1. Who is responsible for your data
ORBIT ΣΥΜΒΟΥΛΟΙ ΙΚΕ (Orbit Consultants P.C.), 14 Nireos Street, 17561 Palaio Faliro, Athens, Greece, VAT No. 801343280, GEMI No. 154774501000 (“Orbit”, “we”) is the data controller for the personal data described in this policy. We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and Greek Law 4624/2019.
Data Protection Officer: Eleftheria Achladianaki, Managing Partner. Contact: info@orbit-consultants.com, +30 210 984 1233, or by post at the address above, marked “Data Protection”.
2. Whose data we process
This policy applies to visitors of this Website, to clients and prospective clients and their representatives, to participants in our training programmes, to our associates, suppliers and subcontractors, and to candidates who apply to work with us.
3. What data we collect and why
| Who | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Website visitors | IP address, browser and device data, pages visited, cookie preferences | Operate and secure the Website; measure use (analytics, only with consent) | Legitimate interest (art. 6(1)(f)); consent for analytics cookies (art. 6(1)(a)) | Server logs 12 months; Google Analytics data 14 months (only if you consent to analytics cookies) |
| Contact-form users | Name, email, phone, company, message | Respond to your enquiry | Pre-contractual steps (art. 6(1)(b)) or legitimate interest | 12 months after last contact, unless an engagement follows |
| Clients and their representatives | Contact and identification details, role, engagement data, invoicing data | Provide consulting and training services; invoicing; legal and tax obligations | Contract (art. 6(1)(b)); legal obligation (art. 6(1)(c)) | Duration of the engagement plus 10 years (tax and accounting law) or the applicable limitation period |
| Training participants | Name, email, employer, attendance, test results, certificates issued | Deliver the course, issue attendance certificates, report attendance to the client or certification body where required | Contract; legal obligation (e.g. Bank of Greece recertification rules) | 5 years after the course, or longer where a certification rule requires |
| Associates, suppliers | Contact details, CV, qualifications, bank details for payment | Manage the cooperation; pay invoices | Contract; legal obligation | Duration of the cooperation plus 10 years |
| Job or cooperation applicants | CV, cover letter, qualifications, interview notes | Assess the application | Pre-contractual steps; legitimate interest | 12 months after the process ends, unless you agree to longer |
We do not process special categories of data (health, political opinions, etc.) unless you provide them yourself and the law allows it. We do not use automated decision-making or profiling.
4. Where the data comes from
Mostly from you directly. For clients and associates we may also receive data from your employer, from public registers (GEMI, professional registers) or from our training partners (for example the Hellenic Bank Association / Hellenic Banking Institute) in the context of a joint programme.
5. Who we share data with
We share personal data only when necessary, with: (a) our associates and subcontractors who work on your engagement under confidentiality obligations; (b) service providers that host our Website, email and IT systems, and our accountants and legal advisers, acting as processors or independent controllers under written terms; (c) training partners and certification bodies, where a course requires attendance reporting; (d) public authorities and courts, where the law requires. We never sell personal data.
6. Transfers outside the EEA
Our systems are hosted in the EU wherever possible. Where a provider (for example an email or analytics service) processes data outside the EEA, we rely on an EU adequacy decision or on the European Commission’s Standard Contractual Clauses with additional safeguards.
7. How we protect data
We apply appropriate technical and organizational measures: access controls, encrypted connections (HTTPS), secure storage, confidentiality undertakings for everyone with access, and regular review of our providers. If a breach is likely to put your rights at risk, we will inform you and the Hellenic Data Protection Authority as the GDPR requires.
8. Your rights
You have the right to: access your data; have inaccurate data corrected; have data erased where there is no longer a lawful reason to keep it; restrict or object to processing based on legitimate interest; receive data you gave us in a portable format; and withdraw consent at any time, without affecting earlier processing. To exercise any right, write to info@orbit-consultants.com. We respond within one month; we may ask you to confirm your identity first.
You also have the right to lodge a complaint with the Hellenic Data Protection Authority (Kifissias 1-3, 11523 Athens, www.dpa.gr, complaints@dpa.gr).
9. Cookies
Our use of cookies is explained in our Cookie Policy.
10. Changes to this policy
We may update this policy when our services or the law change. The current version is always published on this page with its date.
Last updated: November 2026