Hellenic Talent
LoginJoin us

Data retention policy

Last updated: 11 September 2026

1. Introduction and Purpose

Hellenic Talent operates an online platform that connects clients with freelance professionals. In the course of providing its services, Hellenic Talent collects, processes, and stores personal data relating to both clients, professionals who submit applications through the Hellenic Talent website or contact information, and freelancers which are part of the Hellenic Talent Network (together, "Users"). This Data Retention Policy ("Policy") sets out the principles, obligations, and procedures that govern how long Hellenic Talent retains personal data and the steps taken to securely delete or anonymise data once the applicable retention period has expired.

The purpose of this Policy is to:

  • ensure compliance with applicable data protection legislation, including the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Greek Law 4624/2019 on the implementation of the GDPR in Greece;
  • satisfy mandatory retention obligations imposed by Greek tax, accounting, and civil law;
  • protect the legitimate interests of Hellenic Talent and its Users by ensuring that personal data is available for the period reasonably necessary for the purposes for which it was collected; and
  • minimise privacy risk by ensuring that personal data is not held for longer than is necessary.

This Policy should be read alongside the Hellenic Talent Privacy Policy, Cookie Policy, and any applicable data processing agreements.

2. Scope

This Policy applies to:

  • all personal data processed by Hellenic Talent in connection with the operation of its platform, whether collected directly from Users or generated by the platform itself;
  • all employees, contractors, consultants, and third-party service providers acting on behalf of Hellenic Talent who process personal data in the course of their engagement;
  • all systems, databases, storage media, and third-party services used by Hellenic Talent to store or process personal data; and
  • personal data in all formats, including electronic records, scanned documents, and any other structured or unstructured data sets.

This Policy does not apply to anonymised data that cannot reasonably be re-linked to any identifiable individual, nor to aggregated statistical data that does not constitute personal data within the meaning of the GDPR.

3. Definitions

For the purposes of this Policy, the following terms have the meanings set out below:

Personal Data: Any information relating to an identified or identifiable natural person ("Data Subject") as defined in Article 4(1) GDPR. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to that person.

Data Subject: The identified or identifiable natural person to whom personal data relates. In the context of this Policy, Data Subjects include clients, freelancers, platform visitors, and any other individuals whose personal data is processed by Hellenic Talent.

Processing: Any operation or set of operations performed on personal data, whether or not by automated means, including collection, recording, organisation, structuring, storage, adaptation, retrieval, consultation, use, disclosure, dissemination, restriction, erasure, or destruction, as defined in Article 4(2) GDPR.

Retention Period: The defined period of time during which Hellenic Talent is permitted or required to retain personal data, as set out in the Retention Schedule in Section 5 of this Policy, after which the data must be deleted or anonymised.

Anonymisation: The irreversible process of altering personal data in such a manner that the Data Subject can no longer be identified, directly or indirectly, by any means reasonably likely to be used, including by the use of additional information. Data that has been effectively anonymised in accordance with this Policy is no longer considered personal data for the purposes of the GDPR.

Pseudonymisation: The processing of personal data in such a manner that the personal data can no longer be attributed to a specific Data Subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures ensuring that the personal data is not attributed to an identified or identifiable natural person, as defined in Article 4(5) GDPR. Pseudonymised data remains personal data.

Data Controller: The natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Hellenic Talent acts as Data Controller in respect of the personal data of its Users.

Data Processor: A natural or legal person, public authority, agency, or other body which processes personal data on behalf of the Data Controller.

Legal Hold: An instruction issued by Hellenic Talent's legal or compliance advisors requiring that personal data which would otherwise be subject to deletion or anonymisation be preserved because it is, or is reasonably anticipated to be, relevant to actual or threatened litigation, regulatory investigation, or other legal proceedings.

Secure Deletion: The permanent and irrecoverable removal of personal data from all systems and storage media using methods that prevent reconstruction of the data, as further described in Section 6 of this Policy.

4. Data Retention Principles

4.1 Storage Limitation

In accordance with Article 5(1)(e) GDPR, personal data must be kept in a form which permits identification of Data Subjects for no longer than is necessary for the purposes for which the personal data is processed. Where personal data is retained for archiving purposes in the public interest, for scientific or historical research, or for statistical purposes, it must be subject to appropriate technical and organisational safeguards.

Hellenic Talent will not retain personal data beyond the applicable retention period specified in the Retention Schedule in Section 5, except where:

  • a Legal Hold is in force (see Section 7);
  • a mandatory statutory or regulatory obligation requires longer retention; or
  • the Data Subject has provided specific consent to longer retention for a clearly defined purpose.

4.2 Data Minimisation

In accordance with Article 5(1)(c) GDPR, personal data must be adequate, relevant, and limited to what is necessary in relation to the purposes for which it is processed. Hellenic Talent will:

  • collect only the categories and volume of personal data that are strictly necessary for the identified purpose;
  • regularly review the categories of data held and remove data that is no longer necessary; and
  • apply pseudonymisation or anonymisation techniques where appropriate to reduce privacy risk during any required retention period.

4.3 Purpose Limitation

Personal data collected for a specific purpose must not be retained and used for incompatible purposes. Where Hellenic Talent intends to use personal data for a purpose other than that for which it was originally collected, a fresh legal basis assessment must be completed in accordance with Article 6 GDPR and, where applicable, Article 9 GDPR.

4.4 Integrity and Confidentiality

In accordance with Article 5(1)(f) GDPR, personal data must be processed in a manner that ensures appropriate security, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures. These obligations continue throughout the entire retention period and up to and including the point of secure deletion or anonymisation.

4.5 Accountability

In accordance with Article 5(2) GDPR, Hellenic Talent, as Data Controller, is responsible for and must be able to demonstrate compliance with the retention principles set out in this Section. Records of retention decisions, retention reviews, and deletion or anonymisation activities will be maintained in accordance with the schedule in Section 5.

5. Retention Schedule

The following table sets out the retention periods applicable to the principal categories of personal data processed by Hellenic Talent. Where a retention period is expressed as "duration of account + [period]", the retention period commences on the date of account closure, deletion, or deactivation. Where a retention period is expressed in years from a specified event, it commences on the date of that event.

Applicant Data

Description: Name, email address, Skills, portfolio items, work history, certifications, professional biography, profile photographs, interview recordings, interview notes

Retention Period: Duration of application and interviews + 1 year after rejection of applicant

Legal Basis / Justification: GDPR Art. 6(1)(b) (contract performance) and Art. 6(1)(a) (consent).

Action on Expiry: Secure deletion; anonymised aggregate statistics may be retained.

Enquiries Data

Description: Name, email address

Retention Period: 1 year from the Enquiry submission

Legal Basis / Justification: GDPR Art. 6(1)(b) (contract performance) and Art. 6(1)(a) (consent).

Action on Expiry: Secure deletion; anonymised aggregate statistics may be retained.

Public Source Data / Outreach / References

Description: Name, email address, Skills, portfolio items, work history, professional role and availability status, certifications, professional biography, profile photographs

Retention Period: 5 years from compiling the data / from receipt of the reference

Legal Basis / Justification: GDPR Art. 6(1)(f) (legitimate interest).

Action on Expiry: Secure deletion; anonymised aggregate statistics may be retained.

Account / Registration Data

Description: Name, email address, password (hashed), date of registration, account status, identity verification documents, phone number, date/place of birth, address, bank details and tax identification information.

Retention Period: Duration of account + 5 years after account closure

Legal Basis / Justification: GDPR Art. 6(1)(b) (contract performance); Greek Civil Code general statute of limitations (5 years — Art. 250 GCC as applicable to contractual claims).

Action on Expiry: Secure deletion; anonymised aggregate statistics may be retained.

Professional Profile Data (Freelancers)

Description: Skills, portfolio items, work history, certifications, ratings, reviews, professional biography, profile photographs.

Retention Period: Duration of account + 1 year after account closure

Legal Basis / Justification: GDPR Art. 6(1)(b) (contract performance); legitimate interest in dispute resolution (GDPR Art. 6(1)(f)).

Action on Expiry: Secure deletion of identifiable content; anonymised review data may be retained for platform quality metrics.

Financial / Payment & Transaction Data

Description: Invoice records, payment amounts, bank transfer references, commission and fee records, transaction IDs, fee records, payout history, bank account details (account holder, IBAN, BIC/SWIFT).

Retention Period: 10 years from date of transaction

Legal Basis / Justification: Greek Law 4308/2014 (Greek Accounting Standards — mandatory retention of accounting and financial records); GDPR Art. 6(1)(c) (legal obligation).

Action on Expiry: Secure archival then deletion.

Tax-Related Records

Description: VAT invoices, tax identification numbers, withholding tax certificates, income declarations submitted to or generated for tax authorities.

Retention Period: 10 years from the end of the relevant tax year

Legal Basis / Justification: Greek Tax Code as in force from time to time (Law 5104/2024, Κώδικας Φορολογικής Διαδικασίας); GDPR Art. 6(1)(c) (legal obligation).

Action on Expiry: Secure archival then deletion following expiry of tax authority audit window.

User Communications

Description: Messages exchanged between clients and freelancers, video call recordings, support tickets, dispute correspondence.

Retention Period: Duration of account + 2 years after account closure

Legal Basis / Justification: GDPR Art. 6(1)(b) (contract performance); legitimate interest in dispute evidence (GDPR Art. 6(1)(f)).

Action on Expiry: Secure deletion; attachments deleted separately following same schedule.

Platform Usage / Log Data

Description: Access logs, IP addresses, browser/device information, security logs, error logs, API call records.

Retention Period: Duration of account or 12 months from date of collection whichever is later

Legal Basis / Justification: Legitimate interest in platform security, fraud prevention, audit and performance monitoring (GDPR Art. 6(1)(f)).

Action on Expiry: Automated deletion; anonymised aggregate usage statistics may be retained indefinitely.

Cookie / Analytics Data

Description: Strictly Necessary/ Functional cookies, session identifiers.

Retention Period: Per Cookie Policy

Legal Basis / Justification: Greek Law 3471/2006 implementing ePrivacy Directive.

Action on Expiry: Automated expiry and deletion.

Legal / Compliance Records

Description: Records of data subject requests (access, erasure, portability), DPA correspondence, data breach notifications, DPIAs, legal advice received.

Retention Period: 10 years; or duration of legal proceedings + 5 years, whichever is longer

Legal Basis / Justification: GDPR Art. 6(1)(c) (legal obligation — accountability principle, Art. 5(2) GDPR); Greek Law 4624/2019.

Action on Expiry: Secure archival then deletion; records subject to active proceedings retained until final resolution + 5 years.

Marketing Consent Records

Description: Records of consent to receive marketing communications, opt-in timestamps, consent withdrawal records, communication preference history.

Retention Period: Duration of consent + 3 years after withdrawal or lapse of consent

Legal Basis / Justification: GDPR Art. 7(1) (demonstrating consent); legitimate interest in defending against regulatory complaints (GDPR Art. 6(1)(f)).

Action on Expiry: Secure deletion; aggregate opt-in/opt-out statistics anonymised and retained.

Contractual Records

Description: Signed service agreements, freelancer engagement contracts, client platform agreements, terms of service acceptance records, amendments, client briefs, freelancer and client proposals, freelancer shortlists, client, freelancer and HT notes.

Retention Period: 20 years from date of execution or last amendment

Legal Basis / Justification: Greek Civil Code Art. 249 (general 20-year limitation period for contractual claims); GDPR Art. 6(1)(c) and 6(1)(b).

Action on Expiry: Secure archival then deletion; electronic originals retained in access-controlled document management system.

The above schedule is subject to review regularly and will be updated to reflect changes in applicable law, regulatory guidance, or operational requirements. Where a specific statutory provision is cited, the retention period tracks any amendment to that provision.

6. Procedures for Deletion and Anonymisation

6.1 Identification of Data for Deletion

Hellenic Talent's IT and data management systems will, where technically feasible, be configured to flag personal data automatically when it approaches or reaches the end of the applicable retention period. Where automated flagging is not available, manual review processes will be conducted on a regular basis.

6.2 Secure Deletion Methods

The following methods will be used to effect secure deletion of personal data, selected according to the storage medium and sensitivity of the data concerned:

  • Electronic data on live systems: cryptographic erasure (secure key destruction for encrypted data) or overwriting using recognised standards, such that the data cannot be recovered by any reasonably practicable means.
  • Database records: permanent deletion via irreversible database commands, followed by verification that the records are absent from all HT proprietary backups within the backup rotation cycle, or purging of backups provided by third-parties due to expiry of the backup retention window.
  • Backup and archive media: scheduled purging of backup data in line with the relevant applicable backup retention policy of HT’s providers; where encrypted backups are held, deletion of encryption keys constitutes effective deletion.
  • Cloud-hosted data: utilisation of cloud service provider deletion and purging mechanisms that meet industry standards, in reliance on the provider's data processing agreement and documented deletion practices.
  • Physical documents containing personal data: cross-cut shredding, or incineration by a certified document destruction contractor.

6.3 Anonymisation as an Alternative to Deletion

Where the complete deletion of personal data is not practicable due to technical constraints (for example, the presence of data within deeply embedded logs or aggregated datasets), Hellenic Talent may instead apply anonymisation techniques, provided that:

  • the anonymisation is irreversible and meets the standard set out in the definition in Section 3 of this Policy;
  • the anonymisation has been assessed and confirmed to be effective by Hellenic Talent; and
  • the anonymised data is not used in any manner that could enable re-identification.

Anonymisation techniques that may be employed include, but are not limited to: data aggregation, noise addition, data generalisation, data suppression, and tokenisation with secure key destruction.

6.4 Verification Procedures

Following the completion of any deletion or anonymisation exercise, the responsible team member will:

  • record in writing (which may be electronic) that deletion or anonymisation has been completed;
  • where deletion has been performed by a third-party processor, obtain written confirmation from that processor; and
  • retain a record of the deletion or anonymisation activity for the period provided under the Legal / Compliance Records schedule in Section 5.

7. Exceptions to Standard Retention

7.1 Legal Holds

Where Hellenic Talent's legal or compliance function becomes aware of actual or reasonably anticipated litigation, regulatory investigation, or other legal proceedings in which personal data may be relevant, a Legal Hold notice will be issued to the relevant data custodians. Data subject to a Legal Hold must not be deleted or anonymised until the Legal Hold is formally lifted in writing by the issuing function, regardless of whether the standard retention period has expired.

Legal Hold notices will be issued in writing, will identify the categories of data to be preserved, the systems in which that data is held, and the reason for the hold. A register of active Legal Holds will be maintained by the Legal / Compliance team.

7.2 Regulatory Investigations

Where Hellenic Talent receives a request, notice, or indication from a supervisory authority (including the Hellenic Data Protection Authority ("HDPA") or any other competent authority) that it is or may be subject to regulatory investigation, any personal data that is or may be relevant to that investigation must be preserved until the investigation is concluded and any applicable appeal period has elapsed, or until the supervisory authority confirms in writing that the data need no longer be retained.

7.3 Ongoing Disputes

Where a User or third party has notified Hellenic Talent of an unresolved dispute, claim, or complaint (whether formal or informal) involving personal data, the relevant data may be retained beyond the standard retention period until the dispute is resolved and any applicable statutory limitation period has expired.

7.4 Data Subject Requests

Where a Data Subject has submitted a request under the GDPR (including a request for erasure under Article 17 GDPR), Hellenic Talent must consider whether any exception to the right of erasure applies, including obligations under Article 17(3) GDPR, before deleting data. Records of data subject requests and the responses thereto will be retained in accordance with the Legal / Compliance Records schedule in Section 5.

8. Roles and Responsibilities

8.1 IT and Security

HT shall undertake actions to:

  • implement and maintain technical controls that support automated retention and deletion processes;
  • execute secure deletion and anonymisation procedures in accordance with this Policy and the instructions of the Legal Advisors;
  • ensure that backup and archive media are purged in accordance with the applicable retention schedule;
  • maintain audit logs of deletion and anonymisation activities.

8.2 Legal and Compliance

HT shall undertake actions to:

  • monitor changes in applicable law and regulation that may affect retention periods;
  • get advice and guidance on applying Legal Hold, providing the relevant notices and maintaining the Legal Hold register;
  • liaise with supervisory authorities as required.

8.3 Employees and Contractors

All employees, contractors, and third parties with access to personal data are responsible for:

  • complying with this Policy and any instructions issued by Hellenic Talent or HT’s Legal / Compliance advisors in connection with data retention;
  • refraining from retaining personal data beyond the applicable retention period on personal devices, unauthorised storage media, or systems not approved by Hellenic Talent; and
  • reporting any suspected breaches of this Policy without undue delay.

9. Review and Updates

This Policy will be reviewed as required from time to time. Any amendments to this Policy will be advised by the legal consultants of Hellenic Talent and approved by senior management, before coming into force. The version history and effective date of each revision will be recorded. Users will be notified of material changes to this Policy in accordance with Hellenic Talent's privacy notice obligations under Article 13 and Article 14 GDPR.

10. Applicable Law and References

This Policy is governed by, and should be interpreted in accordance with, Greek Law and the relevant applicable laws of the European Union.

Company details

Legal name
Hellenic Talent Single Member P.C. (Hellenic Talent Μονοπρόσωπη Ι.Κ.Ε.)
Registered seat
Pratinou 67, 116 34 Athens, Greece
ΓΕΜΗ number
195798003000
Tax number (ΑΦΜ)
803384999
Share capital
EUR 15,000
Sole partner and manager
Panagiotis Belias
Email
privacy@hellenic-talent.com