Privacy Policy

Who is responsible for your data

The controller of your personal data is the sole trader who runs Pliktro Digital (a web design and development business in Greece):

Koulouridis Nikolaos, Sole proprietorshipAnexartisias 3, 65403 Kavala, Eastern Macedonia and ThraceVAT no.: 302280232Tax office: KavalaGEMI no.: 191230130000 Pliktro Digital [email protected]

We have not appointed a Data Protection Officer (DPO), as one is not required for our activities (Art. 37 GDPR). For any question about your data, email us directly at the address above.

What we process, why, and on what legal basis

Enquiries. When you use the contact form or email us, we process your name, email address, your message and anything else you choose to tell us, so that we can reply. After you send the form, an automatic confirmation goes to the email address you entered (sent through Brevo); it contains only your first name and a fixed message. Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) when you ask about our services; otherwise our legitimate interest in answering the messages we receive (Art. 6(1)(f) GDPR).

Spam and abuse protection. When you open the contact page, Cloudflare Turnstile checks that you are a person and not a bot, using your IP address and browser and device signals. Our server also counts form attempts and submissions per IP address (for IPv6, per network prefix), in its memory only, to block floods of messages; each count expires after 10 minutes. Legal basis: our legitimate interest in keeping the form free of spam and abuse (Art. 6(1)(f) GDPR).

Hosting and security. Whenever you visit the site, our hosting provider Cloudflare processes the technical data needed to deliver the pages and protect them from attacks: your IP address, browser type, the page requested and the date and time. Images of our projects (on the home, projects and about pages and on each project page) are delivered by imgix, the image CDN of our content platform Cosmic, which likewise receives your IP address and browser details. Legal basis: our legitimate interest in running a secure, working website (Art. 6(1)(f) GDPR).

Analytics, only with your consent. Only if you click “Accept” in the cookie banner do we use Google Analytics 4 to understand how the site is used: the pages you visit, your approximate location (country or city, derived from your IP address), your device and browser type, and the page that referred you. This data is pseudonymous: it is linked to a random ID stored in a cookie rather than to your name, but it is still personal data. Google signals and all advertising features are switched off, and nothing is used for advertising. Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 4(5) of Greek Law 3471/2006). Before you choose, and after you refuse, it is not loaded.

Every cookie, what it does and how long it lasts is listed in our Cookie Policy.

Who receives your data

We share personal data only with the recipients below: service providers who process it on our behalf under data processing agreements (Art. 28 GDPR):

• Cloudflare, Inc.: Hosting and delivery of the website (Cloudflare Pages), security, spam protection on the contact form (Turnstile), rate limiting, technical request logs, and forwarding emails sent to our addresses to our mailbox (Email Routing). Location: USA, with a worldwide server network. Transfer safeguard: EU-US Data Privacy Framework; Standard Contractual Clauses in Cloudflare’s data processing addendum.
• Google Ireland Ltd / Google LLC: Website statistics with Google Analytics 4 — only if you accept analytics. Location: Ireland (EU) and USA. Transfer safeguard: EU-US Data Privacy Framework (Google LLC).
• Sendinblue SAS (Brevo): Delivers the messages you send through the contact form to our inbox by email, and sends you the automatic confirmation (your first name and a fixed message only). Location: France (EU). Transfer safeguard: None — processed in the EU.
• imgix (Cosmic’s image CDN): Delivers the images of our projects to your browser, and so receives your IP address and browser details. Location: USA, with a worldwide server network. Transfer safeguard: As set out in imgix’s and Cosmic’s data processing terms.
• Google (Gmail): Hosts our mailbox (the address shown above), where your emails and contact form messages arrive and are kept. Location: USA and EU (Google’s worldwide data centres). Transfer safeguard: EU-US Data Privacy Framework; Standard Contractual Clauses in Google’s data processing terms.

We do not sell your data or share it with anyone else, unless the law requires us to (for example, to a tax authority or a court).

Transfers outside the EU

Cloudflare, Google and imgix are based in the USA. The European Commission has decided that the USA ensures an adequate level of protection for companies certified under the EU-US Data Privacy Framework (Art. 45 GDPR, adequacy decision of 10 July 2023). Transfers to these providers rely on that certification (where the provider is certified) and, where their data processing terms provide for them, on the European Commission’s Standard Contractual Clauses (Art. 46 GDPR). You can check a company’s certification at www.dataprivacyframework.gov. Brevo processes the contact form emails in the EU.

How long we keep your data

• Enquiries: deleted 12 months after our last exchange. If a contract follows, we keep the correspondence needed for it for 5 years, as Greek tax law requires.
• Brevo: email delivery logs are kept for Brevo’s standard retention periods.
• Cloudflare: technical request logs are kept for Cloudflare’s standard retention periods.
• Spam protection: the per-IP (for IPv6, per network prefix) attempt and submission count lives only in the server’s memory. Each count expires after 10 minutes and is deleted at the latest when the next enquiry reaches the rate limiter, or when the server instance restarts, whichever comes first.
• Google Analytics: user- and event-level data is deleted automatically after 2 months; Google keeps only aggregated statistics after that. The analytics cookies themselves last as shown in the Cookie Policy.
• Your cookie choice: stored on your own device and valid for 12 months, after which we ask again.

Your rights

Under Articles 15 to 22 GDPR you have the right to access the personal data we hold about you, to have it corrected, to have it erased, to restrict its processing, to receive the data you gave us in a portable format (where we process it on the basis of a contract or your consent), and to object (see below).

To exercise any of these rights, email us at the address in “Who is responsible for your data”. We reply within one month (Art. 12(3) GDPR), and we may ask for information to confirm that the request comes from you. Exercising your rights is free of charge.

Your right to object (Art. 21 GDPR)

Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR) — answering messages outside a pre-contract context, spam protection, hosting and security — you have the right to object at any time, on grounds relating to your particular situation. We will then stop that processing, unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or we need it to establish, exercise or defend legal claims.

Withdrawing your consent

You can withdraw your analytics consent at any time, as easily as you gave it: open “Cookie settings” (below, or in the footer of every page) and choose “No thanks”. We then stop the analytics, delete the Google cookies set on this site and reload the page. Withdrawing consent does not affect the lawfulness of the processing carried out before it (Art. 7(3) GDPR).

Complaints

If you believe we process your data unlawfully, you have the right to lodge a complaint with the Hellenic Data Protection Authority (ΑΠΔΠΧ), Kifisias 1-3, 115 23 Athens, Greece, www.dpa.gr, or with the data protection authority of the EU country where you live or work. We would appreciate the chance to resolve your concern first, so feel free to contact us.

Do you have to give us your data?

No. You can browse the whole site without giving us any personal data. To send an enquiry we need your name, email address and message, only so that we can reply; without them we cannot answer you. Analytics runs only if you accept it, and refusing makes no difference to how you can use the site.

Automated decisions

We make no decisions based solely on automated processing, including profiling, that have legal or similarly significant effects on you (Art. 22 GDPR).

Changes to this policy

We update this policy whenever our processing changes and change the “Last updated” date at the top. If a change affects what you consented to, we ask for your consent again.