☰

Recruitment & Human Resource consulting solutions for small towns

Privacy policy

Last updated: 26 October 2026

This policy explains how SYNDESI S.M.P.C. ("we", "us") uses personal data when you visit Syndesi at syndesi-international.com, contact us or use our services. It applies to all our websites (listed in our legal notice); anything that applies to this website only is in the last section of this page. We process personal data under the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Greek law (Law 4624/2019 and Law 3471/2006).

+Who is responsible for your data

The controller of your personal data is SYNDESI SINGLE MEMBER P.C. (SYNDESI S.M.P.C.), Glyfada, Agios Georgios, Chora, 84300 Naxos, Cyclades, Greece, ΓΕΜΗ no. 159024238000, VAT no. EL801553663.

Email for anything about your personal data: privacy@syndesi-international.com. Phone: +30 693 290 2373.

We have not appointed a Data Protection Officer: the law does not require one for a business of our size and type. We review this every year. Your privacy contact is the address above.

+What we collect, why, and on what legal basis
  • Messages you send us (contact form, email, phone, live chat): your name, email, phone if given, your message and any files you attach. Purpose: to answer you and, if you ask, to prepare an offer. Legal basis: steps you ask for before a contract (GDPR Art. 6(1)(b)), or our legitimate interest in answering enquiries (Art. 6(1)(f)).
  • Contracts and payments (when you buy a service from us): the details needed to provide the service, invoice and get paid. Legal basis: the contract (Art. 6(1)(b)) and our legal obligations, such as tax and accounting law (Art. 6(1)(c)).
  • Spam and security protection: IP address, browser data and server logs. Legal basis: our legitimate interest in keeping the website and forms safe from abuse (Art. 6(1)(f)).
  • Your language and cookie choices: see "Cookies" below. Legal basis: strictly necessary storage (Law 3471/2006 Art. 4(5)); outside services only with your consent (Art. 6(1)(a)).
  • Visitor statistics (only if you allow Google Analytics in the cookie banner): the pages you view, how you arrived, your device and browser type and your approximate location, linked to a random ID. Purpose: to see which pages are useful and improve the website. Legal basis: your consent (Art. 6(1)(a); Law 3471/2006 Art. 4(5)). You can withdraw it at any time with "Cookie settings".
  • News and offers by email: only if you ask for them (consent, Art. 6(1)(a)), or, if you are already a customer, about similar services of ours, with a free opt-out in every email (Law 3471/2006 Art. 11).

Our legitimate interests are: answering people who contact us, running our business, and protecting our website. You can object to processing based on legitimate interest at any time (see "Your rights").

You do not have to give us any personal data to visit the website. If you want an answer, an offer or a contract, we need the details marked as required; without them we cannot answer or provide the service.

+Who receives your data

We do not sell your personal data and we do not use it for advertising. We share it only with:

  • service providers who work for us under a data-processing agreement (GDPR Art. 28) or who provide a service you use on our website:
    • Hostinger (EU): hosts this website and its database. Processor.
    • Google Workspace (Google Ireland / Google LLC): our email. Processor.
    • Google reCAPTCHA (Google LLC, USA): checks that contact-form submissions come from a person, not a spam robot. It receives your IP address and information about your browser and how you use the page.
    • onWebChat: our live chat. Receives what you type in the chat and technical data about your browser.
    • Calendly (Calendly LLC, USA): meeting booking. Receives the name, email and answers you give when you book.
    • Vimeo (Vimeo.com Inc., USA): our videos.
    • Google Analytics (Google Ireland Ltd., with Google LLC, USA): visitor statistics, only if you allow them in the cookie banner. Receives the pages you view, how you arrived, your device and browser type and your approximate location (worked out from your IP address, which Google Analytics does not store), linked to a random ID in its cookie. We have turned off Google signals and advertising features. Processor (Google Ads Data Processing Terms).
    • Google Fonts and jsDelivr: deliver our fonts and slideshow code. They receive your IP address but do not set cookies.
  • our accountant and, when the law requires it, tax and other public authorities and courts;
  • the partners needed to provide a service you buy from us (listed in the last section of this page, where they apply).

Outside services that run on the page (reCAPTCHA, chat, booking, videos) may also use the data as independent controllers under their own privacy policies.

+Transfers outside the European Economic Area

Some of the providers above are based in the USA or may process data there. Where a provider is certified under the EU-US Data Privacy Framework, the transfer relies on the European Commission's adequacy decision (Decision (EU) 2023/1795). Otherwise it relies on the European Commission's Standard Contractual Clauses (GDPR Art. 46). You can ask us for a copy of the safeguards at privacy@syndesi-international.com.

+How long we keep your data
  • Enquiries that do not lead to a contract: up to 2 years after our last contact.
  • Contracts, invoices and accounting records: for the period Greek tax and commercial law requires.
  • Server and security logs: up to 6 months.
  • Visitor statistics (Google Analytics): 14 months, then Google deletes them.
  • Email news: until you unsubscribe.
  • Cookies: see "Cookies" below.

Longer only if we need the data to establish or defend a legal claim. Specific periods for this website are in the last section of this page.

+Your rights

You have the right to:

  • access your personal data and get a copy (GDPR Art. 15);
  • have it corrected (Art. 16) or erased (Art. 17);
  • restrict its use (Art. 18);
  • receive it in a usable electronic format or have it sent to someone else (Art. 20);
  • not be subject to a decision based solely on automated processing that significantly affects you (Art. 22). We do not make such decisions.

Right to object. You can object at any time to processing based on our legitimate interest, for reasons relating to your situation, and at any time and without giving a reason to the use of your data for direct marketing (Art. 21).

Consent. Where we rely on your consent, you can withdraw it at any time, as easily as you gave it. This does not affect what we did before you withdrew it (Art. 7(3)).

To use any of these rights, write to privacy@syndesi-international.com. It is free. We answer within one month; if a request is complex we may need two more months and will tell you within the first month (Art. 12). We may ask you to confirm your identity.

Complaints. You can complain to the Hellenic Data Protection Authority, Kifisias 1-3, 115 23 Athens, Greece, tel. +30 210 6475600, contact@dpa.gr, www.dpa.gr (online form on its website), or to the data protection authority of the EU country where you live or work (Art. 77). We would be grateful if you contacted us first.

+Children

Our general website services are not aimed at children under 15. In Greece, a person under 15 cannot consent alone to online services; a parent or guardian must consent for them (GDPR Art. 8, Law 4624/2019 Art. 21). If we learn that we received data from a child under 15 without that consent, we delete it. Programmes for young people have their own rules in the last section of this page.

+Cookies and outside services

We store only what the website needs on your device without asking: your language (syndesi_lang) and your cookie choice (syndesi_consent), each kept for 182 days. While you use a step that needs it (an email code, registration or logging in), we also set a session cookie and, after you log in, login cookies; they last until you close your browser or log out. Outside services that may set their own cookies load only after you accept them in our cookie banner. You can change your choice at any time with "Cookie settings" at the bottom of every page. Details, including each cookie, are in our cookie policy.

+Security

We protect your data with appropriate technical and organisational measures (GDPR Art. 32): encrypted connections (HTTPS), restricted access, files sent through our forms stored outside the public website, and regular updates. If a breach is likely to put your rights at risk, we will tell the authority and, where the law requires, you.

+New purposes and changes to this policy

If we want to use your data for a purpose other than the one we collected it for, we will tell you first (GDPR Art. 13(3)) and, where needed, ask for your consent. We update this policy when our services or the law change; the date at the top shows the latest version. Important changes are announced on the website.

+Language versions

This policy is available in several languages. If the versions differ, the Greek version prevails.

+If you live outside Greece
+Specific to Syndesi: job seekers and employers
Job applications and CVs

If you apply for work through our contact form or by email, we collect your name, email address and CV, and optionally your cover letter and LinkedIn profile.

We use them to find you suitable roles, and we share them only with employers we believe are a good match for you, for recruitment purposes only. We do not sell your information. We do this on the basis of our legitimate interest in filling roles for our clients and your interest in being considered for them (GDPR Art. 6(1)(f); Greek Law 4624/2019 Art. 27, which protects job candidates in the same way as employees). You can object at any time, including to your CV being sent to a particular employer.

We keep CVs, cover letters and any other files you send us for up to 12 months from the date we receive them, so that we can consider you for roles that come up during that time. After 12 months we delete them. You can ask us to delete them sooner at any time by writing to privacy@syndesi-international.com.

What not to put in your CV

Please do not include sensitive information that an employer does not need, such as health, religion, political opinions, trade-union membership or ID numbers. If it is in your CV anyway, we use it only as part of your application and do not pass it on separately.

Candidates we find ourselves

Sometimes we find candidates through public professional profiles (for example LinkedIn), job boards or referrals. In that case we tell you, at the latest within one month or when we first contact you, what data we hold, where we got it and that you can ask us to delete it (GDPR Art. 14).

Employers and their contacts

For employers who work with us, we keep the business contact details of the people we deal with and the information needed for the recruitment contract and invoicing, for the period Greek tax and commercial law requires.

Your employer account on this site

Employers can register on this site to read our full terms for employers and print the employer contract. To register we ask only for your email address and a password you choose.

We check that the address is written correctly and that its domain can receive email (a check of the domain's mail record; no outside service is used), then send a 6-digit code to the address. The code is valid for 5 minutes. While you register, a session cookie keeps your registration in progress for up to 30 minutes.

Your account holds your email address (which is also your login name), a display name taken from the part before the @, your password (stored only in scrambled form, never readable), the kind of address (business, public body, non-profit or personal, read from its domain), the language you registered in and the date. The login and session cookies are strictly necessary and are listed in our cookie policy. The code, welcome and approval emails are sent through Google Workspace, which acts as our processor.

We process these details to set up and run your account at your request (GDPR Art. 6(1)(b)). The code is deleted after 5 minutes and the registration record after 30 minutes. We keep the account until you ask us to delete it, and we delete accounts that have not been used for 2 years. To delete your account at any time, write to privacy@syndesi-international.com.

Who sees the terms for employers

The full terms for employers and the contract open only for accounts we have approved. A person at Syndesi checks every registration; no decision is taken by automated means alone (GDPR Art. 22). When you register, we receive an email with your address, the kind of address, your language and your account number. If a registration is refused because the address does not work, we receive the address and the reason, at most once a day, so that we can help.

We record our decision (approved or blocked) and its date in a list that we keep as long as your account. We do this on the basis of our legitimate interest in sharing our contract terms with employers who are genuinely interested in our services (GDPR Art. 6(1)(f)). You can object at any time.

Automated decisions

People, not software, decide which candidates we put forward. See our AI notice.