Last updated: 30/10/2026
1. Data controller
Syntaxis L.P., Asimaki Fotila 10, Missolonghi 302 00, Greece, VAT no. —. For anything about personal data: suntaxismesolongi@gmail.com, tel. +30 2631 302754.
2. What data we collect
- Website visitors: IP address and browser details in the server logs, and cookies (see section 9).
- Portal clients: mobile number (for login), full name, e-mail (optional), preferred office, language, and the requests, messages and documents you send us.
- Security: SMS login codes are stored only as a cryptographic hash. We also record IP, browser and login time, and actions such as file downloads.
- Online meetings: date, time and video-call link.
- Special categories of data: some documents (e.g. medical reports for a disability pension) contain health data. We process them only because you send them to us for your case.
3. Purposes and legal bases
- Providing the services you ask for and communicating about your case: performance of a contract (Art. 6(1)(b) GDPR).
- Health data: your explicit consent, or the establishment and exercise of legal claims (Art. 9(2)(a) and (f) GDPR).
- Login security, fraud prevention and protection of our systems: legitimate interest (Art. 6(1)(f)).
- Tax and accounting obligations: legal obligation (Art. 6(1)(c)).
- Google Maps and Facebook content on the website: only with your consent (Art. 6(1)(a)).
4. Who receives your data
Your data is never sold or used for advertising. Only our office's authorised staff and the following providers, acting on our behalf, have access:
- Papaki / team.blue: website hosting, database and e-mail, with servers in the EU.
- Apifon (Greece): sending SMS. It receives only the number and the SMS text.
- Google: Google Meet and Google Calendar, only if an online meeting takes place.
- Google, Cloudflare (cdnjs) and Tailwind: deliver the page's fonts and icons. They receive your IP address when a page loads.
- Google Maps and Meta (Facebook): only if you click "Accept all" for cookies.
- Public authorities (e.g. e-EFKA): only what your case needs, and on your instruction.
5. Transfers outside the EU
Some providers (Google, Meta, Cloudflare) may process data in the USA. These transfers rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.
6. How long we keep data
- SMS login codes: 1 day.
- Login sessions: up to 30 days after they end. "Remember me": up to 30 days.
- SMS sending log: 1 year. Security log: 2 years.
- Requests, messages and documents: for the duration of our cooperation and then as long as the law or the defence of legal claims requires (usually up to 5 years). They are then deleted.
7. Security
- Documents are stored encrypted (AES-256).
- All traffic uses HTTPS.
- Login uses a one-time code.
- Only you and our authorised staff can access your files, and every download is logged.
- E-mails and SMS never contain message contents or your documents.
8. Your rights
- You have the right of access, rectification, erasure, restriction, portability and objection.
- You can withdraw your consent at any time.
- To exercise a right, write to suntaxismesolongi@gmail.com. We reply within one month.
- You may also lodge a complaint with the Hellenic Data Protection Authority (Kifisias 1-3, 115 23 Athens, www.dpa.gr).
9. Cookies
- SUNTAXISSID (necessary, until you close the browser): keeps you logged in and protects forms.
- STX_TD (necessary, up to 30 days, only if you tick "Remember me"): login without SMS on your device.
- stx_consent (necessary, 6 months): remembers your cookie choice.
- stx_lang (functional, 1 year): remembers your chosen language.
- Google Maps and Facebook (third party): loaded only if you click "Accept all".
We use no advertising or analytics cookies. You can change your choice via the "Cookie settings" link at the bottom of every page.
10. Changes
We may update this policy. The current version is always the one on this page.