Legal
Cookie Policy
Which cookies we use and why we do not show a consent banner.
1. What cookies are
Cookies are small files a website stores on your device so it can «remember» something between two requests — for example that you are halfway through filling in a form. The law treats other forms of storage on the device, such as the browser's local storage, in the same way.
2. The cookies we use
| Name | Purpose | Duration | Party |
|---|---|---|---|
| e-roe-session | Maintains your session so the contact form and the security check can work. It does not contain what you type. | 120 minutes | First party |
| XSRF-TOKEN | Protects the form against cross-site request forgery — a submission made in your name without your intent. | 120 minutes | First party |
| locale | Remembers the language you are reading in, so the application's sign-in screen appears in the same one. The page URL does not reach that far: /login carries no language prefix. It holds only el or en. |
1 year | First party |
The first two are encrypted, marked HttpOnly and SameSite=Lax, and are not readable by third-party code. locale is neither encrypted nor HttpOnly, because it holds a language rather than a secret and the application has to be able to read it.
That is all of them. There is no third-party cookie, and none for tracking or advertising.
3. Language
The site's display language comes from the page URL — /el for Greek, /en for English. Your choice is additionally stored in the locale cookie for one reason: the application's sign-in screen carries no language prefix in its URL, so without it someone reading in English was met with a Greek sign-in screen. It is used for nothing else and is not linked to a person.
4. Why these need no consent
Art. 4(5) of Law 3471/2006, as replaced by art. 170 of Law 4070/2012, permits storage or access without consent where it is «necessary for the provision of an information society service explicitly requested by the user or subscriber».
All three are exactly that: the first exists so the form you asked to use can work, the second secures that same action, and the third carries out a choice you made — the language you selected. Opinion 04/2012 of the Article 29 Working Party places all three in the exempted categories (user-input cookies, user-centric security cookies, and user-interface customisation cookies). The exemption for the last is read against a proportionate lifetime, which is why it is a year rather than indefinite, and why it is written only when the language actually changes.
5. Why we show no banner
Because we install no non-essential cookies. A banner asking consent for something we do not do protects nobody; it just adds a click.
If that changes — if third-party embedded content is added (a video, a map, a font from an external network, a social widget), or a persistent preference cookie, or a hosted analytics service — a consent mechanism will appear, meeting conditions Γ4 and Γ7 of the Greek DPA's Recommendations: accept and reject «with the same number of actions (clicks) and from the same level», with buttons «of the same size, emphasis and colour».
6. Traffic statistics, without cookies
To know which pages are read we use our own installation of Umami — open-source software on our own server. It sets no cookie and stores nothing on your device. It builds no profile, does not track you across websites, and the figures are aggregate: page, country, device type, referring page.
We are precise about two things that are often phrased more flatteringly:
- We do not say it is «anonymous». The visitor is recognised on the server by a hash of the IP address and the browser, with a key that rotates monthly. The IP is not stored, but the result is pseudonymous, not anonymous. The legal basis for that processing is legitimate interest (art. 6(1)(f) GDPR) and it is described in the Privacy Policy.
- We do not say it is «out of scope because it uses no cookies». The measurement falls within art. 4(5), and the Greek DPA states expressly that analytics is not covered by the exemption. What makes it acceptable without prior consent is that it is first-party, aggregated and accompanied by an easy opt-out — and the Authority's position on first-party statistics is that «it suffices that the possibility of withdrawing consent (opt-out) is given».
Opt out of measurement
The switch applies to this browser on this device. Your choice is stored locally and is not sent to us.
Independently of the switch, we honour your browser's «Do Not Track» setting: when it is on, no visit is recorded.
7. Spam protection
The form is protected by ALTCHA, open-source and likewise on our own installation. It works by having your browser solve a computational puzzle, sets no cookie and stores nothing on your device. We use no reCAPTCHA-style service, so there is no third-party cookie and no transfer to a third party for this purpose — and you are not asked to identify images.
8. What we do not use
- Advertising or retargeting cookies.
- Third-party trackers, tracking pixels, social plug-ins.
- Fonts, scripts or images from external content delivery networks — everything is hosted by us.
- Embedded third-party videos, maps or forms.
- Selling or licensing data for advertising use.
9. Your own controls
Beyond the opt-out switch, you can manage or delete cookies from your browser settings. Note: if you block session cookies for this website, the contact form will stop working — submissions will be rejected as invalid. Reading the website is unaffected.
10. References
- Law 3471/2006 art. 4(5), as replaced by art. 170 of Law 4070/2012.
- Hellenic DPA, «Recommendations on the compliance of data controllers with the special legislation on electronic communications», ref. Γ/ΕΞ/1525, 25/02/2020 (the document carries no guideline number).
- Article 29 Working Party, Opinion 04/2012 on the cookie consent exemption (WP194).
- EDPB, Guidelines 2/2023 on the technical scope of art. 5(3) of Directive 2002/58/EC.
11. Changes and contact
If we add or remove a cookie, this page is updated before the change. Questions: dpo@e-roe.gr.