(Last updated: 01.11.2026)
This Policy provides information on the processing of personal data in accordance with Articles 12–14 of Regulation (EU) 2016/679 (GDPR) and applicable national legislation, including Law 4624/2019, which sets out measures for the implementation of the GDPR in Greece.
1. Data controller and contact details
The data controller is the trader operating in Greece as a sole proprietorship (ατομική επιχείρηση) under the trading name GREXIMO.
- Professional activity: real estate brokerage — μεσίτης ακινήτων.
- General Commercial Registry (Γ.Ε.ΜΗ.) number: 164210006000.
- Tax identification number (Α.Φ.Μ.): 176520812.
- Professional Chamber of Thessaloniki: registration No. 145932.
- Address: Sarantaporou 17, 54641 Thessaloniki, Greece.
- Email: office@greximo.com; telephone: +30 694 527 5975.
Questions about personal data and requests to exercise data protection rights should be sent to the email or postal address above.
2. Categories of personal data
Depending on the enquiry and the service, we process contact and correspondence details (name, email address, telephone number, preferred language and message content); information about a property sought or offered (location, type, budget, timeframes, viewings and property features); contract and transaction data (identification, tax and address details, information on ownership, authority to act, invoicing and payments, where necessary); and technical data collected during visits to the website (IP address, browser and device, pages visited, date and time, referral source and online identifiers).
When making an initial enquiry, please do not send identity documents, bank documents or other information that is not necessary to handle the enquiry. (Principle of data minimisation — Article 5(1)(c) GDPR.)
3. Sources of personal data
We receive personal data directly from individuals through website forms, email, telephone calls, meetings and the communication channels used. Where necessary for an instructed service, data may be provided by authorised representatives, property owners, partner estate agents, property platforms and public registers. Where data have not been obtained directly from the individual, we provide information about their source in accordance with the applicable rules (Article 14 GDPR).
4. Purposes and legal bases for processing
Personal data are processed where an applicable legal basis exists under Article 6(1) GDPR. The legal basis for each purpose is set out below.
4.1. Handling enquiries and viewings. Data are processed to provide information, clarify requirements, identify suitable properties and arrange meetings and viewings. The legal basis is taking steps prior to entering into a contract or, for general correspondence, the legitimate interest in responding to enquiries.
4.2. Brokerage services. Data are processed to perform an instructed service, present properties, coordinate the parties involved and prepare the necessary documentation. The legal basis is the performance of a contract or steps taken at the individual’s request prior to entering into a contract.
4.3. Legal obligations. Data are processed to comply with accounting, tax and other applicable legal requirements, including anti-money laundering measures where applicable. The legal basis is compliance with a legal obligation.
4.4. Security and protection of rights. Necessary data and correspondence may be processed to ensure website security, prevent misuse and establish, exercise or defend legal claims. The legal basis is legitimate interest.
4.5. Marketing. Marketing communications unrelated to handling a specific enquiry or performing an instructed service are sent only with prior consent. Consent may be withdrawn at any time (Article 6(1) and Article 7(3) GDPR). Submitting an enquiry does not constitute consent to marketing.
4.6. Analytics and advertising technologies. Non-essential analytics and advertising technologies are used with consent where required by applicable law.
5. Recipients of personal data
Access to personal data is limited to individuals and organisations that require it for the relevant purpose. These may include property owners and prospective buyers or tenants, partner estate agents, lawyers, notaries, accountants, engineers, hosting, email and technical support providers, and competent authorities where disclosure is required by law.
When a property is marketed, the agreed information and photographs may be published on the relevant property platforms. Identity documents, bank details and non-public contractual documentation are not included in the public presentation of the property. Providers processing data on behalf of GREXIMO must comply with the requirements applicable to data processors. Organisations that independently determine the purposes and means of processing act as separate data controllers. Providers processing data on our instructions are bound by the requirements of Article 28 GDPR.
6. Cookies and similar technologies
The website uses cookies and similar technologies for its technical operation, to remember consent preferences and, following consent, to enable optional functions and analytics. Non-essential technologies require prior consent (Article 4(5) of Greek Law 3471/2006; Article 6 GDPR where personal data are processed).
Details of the categories, providers, purposes and retention periods are published in the separate Cookie Policy. Preferences can be changed or consent withdrawn at any time using the “Cookie settings” button at the beginning of that Policy. The page is also accessible through the “Cookies and settings” link in the website footer.
7. Transfers outside the European Economic Area
Some technology providers, including Google and Meta, may process data outside the European Economic Area. Any such transfer must rely on an applicable mechanism under Chapter V of the GDPR, such as an adequacy decision or appropriate safeguards (Articles 44–49 GDPR). Information about the applicable safeguards and how to obtain a copy is available on request at office@greximo.com.
8. Retention periods
- Enquiry data are retained until the enquiry and any necessary follow-up have been completed.
- Contractual, accounting and tax documents are retained for the periods prescribed by applicable law.
- Where anti-money laundering legislation applies, the relevant documents are retained for five years after the end of the business relationship or the date of an occasional transaction, unless the law permits a longer period.
- Data used for marketing are retained until consent is withdrawn or the relevant purpose ceases to apply.
- On greximo.com, statistical records in Koko Analytics are automatically deleted after 36 months under the current setting, in accordance with the principle of storage limitation (Article 5(1)(e) GDPR). Cookie retention periods are set out in the Cookie Policy.
Once the applicable retention period expires, the data are deleted or anonymised. If a dispute or investigation is pending, the necessary data may be retained until it has been concluded and the applicable time limits have expired.
9. Your rights and how to exercise them
Subject to the conditions laid down in the GDPR, you have the right of access, rectification, erasure, restriction of processing, data portability, the right to object to processing based on legitimate interests, and the right to withdraw consent (Articles 15–21 and Article 7(3) GDPR).
If you object to processing for direct marketing, your data will no longer be used for that purpose. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal. Erasure may be limited by a legal obligation to retain data.
To exercise a right, send a request to office@greximo.com. Describe your request and provide sufficient information to identify the relevant enquiry or contractual relationship. Where there are reasonable doubts about your identity, additional information necessary to confirm it may be requested.
A response will be provided without undue delay and, as a rule, within one month (Article 12(3) GDPR). Where necessary, this period may be extended by up to two further months, with the reasons communicated within the first month.
10. Complaints to a supervisory authority
You have the right to lodge a complaint with a supervisory authority in the country of your habitual residence, place of work or the alleged infringement (Article 77 GDPR).
In Greece, the competent authority is Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα — Hellenic Data Protection Authority, Kifisias 1–3, 11523 Athens, Greece, www.dpa.gr.
11. Automated decision-making
GREXIMO does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect individuals (Article 22 GDPR). Analytics and advertising technologies do not replace the individual handling of enquiries or the provision of brokerage services.
12. Changes to this Policy
We reserve the right to update this Policy when our services, technologies or applicable requirements change. The current version is published on this page with its update date.
Contact for personal data matters: office@greximo.com