Privacy notice
Privacy & data protection
This notice explains how Aegean Dots Private Markets (“Aegean Dots”, “we”) collects and uses personal data when you visit this website, register as an investor or owner, sign a Buyer Mandate or NDA, or contact us. Last updated 29 October 2026.
Aegean Dots follows the EU GDPR process.
We process personal data in line with the General Data Protection Regulation (EU) 2016/679 and Greek Law 4624/2019: only for stated purposes, on a lawful basis, kept to the minimum needed, protected with appropriate security, and never sold. You can exercise your rights at any time by writing to info@aegeaendots.com.
1. Who we are
The data controller is Aegean Dots Private Markets, Timoleontos Filimonos 11, Athens, Greece. Aegean Dots is a boutique Greek real estate and investment advisory. For any question about your personal data, contact us at info@aegeaendots.com.
2. Personal data we collect
We collect only what we need for the services you ask for:
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, email address, mobile / WhatsApp number, country | You, at registration or in an enquiry |
| Sign-in profile | Name, verified email and profile photo from Google or LinkedIn | Google or LinkedIn, when you choose to sign in with them |
| Company details | Company name, role, authority to act for the company | You |
| Identification for mandates | Passport number and residential or registered address | You, before signing a Buyer Mandate / NDA |
| Investment profile | Asset types, regions, budget range, strategy | You, and our conversations with you |
| Owners and sellers | Details of the property you ask us to market | You |
| Signed documents | Buyer Mandates, NDAs and their signature records | DocuSign, our e-signature provider |
| Portal activity | Assets viewed, requests made, documents opened, favourites | Your use of the portal |
| Technical and security | IP address, sign-in events, verification attempts | Automatically, to protect accounts |
We do not ask for special categories of data (such as health, religion or political opinions) and we ask you not to send them.
3. Why we use it and our legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and running your account, matching you with suitable opportunities, preparing property-specific mandates and NDAs | Taking steps at your request before a contract, and performing a contract (Art. 6(1)(b)) |
| Verifying identity and, where required, anti-money-laundering checks under Greek Law 4557/2018 | Legal obligation (Art. 6(1)(c)) |
| Staged disclosure: releasing confidential details only after a signed mandate and our approval; keeping an audit log of access | Legitimate interests in protecting owners’ confidential information (Art. 6(1)(f)) |
| Account security, fraud prevention and fixing errors | Legitimate interests (Art. 6(1)(f)) |
| Answering enquiries sent from this website | Steps at your request (Art. 6(1)(b)) or legitimate interests (Art. 6(1)(f)) |
| Sending news about new opportunities, where you ask for it | Consent (Art. 6(1)(a)), which you can withdraw at any time |
Where we rely on legitimate interests, we have balanced them against your rights. You can object at any time (see section 7).
4. Who we share it with
We never sell personal data. Owners do not receive your details without your consent. We share data only with service providers acting for us under data processing agreements, and only as far as they need it:
- Netlify: website hosting and database.
- Google and LinkedIn: sign-in, only if you choose them.
- DocuSign: electronic signature of mandates and NDAs.
- Meta (WhatsApp Business): delivering phone verification codes.
- Our email provider: account and transaction emails.
- Professional advisers (lawyers, notaries, auditors) and public authorities, where the law requires it or a transaction needs it.
5. Transfers outside the EU
Some providers above are based in, or use servers in, the United States. Where data leaves the European Economic Area, we rely on the EU–U.S. Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses with additional safeguards (GDPR Art. 45 and 46). You can ask us for a copy of these safeguards.
6. How long we keep it
| Data | How long |
|---|---|
| Account and investment profile | While your account is active, then 2 years after your last activity |
| Signed mandates, NDAs and identification data | 5 years after the relationship ends, or longer where tax, AML or limitation periods require |
| Unfinished registrations and enquiries that led nowhere | Up to 12 months |
| Security logs | Up to 12 months |
| Verification codes | Minutes. They expire after 10 minutes and are stored only in hashed form |
After these periods we delete the data or make it anonymous.
7. Your rights
Under the GDPR (Articles 15 to 22) you have the right to:
Access
The right to get a copy of your personal data.
Rectification
The right to correct data that is wrong or incomplete.
Erasure
The right to ask us to delete your data, where the law allows.
Restriction
The right to ask us to pause using your data.
Portability
The right to receive your data in a machine-readable format.
Objection
The right to object to processing based on legitimate interests.
Withdraw consent
The right to at any time, without affecting earlier processing.
No automated decisions
The right to we make no decisions with legal effects by automated means alone.
To exercise a right, email info@aegeaendots.com. We reply within one month (extendable by two months for complex requests) and may ask you to confirm your identity. This is free of charge.
9. Security
Data is encrypted in transit (HTTPS) and stored with our hosting provider under a data processing agreement. Confidential property and investor data is released only after the checks described on this website, enforced on our servers. Access is logged, verification codes are hashed and staff access is limited to people who need it. If a breach puts your rights at risk, we will notify the Hellenic Data Protection Authority within 72 hours and inform you without undue delay.
10. Other information
Children. Our services are for professional and adult investors only. We do not knowingly collect data from anyone under 18.
Is providing data required? Browsing public listings needs no personal data. Registering, signing a mandate and seeing confidential details need the data marked in the forms. Without it we cannot provide those services.
Changes. We may update this notice. The date at the top shows the latest version, and we will tell registered members about significant changes.
11. Contact and complaints
Questions or requests: info@aegeaendots.com, Aegean Dots Private Markets, Timoleontos Filimonos 11, Athens, Greece.
If you believe we have not handled your data properly, you can complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1-3, 115 23 Athens, www.dpa.gr, or to the authority in the EU country where you live or work.