This policy explains how DigiKimolia handles personal data when you use this website, contact us about our services, or apply for a role through our careers form.
Who controls your data
DigiKimolia is the controller of the personal data described in this policy. DigiKimolia is a specialist marketing and business development agency for law firms, with offices in Athens and Nicosia.
- Registered name
- DIGIKIMOLIA DIGITAL AGENCY LIMITED
- Registration number
- HE 427019
- Country of registration
- Cyprus
- Registered office
- 11 Kassandras2021 StrovolosNicosia, Cyprus
- Data protection contact
- info@digikimolia.com
For privacy questions or requests, email info@digikimolia.com with the subject line "Data protection request".
Personal data we collect
Contact enquiries
When you use the Get in Touch form, we collect your name, firm, email address, role, country, selected service interests, and message. Name, firm, email, and message are required because we cannot identify or respond to an enquiry without them.
Careers and applications
When you use the careers form, we collect your name, email address, phone number, the role you are applying for, a LinkedIn or portfolio URL, a cover note, and your CV. A CV may contain employment, education, qualification, language, and other information you choose to include. We will also record any separate choice you make about being considered for future roles.
Newsletter and downloadable resources
When you request the newsletter, we collect your email address, the page where you subscribed, and the record of your confirmation. We add the address to our newsletter contacts only after you use the confirmation link. When you request a downloadable guide, we collect your email address and, if you choose to provide it, your firm name. Newsletter consent on a resource form is separate and optional.
Please do not include special category data, information about criminal convictions, client-confidential material, or other sensitive information unless it is relevant and lawful to provide. If such data is necessary, we will process it only where applicable law permits or requires us to do so.
Technical data
Our hosting and security providers may process limited technical data, such as an IP address, browser or device information, request time, and security events. We use this information to deliver the site, prevent abuse, diagnose faults, and protect our systems.
Vercel Web Analytics records anonymous page-view information such as the page visited, referrer, approximate location, browser, operating system, and device type. It does not use cookies or retain an IP address with the analytics event, and it cannot identify an individual visitor.
If you accept analytics cookies, Google Analytics also receives online identifiers, approximate location derived from IP address, device and browser information, page interactions, and conversion events. Our form conversion events identify the form type and do not send form contents, names, email addresses, CV information, or message text.
We collect data directly from you, except for technical data generated when your device communicates with the website.
Why we use data and our lawful bases
Responding to contact enquiries, discussing your firm's needs, and deciding whether our services may be suitable.
Steps requested before entering into a contract, Article 6(1)(b), and our legitimate interests in responding to professional enquiries, Article 6(1)(f).
Assessing an application for a specific role and communicating with the applicant about that recruitment process.
Steps requested before entering into an employment contract, Article 6(1)(b).
Keeping an unsuccessful applicant's details for possible future vacancies in a talent pool.
Your separate, freely given consent, Article 6(1)(a). You can withdraw it at any time.
Sending a requested guide, protecting its temporary download link, and recording the request.
Our legitimate interests in delivering requested professional material and understanding interest in our services, Article 6(1)(f).
Sending the DigiKimolia newsletter after you confirm your email address.
Your consent, Article 6(1)(a). Subscription uses double opt-in and you can unsubscribe or withdraw consent at any time.
Measuring aggregate page use with Vercel Web Analytics.
Our legitimate interests in understanding aggregate website use and improving the website, Article 6(1)(f). Vercel Web Analytics is cookieless and anonymous.
Measuring page use and successful form conversions with Google Analytics.
Your consent, Article 6(1)(a), recorded through the cookie banner and reversible through Cookie settings.
Preventing spam, investigating security incidents, maintaining the website, and diagnosing technical problems.
Our legitimate interests in maintaining secure and reliable systems, Article 6(1)(f).
Meeting legal obligations and keeping records needed for disputes or claims.
Compliance with a legal obligation, Article 6(1)(c), or our legitimate interests in establishing, exercising, or defending legal claims, Article 6(1)(f).
Where we rely on legitimate interests, we consider whether the processing is necessary and balance our interests against your rights and reasonable expectations. We do not use website or application data for automated decision-making or profiling.
How long we keep data
- Contact enquiries: up to 24 months after our last substantive exchange. If the enquiry leads to a client relationship, relevant records move into the applicable client and legal retention schedule.
- Unsuccessful applications: six months after the recruitment decision, then deleted or anonymised.
- Talent pool: up to 12 months from your separate opt-in, unless you withdraw consent sooner. We will not place an applicant in the talent pool merely because they applied.
- Resource requests: up to 24 months after the request. Each encrypted download token expires after 15 minutes and is not a reusable public file address.
- Newsletter: an unconfirmed request expires after 24 hours. Confirmed contact and consent records are kept until you unsubscribe or withdraw consent, with a limited suppression record kept afterwards so we can respect that choice.
- Analytics: anonymous Vercel Web Analytics reports are available for the reporting period included with our Vercel plan. Google Analytics event-level and user-level data, when enabled with your consent, is configured for the shortest available retention period of two months. Google Analytics cookies may remain for up to two years unless you reject analytics or clear them sooner.
- Successful applications: relevant information becomes part of the individual's personnel record and is handled under the employee privacy information and applicable employment law.
- Technical and security logs: normally no more than 30 days, unless a longer period is needed to investigate a security incident or comply with law.
We may keep a limited record longer where applicable law requires it or where it is necessary to establish, exercise, or defend a legal claim. When a retention period ends, we delete or anonymise the data.
Who receives data and international transfers
We disclose personal data only where needed to the following recipients:
- DigiKimolia personnel who need the information for their work.
- Service providers supporting website hosting, security, transactional email, newsletter contact management, analytics, and private file storage.
- Professional advisers, insurers, courts, regulators, or public authorities where disclosure is necessary or legally required.
The website is hosted using Vercel, which also provides anonymous, cookieless Web Analytics. Career CVs are uploaded directly to a private Vercel Blob store and are not publicly accessible. Contact and careers notifications, resource delivery, confirmation emails, and newsletter contacts are handled using Resend, operated by Plus Five Five, Inc. With your consent, Google Analytics is provided by Google Ireland Limited and related Google entities. These providers may process data outside the European Economic Area, including in the United States. Where GDPR restricted transfers occur, safeguards include the European Commission's Standard Contractual Clauses and other valid transfer mechanisms made available by the providers.
We do not sell personal data. We do not share enquiry or application data with third parties for their own advertising.
Your data protection rights
Subject to the conditions in applicable law, you may ask us to:
- confirm whether we process your data and provide access to it;
- correct inaccurate or incomplete data;
- delete data that we no longer have a lawful reason to keep;
- restrict how we use your data;
- provide data in a portable format where the right applies;
- object to processing based on legitimate interests; or
- withdraw consent at any time, without affecting earlier processing.
We may ask for information needed to verify your identity. We normally respond within one month, although the GDPR permits an extension for complex or numerous requests. Exercising these rights is normally free.
Security, links, analytics, and cookies
We use reasonable technical and organisational measures intended to protect personal data against loss, misuse, unauthorised access, alteration, and disclosure. No method of transmission or storage is completely secure, so we cannot promise absolute security.
Vercel Web Analytics measures aggregate traffic without analytics cookies. It uses a daily-changing, one-way visitor identifier and does not follow visitors between different websites or different days.
Google Analytics is optional and remains disabled until you choose "Accept analytics" in the cookie banner. We send Google consent signals with advertising storage, advertising user data, and advertising personalisation denied. We also disable Google Signals and advertising personalisation in our configuration. You can reopen Cookie settings at the bottom of any page to change your choice. Rejecting analytics does not affect the website or any form.
If accepted, Google Analytics sets _ga and a property-specific_ga_* cookie to distinguish visits. These cookies can last up to two years. The site also stores your analytics choice in browser local storage so it can respect that decision. We do not use advertising cookies or cross-site marketing pixels.
The site may link to third-party websites. Their operators control their own data practices, and their privacy notices apply when you visit them.
Questions, requests, and complaints
Send questions or rights requests to info@digikimolia.com. Please use the subject line "Data protection request".
You also have the right to complain to the data protection authority in the EU country where you live, work, or believe an infringement occurred. Relevant authorities for our office locations include the Cyprus Commissioner for Personal Data Protection and the Hellenic Data Protection Authority. We would appreciate the opportunity to address your concern first.
We may update this policy when our services or legal obligations change. The date at the top identifies the current version.