1. Data Controller

This website (the ‘Website’) is operated by [COMPANY LEGAL NAME], a privately owned company registered in Greece, with tax identification number (ΑΦΜ) [ΑΦΜ NUMBER], having its registered address at [REGISTERED ADDRESS] (‘we’, ‘us’, ‘our’). We are the Data Controller for the purposes of Regulation (EU) 2016/679 (the General Data Protection Regulation, ‘GDPR’) and Greek Law 4624/2019.

You may contact us regarding any data protection matter at: info@Aegean_Peninsula.site.

2. What Personal Data We Collect

2.1 Information You Provide Directly

When you submit an Expression of Interest (EOI) through the form on this Website and later when/if we draft a Non-Disclosure Agreement (NDA), we collect:

•  Full name and professional title

•  Company name, registered address, and jurisdiction

•  Business email address and telephone number

•  Nature of interest and any additional information you voluntarily provide

2.2 Information Collected Automatically

When you visit the Website, we may automatically collect the following technical data:

•  IP address and browser type

•  Pages visited, time spent, and navigation paths

•  Device type and operating system

•  Referring URL

This information is collected via Google Analytics. Please refer to Section 6 (Cookies) for further details.

3. Legal Basis and Purposes of Processing

We process your personal data on the following legal bases under GDPR Article 6:

3.1 Performance of a Pre-Contractual Relationship (Article 6(1)(b))

Processing your EOI submission data is necessary to take steps at your request prior to entering into a contractual arrangement, specifically to provide you with the information package, manage the NDA process, and coordinate access to the encrypted data room.

3.2 Legitimate Interests (Article 6(1)(f))

We process analytical and technical data to understand how the Website is used, to improve its performance, and to ensure the security of the platform. Our legitimate interest in operating a professional investment marketing site is balanced against your privacy rights.

3.3 Consent (Article 6(1)(a))

Where we use non-essential cookies or tracking tools that go beyond the analytical purpose described above, we will seek your explicit consent via our cookie consent mechanism before activating such tools.

4. Data Retention

We retain your personal data for the following periods:

•  EOI form data (name, email, company): 3 years from the date of last contact or last communication related to your enquiry.

•  NDA-related personal data: 7 years from the date of execution of the NDA, in accordance with the applicable Greek contractual limitation period under the Greek Civil Code.

•  Cookie and analytics data: 13 months, in accordance with Hellenic Data Protection Authority (HDPA) guidelines.

•  Server and access logs: 12 months.

Upon expiry of the applicable retention period, your data will be securely deleted or anonymised.

5. Sharing of Personal Data

We do not sell, rent, or trade your personal data to third parties. We may share your data in the following limited circumstances:

•  Professional advisors: We have engaged legal, financial, and technical advisors under confidentiality obligations who may process your data on our behalf as Data Processors, strictly within the scope of their mandate.

•  Google LLC: Analytics data is processed by Google LLC as described in Section 6. Google acts as a Data Processor under a Data Processing Agreement incorporating EU Standard Contractual Clauses (SCCs) pursuant to GDPR Article 46(2)(c), covering transfers to the United States.

•  [OTHER THIRD-PARTY TOOLS]: [BRIEF DESCRIPTION OF PROCESSING AND TRANSFER SAFEGUARDS]

•  Legal obligation: We may disclose data if required by applicable law, court order, or regulatory authority, including the Hellenic Data Protection Authority (HDPA).

6. Cookies

6.1 What Are Cookies

Cookies are small text files stored on your device when you visit a website. They allow the website to recognise your browser and store certain information about your preferences or actions.

6.2 Types of Cookies We Use

•  Strictly necessary cookies: Required for the Website to function. They cannot be disabled without impairing the Website’s operation. No consent is required for these cookies.

•  Analytics cookies (Google Analytics): Used to understand visitor behaviour — pages viewed, session duration, referral source. These cookies are activated only with your consent and can be declined via the cookie consent banner.

6.3 Managing Cookies

You may withdraw consent for analytics cookies at any time by adjusting your browser settings or by clicking ‘Manage Cookie Preferences’ in the footer of this Website. Withdrawing consent does not affect the lawfulness of processing prior to withdrawal.

7. International Data Transfers

Your personal data may be transferred to and processed in the United States by Google LLC in connection with the use of Google Analytics. Such transfers are governed by Standard Contractual Clauses (SCCs) adopted by the European Commission pursuant to GDPR Article 46(2)(c). You may obtain a copy of the applicable SCCs by contacting us at info@Aegean_Peninsula.site.

8. Your Rights Under GDPR

As a data subject, you have the following rights under GDPR Articles 15–21:

•  Right of access (Art. 15): To obtain confirmation of whether we process your data and to receive a copy of it.

•  Right to rectification (Art. 16): To request correction of inaccurate or incomplete data.

•  Right to erasure (Art. 17): To request deletion of your data, subject to our legal obligations and retention requirements.

•  Right to restriction of processing (Art. 18): To request that we limit how we use your data in certain circumstances.

•  Right to data portability (Art. 20): To receive your data in a structured, machine-readable format.

•  Right to object (Art. 21): To object to processing based on our legitimate interests.

To exercise any of these rights, please contact us at info@Aegean_Peninsula.site. We will respond within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) at www.dpa.gr, Kifissias 1–3, 115 23 Athens, tel. +30 210 6475 600.

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encrypted data transmission (SSL/TLS), access-restricted data room infrastructure, and contractual confidentiality obligations binding all third-party processors.

No method of transmission over the internet is entirely secure. While we take all reasonable precautions, we cannot guarantee absolute security.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in applicable law or our data processing practices. The current version will always be available on this page, with the ‘Last updated’ date revised accordingly. Where changes are material, we will notify users who have previously submitted an EOI by email where practicable.

11. Governing Law

This Privacy Policy is governed by Greek law and the applicable provisions of GDPR (Regulation (EU) 2016/679) and Greek Law 4624/2019. Any dispute arising from this Privacy Policy shall be subject to the exclusive jurisdiction of the competent courts of [Thessaloniki], Greece.