Who we are
The controller of the personal data collected through this website and our services is Vasilis Stamos, sole proprietorship, trading as KodeX GRC, based in Larissa, Greece, VAT number 128962994.
As a natural person operating as a sole trader, the controller is also the point of contact for data protection matters. For any question concerning the processing of personal data, you can write directly to privacy@kodexgrc.gr.
What data we collect
We collect only the data needed for the purpose you give it to us for. We do not collect data "in case it is useful one day". Specifically:
A. When you book an intro call
- Name, email and company — required
- The date and time of the call you chose
B. Through the contact form
- Name, company, work email and message — required
- Phone, role, organisation size, services of interest, timeline — optional
C. Through the free gap analysis
Your answers (sector, size, frameworks, existing security measures), the email address the results are sent to, and optional notes. To confirm the email is yours we send a six-digit code that is valid for 10 minutes and is not kept after use. The answers are mostly company data — we do not ask for personal data of your customers or staff.
D. Visit counting — without cookies
We count how many visits each page gets and where visitors come from
(e.g. search, LinkedIn, ChatGPT), so we know which content is useful.
For each page view we receive the page path, the site you came from
(referrer) and the utm_source tag if present.
We do not store your IP address and we store nothing on your
device. To count each visitor once a day, a code is computed
from the IP and browser with a random "salt" that exists only in the
server's memory and changes every day — so it cannot be linked to you,
not even by us. Only totals are kept. If your browser sends
Global Privacy Control or Do Not Track, your visit is
not counted at all.
E. Server logs
- IP address, date/time, page, user agent — for the security of the website (detecting and blocking attacks)
F. Client records and correspondence
When you book a call, write to us or complete a gap analysis, a record is created with your contact details, the history of those requests and notes from our conversations. We use it only to serve you and to follow a possible engagement.
Purposes & legal basis
We process your data only for the purposes below, with the legal basis stated for each. Article references are to Regulation (EU) 2016/679.
Retention periods
We keep your data only as long as needed. Deletion runs automatically every day in our system, not "when we remember". Specifically:
Backups are encrypted and run on a rolling 30-day cycle; anything deleted from our systems disappears from the backups within 30 days at the latest.
Who we share it with
We do not sell, rent or trade your personal data. We share it only with the processors we need in order to operate — and only as far as necessary.
Providers we use
- Website hosting — Hetzner Online GmbH, Germany. The server and the data are in a data centre inside the EU.
- Email delivery — a provider based in the EU with servers in the EU, for confirmation emails, verification codes and gap-analysis results.
- Video calls — Microsoft Teams (Microsoft Ireland Operations Ltd), for the calls you book with us.
- Accountant — for invoicing, if we work together.
- Authorities — only where there is a legal obligation and a documented request.
Clients & projects
When we deliver a compliance project for you, we may have access to data you process as controller. In that case you are the controller and we are the processor, under a DPA signed before the project starts. This applies especially to GDPR, ISO 27001 and penetration-testing projects.
Transfers outside the EU
The website, form data and backups are hosted inside the EU. Fonts and every file of the website are served from our own server — nothing is loaded from Google Fonts, a CDN or any other third party.
The only possible transfer outside the EEA concerns Microsoft (Teams), when we hold our call. Microsoft may also process data in the United States, under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses (Articles 45–46 GDPR). If you prefer another platform or a phone call, just tell us.
Your rights
You have the following rights over your data. Each can be exercised by email to privacy@kodexgrc.gr. We reply within 30 days — usually much sooner.
To learn what data we hold about you, for what purpose, and to whom we've given it.
To have inaccurate or incomplete data about you corrected.
To have your data deleted, unless we have a legal obligation to keep it.
To have processing suspended while a request or dispute is being examined.
To receive your data in a structured, machine-readable format (JSON, CSV).
To object to processing based on legitimate interest.
To withdraw your consent — going forward, without retroactive effect.
Not to be subject to a decision based solely on automated processing. We don't make such decisions.
How we protect it
We implement the technical and organisational measures required by Article 32 GDPR, proportionate to the nature of the data and the risk. We're professionals who audit others' compliance — it would be absurd not to apply the same measures to ourselves.
Technical measures
- Encryption in transit — HTTPS/TLS 1.3 for every connection, with HSTS.
- Two layers of firewall — only the website ports are open; administration is not reachable from the internet.
- Automatic attack blocking — addresses that scan or try passwords are blocked automatically.
- Two-step login (MFA) — on every administrative account, without exception.
- Audit log — every administrative action is recorded: who, when, what.
- Encrypted backups — daily, in a separate location inside the EU, with restore tests.
- Least privilege — the application runs isolated and can only talk to the services it needs.
Organisational measures
- Least privilege — only what's essential to deliver the service.
- Confidentiality commitments — every associate signs an NDA before starting.
- Training — annual data protection and phishing training.
- Breach management process — with a 72-hour escalation flow, as GDPR requires.
- Internal audits — annual compliance review of our own processes.
Cookies & tracking
Our website does not use cookies. That is why there is no cookie banner: there is nothing to ask consent for.
Visit counting
We count visits without cookies, without storing anything on your device and without storing IP addresses — details in section 02, point D. We do not use Google Analytics, Facebook Pixel or any other third-party tool.
LocalStorage
The free gap analysis uses your browser's localStorage to
keep your progress, so you can continue where you left off. This data:
- Stays on your device until you submit the form
- Is not used for tracking or profiling
- Is deleted with the "Delete progress" button and after submission
Third-party fonts & assets
None. Fonts, images and code are served from our own server, so your visit is not disclosed to third parties.
Data breach
If the security of your data is breached — accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access — we follow the process set by Article 33 GDPR:
- Immediate assessment — within 4 hours of detection, with entry in our internal breach register.
- Notification to the authority within 72 hours — where there's a risk to your rights and freedoms.
- Notification to data subjects — without undue delay, where the risk is high.
- Recording and analysis — what went wrong, what we change, how we prevent recurrence.
If you're a client, we commit to notifying you within 24 hours of discovering a breach affecting your data — earlier than the legal deadline, because we consider it an obligation within our relationship.
Changes to this policy
We may update this policy to reflect changes in our practices or legal requirements. Each version carries a date and version number at the top of the page.
Material changes — for example, a new processing purpose, a new recipient of data, a longer retention period — are announced prominently on the website for at least 30 days, and sent by email to those with an active relationship with us.
Non-material changes — clarifications, wording corrections, contact updates — take effect immediately, with an updated version date.
Complaining to the DPA
If you believe we're infringing your rights in the processing of your personal data, you can lodge a complaint with the Hellenic Data Protection Authority (HDPA). Before it reaches that point, we'd appreciate the chance to discuss it — it's often resolved with one email.
Last updated: 20 October 2026 · Version v3.5 · Previous versions available on request.