Privacy Policy
Protecting your personal data is a core priority for the practice of Dr Alexandros Tzaveas. This Privacy Policy explains in detail what data we collect, how we use it, who we share it with and how we protect it, in accordance with the General Data Protection Regulation (GDPR — EU Regulation 2016/679) and Greek Law 4624/2019.
Data Controller
The controller of your personal data is:
Dr Alexandros P. Tzaveas
• Email: info@alexandrostzaveas.gr
• Website: alexandrostzaveas.gr
For any matter relating to data protection, you may contact us directly by email or by telephone.
Data We Collect
Depending on how you interact with our website, we may collect the following categories of data:
Contact Form Data
Newsletter Sign-up Data
Browsing Data (via Google Analytics 4)
Cookie Data
Full information about cookies can be found on the Cookie Policy page.
Important Note
We do not collect sensitive medical data through the website. The contact form is intended solely for appointment requests and general enquiries. Any medical history or clinical data is provided only during your in-person visit to the practice and is covered by medical confidentiality.
Purpose of Processing
We process your data solely for the following purposes:
Handling Your Requests
Updates (Newsletter)
Improving the Website
We do not use your data for automated decision-making or profiling.
Legal Basis for Processing
Data processing is based on the following legal bases under the GDPR:
Article 6(1)(a) — Consent
You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
Article 6(1)(b) — Performance of a Contract / Pre-contractual Measures
Article 6(1)(f) — Legitimate Interests
Sharing Data with Third Parties
We do not sell, trade or rent your personal data. We may disclose data only in the following cases:
Service Providers (Processors)
• Google Analytics (Google LLC) — Anonymous traffic statistics. The data is anonymised through IP anonymization.
• Deltazi Platform — Website hosting and newsletter delivery. Acts as a processor under contract.
• Cloudflare — CDN and DDoS protection service.
Legal Obligation
Important
We do not use Meta/Facebook tools, advertising pixels or retargeting platforms. We do not share data with advertising networks.
Data Retention Period
We keep your data only for as long as is necessary:
• Contact form requests — Kept for 12 months after the request has been dealt with, unless an ongoing patient-doctor relationship arises
• Newsletter data — Kept for as long as you remain subscribed. After you unsubscribe, it is deleted within 30 days
• Analytics cookies — Google Analytics data is kept for 14 months (GA4 default)
• Cookie consent — Your choice is stored for 1 year
• Security logs — Technical logs are kept for 90 days
At the end of each period, the data is automatically deleted or fully anonymised.
International Data Transfers
Our website is hosted on a server in Germany (Hetzner Online GmbH), within the European Economic Area (EEA).
Transfers outside the EEA
• Google Analytics — Google LLC is based in the USA. The transfer of data relies on the EU-US Data Privacy Framework (European Commission adequacy decision, July 2023) as well as on Standard Contractual Clauses (SCCs).
• Cloudflare — Applies Standard Contractual Clauses and additional security measures.
In every case, we ensure that any transfer of data outside the EEA takes place with appropriate safeguards in accordance with Articles 44-49 of the GDPR.
Your Rights (Articles 15-22 GDPR)
Under the GDPR, you have the following rights:
• Right of access (Article 15) — To obtain a copy of your data and information about how it is processed
• Right to rectification (Article 16) — To request the correction of inaccurate data
• Right to erasure (Article 17) — To request the deletion of your data (the "right to be forgotten")
• Right to restriction (Article 18) — To request that processing be restricted
• Right to data portability (Article 20) — To receive your data in a readable format
• Right to object (Article 21) — To object to processing based on legitimate interests
• Right to withdraw consent — At any time, without retroactive effect
How to exercise your rights:
• Email: info@alexandrostzaveas.gr
• Telephone: 2310 222 828
We respond to every request within 30 days of receipt, in accordance with Article 12(3) GDPR.
Security Measures
We apply appropriate technical and organisational measures to protect your data (Article 32 GDPR):
Technical Measures
Organisational Measures
In the event of a data breach, we will notify the Hellenic Data Protection Authority (HDPA) within 72 hours and inform you without undue delay, in accordance with Articles 33-34 GDPR.
Protection of Minors
Our website is not aimed at minors under 16 years of age. We do not knowingly collect data from minors. If you are a parent or guardian and believe that a minor has provided us with data, please contact us at info@alexandrostzaveas.gr and we will delete it immediately.
Where an appointment is made for a patient who is a minor, consent is given by the parent or legal guardian.
Policy Updates
This Privacy Policy may be amended from time to time to reflect changes in our practices, new services or changes in the law.
Last updated: 31 March 2026
Where the changes are substantial, we will inform you by means of a prominent notice on the website or by email (if you are subscribed to the newsletter). Continued use of the website after changes have been published constitutes acceptance of the updated policy.
Contact & Right to Lodge a Complaint
For any question or request concerning the processing of your data:
Data Controller
• Email: info@alexandrostzaveas.gr
• Telephone: 2310 222 828
Right to Lodge a Complaint
If you believe that the processing of your data infringes the GDPR, you have the right to lodge a complaint with:
• The Hellenic Data Protection Authority (HDPA)
• Email: contact@dpa.gr
We encourage you to contact us first, so that we can try to resolve any issue directly.
Do you have questions about your data?
If you need more information, or wish to exercise any of your rights under the GDPR, please do not hesitate to contact us. We respond to every request within 30 days.