Privacy Policy

Last updated: 11 October 2026

The Mikrolab microbiology laboratory (hereinafter the “Company”) attaches particular importance to the protection of your personal data. This Personal Data Protection Policy (hereinafter the “Policy”) sets out the conditions under which our Company, with registered offices at 15A Theodorou Kolokotroni St, Chalandri 152 33, tel.: 210 6855799, email: mikrolabchristou@gmail.com, collects, stores and uses personal information. The Company also operates a second laboratory at 10 Korytsas St, Agia Paraskevi 153 43, tel.: 210 6006456.

About us

The Company is responsible for the website https://mikrolab.gr/, which is the Company’s online presence (hereinafter the “site”). The personal data you provide to us when visiting our website or contacting us are processed and kept in a file under the responsibility of our Company.

This Policy may be updated from time to time; for this reason you should check its content regularly for any changes.

This Policy concerns the website. Information on the processing of your data as a person tested at our laboratories (e.g. referrals, test results) is provided by the laboratory staff.

1. Definition of personal data

The term “personal data”, as used in this Policy, refers to information about data subjects, i.e. natural persons, whether private individuals or professionals, such as full name, postal address, email address, contact telephone number and the like, which can be used to identify a customer or visitor of the website.

2. Definition of processing of personal data

Processing of personal data means the collection, recording, organisation, storage, adaptation, alteration, retrieval, consultation, use, disclosure to third parties, dissemination, alignment, combination, restriction, erasure and destruction of the personal data of natural persons.

3. How personal data are collected

We collect information about you, among other cases, in the following situations:

  • when you contact us directly, by telephone or email, to request information,
  • when you visit the website,
  • when you fill in the contact form on our website.

The website has no member registration or user accounts, and no online payments are made through it.

If you provide personal data on behalf of a third party, you must ensure that this third party has first been informed of this Policy. If you are under 16, you must not provide us with any information about yourself unless you have the consent of the person who holds parental responsibility for you. Please help us keep your information up to date by informing us of any changes to your data.

4. Which personal data we collect

The following categories of data about you may be collected and further processed:

  • Contact and appointment form data: full name, phone number, email address, your preferred laboratory, your preferred day, the test or service you are interested in, whether you are interested in home blood sampling, and your message.
  • Information about why you contact us: information about your reasons of interest and requests for our services, including complaints and claims.
  • Technical data on the use of the website: IP address and browsing data, as recorded in the logs of the server and of the Cloudflare security service, for security and proper operation.
  • Traffic and advertising measurement data: only if you give your consent through the cookie notice, Google Analytics and Google Ads collect random identifiers of your device, the pages you visited, the source of the visit (e.g. search or an ad) and actions such as a call from the website or a form submission. See the Cookie Policy for details.

Health data. Stating the test you are interested in or a request for home blood sampling may reveal information about your health, which is a special category of data (Article 9 GDPR). We process it solely to serve you and schedule your appointment, based on your explicit consent, which you give before submitting the form. Please do not send test results, medical opinions or other health data through the form or by email beyond what is needed for the appointment. For such matters, please call the laboratory.

We collect the above data from you, as you provide them voluntarily. For the cookies and third-party content embedded in the website (Google maps, Google reviews), please see the Cookie Policy.

5. Processing of personal data

We do not make decisions or carry out profiling based on automated processing of your data.

6. Legal basis for processing personal data

  • Contact and appointment form, contact by email or phone: taking steps at your request prior to providing our services (Article 6(1)(b) GDPR) and, for any health data, your explicit consent (Article 9(2)(a) GDPR), which you give before submitting the form.
  • Analytics and advertising cookies: your consent (Article 6(1)(a) GDPR and Article 4(5) of Greek Law 3471/2006), which you can withdraw at any time from the website’s cookie settings.
  • Security and proper operation of the website (server logs, protection against attacks and automated messages): our legitimate interest in protecting the website and its visitors (Article 6(1)(f) GDPR).

Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

7. Purpose of processing personal data

The personal data you provide on our website are intended exclusively for purposes relating to the provision of our services and communication with you, so that we can respond to your request.

They may not be used by any unauthorised third party without compliance with the provisions of the General Data Protection Regulation (EU) 2016/679, national legislation and the relevant acts of the Hellenic Data Protection Authority, Law 3471/2006 and the ePrivacy Directive (2002/58/EC, as amended by 2009/136/EC), as in force.

The Company operates in accordance with applicable Greek and EU legislation and keeps your personal data secure. In short, we ask only for as much information as we need to serve you and communicate with you.

8. Recipients of the data

The recipients of the data are only the strictly necessary staff and associates of the Company, who are bound by confidentiality. We may share or disclose your data when you have expressly requested it or when required by law.

9. Processors

To operate the website, the Company works with the following providers, who process data on its behalf:

  • the website hosting and technical support provider,
  • Cloudflare, Inc., for the security and speed of the website and the protection of the form against automated messages,
  • Google Ireland Ltd., for the email service, traffic measurement (Google Analytics) and advertising measurement (Google Ads), the last two only with your consent,
  • Trustindex Ltd., for displaying Google reviews on the website.

The processors have agreed with and committed to the Company to keep confidentiality, not to send data to third parties without the Company’s permission, to take appropriate security measures, and to comply with the legal framework for the protection of personal data, in particular the GDPR.

10. Transfers outside the European Economic Area

Some of the above providers (Google, Cloudflare) or their affiliates may process data in countries outside the European Economic Area, in particular the United States. These transfers are based on the European Commission’s adequacy decision for the EU–US Data Privacy Framework, under which these providers are certified, or, where needed, on the European Commission’s Standard Contractual Clauses.

11. Processing and storage period – deletion

We keep the data you provide only for as long as necessary to fulfil the purpose for which you shared them and in compliance with the applicable legislation. In particular:

  • Contact form messages are sent to the Company’s email and recorded in the website database. They are kept for up to 12 months from our last communication, unless a longer period is needed to handle your request or to comply with the law, or until you request their earlier deletion.
  • Google Analytics statistics data are kept for up to 14 months and are then deleted automatically.
  • The duration of each cookie is listed in the Cookie Policy.

We restrict access to your data to authorised persons who need to use them for the specific purpose.

12. Data security

We are committed to safeguarding your personal data. We have taken appropriate organisational and technical measures to secure and protect your data against any form of accidental or unlawful processing. The site has an SSL certificate installed for the encryption and secure handling of your personal and browsing data.

These measures are reviewed and amended whenever necessary. Any processing of your data is permitted only by persons authorised by us, our employees and associates, exclusively for the purposes stated above.

13. Your rights as a data subject

  • Right of access. You have the right to be informed by us whether and which of your data we process, the purpose of the processing, the type of data we keep, to whom we disclose them, how long we store them and whether automated decision-making takes place.
  • Right to rectification. If you find an error in the personal data we hold about you, you may ask us to correct it.
  • Right to erasure (“right to be forgotten”). You may ask us to delete your data if they are no longer necessary for the above processing purposes or if you wish to withdraw your consent, where consent is the only legal basis.
  • Right to data portability. You may ask to receive the data you have provided in a readable format, or to have them transmitted to another controller.
  • Right to restriction of processing. You may ask us to restrict the processing of your data while your objections to the processing are being examined.
  • Right to object. You may object to the processing of your data or withdraw your consent, and we will stop processing unless there are other compelling legitimate grounds that override your right.

14. How to exercise your rights

Any request should be addressed in writing to the Company at mikrolabchristou@gmail.com. For any question, suggestion or statement relating to these matters, contact us by email or through the contact form. You may contact us in the same ways for information on the progress of your requests.

15. Handling of requests

We respond to your requests free of charge and without delay, and in any case within one (1) month of receiving your request. If your request is complex or there is a large number of requests, we will inform you within that month whether an extension of a further two (2) months is needed, within which we will respond.

If your requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may charge a reasonable fee, taking into account the administrative costs, or refuse to act on the request.

16. Applicable law

We process your data in accordance with the General Data Protection Regulation (EU) 2016/679 and, in general, the applicable national and European legislative and regulatory framework for the protection of personal data.

17. Right to lodge a complaint

You have the right to lodge a complaint with the Hellenic Data Protection Authority (1-3 Kifissias Ave, 115 23 Athens, tel. +30 210 6475600, email: contact@dpa.gr, www.dpa.gr) if you believe that the processing of your personal data violates the applicable legal framework for the protection of personal data.

18. Amendments to this Policy

We will update this Policy whenever necessary. If there are significant changes to the Policy or to the way we use your personal data, we will notify you by posting a notice in a prominent place before the changes take effect, or by any other appropriate means. We encourage you to read this Policy at regular intervals.

The Company is the Controller of the data it processes. See also the website’s Terms of Use and Cookie Policy.