Privacy Policy

Last updated: 11 October 2026

1. Who We Are

MyGreekTax is an English language administrative coordination service for Greek tax and government paperwork. We are not an accounting firm and we are not licensed tax professionals. Every regulated filing is carried out by our licensed Greek accountant partner, a member of the Economic Chamber of Greece (OEE), under an authorisation you grant. Our role is to coordinate the process and make it work in English; theirs is to perform the regulated work under Greek law.

The data controller is Orphix OÜ, trading as MyGreekTax, registry code 17612931, Pärnu mnt 139b-14, 11317 Tallinn, Estonia. For any question about your data, or to exercise your rights in section 7, contact hello@mygreektax.eu.

2. Data We Collect

When you submit the consultation form we collect your name, email address, and the details you provide. If you contact us on WhatsApp, we receive your name, phone number and messages. We do not collect card details on this site. Payments are processed by our payment providers listed in section 5. We receive your name, the amount, and the payment status.

If you go on to become a client, we also hold the case information you send us (correspondence, documents, and the details needed for the filings you have asked us to handle) in our client portal at portal.mygreektax.eu. If you choose to use our secure credential form, we additionally hold an encrypted copy of the TAXISnet details you submit through it. Section 4 explains that in full.

3. How We Use Your Data

Your data is used solely to respond to your enquiry and to carry out the work you have engaged us for. We do not sell or rent your personal data, and we share it with third parties only where required by law, for the advertising described below, or where necessary to deliver the service you asked for (principally our licensed Greek accountant partner, who carries out regulated filings under a formal authorisation you grant).

Delivering your case. To carry out the work you ask for, we share your case data with the licensed professionals working on it (our accountant partner and, where needed, our partner lawyer) and with the competent Greek authorities, such as AADE. We share only what each filing needs. Our lawful basis is the performance of our contract with you (GDPR Article 6(1)(b)) and, where Greek law requires a submission, compliance with a legal obligation (Article 6(1)(c)).

Advertising on Facebook and Instagram. We advertise on Meta's platforms. So that we do not spend money showing our ads to people who are already our clients, we may share your email address and phone number with Meta Platforms Ireland Ltd through its Custom Audiences tool. The details are hashed (turned into unreadable codes) on our side before they are sent. Meta uses them only to find matching accounts, deletes the hashed details once the match is done, and may not use them for any other purpose. Our lawful basis is our legitimate interest in running our advertising efficiently (GDPR Article 6(1)(f)). You can object at any time by emailing hello@mygreektax.eu, and we will remove you from the list.

How your replies are written. Our WhatsApp line starts with an automated assistant that asks a few questions, and an AI tool reads your answers to help us sort enquiries. Apart from that, and automatic confirmations, every reply you receive is read, written and approved by a person on our team. To help us answer quickly and consistently, we use an AI tool that pulls together the relevant history of your case and suggests a starting point for the person handling it. It is a research assistant, not the author: the substance, the judgement and the final wording are ours. No decision affecting you is made by software alone.

4. TAXISnet Credentials (Optional)

We do not need your TAXISnet password in order to act for you. The standard route is a formal εξουσιοδότηση (authorisation) that you grant through myAADE, scoped to the specific filing. Your account stays under your sole control, and this remains our recommended approach.

Some clients would rather we register that authorisation on their behalf than do it themselves. Where you ask us to, we send you a single use link to a secure form on our portal. Using it is entirely voluntary and is never a condition of any service. If you do use it, this is exactly what happens:

• What we ask for. Your AFM, AMKA, TAXISnet username and password, any two step verification detail needed to complete the login, and any note you want to add.
• It is encrypted in your browser. The form encrypts your submission on your own device, before anything is transmitted (RSA OAEP 4096 with AES 256 GCM). What our database receives, and all it is ever able to hold, is unreadable ciphertext.
• Our systems cannot read it. The key that decrypts your submission is held outside them entirely: not in our database, not in our hosting provider's configuration, not in our source code, and not in any environment variable. It is entered by hand into a single administrator's browser at the moment a submission is opened, and is discarded when that page is reloaded.
• It is used for one purpose. To register the authorisation for the service you asked about, and for nothing else.
• It is not shared. Not with our accountant partner, who works through the authorisation rather than through your password, and not with anyone else.
• Every access is recorded. Each time a submission is opened or deleted, we log who did it, when, and which service justified it.
• Time limits apply. The link expires 30 days after we issue it and can be revoked sooner. A submission is deleted 180 days after it is made, or earlier at your request. Submitting again replaces and erases the previous submission.
• You can withdraw at any time. Our lawful basis for holding these details is your explicit consent (GDPR Article 6(1)(a)). Email hello@mygreektax.eu and we will delete the submission and confirm that we have done so.

If you have shared your password with us, we recommend changing it once the authorisation is in place. We will never ask for your TAXISnet password by email, by phone, or through any messaging app, and you should not send it that way. The only channel we use is the encrypted form described above.

5. Third Party Services

• WhatsApp (Meta): carries messages sent to our WhatsApp line.
• OpenRouter: runs the AI tools that sort WhatsApp enquiries and help us draft replies.
• Our form processing service: receives consultation form submissions and routes them to our internal client system.
• Revolut Bank UAB (Lithuania): our bank and card payment processor.
• Stripe Payments Europe Ltd (Ireland): card payment processor, used in some cases.
• Our licensed Greek accountant partner: receives the data needed for the filings you ask us to handle.
• Our partner lawyer: receives the data needed, only where your case involves legal work.
• Greek authorities (such as AADE): receive the data each filing requires, as described in section 3.
• Supabase: the database behind our client portal, where client and case records are stored. Encrypted credential submissions are stored here as ciphertext only.
• Cloudflare: hosts and serves this site and our client portal.
• Mailgun (Sinch): delivers the email we send you about your case.
• Meta Platforms Ireland Ltd (Facebook and Instagram): receives hashed client email addresses and phone numbers for ad audience matching, as described in section 3. See their privacy policy.
• Plausible Analytics: cookie free analytics that complies with GDPR. No personal data stored.
• Our own page statistics: we count which pages are read and which buttons, quizzes and forms are used, so we can see what helps people. This runs on our own servers (Cloudflare and Supabase, EU). It stores no cookies and nothing else on your device, no IP address and no browser details. We keep only the country, region and city your connection comes from. Each page view gets a random number that is forgotten when you leave the page, so visits cannot be linked to you.
• Google Ireland Ltd (Google Ads): only if you accept the cookie banner, sets a cookie that tells us which of our ads brought you here and whether you then contacted us (form, WhatsApp or email click). See their privacy policy.
• Microsoft Clarity: records how visitors use our pages (clicks, scrolling) so we can fix what is confusing. Text you type into forms is masked.
• Google Fonts: fonts loaded from Google's CDN; your IP may be logged by Google.

6. Cookies

Plausible Analytics and our own page statistics operate without cookies or any other storage on your device. Google Ads cookies are set only if you accept them in our cookie banner, and you can change your choice at any time with the "Cookie settings" link at the bottom of every page. See our Cookie Policy.

7. Your Rights (GDPR)

You have the right to access, rectify, or erase any personal data we hold about you, to restrict or object to how we use it, to receive it in a portable format, and to withdraw any consent you have given. Email hello@mygreektax.eu and we will reply within one month.

You also have the right to complain to a data protection authority. Our lead authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, Tatari 39, Tallinn, aki.ee). If you live in Greece you can also complain to the Hellenic Data Protection Authority (dpa.gr). We would appreciate the chance to put things right first, so please contact us before you do.

Our accountant partner. The licensed Greek accountant who files for you works under their own legal and professional duties under Greek law, so for the filings they make they are responsible for your data in their own right. We share with them only what each filing needs, and they are bound by professional confidentiality under Greek law.

8. Data Retention

Enquiry data is retained for up to 3 years unless you request earlier deletion. Our own page statistics are kept for up to 25 months. Encrypted TAXISnet credential submissions are retained for 180 days and then deleted, or sooner on request, as described in section 4. Invoices and payment records are kept for 7 years, as Estonian accounting law requires. Client case files and the documents you send us are kept for as long as we work for you and then for 6 years, the period in which Greek authorities can usually still ask questions about a filing. After that we delete them or return them to you.

9. Changes

We may update this policy occasionally. The "last updated" date at the top will reflect any changes.