Privacy Policy

Effective Date: 29 September 2026

1. DATA CONTROLLER

This website is provided and controlled by MYLONAS CHARALAMPOS DIMITRIOS, a registered sole proprietorship in Greece, operating under the registered trade name "Harry Mylonas Advisory" with GEMI Application Protocol Number 3650, and registered address at 17A Thermopylon Street, Vrilissia 15235, Greece (the “Business”).

For the purposes of Regulation (EU) 2016/679 (the “GDPR”) and applicable Greek data protection legislation, MYLONAS CHARALAMPOS DIMITRIOS is the data controller for personal data processed in connection with this website and the Business’s communications and prospective professional engagements.

For questions concerning this Privacy Policy or the processing of your personal data, please contact:

Email: admin [@] harrymylonas.com

2. SCOPE

This Privacy Policy explains how the Business collects and processes personal data when you:

• visit harrymylonas.com;

• use the website and its content;

• contact the Business by email or through other contact details published on the website; or

• communicate with the Business in connection with a prospective or existing professional engagement.

The Business processes personal data in accordance with the GDPR and applicable Greek data protection and electronic communications legislation, including Law 4624/2019 and Law 3471/2006, as applicable.

3. PERSONAL DATA WE MAY PROCESS

Depending on how you interact with the Business, we may process the following categories of personal data.

Information provided directly by you

When you contact the Business, this may include:

• name and surname;

• company and professional role;

• business email address;

• telephone number, where provided;

• information contained in your correspondence; and

• information you voluntarily provide concerning a potential or existing professional engagement.

Website and analytics information

When you visit the website and consent to the use of non-essential analytics cookies, Google Analytics 4 may collect information concerning your use of the website, including:

• pages and content viewed;

• interactions with the website;

• approximate geographic information, including country, region and city;

• browser and browser-version information;

• device type, brand, model and related device information;

• operating-system and platform information;

• screen resolution; and

• other technical and usage information made available through Google Analytics.

Google LLC documents that its granular location and device settings may include city, browser information, device brand and model, operating-system information, platform information and screen resolution.

For users in the European Union, Google LLC states that Google Analytics does not log or store individual IP addresses. IP addresses may be used at collection to derive geographic information and are then discarded before the Analytics data is logged.

The Business does not intentionally configure Google Analytics to collect names, email addresses, telephone numbers or other directly identifying information as Analytics data.

The Business does not intentionally collect special-category personal data through this website. You should therefore avoid sending confidential business information, customer information, credentials, security-sensitive information or other sensitive material through an ordinary website enquiry or email unless specifically requested through an appropriate secure communication channel.

4. HOW PERSONAL DATA IS COLLECTED

Personal data may be collected:

• Directly from you, when you contact the Business or voluntarily provide information in connection with a professional enquiry or engagement.

• Automatically through the website, through Google Analytics 4 and associated technologies, where you have consented to the use of non-essential analytics cookies.

Google Sites provides visitors in the European Union with a cookie-consent mechanism when Google Analytics is used. The mechanism allows visitors to Accept or Reject the use of non-essential cookies.

5. PURPOSES AND LEGAL BASES FOR PROCESSING

The Business processes personal data only where there is an applicable legal basis under the GDPR.

5.1 Pre-contractual and contractual processing

Where necessary to take steps at your request before entering into an engagement, personal data may be processed under Article 6(1)(b) GDPR for purposes including:

• responding to a professional enquiry;

• discussing a potential Technical Due Diligence, Independent Architecture Assurance or DORA/AWS Control Plane Assessment engagement;

• understanding the requirements and proposed scope of a prospective engagement; and

• preparing proposals, Statements of Work or other pre-contractual documentation.

Where an engagement has been entered into, personal data may be processed where necessary for the performance of the contractual relationship.

5.2 Legitimate interests

The Business may process personal data where necessary for its legitimate interests under Article 6(1)(f) GDPR, including:

• maintaining professional business communications;

• administering and protecting its information systems and communications;

• preventing and detecting security incidents, fraud or malicious activity;

• establishing, exercising or defending legal claims;

• maintaining and improving the website; and

• conducting its professional advisory business.

Where this legal basis is relied upon, the Business considers the interests and fundamental rights of the data subject and applies the processing only where its legitimate interests are not overridden by those interests or rights.

5.3 Consent for analytics cookies

Google Analytics 4 and its associated non-essential analytics cookies are used on the website only after the visitor has provided the relevant consent.

The purpose of this processing is to understand website usage, geographic distribution, device and browser usage, content engagement and website performance. The Business uses this information for its own website analysis and does not use Google Analytics for personalised advertising, remarketing or advertising profiling.

Consent may be withdrawn through the consent mechanism provided by the website, where available. Google LLC identifies analytics_storage as the consent category controlling analytics-related cookie storage in its consent framework.

6. GOOGLE ANALYTICS 4

This website uses Google Analytics 4, a web analytics service provided by Google LLC. Google Analytics is used to understand how visitors use the website and to evaluate website performance, content engagement, geographic distribution and technical usage patterns.

The Business has configured Google Analytics as follows:

• Google Signals: disabled;

• Google Ads integration: disabled;

• Google Analytics advertising features: disabled;

• advertising personalization: disabled;

• user-provided data collection: disabled;

• user-level and event-level retention: 2 months;

• reset of retention period on new activity: disabled;

• granular location and device data: enabled.

Google LLC documents that granular location and device data may include city, browser information, device brand and model, operating-system information, platform information and screen resolution.

The Business uses these analytics capabilities for website analysis and does not use them for personalised advertising or remarketing. Google LLC provides privacy controls for Analytics, including controls for granular location and device data, Google Signals, advertising features, advertising personalization and data retention.

The Business does not intentionally configure Google Analytics to collect directly identifying information such as names, email addresses or telephone numbers.

7. COOKIES AND SIMILAR TECHNOLOGIES

The website uses essential technologies required for the operation and security of the website. The website also uses non-essential analytics cookies associated with Google Analytics 4.

Non-essential analytics cookies are used only where the visitor has provided consent through the cookie-consent mechanism presented by the website. The Google Sites consent mechanism allows visitors in the European Union to accept or reject non-essential cookies used by the site, including Google Analytics cookies. If you reject non-essential cookies, the relevant analytics cookies are not used through that consent mechanism.

8. GOOGLE SITES, GOOGLE WORKSPACE AND SERVICE PROVIDERS

The website is provided using Google Sites. The Business also uses Google Workspace for business email and related business services. Google LLC provides Google Analytics 4. Google LLC and its affiliates may therefore process personal data in connection with the provision of these services.

Depending on the relevant service and processing activity, personal data may be processed or transferred outside the European Economic Area. Where an international transfer of personal data takes place, the Business relies on an applicable lawful transfer mechanism and appropriate safeguards, including, where applicable, the European Commission’s Standard Contractual Clauses or another legally recognised transfer mechanism.

The Business does not sell personal data and does not disclose personal data to third parties for their independent direct-marketing purposes.

9. DATA RETENTION

The Business retains personal data only for as long as necessary for the purposes for which it was collected, including where necessary to establish, exercise or defend legal claims or to comply with applicable legal, tax or accounting obligations. Business correspondence may therefore be retained for an appropriate period depending on the nature of the enquiry and whether it results in a professional engagement.

Google Analytics

The Business has configured Google Analytics 4 with:

• User-level and event-level data retention: 2 months.

• The retention period does not reset as a result of new user activity.

Google LLC states that the retention setting applies to user-level and event-level data and that, for standard Analytics properties, the available retention periods include 2 and 14 months. Standard aggregated Analytics reports are not affected by this user-level and event-level retention setting.

10. RECIPIENTS OF PERSONAL DATA

Depending on the circumstances, personal data may be processed by:

• Service providers: Google LLC and relevant Google group entities, in connection with Google Sites, Google Workspace and Google Analytics 4.

• Public authorities: Personal data may be disclosed to competent public authorities where required by applicable law, lawful request or legal obligation, or where necessary for the establishment, exercise or defence of legal rights.

The Business does not otherwise sell personal data or disclose personal data to third parties for their independent direct-marketing purposes.

11. INTERNATIONAL DATA TRANSFERS

Because the Business uses third-party services, certain personal data may be processed in jurisdictions outside the European Economic Area. Where such processing constitutes a transfer of personal data outside the EEA, the Business relies on the applicable legal transfer mechanism and appropriate safeguards provided for under applicable data protection legislation. The precise transfer mechanisms may depend on the service provider concerned and the applicable contractual and privacy arrangements.

12. YOUR DATA PROTECTION RIGHTS

Subject to the conditions and limitations established by applicable law, you may have the right to:

• request access to your personal data;

• request rectification of inaccurate or incomplete personal data;

• request erasure of personal data;

• request restriction of processing;

• object to processing where the applicable legal requirements for exercising that right are met;

• request data portability where the applicable conditions for that right are satisfied; and

• withdraw consent where processing is based on consent.

The Hellenic Data Protection Authority identifies these rights, including access, rectification, erasure, restriction, objection and portability, under the relevant GDPR provisions.

To exercise your rights, contact:  admin [@] harrymylonas.com

The Business will normally respond without undue delay and, in any event, within one month of receiving the request. Where permitted by the GDPR, this period may be extended by up to a further two months where necessary because of the complexity or number of requests. Where an extension is necessary, the data subject will be informed within the initial one-month period.

13. RIGHT TO LODGE A COMPLAINT

You have the right to lodge a complaint with a competent data protection supervisory authority if you consider that the processing of your personal data infringes applicable data protection law.

For the Business established in Greece, the relevant supervisory authority is:

Hellenic Data Protection Authority (HDPA)

Kifissias 1-3

115 23 Athens

Greece

Telephone: +30 210 6475600

Website: https://www.dpa.gr

The Hellenic Data Protection Authority confirms its competence to investigate complaints concerning alleged violations of data protection law and provides procedures for submitting complaints.

14. DATA SECURITY

The Business implements appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. The Business also relies on the security controls and infrastructure provided by its service providers, including Google LLC, Microsoft Corporation, and Amazon Web Services, Inc., in accordance with the relevant services and contractual arrangements. No method of transmission over the internet or method of electronic storage can be guaranteed to be completely secure.

15. LINKS TO THIRD-PARTY WEBSITES

The website contains links to third-party websites and services, including LinkedIn and Amazon. If you follow a link to a third-party website, the processing of personal data by that third party is governed by its own privacy policies and practices. The Business does not control and is not responsible for the privacy practices of third-party websites.

16. CHANGES TO THIS PRIVACY POLICY

This Privacy Policy may be updated from time to time to reflect changes to the website, services, processing activities or applicable legal requirements. The current version will be published on this page together with its effective date.

17. CONTACT

For questions concerning this Privacy Policy, the processing of personal data, or the exercise of data protection rights, please contact:

MYLONAS CHARALAMPOS DIMITRIOS

Trade Name: Harry Mylonas Advisory

17A Thermopylon Street

Vrilissia 15235

Greece

Email: admin [@] harrymylonas.com