Security & Confidentiality

10.1 Confidentiality by law and by contract

Everything you tell us is confidential. Our attorneys are bound by professional secrecy under the Greek Code of Lawyers (Law 4194/2013) and the Bulgarian Attorneys Act. All staff sign confidentiality undertakings. Our Client Agreement contains an express confidentiality clause with no time limit.

10.2 Where your data is stored

• No client data is stored on personal devices or in unmanaged cloud accounts.

10.3 Technical measures

• Encryption in transit (TLS 1.2 or higher) and at rest (AES-256).
• Two-factor authentication for all client and staff accounts.
• Role-based access: only the professionals assigned to your matter can open your file; every access is logged.
• Daily encrypted backups held in a separate EU location.
• Regular security updates and vulnerability management; annual review of access rights.
• Payment data: we do not store card details; payments are by bank transfer only.

10.4 Organisational measures

• Staff training on data protection and phishing.
• Documented procedure for security incidents: containment within 24 hours, notification to the supervisory authority within 72 hours where required by GDPR, and notification to affected clients without undue delay.
• Written data-processing agreements with every provider that touches client data.

10.5 Sharing with creditors and third parties

We disclose information to a creditor only to the extent needed for the negotiation and only after you have approved in writing what will be sent. We do not sell, rent or otherwise commercialise client data. Our proprietary negotiation-outcome data is fully anonymised and aggregated; it cannot identify any client.

10.6 Retention

Client files are retained for 5 years after the matter closes (AML and professional-liability requirements) or longer where a legal obligation requires it, and are then securely deleted. You may request earlier deletion of data we are not legally required to keep.