Skip to main content

Privacy notice

This page says what we hold about you, why, where it lives, how long it stays, and how you get it back or have it deleted.

It is written from the database itself, not from a template. Every table that holds something of yours is named here.

Who we are

Controller: Hermeon — υπό σύσταση.

Contact: info@hermeon.gr.

We have not appointed a Data Protection Officer. Our assessment is that one is not required (Art. 37 GDPR: we are not a public authority, we do not monitor people systematically on a large scale, and we do not process special categories on a large scale) — our lawyer confirms this before we open.

Legal name
Hermeon — υπό σύσταση
VAT number
ΧΧΧΧΧΧΧΧΧ
Companies register (ΓΕΜΗ)
ΧΧΧΧΧΧΧΧΧΧΧΧ
Registered address
ΧΧΧΧΧΧΧΧΧΧ ΧΧ, ΧΧΧ ΧΧ Αθήνα

What we hold, and why

Nothing is collected just in case. Every line below exists because something specific cannot happen without it.

A visitor who asks a question (chat)
Name, email, what you wrote, your IP address and the language of the page. To answer you, and to stop the form being abused. Basis: your consent, and our legitimate interest in not being attacked.
An owner listing a property
Name, email, phone, the property's address and details, and photographs. To assess it, call you, and — if you agree — publish it. Basis: our contract with you and steps taken before it. Your address and phone are NEVER published in the catalogue.
A customer with an account
Email and name, phone, country, your language; your Greek identifiers (tax number, social security, TAXISnet username, IBAN, permit number, personal number); documents you upload and documents we issue; family members declared on a residence application; your conversation with us; your orders and payments. Basis: our service contract and our legal obligations.
A request to find a property
Name, email, phone and what you are looking for — area, budget, type. Basis: steps taken at your request before a contract.
The emails we send you
The address, subject and text of each message, and whether and when it was sent. Basis: legitimate interest — being able to answer "what exactly did you send me, and when".
The record of changes
Every change to a price, a detail, a document or a payment, with who made it and when. Basis: legitimate interest — one mistyped figure changes whether your permit is possible.
Cards
We never store a card number, anywhere. We keep the brand, the last four digits and the expiry. The card details go straight to our payment processor, inside their own form.

Who else sees it

We do not sell data and we do not give it to advertisers. It is seen only by those needed to run the service:

Where processing happens outside the EU it relies on the European Commission's Standard Contractual Clauses and the EU–US Data Privacy Framework.

Beyond that, we share details with lawyers, notaries, accountants and engineers ONLY when your own case requires it, and only what that case needs.

Supabase
The database and the files. Ireland (EU).
Vercel
Hosting for the site. Frankfurt (EU).
Stripe
Card payments. EU / USA.
Resend
Sending the emails. EU / USA.
Google
Only if you choose "Sign in with Google". EU / USA.
Cloudflare
The "not a robot" check on public forms, when enabled.

How long we keep it

Two periods are not ours to choose. The law sets them, and they outrank a deletion request (GDPR Art. 17(3)(b)):

Accounting records and invoices: ten (10) years from the end of the tax year they belong to — Greek law ν. 5104/2024, άρθ. 13 παρ. 2. For a payment made in 2026, that is until 31.12.2036.

When we act as agents on a sale of €10,000 or more, anti-money-laundering law makes us an obliged entity: identification data and the transaction file are kept for five (5) years after our relationship with you ends — Greek law ν. 4557/2018, άρθ. 30 (υπόχρεα: άρθ. 5 παρ. 1 περ. η΄).

Both concern the transaction file — not your conversation, your messages, your account or a property listing, which are deleted normally as soon as you ask.

What our own code enforces is already true today:

One point is still with our lawyer and accountant: how long a residence-application file stays after the permit is issued, and which limitation period applies to claims arising from our own services.

Property management link
15 days, then it dies and you ask for a new one.
Visitor conversation
The key in your browser lives 15 days from your last message; the link we email you stops working 15 days after the conversation goes quiet.
Interest in a region
When you press «I'm interested» on a region, we keep, anonymously, the region, the time and the kinds of property you picked. To count one vote per connection per day we keep a one-way fingerprint of your IP address — never the address itself — and delete it within two days.
A listing that was never confirmed
If you do not press the confirmation link, the listing and your details are deleted 15 days after you sent it.
Customer account
As long as you keep it. You can delete it yourself, whenever you like.
Property listing
While it is live. After a sale or withdrawal, you delete it by asking.
Record of sent email
The line saying something was sent stays; its content goes with the rest of your data.

✎ Outstanding — to be completed before we open.

Your rights — and exactly where to press

You do not have to write us a letter. The two that matter are buttons:

For access, correction, restriction, objection or portability, write to info@hermeon.gr. We answer within one month at the latest. Where processing rests on your consent you may withdraw it at any time, without affecting what was done before.

You have an account
Account → Profile → "Download my data" and "Delete my account & data". Both act immediately.
You listed a property
From the management link we emailed you: download a copy at once, or ask for erasure — a person carries that out, after calling you.
Neither of those
Email info@hermeon.gr from the address you want to see or erase.

What survives an erasure

"We deleted everything" is never quite true, and we would rather say so:

The payment record
Money that moved is an accounting record. Our payment processor keeps it under its own obligations (GDPR Art. 17(3)(b)).
That some email was sent
The address, subject and body are erased. A line remains saying something went out on a date.
Proof of the erasure itself
A one-way hash of your address and the date — so we can answer "yes, you were erased" without keeping the address to answer it with.

Cookies

We have no advertising or analytics cookies, which is why we do not throw a consent banner at you. What we use is strictly necessary:

Sign-in
Keeps your session while you are signed in.
Visitor conversation
The key to your own conversation, 15 days from your last message, unreadable by the page itself.
Language and text size
Your choice, in your browser. It never leaves it.

Automated decisions

No decision about you is made automatically. Working out whether a property meets the Golden Visa threshold is information, not a decision: a person confirms it before it is said to anyone. We do not profile.

Do you have to give us any of this?

No — but without some of it the work cannot happen. Without an email we cannot answer you. Without the property's details we cannot assess it. Without the documents the authority asks for, the application is not filed.

The minimum for asking us a question is a name and an email. Nothing else is asked for before it is needed.

If you disagree with how we handle it

Tell us first, at info@hermeon.gr — most of the time it is something we can fix the same day.

You also have the right to complain to the Hellenic Data Protection Authority: Kifissias 1-3, 115 23 Athens, Greece, tel. +30 210 6475600, contact@dpa.gr (https://www.dpa.gr).

The legal framework

So that what we say here can be checked — by you, by your lawyer, or by the authority — these are the laws it rests on:

Data protection
Κανονισμός (ΕΕ) 2016/679 (GDPR) and the Greek implementing law ν. 4624/2019.
Tax records
Greek law ν. 5104/2024, άρθ. 13 παρ. 2 — ten-year retention.
Anti-money-laundering
Greek law ν. 4557/2018, άρθ. 30 (υπόχρεα: άρθ. 5 παρ. 1 περ. η΄) — five-year retention, for transactions from €10,000.
Residence permits
Greek law ν. 5038/2023 (Κώδικας Μετανάστευσης). Golden Visa thresholds: άρθ. 100 ν. 5038/2023, όπως αντικαταστάθηκε από το άρθ. 64 ν. 5100/2024.
Estate agency
Greek law ν. 4072/2012, άρθ. 197-204 — written brokerage contract and entry in the agents' register.

Changes to this text

Last updated: 2026-09-26. If something material changes you will see it here with a new date — and where it affects you directly, we will email you.