Who we are — the data controller

White Glove Group ("WGG", "we", "us", "our") is the data controller responsible for your personal data. We are a concierge and life management services company operating in southern Greece (Peloponnese region).

As data controller, WGG is responsible for advising on our obligations under the GDPR, monitoring compliance, and acting as the point of contact for data subjects and the supervisory authority.

Personal data we collect

We collect and process personal data that is necessary to provide our services. We follow the principle of data minimisation — we only collect what we genuinely need. The categories of data we collect depend on the services you use.

How we use your personal data

We use your personal data only for legitimate purposes directly related to the delivery of our services and the operation of our business. We do not sell your personal data. We do not use your data for automated decision-making or profiling that produces legal effects.

Legal basis for processing

Under the GDPR, we must have a valid legal basis for every type of personal data processing. WGG relies on the following legal bases:

Special category data — health & medical information

Where you use WGG's elder care or medical services coordination, we may process health-related information — including medical history, prescriptions, care needs, appointment records, and medical correspondence — that you voluntarily share with us.

We process this data on the following basis under Article 9(2) GDPR:

• Explicit consent (Article 9(2)(a)): You have given explicit, specific, informed consent for us to process your health data for the purpose of coordinating medical or elder care services on your behalf. This consent is sought separately and clearly at the point of service registration.
• Vital interests (Article 9(2)(c)): In emergency situations where the data subject is unable to consent, we may process health data to protect vital interests.

Health data is shared only with the specific medical or care professionals engaged to assist you. It is not shared with any other third parties and is handled with the highest level of security and discretion within WGG.

You have the right to withdraw consent for health data processing at any time. However, withdrawal may mean we are unable to provide medical or elder care services that require that information.

Under Greek Law 4624/2019, the processing of special categories of personal data (including health data) is subject to additional conditions beyond the GDPR's baseline requirements. WGG complies with these additional requirements in full.

Who we share your data with

WGG does not sell, rent, or trade your personal data. We share your data only where necessary to deliver services on your behalf or to comply with legal obligations.

International data transfers

WGG is based in Greece (an EU member state) and processes data primarily within the EU/EEA. Where data is transferred outside the EU/EEA — for example, to cloud service providers with servers in non-EEA countries — we ensure that appropriate safeguards are in place, including:

• Adequacy decisions: Transfers to countries recognised by the European Commission as providing an adequate level of data protection (e.g., the UK, Switzerland, and the US under the EU-US Data Privacy Framework);
• Standard contractual clauses (SCCs): EU Commission-approved standard contractual clauses incorporated into our agreements with international service providers;
• Binding corporate rules: Where applicable for multinational service providers.

You may request details of the specific safeguards in place for any international transfer by contacting info@wgg.gr.

Transfer of personal data to the US is now possible if the data importer has signed up to the EU-US Data Privacy Framework, which provides businesses in the EU and the US with a mechanism to comply with data protection requirements when transferring personal data.

How long we keep your data

We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by applicable law. Our retention periods are as follows:

At the end of the applicable retention period, data is securely deleted or anonymised. You may request early deletion subject to our legal retention obligations (see Section 9 — Your Rights).

Your rights under the GDPR

Under the GDPR and Greek Law 4624/2019, you have the following rights in relation to your personal data. These rights are not absolute and may be subject to exceptions, but WGG will always respond to your request within 30 days and explain any limitations.

Under Article 40(1) of Greek Data Protection Act 2019, lawsuits against data controllers for violations of the GDPR may be brought before the civil court of the district in which the controller has its establishment or in which the data subject usually resides.

Cookies & tracking technologies

Our website and platform use cookies and similar technologies. The Hellenic DPA's cookie consent guidelines require that users are given a clear choice to accept or reject non-essential cookies, with an equally prominent option to decline as to accept.

We use the following types of cookies:

You may manage your cookie preferences at any time via the cookie settings panel on our website, or by adjusting your browser settings. Disabling essential cookies will affect your ability to use the platform.

Under Greek Law 3471/2006, which transposes the ePrivacy Directive, electronic direct marketing and the use of non-essential cookies require the prior explicit consent of the recipient, consistent with the GDPR's definition of consent.

Data security

WGG takes the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:

• Encrypted data transmission (HTTPS / TLS) across all platform communications;
• Hashed and salted password storage — passwords are never stored in plain text;
• Email verification (OTP) to protect account creation and access;
• Role-based access controls — staff access only the data necessary for their role;
• Confidentiality agreements binding all WGG staff and affiliated providers;
• Regular security reviews and updates to our platform;
• Secure document storage with per-client access isolation.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, WGG will notify the Hellenic Data Protection Authority within 72 hours of becoming aware of the breach, as required under the GDPR. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.

No data transmission over the internet or electronic storage is 100% secure. While we use all commercially reasonable measures to protect your data, we cannot guarantee absolute security.

Children's data

WGG's services are intended for adults aged 18 and over. We do not knowingly collect personal data from children under the age of 15. Under Greek Law 4624/2019, children's consent is required for the processing of their personal data in relation to information society services directly to them when they have reached the age of 15. Below that age, consent of a legal representative is required.

If you believe we have inadvertently collected data from a person under 15 without parental consent, please contact us immediately at info@wgg.gr and we will delete it promptly.

Where elder care services involve collecting data about elderly individuals who may lack full capacity, we will work with designated family members or legal guardians and process data on the basis of vital interests or legitimate interests, with appropriate safeguards in place.

Marketing communications

WGG will only send you marketing communications if you have explicitly opted in to receive them. We do not send unsolicited commercial emails.

When you register, you will have the option to subscribe to our newsletter and service updates. This is entirely optional and separate from service-related communications (which we may send regardless, as they are necessary for the performance of your contract with us).

You may unsubscribe from marketing communications at any time by:

• Clicking the unsubscribe link in any marketing email;
• Updating your preferences in your WGG portal account settings;
• Contacting us at info@wgg.gr.

Under Greek Law 3471/2006, email addresses legitimately acquired in the context of a previous transaction may be used for marketing purposes even without fresh consent, on condition that the recipient is given a clear opt-out option at every communication. We apply this rule conservatively and will always provide an easy way to opt out.

Changes to this privacy policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by email at least 30 days before the changes take effect and update the "Effective date" at the top of this page.

Non-material changes (such as corrections or clarifications) may be made without prior notice. We encourage you to review this policy periodically.

Your continued use of WGG's services after the effective date of any updated policy constitutes acceptance of the revised policy. If you do not accept the changes, you may close your account in accordance with our Terms of Use.

The Hellenic Data Protection Authority (HDPA) is responsible for supervising the application of the GDPR and Greek Law 4624/2019. Any material changes to this policy that affect how we process your data will be reviewed for compliance with HDPA guidance before taking effect.

Contact us & how to complain