Privacy & Personal Data Protection Policy

1. Purpose and scope

ELDERO HOLDINGS I.K.E. (hereinafter “Avrio Assets”, “the Company”, “we”, “us”), which operates the website www.avrioassets.com under the distinctive title and trademark “Avrio Assets”, respects privacy and the protection of personal data. This Policy explains in a transparent manner what data we collect from prospective buyers, investors and other interested parties, for what purposes, on what legal basis, to whom it may be disclosed, for how long we retain it and what rights you have.

The Policy applies in particular when you visit the website www.avrioassets.com, create a user account, save searches or favourite properties, subscribe to alerts about new listings, complete an expression of interest form or a request for information about a specific property, contact us by telephone, email or messages, take part in a physical or virtual property viewing, submit an offer or an expression of intent, or proceed to negotiate and complete the acquisition of full ownership, bare ownership, usufruct or another right in rem.

The website www.avrioassets.com is addressed to the demand side, that is to say to persons who are seeking, evaluating or wish to acquire a property or a right in rem. For the supply side, that is to say for owners and sellers, the Company operates a separate website with a separate privacy policy. The two websites have the same Data Controller. The relationship and the flow of data between them is described in detail in section 12.

The Policy does not replace more specific notices that we may provide to you at a particular stage of the process, in particular where additional processing or the collection of documents is required for identification, source of funds checks, financing, or legal, technical, tax or notarial due diligence.

“Platform”. Hereinafter, “Website” means jointly the website www.avrioassets.com, every subdomain and alternative domain thereof, as well as every application for mobile or other devices (mobile or desktop application), progressive web application (PWA) or other digital interface that the Company makes available or will make available in the future under the distinctive title “Avrio Assets” and through which the same or substantially equivalent services are provided. Every reference in this text to “Website” shall be understood as a reference to the Platform, unless it follows from the content of the specific provision that it concerns exclusively the web page.

Technological neutrality. This document applies irrespective of the technical means of access. If the Company makes available an application for mobile devices, this document continues to apply to it as well, subject to: (a) any additional information or special terms provided upon installation or first use of the application, which prevail as regards the matters they govern, and (b) the terms of the application store through which the application is made available.

2. Data Controller

The Data Controller for the personal data described in this Policy is ELDERO HOLDINGS I.K.E., which operates on the demand side under the distinctive title “Avrio Assets”.

The same company also operates on the supply side under a different distinctive title and through a separate website. The fact that the Data Controller is the same does not mean that the data of the two sides is freely merged; the Company applies distinct purposes, distinct levels of access and the restrictions described in section 12.

For any matter relating to the processing of personal data or for the exercise of one of your rights, you may contact us at [email protected] or by post at the contact address stated at the beginning of this Policy.

If the Company appoints a Data Protection Officer (DPO) in the future, their contact details will be published in this Policy. Until then, the above email address is the dedicated point of contact for personal data protection matters.

3. Legal framework and basic principles

The processing is carried out in accordance with Regulation (EU) 2016/679 (the “GDPR”), Law 4624/2019 and Law 3471/2006 on the protection of privacy in electronic communications.

Because the activity concerns the acquisition of properties and rights in rem, the following may additionally apply, as the case may be: Law 4557/2018 on the prevention and suppression of money laundering and terrorist financing, the EU and international regulations on restrictive measures (sanctions), tax and accounting legislation, as well as Law 5038/2023 (Immigration Code) where the interested person is a third-country national seeking an investor residence permit.

We apply the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability.

4. What personal data we collect

Depending on the stage of the communication or of the potential transaction, we may collect the following categories of data. Collection is progressive:

• Identity and contact details: full name, email, telephone, country of residence, language of communication, preferred method and time of contact.
• User account details: username, encrypted password, date of registration, login history, settings and alert preferences.
• Search criteria and investment profile: areas of interest, type and use of property, surface area, number of rooms, condition, budget range, purpose of acquisition (own residence, holiday use, investment, income generation), desired time horizon and tolerance for renovation or outstanding legal matters.
• Interest in a specific right in rem: whether you are seeking full ownership, bare ownership, usufruct or another right, as well as your tolerance for an existing usufruct, right of habitation or lease over the property.
• Details of financial capacity and financing: range of available funds, method of financing (own funds, bank lending, a combination), stage and status of any loan pre-approval, whether you have a property to sell on your side and, where required at an advanced stage, proof of funds.
• Identification and compliance details: identity card or passport number and issuing details, date of birth, nationality, tax residence, tax identification number and competent tax office, home address, bank account details (IBAN), information on the source of funds and wealth, as well as the results of the checks described in section 7. This information is requested only when and to the extent that it is required.
• Legal entity details, where the acquisition is made through a company or other body: company name, tax identification number, articles of association, details of legal representatives and authorised persons, shareholding or corporate structure and details of beneficial owners.
• Viewing and appointment data: date, time and place of the viewing, persons present, notes and comments from the viewing, cancellations and rescheduling.
• Offer and negotiation data: the amount and terms of the offer, proposed timetable, conditions, counter-offers, negotiation history and any preliminary contracts or commitments.
• Transaction documents, where the matter progresses: powers of attorney, bank certificates, tax documents, source of funds declarations, transfer supporting documents, notarial and other documents necessary for legal, technical or tax due diligence and for the completion of the transfer.
• Confidentiality agreements: details of the signing of and compliance with non-disclosure agreements, where you are given access to properties or information that is not made public.
• Communication and service data: the content of emails, forms and messages, notes from communications or meetings and service history, to the extent necessary for handling your request.
• Technical data and website usage data: IP address, device and browser type, date and time of access, pages and listings you viewed, viewing duration, search history within the website, source of the visit and cookie identifiers or similar technologies, in accordance with your choices and the Cookie Policy.

5. User account, saved searches and alerts

The website may allow you to create an account, to save search criteria and favourite properties and to receive alerts when new listings matching your criteria become available.

Creating an account is optional. You can browse the website and contact us without an account, with more limited functionality. The management of the account and of the saved preferences constitutes performance of the contract of use that you conclude with us upon registration.

The alerts about new properties based on your saved criteria are a service that you activate yourself and that you can deactivate at any time from the account settings or through the unsubscribe link in the message. These alerts are distinct from the general commercial communication referred to in section 18, which requires separate consent.

You may delete your account at any time. Deletion of the account does not automatically entail the deletion of all your data where there is an active case, a legal obligation to keep records or a need to defend legal claims. In such cases, access is limited to the persons who need to have access for the particular purpose.

6. Special categories of data, Article 10 GDPR data and free text

The Company does not request through the website forms special category data within the meaning of Article 9 GDPR, such as data concerning health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, or data concerning sex life or sexual orientation.

Please do not include such information in free-text fields or in documents, unless it is expressly and lawfully requested from you at a later stage. If we receive unnecessary special category data, we may delete or isolate it, unless there is a specific lawful reason for retaining it.

Data relating to criminal convictions and offences (Article 10 GDPR). In the context of the compliance checks described in section 7, information falling within Article 10 GDPR may arise, such as the results of searches against sanctions lists or in published sources. Such processing is carried out only under the control of a public authority or where permitted by Union or national law, in particular in the context of Law 4557/2018 and the legislation on restrictive measures, with strictly limited access and separate storage.

Financial details, source of funds declarations, tax documents and lending details do not automatically constitute “special categories” within the meaning of Article 9 GDPR, but we treat them as information of heightened confidentiality and limit them to what is strictly necessary.

7. Identification, source of funds and compliance checks

The acquisition of a property or a right in rem entails checks that are not required at the initial stages of interest. These checks are triggered only when the matter reaches a particular stage, in particular before the submission of a binding offer, access to confidential property information or the preparation of a transfer.

Depending on the nature of the transaction and the role of the Company, the following may be carried out:

• Identification and verification of identity of the prospective buyer and, where the acquisition is made through a legal entity, of the representatives and beneficial owners.
• Source of funds and source of wealth checks (source of funds / source of wealth), on the basis of documents and declarations that you provide.
• Screening against restrictive measures (sanctions) lists of the European Union, the UN and other applicable regimes.
• Politically exposed person (PEP) screening and screening of close relatives or associates, where required.
• Screening in published sources (adverse media), limited to what is necessary for risk assessment and without any automatic drawing of conclusions.

These checks are carried out either because the Company itself has a relevant obligation as an obliged entity under Law 4557/2018, or because it must provide the necessary information to other obliged entities involved in the transaction, such as notaries, lawyers and credit institutions, or in order to protect the legitimate interests of the Company and of the counterparties. The legal basis is set out in the table in section 9.

Consequences. If the necessary identification information is not provided or if the checks reveal a legal impediment, the Company may be unable to proceed with the transaction or may be obliged to refrain from it. In certain cases the law prohibits disclosure of the reason. The screening is not automated within the meaning of Article 22 GDPR: any negative result is assessed by a competent person before any decision is taken.

The records of the checks are kept separately from other data, with limited access, and for the period specified in section 16.

8. Where we collect the data from

We collect personal data:

• directly from you, through the user account, the expression of interest forms, telephone or electronic communication, meetings, viewings and documents that you provide to us.
• from persons acting lawfully on your behalf or participating in the transaction, such as attorneys-in-fact, co-beneficiaries, spouses or partners where there is a legally relevant right, representatives of legal entities or your advisers.
• from professionals lawfully involved in the process, such as lawyers, notaries, engineers, valuers, accountants or tax advisers.
• from credit institutions or financing bodies, when you request it or when it is necessary for financing the acquisition.
• from public or lawfully accessible registers, sanctions lists, politically exposed persons databases, published sources and specialised screening service providers, within the framework and the limits of section 7.
• from the seller or the owner of the property and from the supply-side website, where this is necessary for the particular matter.
• automatically, when you visit the website, through technical files and cookies or similar technologies, in accordance with the Cookie Policy and your consent choices.

Where we receive personal data of a third party from another source and we have an obligation to provide information under Article 14 GDPR, we provide the required information within the statutory time limits, unless a lawful exemption applies, in particular where such information is prohibited by anti-money laundering legislation.

9. Purposes of processing and legal bases

We do not use the data for purposes incompatible with those for which it was collected. The main purposes and legal bases are as follows:

Where a particular processing operation is objectively necessary in order for us to examine or carry out the transaction that you have requested or in order to comply with a legal obligation, we do not artificially base the processing on consent. Where the processing is optional and consent is the appropriate legal basis, consent is requested separately and may be withdrawn at any time without affecting the lawfulness of the previous processing.

10. Property viewings, offers and negotiation

In order to arrange a property viewing we collect the information necessary for scheduling and conducting it, as well as the names of any accompanying persons, where this is required for access or security reasons.

Video surveillance systems. Certain properties may be equipped with a video surveillance system or a video entry system operated by the owner, the building manager or a third party. In such cases, the Data Controller for the video surveillance is the person operating it and not the Company. Where we know of this in advance, we will inform you before the viewing.

Photographs, videos and virtual tours. We do not photograph or film visitors. The visual material of the properties is produced without visitors present or in a manner that does not allow them to be identified.

Offers. The details of your offer, the amount, the terms and the timetable are disclosed to the seller or owner in order to be assessed. In the first phase we seek to disclose the commercial details of the offer and not full identification details, unless this is necessary or you request it.

Confidentiality. Where you are given access to properties or information that is not made public, you may be asked to sign a confidentiality agreement. The signing and management of that agreement constitute separate processing on the basis of the performance of that agreement.

11. Third-party data and acquisition through a legal entity

The transaction may also concern or affect other persons, such as co-beneficiaries, spouses or partners where there is a legally relevant right, attorneys-in-fact, advisers, family members to be included in a residence permit application or other participants.

If you provide us with the personal data of a third party, please limit yourself to what is strictly necessary and ensure that the person concerned is aware of the transfer. Where required by law, the Company will provide the third party with the information required under Article 14 GDPR or will apply another lawful exemption. This provision does not transfer to you obligations that the law assigns to the Company as Data Controller.

Acquisition through a legal entity. Where the acquisition is made through a company, trust or other body, we process the personal data of the legal representatives, the authorised persons and the beneficial owners, to the extent required for the identification and the checks referred to in section 7. Those persons have all the rights set out in section 21.

12. Relationship with the supply-side website and data flow

ELDERO HOLDINGS I.K.E. operates two distinct websites: one for owners and sellers and the present one for prospective buyers and investors. The Data Controller is the same, but the purposes of processing are distinct.

The core function of the Company is the matching of supply and demand. This means that certain data is transferred from one side to the other, always subject to the following restrictions:

• In the initial phase, the seller receives the interest profile and the commercial details, without identification details of the prospective buyer, unless this is necessary or you request it.
• The identification, financial capacity and compliance data referred to in section 7 is not disclosed to the seller, unless this is required by law or is necessary for the completion of the transfer.
• Full details of both sides are exchanged when the matter reaches the stage of notarial preparation or when this is required by the professionals involved and the competent bodies.
• Your user account data, saved searches and browsing history are not disclosed to sellers.

If you are both a seller and a buyer, that is to say you have provided details on both websites, the two cases are kept separately and are linked only where this is necessary for their management or where you request it.

You have the right to object to processing based on our legitimate interests, including the matching, in accordance with section 21.

13. To whom we disclose personal data

Access to personal data is limited to persons who need the data for a specific lawful purpose. Depending on the stage of the matter, data may be disclosed:

• to authorised officers and associates of the Company who handle the communication, the assessment and the transaction.
• to the seller or owner of the property and to their advisers, subject to the restrictions in section 12.
• to lawyers, notaries, engineers, valuers, accountants, tax advisers and other professionals, only to the extent that their involvement is necessary or lawfully justified.
• to credit institutions, payment providers, insurance undertakings or other financial bodies, where required for the financing or the lawful handling of the transaction.
• to specialised providers of identification, sanctions screening and compliance screening services, within the framework of section 7.
• to technology and infrastructure providers, such as hosting, CRM, email, cloud storage, IT support, systems security, analytics or marketing services. Those providers are bound by the appropriate contractual and regulatory obligations according to their role.
• to public, tax, judicial, supervisory or other competent authorities, where this is required by law or is necessary for the exercise or defence of legal claims, as well as to the Anti-Money Laundering Authority where provided for.

Certain recipients act as “processors” on behalf of the Company and are bound by contract in accordance with Article 28 GDPR. Others, such as lawyers, notaries, banks or the seller themselves, act as independent Data Controllers for their own legal obligations.

We do not sell personal data as a standalone commercial product and we do not disclose it to third parties for their own independent marketing purposes without an appropriate legal basis.

14. Prospective investors from third countries

The website may also be addressed to persons who do not reside in Greece or in the European Union. In that case we may process additional data, such as passport details, nationality, tax residence, details of representation in Greece and details of family members to be included in a relevant application.

If you expressly ask us to support or coordinate an application for an investor residence permit under Law 5038/2023, the necessary data is transmitted to the cooperating lawyers and to the competent authorities. This service is optional and independent of the acquisition of the property.

The Company does not provide legal, tax or immigration advice and does not guarantee the outcome of any administrative procedure.

15. Transfers outside the European Economic Area

Certain technology providers and compliance screening service providers may store or process data outside the European Economic Area (EEA). In addition, where the interested person resides in a third country, communication with or the transmission of documents to that country may be required.

Where such a transfer takes place, the Company applies the mechanisms provided for in Chapter V of the GDPR, such as an adequacy decision of the European Commission or Standard Contractual Clauses, and takes supplementary measures where this is required. Where the transfer is necessary for the performance of a contract that you have requested, the corresponding derogation of Article 49 GDPR may apply.

You may request information about the safeguards applied by contacting us at [email protected].

16. Retention period

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, taking into account the nature of the data, the stage of the matter, any obligations arising from the applicable legislation and the need to establish, exercise or defend legal claims. The Company does not retain personal data indefinitely.

User account and saved preferences. Account data is retained for as long as the account remains active. Accounts that remain inactive for twenty-four (24) months are flagged and, following a relevant notification, are deleted or anonymised. You may delete your account at any time.

Expressions of interest that do not lead to a transaction. Contact details, search criteria and the information necessary for the assessment and possible re-examination of your interest are retained for a period of up to twenty-four (24) months from the last substantive communication or activity. Substantive activity is taken to include, indicatively, communication regarding a specific property, an update of criteria, a request for or the sending of information, a viewing, or the submission or examination of an offer. General or automated promotional communications and automatic alerts about new listings are not regarded as substantive activity and do not in themselves restart the retention period.

Identification and compliance records. Where the Company has obligations as an obliged entity under Law 4557/2018, the due diligence documents and information, as well as the transaction records, are kept for five (5) years after the end of the business relationship or from the date of the occasional transaction, in accordance with Article 30 of Law 4557/2018. This period may be extended where required by a competent authority or by another provision of law. These records are kept separately, with limited access, and are not used for commercial purposes.

Active cases. Where a matter moves into an active process, such as viewings, negotiation, exchange of documents or notarial preparation, the data is retained for as long as is required for its management and completion. The lapse of 24 months from the initial expression of interest does not automatically entail deletion for as long as the matter remains active.

Completed transactions. Where a transaction is completed or a contractual relationship is created, the relevant data is retained for as long as is required in order to comply with tax, accounting, corporate, regulatory or other legal obligations and for the establishment, exercise or defence of legal claims, in accordance with the applicable limitation periods.

Matters that are definitively closed. Where you inform us that you no longer wish your request to be examined, or where we establish that there is no genuine possibility of a transaction, the data that is no longer necessary is deleted or anonymised without waiting for the maximum period to elapse. Limited information may continue to be kept where this is required by a legal obligation or in order to demonstrate the Company’s compliance.

Commercial communication. In the event of withdrawal of consent or objection to promotional communications, the Company ceases the relevant use of the data and retains the strictly necessary information in a suppression file, so that your choice is respected in the future.

Deletion and anonymisation. Upon expiry of the applicable period, personal data is deleted, anonymised or taken out of active use, unless its further retention is required or permitted by another lawful basis. Retention periods are reviewed periodically. The Company applies the principle that holding data “just in case” does not in itself constitute a sufficient reason for retaining it.

17. Cookies, analytics and targeting technologies

The website uses cookies or similar technologies. Strictly necessary cookies are used to the extent required for the operation and security of the website, for logging in to the account or for the provision of a service that you have requested.

Because the website displays properties, additional analytics cookies and targeting or retargeting cookies may be used, in order to measure the performance of the listings and, if you allow it, to show you relevant advertisements on third-party platforms. These technologies are activated only after valid consent has been given and may involve the disclosure of identifiers to third-party providers, some of which act as independent or joint Data Controllers.

You may change or withdraw your choices at any time through the cookie management mechanism of the website. Detailed information about cookie categories, providers, purposes and durations is provided in the separate Cookie Policy.

18. Commercial communication and marketing

We distinguish between two categories of messages. The alerts about new properties corresponding to a saved search that you have activated yourself form part of the service you requested. The general informational or promotional communication regarding the Company’s services, the market or its events requires separate, clear and non-pre-ticked consent.

Participation in promotional communications is optional and is not a precondition for being served by us or for any transaction.

You may withdraw your consent or deactivate the alerts at any time through the account settings, the unsubscribe link included in every message, by replying to the communication or by sending a request to [email protected]. Withdrawal does not affect the lawfulness of the processing carried out before it.

For electronic communications of an advertising or direct marketing nature, the specific rules of Law 3471/2006 additionally apply, which as a rule require prior consent, with specific exceptions where there is a prior transactional relationship and the relevant conditions are met.

19. Profiling, matching and automated decisions

In order to propose relevant properties to you, the Company may create an interest profile based on the criteria you state, your saved searches, the listings you have viewed or saved and our communications. This profile is used for matching with available properties, for prioritising requests and for adapting the content displayed to you.

Indicators of the seriousness or readiness of interest may also be used, such as the completeness of the information, the financing stage or the time horizon. These indicators are used in a supporting capacity for human assessment and do not replace the judgement of a competent person.

The operation of the website is not intended in itself to lead to a decision based solely on automated processing which produces legal effects or similarly significantly affects you. In particular, any negative result from the checks referred to in section 7 is always assessed by a competent person. If the Company introduces in the future any processing falling within Article 22 GDPR, it will inform you beforehand and will apply the required safeguards, including the right to human intervention, to express your point of view and to contest the decision.

You may object to profiling based on our legitimate interests or withdraw your consent to consent-based personalisation, in accordance with section 21.

20. Security and confidentiality

The Company applies appropriate technical and organisational measures, proportionate to the nature, context, purposes and risks of the processing, with a view to protecting the data against unauthorised access, unlawful use, alteration, loss, destruction or unauthorised disclosure, in accordance with Article 32 GDPR.

Access is restricted on the basis of role and need to know. The identification and compliance data referred to in section 7 is kept with enhanced measures and access limited to specific persons. Employees and associates are bound by confidentiality or professional secrecy obligations where applicable. Service providers are assessed and bound by contract according to their role.

We recommend that you use a strong and unique password for your account and that you do not share it with third parties.

In the event of a personal data breach incident, we apply a procedure for assessment and, where required, notification to the competent supervisory authority and communication to the affected persons, in accordance with Articles 33 and 34 GDPR.

21. Your rights

Depending on the legal basis and the conditions of the GDPR, you have the following rights:

• The right to be informed and to access the personal data concerning you.
• The right to rectification of inaccurate data or completion of incomplete data.
• The right to erasure (the “right to be forgotten”) where the legal conditions are met.
• The right to restriction of processing.
• The right to data portability, where the processing is based on consent or a contract and is carried out by automated means. This covers in particular your account data and your saved searches.
• The right to object to processing based on legitimate interests, including profiling and matching. In the case of direct marketing you may object at any time and without giving reasons.
• The right to withdraw consent at any time, where the processing is based on consent.
• The right not to be subject, under the conditions of Article 22 GDPR, to a decision based solely on automated processing which produces legal or similarly significant effects.

Restrictions. Certain rights are not absolute. In particular, data kept under anti-money laundering legislation cannot be deleted before the expiry of the statutory retention period, while the law may restrict the provision of information regarding certain reports or checks.

To exercise a right, send a request to [email protected]. We may ask for reasonable additional information to confirm your identity where this is necessary to protect your data. Requests are dealt with without undue delay and, as a rule, within one (1) month, with the possibility of an extension of up to two further months in the cases provided for by the GDPR.

The exercise of rights is as a rule free of charge. In the case of manifestly unfounded or excessive requests, in particular because of their repetitive character, the options provided for by the GDPR may be applied.

22. Right to lodge a complaint

If you consider that the processing of your personal data infringes applicable law, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA).

Hellenic Data Protection Authority

1-3 Kifisias Ave., 115 23 Athens

Tel.: +30 210 6475600

Website: www.dpa.gr

If you reside in another Member State of the European Union, you may alternatively apply to the supervisory authority of your place of residence or work. The possibility of lodging a complaint does not limit any other administrative or judicial remedy available to you under the law.

23. Minors

The Company’s services concern real estate transactions and are addressed to adults or to persons acting through lawful representation. The creation of a user account is permitted only to adults. We do not seek to collect the personal data of minors through the website. If we establish that we have received such data without a lawful basis, we will take the appropriate measures for its deletion or restriction.

Where a minor participates in a transaction as a beneficiary or family member, their data is collected from their parents or legal representatives and is limited to what is strictly necessary.

24. Links and embedded third-party content

The website may contain links to third-party websites or services, as well as embedded content such as maps, virtual tours, videos, instalment calculators or communication tools. This content may collect data from your device on its own terms.

Where the embedded content is not strictly necessary, it is loaded only after your consent through the cookie management mechanism. The Company does not control and is not responsible for the independent privacy practices of those third parties. We recommend that you read their respective privacy policies before providing them with personal data.

25. Changes to this Policy

The Company may update this Policy in order to reflect changes in legislation, in its services, in technologies or in processing practices. The version in force is published on the website with a visible last-updated date. Where the changes are material and it is required by law, additional information will be provided before they take effect. Registered users may also be notified by a message to their account address.

26. Contact

For questions regarding this Policy, for the exercise of rights or for any personal data protection matter:

Personal data email: [email protected]

General contact: [email protected]

Telephone: +30 6978 164 499

Address: 59-61 Ag. Konstantinou St., Marousi 151 24, Attica

Last updated: 10.08.2026