. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. Categories:

  • Essential cookies: required for the site to function (no consent needed)
  • Analytics cookies: anonymous usage statistics (consent required)
  • Marketing cookies: targeted advertising (consent required, disabled by default)

You can change your preferences at any time via the cookie banner.

9. Children's Privacy

Our Service is not intended for children under 16 years old (Art. 8 GDPR). We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately so we can delete it.

10. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you (Art. 22 GDPR).

11. Changes to This Policy

We may update this Privacy Policy from time to time. The latest version is always available on this page with the “Last updated” date. Material changes will be communicated by email or a notice on the website.

12. Supervisory Authority

If you believe our processing of your personal data is unlawful, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA / Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα):

Hellenic Data Protection Authority
Kifissias 1-3, 115 23 Athens, Greece
Phone: +30 210 6475600
Website: www.dpa.gr

Privacy Questions?

Contact us at contact@athestate.com to exercise your rights under GDPR.

Contact Us