Personal Data Protection Policy

The Independent Authority “Consumer Ombudsman”, has a confidentiality duty for documents and data, of which it becomes aware in the context of the investigation and handling of complaints. It is committed to protecting and respecting your personal data, in accordance with national legislation and the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679).

Purpose of collection and processing of personal data
Greek Consumer Ombudsman, keeps, processes and transmits personal data exclusively within the framework of its competences, in order to be able to effectively fulfill its purpose and mission. In this context:

  1. It receives and forwards complaints to traders, as well as documents and case data exchanged between involved parties.
  2. It cooperates with other Authorities, National Enforcement Bodies, etc. in Greece and abroad mandated with the implementation of consumer protection legislation in Greece and the European Union. In the context of this cooperation, it may seek information and data that are related to consumer disputes under investigation and contribute to their effective resolution.
  3. It communicates the possible commission of criminal offences to the competent judicial authorities.

The Authority may further process personal data for the purposes of archiving, scientific research or statistical analysis, always in accordance with provisions of national and EU legislation.
It may also make public its Recommendations, removing from the relevant texts any personal or other identifying information of consumers.

Personal data maintained by ECC-Greece
Greek Consumer Ombudsman collects and processes information and data that are voluntarily disclosed by consumers during the submission of complaints. Such data include, for example, the name, occupation, address and contact details of the complainant. It also collects and processes information and data that may be submitted at a later stage as supplementary to a complaint, as well as any other information that has been collected legally and is deemed necessary for the effective investigation and resolution of complaints.

The Authority may also competently collect personal data from other public Authorities, organizations or even third parties. Processing of special data categories of (e.g. sensitive), like health-related data, is carried out based on their voluntary disclosure by the data subject or in the context of duties imposed by national and/or EU law.

Who is your data shared with?
Greek Consumer Ombudsman will not disclose your personal data to additional persons, organizations or other external entities, except those legally provided in order to process your case.

Retention time of personal data
Date retention is regulated according to provisions of the Organizational Charter of the Greek Consumer Ombudsman (Presidential Decree 55/2014 - Government Gazette A' 91/14.04.2014).

Rights of data subjects
As the data subject, you have the right to request a copy of personal data concerning your person that are lawfully collected and processed by Greek Consumer Ombudsman, in order to be able to exercise the right to correct, limit and/or object to the processing of these data. In case of objecting to the further processing of your personal data, any other involvement of the Authority to the complaint ceases immediately.

Contact details for personal data issues
For any questions and/or clarifications regarding the management and protection of your personal data by Greek Consumer Ombudsman or in case you wish to exercise any of your aforementioned rights as a data subject, you can contact the data protection officer by email:

Right to lodge a complaint to the Hellenic Data Protection Authority
In the event of an estimated breach of the rights of data subjects, you can contact the Hellenic Data Protection Authority (, which is responsible for the supervision of the application of the General Data Protection Regulation (GDPR), as well as other regulations concerning the protection of the individual from the processing of personal data.