Legal
Privacy Policy
How we collect, use and protect your personal data.
1. Controller
GEORGIOS ZEAKIS, registered seat ΗΡΑΚΛΕΙΟ ΚΡΗΤΗΣ (ΕΘΝΙΚΗΣ ΑΝΤΙΣΤΑΣΕΩΣ 176, ΗΡΑΚΛΕΙΟ ΚΡΗΤΗΣ, 71307), Γ.Ε.ΜΗ. no. 186886927000, VAT no. EL063484969.
E-mail: info@e-roe.gr — Telephone: +306937085785.
2. Data protection contact
For any data protection matter: dpo@e-roe.gr.
We have not designated a Data Protection Officer, and we say so expressly so that the address above is not taken for one. Art. 37(1) GDPR lists the cases exhaustively — a public authority, a core activity of large-scale systematic monitoring, or large-scale special-category data — and a contact form with aggregate statistics meets none. If one is designated, the details will be published here and communicated to the Authority under art. 37(7).
3. What we collect
From the contact form: your name, e-mail address, telephone, organisation, organisation type, role, what you are interested in, and your message.
As evidence of your consent: the date and time of the consent and the IP address it was given from. These are kept because art. 7(1) GDPR requires us to be able to demonstrate consent — not to identify you.
Attribution data: the page language, the referring page, and campaign parameters (utm_source, utm_medium, utm_campaign) where present in the URL.
Mailing state: when the acknowledgement and the follow-up message were sent, a unique unsubscribe token, and whether and when you unsubscribed.
Technical logs: the server records IP addresses, request times and errors, for security and fault diagnosis.
Traffic statistics: aggregate and cookieless — see the Cookie Policy.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Answering your enquiry, question or demo request | Art. 6(1)(b) GDPR — steps taken at your request prior to entering into a contract. Not consent. |
| A single follow-up message, 3 days after you contact us | Art. 6(1)(a) GDPR (consent) and art. 11 of Law 3471/2006. Freely withdrawable, using the unsubscribe link in every message. |
| Aggregate, cookieless traffic measurement | Art. 6(1)(f) GDPR — legitimate interest: knowing which pages are read, so we can improve them. You can opt out. |
| Security, anti-spam and abuse prevention | Art. 6(1)(f) GDPR — legitimate interest: network and information security (recital 49). |
| Evidence of consent (timestamp and IP) | Art. 7(1) GDPR — the duty to demonstrate consent, read with art. 5(2) (accountability). |
5. Commercial communication
The consent box on the form covers contacting you about your enquiry and the single follow-up message. We do not add you to a mailing list, we send no periodic newsletter, and we do not pass your details to third parties for commercial use.
Art. 11 of Law 3471/2006 requires prior consent, and paragraph 5 of that article expressly provides that these rules apply to subscribers who are legal persons too — Greece did not take the corporate-subscriber exemption, so a work address is equally protected. Every message we send carries our identity and a one-click unsubscribe link that needs no login and costs nothing.
Withdrawing consent takes effect for the future and does not affect the lawfulness of processing carried out before it.
6. Recipients
Only staff who need the data in order to reply have access to it. We use one processor, and we name it:
- Hosting and e-mail
- OVH Hosting Limited, 38/39 Fitzwilliam Square West, Dublin 2, D02 NX53, Ireland, registered no. 468585.
- Processing agreement
- OVH Data Processing Agreement, version 17.10.2025, under art. 28 GDPR. Under the order of precedence the contract sets for itself, the DPA prevails over the General Terms of Services.
Traffic measurement (Umami) and the form's security check (ALTCHA) are hosted by us: they are not recipients, there is no transfer to a third party, and no reCAPTCHA-style service is used. We use no advertising networks and do not sell data.
7. Location and transfers outside the EU
The processor is a company established in the European Union (Ireland) and our server sits in a datacentre in France. The datacentre is chosen by us when ordering and, under art. 6.1 of the DPA, the provider does not change it without our prior approval.
We state the following too, because an absolute claim would be inaccurate: under art. 6.2 of the DPA the provider and its authorised sub-processors may process data remotely to the extent needed to operate, maintain and secure the service. Where such processing takes place from a country without an adequacy decision, the standard contractual clauses of Implementing Decision (EU) 2021/914 apply (art. 6.5 of the DPA). We do not select or use services in datacentres outside the EU.
8. Retention
| Category | Retention |
|---|---|
| Contact details that did not lead to a working relationship | 3 years from our last substantive contact with you, then deleted. |
| Details that led to a contract | For the duration of the contract and for as long as tax, accounting and limitation rules require. |
| Evidence of consent | While we rely on the consent and for 3 years afterwards. |
| Unsubscribe record | Indefinitely. It looks contradictory and is not: deleting the record that you do not want messages is what would let you receive them again. |
| Traffic statistics | Up to 13 months at visit level; aggregate figures up to 25 months. |
| Technical logs | Up to 6 months. |
9. Security
All communication with this website is over an encrypted connection (TLS). Access to data is restricted by role, passwords are stored hashed, sensitive fields are encrypted, and every uploaded file is scanned for malware before it is stored.
10. Your rights
- Access (art. 15), rectification (16), erasure (17) and restriction (18).
- Objection (art. 21) to processing based on legitimate interest. For direct marketing the right to object is absolute (art. 21(2)-(3)): saying so is enough.
- Portability (art. 20) — this attaches only to processing based on consent or contract and carried out by automated means; it does not cover the statistics or the security processing.
- Withdrawal of consent at any time (art. 7(3)).
Write to dpo@e-roe.gr. We reply within one month; for complex requests that period may be extended by two further months, with an explanation (art. 12(3)).
11. Is providing data mandatory?
No. Completing the form is entirely voluntary and follows from no law or contract. The only consequence of not giving us your details is that we cannot reply.
12. Automated decision-making
We carry out no automated decision-making and no profiling, and no algorithmic scoring or ranking of enquiries. Enquiries are read by people.
13. Minors
This website addresses professionals and organisations and is not intended for minors. Note that in Greece art. 21 of Law 4624/2019 sets the age of consent at 15.
14. Right to complain
You have the right to lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), 1-3 Kifisias Ave., 115 23 Athens, through the Authority's complaint submission page. We would nonetheless be glad of the chance to put things right first: tel. +306937085785.
15. Cookies
See the Cookie Policy, which describes the two strictly necessary cookies, the cookieless traffic measurement and the opt-out switch.
16. Our client bodies' data
This policy concerns this website. For data we process inside the e-ROE platform on behalf of an organisation, that organisation is the controller and we are the processor: see the GDPR page.