Legal

Privacy Policy

Last updated: 2026-10-02

1. Data controller

2. What we collect

2.1 Contact form

When you send us a message we store your name, email address, topic, message text, site language and the time of submission. Legal basis: steps taken at your request before entering a contract (GDPR Art. 6(1)(b)) and our legitimate interest in answering enquiries (Art. 6(1)(f)). We keep messages for 24 months after the last exchange, or until you ask us to delete them. Technical server logs (which do not contain your email address in clear) are kept for 30 days.

2.2 Spam protection

The form is protected by Cloudflare Turnstile, which processes technical connection data (such as IP address and browser characteristics) to tell people from automated programs. Cloudflare acts as our processor. We apply a per-connection message limit; the IP address used for this is held only in server memory for one hour and is never stored.

2.3 Cookieless traffic measurement

For every page view we record the page path, language, device class (mobile, tablet, desktop or bot), the referring site's domain, the country (from a network header) and the time. We record no IP address, no cookies and no identifier of any kind. This data cannot be linked to a person and requires no consent.

2.4 Google Analytics 4 (consent only)

If you accept analytics cookies, Google Analytics 4 loads with IP anonymisation. Until then no cookie beyond the strictly necessary is set. You can change your choice at any time via the "Cookie Settings" link in the footer. Legal basis: your consent (Art. 6(1)(a)).

3. Recipients and transfers

Data is hosted on Google Cloud (region europe-west1, Belgium) and passes through Cloudflare's network. Both providers are bound by data processing agreements and Standard Contractual Clauses for any transfer outside the EEA. We do not sell or share data with third parties for advertising.

4. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. Email [email protected]; we respond within 30 days. You may also lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr, Kifisias 1-3, 115 23 Athens, Greece).

5. Security

The connection is encrypted (HTTPS with HSTS). Access to stored messages is limited to authorised persons through role-based access control.

6. Changes

Changes are published on this page with a new "last updated" date.