PRIVACY POLICY

DART FIRM

Effective Date: 14 October 2026
Last Updated: 14 October 2026

1. Introduction

DART FIRM (“DART”, “we”, “us” or “our”) respects the privacy of individuals and is committed to the lawful, fair and transparent processing of personal data.

This Privacy Policy describes how personal data is collected, used, disclosed, retained and protected in connection with the website www.dartfirm.com, our professional communications and our business consulting, advisory and commercial activities.

This Policy has been prepared with reference to Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”), Greek Law 4624/2019, Greek Law 3471/2006 and other applicable data protection legislation.

It applies to individuals who:

• Visit or interact with our website.

• Submit an enquiry or request a discovery call.

• Represent prospective or existing business clients.

• Communicate with us in a professional capacity.

• Participate in business negotiations, consulting engagements or commercial partnerships.

• Are identified in information lawfully received during the provision of professional services.

This Policy applies where DART determines the purposes and means of processing personal data and therefore acts as a data controller.

Where DART processes personal data solely on behalf of a client under that client's instructions, the respective parties' contractual data protection arrangements shall govern that processing.

2. Identity and Contact Details of the Data Controller

The data controller responsible for DART's own business operations is:

Registered Legal Name: ΝΤΟΥΒΑΛΗΣ ΧΡΗΣΤΟΣ (DOUVALIS CHRISTOS)

Commercial Designation: DART FIRM

Legal Form: Sole Proprietorship (Ατομική Επιχείρηση)

Registered Business Address: Ithakis 22, Pallini, Attica, 15351, Greece

Tax Identification Number (ΑΦΜ): 168060121

General Commercial Registry Number (Γ.Ε.ΜΗ.): 196733401000

Website: https://www.dartfirm.com

Email: info@dartfirm.com

Telephone: +30 213 049 7841

For all enquiries concerning personal data protection or the exercise of rights under the GDPR, individuals may contact us using the email address above.

3. Categories of Personal Data

We process personal data relevant to our professional activities and the services requested.

3.1 Identification and Contact Details

This includes names, business email addresses, telephone numbers, professional titles, employer details and other contact information provided through our website, meetings, correspondence or business relationships.

3.2 Business and Professional Information

We collect information concerning companies and their representatives where relevant to our services.

This may include company names, employee numbers, professional responsibilities, business objectives, organisational challenges, service requirements and information contained in business enquiries.

Information relating exclusively to a legal entity does not necessarily constitute personal data. However, information identifying an individual representative, sole trader or other identifiable natural person is protected where the GDPR applies.

3.3 Website Enquiries and Bookings

When an individual submits a contact form or requests a consultation through our website, we process the information required to evaluate and respond to the request.

Such information includes contact details, booking dates and times, descriptions of business requirements and related communications.

Our website uses Wix services for website functionality, forms and appointment booking.

3.4 Professional Correspondence

We process information contained in emails, meeting invitations, telephone communications, business proposals and other correspondence connected with our activities.

Meeting records and notes may be maintained where necessary for professional administration and service delivery.

Meetings are not routinely represented as being recorded. Where recording is proposed, the participants shall receive appropriate information beforehand and any necessary legal requirements shall be satisfied.

3.5 Contractual and Financial Data

Where a business relationship is established, we process information necessary for negotiating and administering contracts, preparing invoices, managing payments and complying with tax and accounting obligations.

This may include billing details, business contact information, tax identification information, contractual documentation and transaction records.

3.6 Project and Consulting Information

During a professional engagement, DART may receive documents, records, reports and operational information supplied by the client.

Such materials may include personal data relating to employees, managers, customers, suppliers or other individuals.

DART processes personal data contained in client materials only to the extent necessary for the agreed professional activities and in accordance with the applicable legal and contractual framework.

3.7 Technical and Website Usage Data

When the website is accessed, information necessary for website operation, security and technical administration may be processed by the website platform and its supporting infrastructure.

This information can include IP addresses, device and browser information, technical logs, access dates and times, and security-related information.

Additional information about cookies is provided in Section 10.

4. Sources of Personal Data

Personal data is primarily obtained directly from individuals through our website, booking system, professional correspondence, meetings and other communications.

We also receive professional information from business clients, authorised representatives, commercial partners, professional referrals and publicly accessible business sources.

Where personal data is obtained from sources other than the individual concerned, DART shall comply with the applicable transparency obligations under Article 14 GDPR, including the relevant time limits and exceptions.

Information available through a public source is not treated as exempt from data protection law.

5. Purposes and Legal Bases of Processing

DART processes personal data where at least one lawful basis under Article 6 GDPR applies.

5.1 Enquiries and Consultation Requests

We use submitted contact and business information to respond to enquiries, assess potential engagements, provide information about our services and arrange initial consultations.

Legal basis: Article 6(1)(b) GDPR where processing is necessary to take steps requested by an individual before entering into a contract, or Article 6(1)(f) GDPR where processing concerns legitimate business communications, including communications with representatives of organisations.

5.2 Provision of Professional Services

We process relevant information to perform consulting, advisory, market research, commercial assessment, project coordination and other agreed professional activities.

Legal basis: Article 6(1)(b) GDPR where the individual concerned is a contractual party, or Article 6(1)(f) GDPR where processing is necessary for the legitimate administration and performance of business-to-business relationships.

Where DART acts as a processor, its obligations are determined by the relevant processing agreement and the client's documented instructions.

5.3 Contract Management and Administration

We process personal data to prepare proposals, negotiate agreements, manage professional engagements, maintain contractual records and communicate with clients.

Legal basis: Article 6(1)(b) or Article 6(1)(f) GDPR, as applicable.

5.4 Accounting and Legal Compliance

We process and retain information necessary to comply with applicable tax, accounting, regulatory and other legal requirements.

Legal basis: Article 6(1)(c) GDPR.

5.5 Business Development and Commercial Relationships

We process appropriate professional contact information to maintain business relationships, respond to commercial opportunities, arrange professional introductions and communicate with prospective clients or business partners.

Legal basis: Article 6(1)(f) GDPR, where the processing is necessary for legitimate business interests and those interests are not overridden by individuals' rights and freedoms.

Direct electronic marketing is additionally subject to the applicable rules of Greek Law 3471/2006.

5.6 Website Administration and Security

We process necessary technical information to operate our website, provide requested functions, prevent misuse, identify technical problems and protect the security of our systems.

Legal basis: Article 6(1)(f) GDPR or another applicable lawful basis.

Storage of information on a visitor's device and access to information already stored there are separately subject to applicable cookie and electronic communications requirements.

5.7 Marketing Communications

Where required, DART obtains prior consent before sending promotional electronic communications.

Individuals may withdraw marketing consent or object to direct marketing at any time.

Legal basis: Article 6(1)(a) GDPR where consent is relied upon, or another lawful basis where expressly permitted by applicable legislation.

5.8 Legal Claims

We may process relevant information where necessary to establish, exercise or defend legal claims or respond to lawful requests from competent authorities.

Legal basis: Article 6(1)(c) or Article 6(1)(f) GDPR, as applicable.

6. Business Referrals and Commercial Intermediation

DART undertakes business development activities that may include introducing potential corporate clients to independent professional service providers and commercial partners.

Where a business introduction is arranged, we disclose only the personal data reasonably necessary for that purpose and only where an appropriate lawful basis exists.

Such information ordinarily consists of relevant professional contact details, the organisation represented and the nature of the expressed business interest.

We do not disclose unrelated employee records, client databases, confidential reports or personal information merely because a commercial referral arrangement exists.

Where a referred organisation or independent service provider determines its own purposes and means of processing, it acts as a separate data controller with its own obligations under applicable data protection legislation.

Any commercial or financial arrangements between DART and its partners do not remove the requirement to process personal data lawfully.

7. Confidential Client Materials and Processing on Behalf of Clients

DART may receive confidential business materials during consulting engagements.

Where those materials contain personal data, the responsibilities of DART and the client shall be determined by their respective roles under the GDPR.

Where DART acts as an independent controller, it is responsible for identifying an appropriate lawful basis and complying with the relevant GDPR obligations.

Where DART acts as a processor on behalf of a client, processing must be governed by an agreement meeting Article 28 GDPR, where applicable.

Such an agreement shall address the nature and purpose of processing, duration, categories of information concerned, confidentiality, security, subprocessors, assistance with data subject rights and the return or deletion of information.

Access to client materials is limited to authorised purposes and subject to applicable confidentiality obligations.

A client's provision of business materials does not, by itself, authorise their unrestricted reuse, disclosure or transfer.

8. Recipients and Service Providers

Personal data is disclosed only where necessary for a legitimate purpose and where permitted by applicable law.

The categories of recipients involved in our activities include:

Website Infrastructure and Booking Services

Wix and relevant service providers supporting website hosting, online forms, appointment booking, technical infrastructure and related website functions.

Communication and Productivity Services

Google services used for professional email, scheduling, online meetings and business productivity.

Professional Advisers

Accountants, legal advisers and other qualified professional service providers where disclosure is necessary for an authorised purpose or legal obligation.

Authorised External Specialists

Independent contractors or specialists engaged in connection with defined projects, subject to appropriate confidentiality and data protection safeguards.

Independent Commercial Partners

Organisations receiving relevant professional contact information in connection with lawful business introductions and agreed commercial relationships.

Competent Authorities

Tax authorities, courts, regulatory bodies and other competent public authorities where disclosure is legally required.

DART does not sell personal data as an independent commercial dataset.

The engagement of third-party service providers does not relieve DART of its applicable responsibilities as a data controller.

9. International Data Transfers

DART uses technology services whose infrastructure, personnel or authorised subprocessors may be located outside Greece or the European Economic Area.

Where personal data is transferred to a country outside the EEA, DART is responsible for ensuring that an appropriate transfer mechanism applies.

Depending on the recipient and destination, this may include an adequacy decision adopted by the European Commission, approved Standard Contractual Clauses, supplementary safeguards where required, or another mechanism permitted by Chapter V GDPR.

Individuals may request further information about relevant international transfers and the safeguards applicable to their personal data by contacting info@dartfirm.com.

10. Cookies and Similar Technologies

Our website uses technology provided through Wix and supporting website services.

Cookies and related technologies are used in connection with the operation, functionality and security of online services.

10.1 Strictly Necessary Technologies

Strictly necessary cookies and technologies support essential website functions, including maintaining security, managing sessions and delivering services expressly requested by visitors.

Where the legal exemption applies, such technologies do not require prior consent.

10.2 Optional Functional Technologies

Certain additional website features or integrations can involve storage or access technologies that are not strictly necessary.

Where consent is legally required, the relevant technology must not be activated before valid consent has been obtained.

10.3 Analytics Technologies

If website analytics technologies are enabled, their use shall be subject to the applicable consent and transparency requirements.

10.4 Advertising Technologies

If advertising, remarketing or other non-essential tracking technologies are introduced, their operation shall be subject to applicable consent requirements.

10.5 Consent and Withdrawal

Where consent is required, visitors must receive clear information about the purposes of the relevant technologies and be given a genuine opportunity to accept or reject them.

Consent must be freely given, specific, informed and unambiguous.

Withdrawing consent must be possible without detriment, and withdrawal shall not affect the lawfulness of processing carried out before withdrawal.

Visitors may also manage or delete cookies through their browser settings.

A cookie notice or consent interface must identify the actual non-essential technologies deployed, their purposes, providers and relevant retention periods.

11. Data Retention

DART retains personal data only for as long as necessary to fulfil the purposes for which it was collected and to satisfy applicable contractual, accounting, tax and legal obligations.

The relevant retention period is determined by the purpose of processing, the duration of the relationship, applicable statutory requirements and any justified need to establish, exercise or defend legal claims.

General Enquiries and Consultation Requests

Enquiry and booking records are retained while the request is being processed and for an appropriate period thereafter, ordinarily not exceeding twenty-four months after the last substantive communication unless further retention is justified.

Prospective and Existing Professional Relationships

Professional contact records are retained while a relevant business relationship or legitimate commercial interest continues, subject to periodic assessment and applicable rights of objection.

Consulting and Contractual Records

Contractual and project documentation is retained for the duration of the relevant engagement and subsequently for the period reasonably necessary to comply with legal obligations, resolve disputes or defend legal claims.

Financial and Accounting Records

Invoices and related accounting information are retained for the statutory period required by Greek law.

Client-Controlled Data

Where DART acts as a data processor, retention and deletion shall be governed by the applicable processing agreement, lawful instructions and any overriding statutory requirements.

Technical Data

Website-related technical records are retained according to their purpose, applicable provider configurations and legal requirements.

Personal data shall be deleted, securely destroyed or anonymised when continued retention is no longer justified.

12. Data Security and Confidentiality

DART recognises the importance of protecting personal and commercially confidential information against unauthorised access, unlawful disclosure, alteration, loss and destruction.

Appropriate technical and organisational measures shall be maintained according to the nature, scope and risks of the processing activities.

Such measures include appropriate controls over access to business accounts and client information, the use of security features provided by relevant technology platforms, confidentiality arrangements where applicable and procedures for responding to suspected incidents.

Security measures shall be reviewed in proportion to the sensitivity of the information processed and the risks involved.

No electronic system can provide an absolute guarantee against all potential security incidents.

In the event of a personal data breach, DART shall assess the incident and comply with the notification obligations of Articles 33 and 34 GDPR where applicable.

13. Rights of Individuals

Individuals whose personal data is processed by DART may exercise the rights available under the GDPR, subject to the applicable legal requirements and exceptions.

These include:

Right of Access: The right to obtain confirmation of whether personal data is processed and, where applicable, receive access to it.

Right to Rectification: The right to request correction of inaccurate personal data.

Right to Erasure: The right to request deletion where the relevant legal conditions are satisfied.

Right to Restriction: The right to request restriction of processing in circumstances provided by law.

Right to Data Portability: The right to receive qualifying personal data in a structured, commonly used and machine-readable format, where applicable.

Right to Object: The right to object to processing based on legitimate interests in accordance with Article 21 GDPR.

Right to Object to Direct Marketing: The right to object to processing for direct marketing purposes at any time.

Right to Withdraw Consent: The right to withdraw consent where processing relies upon it, without affecting the lawfulness of prior processing.

Rights Regarding Automated Decisions: The rights provided under Article 22 GDPR where applicable to qualifying decisions based solely on automated processing.

To exercise these rights, requests should be sent to:

info@dartfirm.com

DART may request information reasonably necessary to verify the identity of the applicant.

Requests shall be handled without undue delay and normally within one month, subject to extensions permitted by Article 12 GDPR.

The exercise of rights is ordinarily free of charge, subject to the exceptions provided by law.

14. Provision of Personal Data

Providing personal data through a general website enquiry is voluntary.

However, certain information is necessary to identify and respond to the individual concerned or to arrange a requested consultation.

Contractual and billing information may also be necessary for entering into or performing a contract or satisfying legal obligations.

Failure to provide required information may prevent DART from responding to a request, entering into an agreement or providing a requested service.

Individuals should avoid including unnecessary personal or sensitive information in general enquiry forms.

15. Special Categories of Personal Data

DART's general enquiry and booking services are not intended for the collection of special categories of personal data under Article 9 GDPR.

Such categories include health information, religious or philosophical beliefs, political opinions, biometric information used for unique identification and other specially protected information.

Where special-category information arises in the course of a legitimate professional engagement, it shall be processed only where the relevant legal requirements, including an applicable Article 9 condition, are satisfied.

Special-category information shall not be requested or processed merely because it is included in material supplied by a business client.

16. Automated Decision-Making

DART's standard website enquiry and booking processes are not intended to make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.

Should any processing activity involving such decisions be introduced, the relevant information and safeguards shall be provided in accordance with applicable law.

17. Minors

DART primarily provides professional services to businesses and adult representatives.

The website is not directed at children and is not intended to solicit personal information from minors.

Where the processing of a minor's personal data is identified, the lawfulness and necessity of that processing shall be assessed and appropriate measures taken.

18. External Websites

The DART website may contain links to websites and services operated by independent third parties.

Personal data submitted directly to such external services is subject to their own applicable privacy notices and processing practices.

DART is not responsible for processing activities independently determined by external organisations that it does not control.

19. Supervisory Authority and Complaints

Individuals have the right to lodge a complaint with the competent supervisory authority where they believe their personal data has been processed in violation of applicable law.

The competent authority in Greece is:

Hellenic Data Protection Authority (HDPA)

1–3 Kifisias Avenue
115 23 Athens, Greece

Website: https://www.dpa.gr
Email: contact@dpa.gr
Telephone: +30 210 6475600

Individuals may contact DART before submitting a complaint, although this does not restrict their right to approach a supervisory authority or pursue available legal remedies.

20. Amendments

DART may update this Privacy Policy to reflect changes in its services, processing activities, technologies, legal obligations or organisational practices.

The latest version will be published on the website, accompanied by an updated effective or revision date.

Where changes require additional notice or renewed consent under applicable law, DART shall take the necessary steps before implementing the relevant processing.

21. Contact

For questions, requests or complaints concerning personal data protection, please contact:

DART FIRM

Operated by ΝΤΟΥΒΑΛΗΣ ΧΡΗΣΤΟΣ (DOUVALIS CHRISTOS)

Ithakis 22
Pallini, Attica, 15351
Greece

Email: info@dartfirm.com
Telephone: +30 213 049 7841
Website: https://www.dartfirm.com

© 2026 DART FIRM. All rights reserved.