Privacy Policy

1. Data protection at a glance. General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you. Detailed information on data protection can be found in our privacy policy below.

Data collection on this website.

Who is responsible for data collection on this website?

Data processing on this website is carried out by the Data Controller. You can find their contact details in the section "Information on the responsible party" in this privacy policy.

How do we collect your data?

On one hand, your data is collected when you provide it to us. This could include, for example, data that you enter into a contact form or via email.

Other data is collected automatically by our IT systems when you visit the website. This is primarily technical data (e.g., internet browser, operating system, or time of page access). This data is collected automatically as soon as you access this website. Technical data necessary for website stability is collected automatically. Non-essential tracking and analytical data are collected only after you grant explicit consent via our cookie consent management tool.

What do we use your data for?

Some data is collected to ensure the website functions correctly. Other data may be used to analyze your user behavior. If contracts can be concluded or initiated via the website, the transmitted data will also be processed for contract offers, orders, or other inquiries. The legal bases for our processing operations are: Article 6(1)(a) GDPR for processing based on your consent (e.g., newsletter, analytical cookies); Article 6(1)(b) GDPR for the performance of a contract or pre-contractual measures (e.g., contact forms, orders); and Article 6(1)(f) GDPR for safeguarding our legitimate interests (e.g., website security).

What rights do you have regarding your data?

As a data subject under the GDPR and Greek law, you have the following rights:

• Right of Access (Article 15): Request information free of charge at any time about the origin, recipients, and purpose of your stored personal data. 
• Right to Rectification & Erasure (Articles 16 & 17): Request the correction of inaccurate data or the deletion of your personal data. 
• Right to Withdraw Consent: If you have given your consent to data processing, you can revoke this consent at any time, effective for the future.
• Right to Restrict Processing (Article 18): Request the restriction of the processing of your personal data under certain circumstances.
• Right to Data Portability (Article 20): Request a copy of your data in a structured, commonly used, and machine-readable format to transfer to another controller. 
• Right to Object (Article 21): Object to the processing of your data based on our legitimate interests.

Right to Lodge a Complaint

You have the right to lodge a complaint with the competent supervisory authority. In Greece, this is the Hellenic Data Protection Authority (HDPA): Address: 1-3 Kifissias Avenue, 115 23, Athens, Greece, Email: contact@dpa.gr

Analytics Tools and Third-Party Tools

When you visit this website, your browsing behavior may be statistically analyzed for optimization and marketing purposes. This is primarily done using analytics programs. You can find detailed information about these analytics programs and manage your preferences in our Cookie Policy. Under Greek law (Law 3471/2006) and the GDPR, the use of analytical, targeting, and third-party cookies/trackers requires your explicit, opt-in consent before they can be placed on your device. You can grant, customize, or revoke your consent at any time via our cookie banner or the settings widget.

2. Hosting

We host the content of our website with the following provider:

External Hosting

This website is hosted externally. The personal data collected on this website is stored on the servers of the host(s). This may include, in particular, IP addresses, contact requests, metadata and communication data, contract data, contact information, names, website access data, and other data generated via a website.

External hosting is carried out for the purpose of fulfilling our contractual obligations to our potential and existing customers (Article 6 paragraph 1 point (b) GDPR) and in the interest of a secure, fast, and efficient provision of our online services by a professional provider (Article 6 paragraph 1 point (f) GDPR).

Where consent has been requested, processing of device-level data (such as cookies or device fingerprinting) is carried out exclusively on the basis of Article 6 Paragraph 1 point (a) GDPR and Article 4 of Law 3471/2006. Consent can be revoked at any time.

Our hosting provider(s) will only process your data to the extent necessary to fulfill its contractual obligations and will comply with our instructions regarding this data.

We use the following hosting provider:

Webador / JouwWeb B.V.

Torenallee 20

5617 BC Eindhoven

NETHERLANDS

Data Processing Agreement (DPA)

We have concluded a Data Processing Agreement (DPA) with our hosting provider. This is a legally required contract under data protection law, which ensures that the personal data of our website visitors is processed only according to our instructions and in full compliance with the GDPR

3. General Information and Mandatory Disclosures

Data Protection

The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in strict accordance with the EU General Data Protection Regulation (GDPR), the Greek Data Protection Law (Law 4624/2019), and this Privacy Policy.

When you use this website, various personal data are collected. Personal data refers to any information relating to an identified or identifiable natural person. This Privacy Policy explains what data we collect, the legal basis for processing it under Article 6 of the GDPR, and the purposes for which it is used. It also outlines your rights as a data subject, including your right to object, access, rectify, or erase your data.

Please note that data transmission over the Internet (e.g., when communicating by email) can have security vulnerabilities. Absolute protection of data against unauthorized access by third parties cannot be guaranteed, but we implement appropriate technical and organizational measures to secure your data.

Information on the Data Controller

The Data Controller responsible for data processing on this website under Article 4(7) of the GDPR is:

Konstantinos Vardaros 

Plagia Ikarias 

83300 AGIOS KIRIKOS 

IKARIA/ Greece 

Telefon: +306944109560 

E-Mail: mareaikaria@gmail.com 

Under Article 4(7) of the General Data Protection Regulation (GDPR) and Greek Law 4624/2019, the Data Controller is the natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data (e.g., names, email addresses, etc.)

Data Retention and Erasure Period

Unless a more specific retention period is specified within this Privacy Policy, your personal data will be stored only for as long as necessary to fulfill the purposes for which it was collected.

If you submit a legitimate request for erasure (“right to be forgotten”) under Article 17 of the GDPR, or if you withdraw your consent to data processing under Article 7(3) of the GDPR, your data will be permanently deleted or irreversibly anonymized within thirty (30) days, provided that no overriding statutory grounds or legal obligations require further storage.

Such statutory exceptions include, but are not limited to, mandatory tax and commercial retention obligations under the Greek Tax Procedure Code (Law 4174/2013) and Greek Accounting Standards (Law 4308/2014), or where processing is necessary for the establishment, exercise, or defense of legal claims (Article 25 of Greek Law 4624/2019). Once these statutory retention grounds expire, your data will be securely destroyed.

Right to Complain

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint regarding our data processing practices with the competent supervisory authority, the Hellenic Data Protection Authority (HDPA) (Kifissias 1-3, 115 23 Athens, Greece)

General Information on the Legal Basis for Data Processing on this Website

If you have consented to data processing, we process your personal data on the basis of Article 6(1)(a) GDPR or Article 9(2)(a) GDPR if special categories of data pursuant to Article 9(1) GDPR are processed. In the case of explicit consent to the transfer of personal data to third countries, data processing also takes place on the basis of Article 49(1)(a) GDPR. If you have consented to the storage of cookies or to access to information on your device (e.g., via device fingerprinting), data processing additionally takes place on the basis of Article 4(5) of the Greek Law 3471/2006. You may withdraw your consent at any time. If your data is required for the performance of a contract or for taking steps prior to entering into a contract, we process your data on the basis of Article 6(1)(b) GDPR. Furthermore, we process your data if this is necessary to fulfill a legal obligation, based on Article 6(1)(c) GDPR. Data processing may also be based on our legitimate interest pursuant to Article 6(1)(f) GDPR. The applicable legal bases in each individual case are explained in the following paragraphs of this privacy policy.

Recipients of Personal Data

In the course of our business operations, we disclose personal data to external third parties and data processors. We only disclose personal data if a valid legal basis applies under Article 6(1) of the EU General Data Protection Regulation (GDPR) and Greek Law 4624/2019. This includes disclosures necessary for the performance of a contract (Art. 6(1)(b) GDPR), compliance with a legal obligation to which we are subject (Art. 6(1)(c) GDPR, such as disclosures to competent Greek tax or regulatory authorities), or the purposes of our legitimate interests (Art. 6(1)(f) GDPR), provided these are not overridden by your data protection rights. When engaging data processors, we strictly transfer personal data pursuant to a valid Data Processing Agreement (DPA) in accordance with Article 28 GDPR. In instances of joint controllership, a joint processing agreement is concluded in accordance with Article 26 GDPR.

Withdrawal of Consent (Art. 7(3) GDPR)

Many data processing operations are only lawful with your explicit consent. You have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. You can submit your withdrawal at any time by contacting us at mareaikaria@gmail.com. It is as easy to withdraw consent as it is to give it.

Right to object to data processing in special cases and to direct marketing (Art. 21 GDPR / Art. 35 of Greek Law 4624/2019)

Objection based on particular situations: If data processing is based on Art. 6(1)(e) (public interest) or Art. 6(1)(f) (legitimate interests) GDPR, you have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you. This also applies to profiling based on these provisions. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or the processing serves the purpose of establishing, exercising, or defending legal claims (pursuant to Article 21(1) GDPR). Under Article 35 of Greek Law 4624/2019, this right does not apply if a public body is legally required to process the data or if the processing is mandatory for urgent public interest reasons.

Objection to direct marketing: If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing. This also applies to profiling insofar as it is related to such direct marketing. If you object, your personal data will subsequently no longer be used for direct marketing purposes (pursuant to Article 21(2) GDPR).

How to exercise your right: You can exercise your right to object at any time with no formal requirements. To do so, please contact us at mareaikaria@gmail.com

Right to lodge a complaint with the competent supervisory authority

In the event of violations of the EU General Data Protection Regulation (GDPR), data subjects have the right to lodge a complaint with a competent supervisory authority, in particular in the Member State of their habitual residence, their place of work, or the place of the alleged infringement. In Greece, the competent supervisory authority is the Hellenic Data Protection Authority (HDPA). This right to lodge a complaint is without prejudice to any other administrative or judicial remedy.

Contact Information for Greece:

Authority: Hellenic Data Protection Authority

Address: 1-3 Kifissias Avenue, 115 23 Athens, Greece

Website: www.dpa.gr

Email: complaints@dpa.gr

Right to data portability

You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format. You also have the right to transmit those data to another controller without hindrance from us, where the processing is carried out by automated means and is based on your consent or on a contract. If you request the direct transmission of the data from us to another controller, this will be carried out only where technically feasible.

Information, Rectification, and Erasure

Under applicable EU and Greek data protection laws, you have the right to obtain [free of charge] information regarding your stored personal data, its origin, recipients, and the purpose of processing. You also have the right to request the rectification (correction) of inaccurate data, or the erasure of your data, provided these requests comply with legal obligations. You can contact us at any time with regard to these rights or any further questions concerning your personal data.

Right to Restriction of Processing

You have the right to request the restriction of the processing of your personal data under the conditions laid down in Article 18 of the General Data Protection Regulation (GDPR). You can contact us at any time to exercise this right. The right to restriction of processing applies in the following cases:

• Inaccuracy of Data: If you contest the accuracy of your personal data stored by us, for a period enabling us to verify the accuracy of the personal data.
• Unlawful Processing: If the processing is unlawful and you oppose the erasure of the personal data and request the restriction of its use instead.
• Establishment of Legal Claims: If we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise, or defense of legal claims.
• Pending Objection: If you have objected to processing pursuant to Article 21(1) GDPR, pending the verification whether our legitimate grounds override yours.

Where processing has been restricted, such personal data shall, with the exception of storage, only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the European Union or of a Member State.

SSL/TLS Encryption

For security purposes and to protect the transmission of confidential content—such as inquiries you send to us as the site operator—this site uses SSL/TLS encryption. You can recognize an encrypted connection by the browser's address changing from "http://" to "https://" and the padlock icon in your browser bar.

When SSL/TLS encryption is active, the data you transmit to us cannot be read by third parties.

Objection to Unsolicited Commercial Communication

We expressly prohibit the use of contact details published on our Legal Notice/Imprint page for the purpose of sending unsolicited advertising or informational materials (e.g., spam). The website operators reserve the right to take legal action in the event of any violation of this prohibition.

4. Data Collection on this Website

Cookies

Our website uses so-called "cookies." Cookies are small data packets that do not harm your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are automatically deleted after you leave our website. Persistent cookies remain stored on your device until you delete them yourself or until they are automatically deleted by your web browser. 

Cookies can originate from us (first-party cookies) or from third-party companies (so-called third-party cookies). Third-party cookies enable the integration of certain services from third-party companies within websites (e.g., cookies for processing payment services). 

Cookies have various functions. Many cookies are technically necessary because certain website functions would not work without them (e.g., the shopping cart function or the display of videos). Other cookies can be used to analyze user behavior or for advertising purposes. 

Cookies that are necessary for the execution of electronic communication processes, for providing certain functions you have requested (e.g., for the shopping cart function), or for optimizing the website (e.g., cookies for measuring website traffic in an anonymized form) (essential/strictly necessary cookies) are stored on the basis of Article 4(5) of the Greek Law 3471/2006 as an exception to the consent requirement, as well as Article 6(1)(f) GDPR. The website operator has a legitimate interest in storing essential cookies to ensure the technically flawless and optimized provision of its services.

If consent to the storage of non-essential cookies (such as analytics, tracking, or marketing cookies) and similar recognition technologies has been requested, processing is carried out exclusively on the basis of this explicit consent (Article 6(1)(a) GDPR and Article 4(5) of Law 3471/2006); this consent can be revoked at any time via our cookie settings tool.

Alternatively, you can configure your browser settings to refuse cookies or notify you when cookies are being sent. Please note that blocking essential cookies via your browser may severely limit the functionality of this website.

Detailed information about the specific cookies we use, their purposes, lifespan, and any third-party services involved can be found below in this Privacy and Cookie Policy.

Server Log Files 

Scope and Types of Data Collected 

The provider of this website automatically collects and stores information in server log files, which your browser automatically transmits to us. This information includes:

• Browser type and version
• Operating system used
• Referrer URL (the previously visited page)
• Hostname and IP address of the accessing computer
• Date and time of the server request

This data is not merged with other data sources.

The collection of this data is based on Article 6(1)(f) GDPR. The website operator has a legitimate interest in the technically flawless presentation, optimization, and security of its website—the server log files must be recorded for this purpose.

Data Retention

The collected log data is temporarily stored and automatically deleted or anonymized within a maximum of 7 to 30 days (depending on your hosting provider's technical settings) unless a longer storage period is legally required (e.g., to investigate cyberattacks or resolve technical incidents). 

Right to Object

As the data subject, you have the right to object to this processing at any time on grounds relating to your particular situation (pursuant to Article 21 GDPR).

Contact Form

If you send us inquiries via our contact form, the data you provide—including your contact details—will be stored by us to process your inquiry and handle any follow-up questions. We do not share this data with third parties without your explicit consent.

Legal Basis for Processing:

• Pre-contractual/Contractual: Processing is based on Art. 6 para. 1 lit. b GDPR if your inquiry relates to fulfilling a contract or taking steps prior to entering into one.
• Legitimate Interest: In all other cases, processing is based on Art. 6 para. 1 lit. f GDPR, as we have a legitimate interest in effectively handling the inquiries addressed to us. 
• Consent: If you explicitly agree to further communication, processing is based on Art. 6 para. 1 lit. a GDPR. You may withdraw your consent at any time, effective for the future.

Data Retention:

Your data will remain with us until you request its deletion, withdraw your consent for storage, or the purpose for data storage no longer applies. Mandatory statutory retention periods—especially under tax and commercial law—remain unaffected.

Your Rights & Supervisory Authority:

You have the right to request access to your data, rectification, erasure, or restriction of processing, as well as the right to data portability. You also have the right to lodge a complaint with the Hellenic Data Protection Authority at contact@dpa.gr or via their Official HDPA Website.

Inquiries via Email, Telephone, or Fax

When you contact us via email, telephone, or fax, your inquiry, including all resulting personal data (e.g., name, contact details, and the content of your inquiry), will be stored and processed by us for the sole purpose of handling and responding to your request. We will not share this data with third parties without your explicit consent, unless required by law.

The processing of this data is based on Article 6(1)(b) of the General Data Protection Regulation (GDPR) if your inquiry relates to the performance of a contract or is necessary for taking steps prior to entering into a contract. In all other cases, processing is based on our legitimate interest in the effective handling of inquiries addressed to us (Article 6(1)(f) GDPR) or on your explicit consent (Article 6(1)(a) GDPR), if such consent has been requested and obtained; you may withdraw your consent at any time with future effect.

The data you send us via contact requests will remain with us until you request its deletion, withdraw your consent to its storage, or the purpose for data storage no longer applies (e.g., after your request has been fully processed). Mandatory legal provisions—in particular statutory retention periods under Greek civil, commercial, and tax laws—remain unaffected.

Pursuant to the GDPR and Greek Law 4624/2019, you retain the rights of access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and objection. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA).

5. Plugins and Tools

Google Fonts (local hosting)

This website uses Google Fonts for the uniform display of fonts. The Google Fonts are installed locally on our server. No connection to Google's servers is established when loading pages, and no data is transferred to third parties.

Further information about Google Fonts can be found on the Google Fonts FAQ page and in the Google Privacy Policy.

Google Maps

This website uses the Google Maps service. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. This service allows us to integrate interactive maps directly into our website.

To use the functions of Google Maps, it is necessary to process and store your IP address. This information is generally transmitted to and stored on a Google server in the United States. The provider of this website has no influence on this data transfer. When Google Maps is active, Google may also load external web fonts to ensure a consistent font display. Your browser loads the necessary web fonts into its cache to display text and layouts correctly.

The use of Google Maps is based on your explicit consent pursuant to Article 6(1)(a) GDPR and Article 4(5) of Greek Law 3471/2006, insofar as the service involves the storage of cookies or access to information on your device (e.g., device fingerprinting). You can withdraw your consent at any time via our cookie consent manager.

For data transfers to the USA, Google relies on the EU-US Data Privacy Framework. For cases where data may be transferred to countries without an adequacy decision, Google utilizes the EU Commission's Standard Contractual Clauses (SCCs).

Details on data processing can be found on the Google GDPR Controller Terms page and the Google SCCs Information page. More information on user data handling is available in the main Google Privacy Policy.