PRIVACY POLICY & COOKIES POLICY

OFFICE25ARCHITECTS | https://o25.gr

Last updated: 6 November 2026

1. Introduction

OFFICE25ARCHITECTS (“we”, “us”, “our”) respects the privacy of visitors and professional contacts. This Policy explains the collection, use, retention and protection of personal data through https://o25.gr (the “Website”), together with your rights. Processing is governed by Regulation (EU) 2016/679 (GDPR), applicable Greek legislation including Law 4624/2019, and electronic communications rules including Law 3471/2006.

2. Data Controller and Contact

OFFICE25ARCHITECTS

Leof. Meg. Alexandrou 9

54640 Thessaloniki, Greece

Telephone: +30 2310 244 114

Email: o25@o25.gr

Website: https://o25.gr

For privacy requests, email o25@o25.gr with the subject “Data Protection Request”. The legally registered identity of the controller should be confirmed before publication.

3. Personal Data Collected

We may process names, email addresses, telephone numbers, enquiry messages and information voluntarily submitted through contact forms or correspondence. We may also process IP addresses, browser and device information, access dates, referring pages, technical diagnostic logs and security-related information. With the relevant consent, analytics and advertising tools may process page visits, online identifiers, traffic-source parameters and interaction events. Do not include sensitive or confidential information in enquiries unless necessary.

4. Purposes and Legal Bases

We use enquiry information to respond to requests and consider potential engagements (Article 6(1)(f), legitimate interests, or Article 6(1)(b), pre-contractual steps, depending on context). Client correspondence may be processed to perform contracts (Article 6(1)(b)). Security and Website administration rely on legitimate interests (Article 6(1)(f)); compliance records rely on legal obligations (Article 6(1)(c)). Non-essential analytics and advertising technologies rely on consent (Article 6(1)(a) GDPR and applicable electronic communications law). Information may also be processed to establish, exercise or defend legal claims where justified. Our legitimate interests include secure operation, responding to genuine enquiries and managing our professional practice; we balance these against individual rights.

5. Contact Forms

Website enquiries may be stored in the Website administration system and accessed by authorised personnel and service providers. Supplying contact information is voluntary, but we may be unable to reply without sufficient details. Submitting an enquiry does not automatically enrol you in marketing communications.

6. Cookies and Similar Technologies

Cookies, local storage and pixels can support essential Website operation, remember privacy preferences, measure audience activity and assess advertising performance. Strictly necessary technologies may operate without consent where a legal exemption applies. Optional Google Analytics 4 and Meta Pixel technologies are used only where the relevant consent has been provided. Consent must be freely given, specific, informed and unambiguous, and may be refused or withdrawn without loss of access to essential Website content.

6.1 Cookie examples

Depending on the actual deployment and your preferences, identifiers may include _ga and _ga_* (Google Analytics), _fbp and _fbc (Meta), and local consent-preference storage. These examples are not a verified inventory. The exact cookies, provider identities, purposes and lifetimes must be checked against the live Website and published in the cookie settings or this Policy.

6.2 Consent management

The Website provides controls to accept, reject and manage optional tracking. You may change or withdraw consent using the Website’s cookie preferences controls. Withdrawing consent does not invalidate earlier lawful processing. Browser settings also permit deletion of stored cookies, but deleting them may reset your saved preferences. Google Consent Mode communicates signals such as analytics_storage, ad_storage, ad_user_data and ad_personalization; it is not a substitute for legally valid consent.

7. Service Providers and Recipients

Data may be shared where necessary with hosting, cloud/database, technical maintenance, communications and professional service providers, and with Google or Meta in connection with consented measurement services. Providers may act as processors or independent controllers depending on the activity. Appropriate contractual safeguards are sought where required. Data may also be disclosed to competent authorities when legally required. We do not claim that information is never shared with third parties.

8. International Transfers

Some providers may access or process data outside the European Economic Area. Where applicable, transfers must rely on a valid legal mechanism, such as an EU adequacy decision or Article 46 safeguards, including Standard Contractual Clauses and supplementary measures where necessary. Details of applicable safeguards may be requested by email.

9. Retention

Data is retained only as long as necessary for the relevant purpose or as required by law. Enquiries are kept for a reasonable response and follow-up period; contractual and accounting records follow applicable legal periods; security logs follow operational needs; analytics and advertising records follow configured service retention periods; consent records may be kept to demonstrate compliance. Specific retention schedules must be confirmed against the live systems before publication. Data is then deleted or anonymised unless continued retention is justified.

10. Security and Breaches

We seek to apply appropriate technical and organisational safeguards, including access restrictions, secure communications and appropriate provider controls. No system can guarantee absolute security. Where a personal data breach triggers GDPR obligations, we will notify the competent authority and affected individuals where required by law.

11. Your GDPR Rights

Subject to applicable conditions, you may request access, rectification, erasure, restriction, portability, or object to processing. You may withdraw consent at any time and exercise applicable rights concerning solely automated decisions with legal or similarly significant effects. Send requests to o25@o25.gr. We may verify identity where necessary and generally respond within one month; lawful extensions of up to two further months may apply for complex or numerous requests.

12. Complaints

You may complain to the Hellenic Data Protection Authority (HDPA), https://www.dpa.gr, or another competent EU supervisory authority where applicable. You may also contact us first to discuss your concern.

13. Automated Decision-Making

The Website is not intended to make solely automated decisions producing legal or similarly significant effects about visitors. Third-party analytics and advertising services may perform statistical analysis or profiling according to their own practices and applicable consent requirements.

14. External Links and Children

External websites have their own privacy practices, for which their operators are responsible. The Website is not directed specifically at children and does not intentionally seek children’s personal data for marketing. Contact us if you believe inappropriate information was submitted.

15. Policy Changes