Cookie policy

Cookie and local storage policy

Last updated: [DD/MM/YYYY]

This policy describes what actually happens today on the website www.homedesignek.gr. It is not a boilerplate text: if something is not mentioned here, it does not happen. If something is ever added, the policy will be updated before it is activated. One such planned addition, the Calendly appointment booking tool, is already described in section 5A, with the express note that it is not yet active.

1. Who we are

The controller for the data described here is:

• Legal form: sole proprietorship · Full name: Achilleas Priftis (trade name: ek Home Design)
• Business activity: building custom kitchen cabinetry and wardrobes
• Registered office / showroom: Kritis 67, Nea Ionia, 142 31 Athens
• VAT no. (AFM) / Tax office (DOY): 100205125 / KEFODE · GEMI no.: 195323602000
• Phone: 697 297 9439 · Email: home.design.ek@gmail.com
• Contact person for personal data matters: Achilleas Priftis (owner of the business), home.design.ek@gmail.com, 697 297 9439

For how we handle your personal data overall (for example what you send us through the appointment form), see the Privacy policy. This policy concerns only what is stored or read on your device and what the website loads from third parties.

2. What cookies are and what local storage is

Cookies are small text files that a website asks your browser to store on your device. They are sent back to the server on every subsequent visit, which is how a website can "remember" you.

Local storage (technically: localStorage) is a space within the browser itself where a website can keep a piece of information. The difference is that it is not automatically sent anywhere: it stays on your device and is read only by the website that wrote it, when you visit it again.

Legally they are treated the same way: Article 4(5) of Law 3471/2006 applies to both, meaning that your consent is required, unless the item is strictly necessary in order to provide you with the service you requested.

3. What we DO NOT do

We state this expressly, because it is the most important part of this policy. The website:

• does not use cookies or other analytics tools (there is no Google Analytics or equivalent);
• does not use advertising or remarketing cookies or pixels (there is no Meta Pixel, Google Ads, TikTok or other);
• does not build visitor profiles and does not track your behavior within the pages;
• has no user accounts, cart, payments, newsletter or comments, so there are no login or session cookies;
• has no live chat window and no A/B testing of page variants;
• does not share your data with advertising networks or data brokers;
• makes no automated decisions concerning you.

Today the website sets no cookies of its own. The only items we store on your device are two entries in local storage, not cookies: the record of your own answer to the consent question and any settings you yourself make in the accessibility tool (section 4).

These statements are not a figure of speech: we commit to checking them before every technical change to the website and to updating the text before (not after) every addition (see section 14).

4. The only strictly necessary items: your choice and your settings

A. The record of your choice about the map. When you visit the website for the first time, a message appears asking whether you accept the loading of the embedded map (see section 5). In order not to ask you again on every page and every visit, we have to remember your answer.

• What is stored: three items: your choice about the map (yes or no), the date and time you made it, and the version number of this policy. Nothing else: no identifier, no identifying information, no IP address.
• Where: in your own browser's local storage, under the key ek-consent.
• Whether it is sent to us: no. The information stays on your device. We never see it.
• How long it lasts: 6 months. After six months the record expires, is deleted automatically and the question appears again, so that your choice stays current. It also expires earlier if (a) you delete the site data from your browser, (b) you change your choice from the footer, or (c) this policy changes materially. In that case the stored version number no longer matches and we ask you again from the start.
• If your browser does not allow storage (private browsing, site data blocked): nothing is stored, the map stays off and the question appears again on every visit. No function is lost.
• Why we do not ask for consent for this: because it is the means by which we honor your own choice. If we deleted it, we would ask you again and again. It is a strictly necessary item under the exception in Article 4(5) of Law 3471/2006.

B. The accessibility tool settings. At the bottom of every page there is a button with accessibility settings (text size, contrast, text spacing, dyslexia-friendly font, reading guide, link highlighting, large cursor, pause animations). So that your settings apply on all pages and on your next visit, they are stored on your device.

• What is stored: only the values of these settings (for example "text size 120%", "dark contrast: yes"). No identifier, no identifying information.
• Where: in your browser's local storage, under the key ekhome-a11y-v1.
• When it is created: only when you change a setting or press "reset". If you never use the tool, nothing is written.
• Whether it is sent to us: no. We do not know what you set.
• How long it lasts: until you reset the settings from the tool itself or delete the site data from your browser.
• Why we do not ask for consent for this: because it is a service you expressly request (by pressing the setting) and the storage is strictly necessary in order to provide it to you. It falls under the same exception in Article 4(5) of Law 3471/2006.

5. The embedded Google Maps map (third party)

The Contact page contains an embedded map from the Google Maps service, so that you can easily find our showroom.

This map does not load automatically. In its place you initially see a box explaining why the map has not loaded, a "Load map" button and a plain link to Google Maps. The map appears only after you give your consent. Our full address is in any case on the same page, as text.

What loading it means in practice:

• Your browser connects directly to servers of Google Ireland Limited (and its group).
• Google receives your IP address, information about your device and browser, the page from which the call originated and the time.
• Google may set cookies of its own or equivalent technologies on your device. Their names, purposes and durations are determined exclusively by Google, not by us, and may change without our knowledge.
• If you are signed in to a Google account, the visit may be associated with your account.
• A transfer of data outside the European Economic Area may take place, mainly to the USA. Google states that it relies on the adequacy decision for the EU-US Data Privacy Framework and/or on standard contractual clauses. These safeguards are its own statements, which we cannot verify.

Who is responsible for what. For the fact that our website causes your details to be sent to Google at the moment you consent, we are responsible: that is exactly why we load nothing before you allow it. For what Google subsequently does with that data, Google alone is responsible: we have no access to it, we receive no statistics from the map and we cannot intervene. Its own terms apply:

• Google Privacy Policy: policies.google.com/privacy
• How Google uses cookies: policies.google.com/technologies/cookies

If you do not consent, the map does not load and nothing is sent to Google. If you withdraw later, the map is actually removed from the page. In its place remains the box with the link to Google Maps, which you open only if you choose to, in which case Google's terms apply, as on any visit to a third-party website.

5A. Calendly appointment booking tool (third party, applies only when the integration is active)

Status: the integration is planned and not yet active. As long as it is not active, nothing is loaded from Calendly, none of its cookies are set and this section has no practical effect. We include it now so that you are informed before activation, as we commit to in section 14. Once it is activated, the date at the top of the text will change and you will be asked for your choice again.

Once it is activated, the following will apply:

• The Contact page will contain an appointment booking window from the Calendly service (Calendly, LLC, USA), in which you choose a day and time and fill in the booking details. What is collected during the booking and how long we keep it is described in the Privacy policy.
• The window will not load automatically. Like the map, it will appear only after you give your consent, with a separate toggle in the "Cookie settings" window and a load button in its place. The appointment form and our phone number remain available to anyone who does not consent: no way of booking is lost.
• When it loads, your browser connects directly to Calendly's servers, and Calendly receives your IP address, information about your device and browser and the page from which the call originated, and may set cookies of its own (for the operation and security of the service). Their names and durations are determined by Calendly.
• A transfer outside the EEA may take place, to the USA. The transfer relies on the EU-US Data Privacy Framework, provided Calendly is certified at the time of the transfer, and/or on the standard contractual clauses included in its data processing agreement.
• Who is responsible for what: for the fact that our website causes the loading, we are responsible, and that is why we load nothing before you allow it. For the booking data, Calendly acts as a processor on our behalf. For its own cookies and the operation of its platform, it acts as an independent controller, under its own policy: calendly.com/privacy
• Withdrawal will actually remove the window from the page, just as for the map (section 11).

6. What the website loads while you browse: nothing from third parties

All the files a page needs in order to display (texts, photographs, font and the code for animations and functions) are loaded from our own servers. Specifically:

• Font: hosted locally. No call is made to Google Fonts, so simply browsing does not send your IP address to Google.
• Website code (JavaScript, CSS): it is our own and is hosted locally. No external libraries or third-party content delivery network (CDN) are used.

In practice this means that, as long as you have not asked for the map to load, your browsing is not revealed to any third-party company, neither to a font service, nor to a library delivery network, nor to an analytics tool. The only unavoidable processing is that of our hosting provider, Cloudflare, which sees your IP address in order to deliver the page to you and acts as a sub-processor on our behalf (section 7). Local hosting of the font and code is a deliberate choice in favor of your privacy and costs a little more in maintenance.

7. Hosting and technical maintenance of the website

The building, hosting and technical maintenance of the website have been entrusted to Instatok (sole proprietorship of Antonis Kavidas, Tax ID 146129547, Sevasteias 39, Nea Ionia 142 31, Athens, instatok.gr), which acts as a processor on our behalf, under a contract in accordance with Article 28 GDPR. The website is hosted on the Cloudflare platform (Cloudflare, Inc., USA), which Instatok uses as a sub-processor with our approval (Article 28(2) and (4) GDPR). Cloudflare serves the pages from its global network, that is, from the data center closest to the visitor.

The hosting, as we have checked it, sets no cookies for this website; we will re-check this with every material change. The server, like every server on the internet, keeps technical logs (IP address, time, page, browser type) for the security and operation of the service. This processing relies on our legitimate interest (Article 6(1)(f) GDPR) in secure and uninterrupted operation, is not used for traffic analysis, and the logs are kept for [log retention period, to be confirmed in writing by the hosting provider].

Transfer outside the EEA: for visitors from Greece, pages are as a rule served from a data center within the EU, although processing in another region, including the USA, where Cloudflare is based, cannot be ruled out. This processing is covered by the EU-US Data Privacy Framework, provided the provider is certified at the time of the transfer, and/or by the European Commission's standard contractual clauses and the additional measures provided for in the provider's data processing agreement. You can request a copy of these safeguards at the details in section 17.

8. Plain links to third-party websites

The website contains plain links to third-party websites, such as the link that opens our address in Google Maps in a new tab and the link to the website's developer (instatok.gr). These are not embeds: no content, script or cookie from those websites is loaded on our pages, and nothing is sent there unless you click the link. If you click it, you are taken to a third-party website, where its own terms and cookies apply.

9. The "Book an appointment" form

The form on the Contact page uses no cookies and stores nothing on your device. What you fill in is sent, when you press the button, through a small program operated on our behalf by our technical partner (Instatok) and is delivered as an email message to the business, so that we can contact you about the appointment. This program does not store your details.

The form includes a hidden technical field that visitors do not see and do not fill in. Only automated programs (bots) fill it in, and in that case the request is ignored. This measure stores nothing on your device, collects none of your data and uses no third-party service (such as reCAPTCHA).

Below the form fields there is a short notice about the use of your details and a link to the Privacy policy. We do not ask you to "pay" with your data in order to use the website, nor to consent with a checkbox: the details you send us are processed in order to respond to your request and to take steps prior to a possible contract. This has no connection to, and no dependence on, your choice about the map: the one does not affect the other. Details in the Privacy policy.

10. Summary table

A. Strictly necessary (no consent required)

B. Third-party embeds (only with consent)

C. What is loaded from our own servers

Categories that do not exist at all: statistics / analytics, advertising, social media, personalization, profiling.

11. How you give, change and withdraw your consent

How you give it. On your first visit a message appears with three buttons: "Decline", "Accept" and "Settings". Declining is as visible and as easy as accepting: one click, in the same place. No option is pre-selected. Simply browsing, scrolling or ignoring the message is not treated as consent. Until you answer, the map does not load.

Separate choice per purpose. In the "Settings" window you see separately the strictly necessary items (always on, with an explanation) and the Google Maps map, with its own toggle that is off by default. Once the Calendly booking tool is activated (section 5A), it will get its own separate toggle, also off by default. You can save your choices or decline everything.

How you change or withdraw it. In the footer of every page there is a permanent "Cookie settings" link. Click it whenever you wish, the same settings window opens and you change your choice. Withdrawal is as easy as giving consent (Article 7(3) GDPR) and takes effect immediately: the map is removed from the page and does not load again. Any cookies Google had already set on your device remain until you delete them from your browser (see section 12) or until they expire. This is not within our control.

When we will ask you again. After 6 months from your choice, whenever this policy or the third-party items described here change materially, and if you delete your browser data.

Withdrawal is not retroactive: it does not affect the lawfulness of what took place while your consent was in force.

12. How to delete cookies and local storage from your browser

You can delete or block cookies and local storage at any time from your browser settings:

• Google Chrome: Settings → Privacy and security → Cookies and other site data / Clear browsing data
• Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data → Manage Data
• Safari (Mac): Safari → Settings → Privacy → Manage Website Data
• Safari (iPhone/iPad): Settings → Safari → Advanced → Website Data
• Microsoft Edge: Settings → Cookies and site permissions
• Android (Chrome): Chrome → Settings → Site settings → Cookies

Most browsers also offer private browsing, in which everything is deleted when the window is closed.

One thing to note: if you delete site data, the record of your choice will also be erased, along with any accessibility settings you had made. This is not an error; you will simply see the consent message again on your next visit and will need to make your settings again.

13. Declining does not hold you back in any way

There is no "cookie wall". If you decline, the website works fully and normally: all pages, all texts and all photographs of the kitchens and wardrobes are available to you, and the appointment form is equally available.

The only difference is that the embedded map on the Contact page does not appear (and, once activated, the Calendly booking window). In its place there is a box with an explanation and a link that opens the map in a new tab if you choose so, while the full address and phone numbers are on the same page in any case. No function, no information and no way of contacting us is lost.

14. If analytics or other tools are added in the future

Today we do not measure visits in any way. If this changes, we commit that all of the following will happen before anything is activated:

1. Updating this text first. A new category will be added to the table in section 10, with the name of each cookie, the provider, the exact purpose, the duration and the country of storage, and the last-updated date will change.
2. Prior consent. Analytics cookies are not strictly necessary. Nothing will load before an explicit, affirmative action on your part. No option will be pre-selected, in accordance with the Authority's Guidelines 1/2020.
3. Separate choice per category. The settings window, which already separates the strictly necessary items from the map, will get a separate toggle for each new category as well, so that you can accept one and decline another. The "Decline all" button will remain on the same level as acceptance.
4. Record of proof of consent. Documentation will be kept of which categories were approved, when and under which version of the text, so that consent can be demonstrated under Article 7(1) GDPR.
5. Preference for a privacy-friendly solution. Priority will be given to a tool hosted in the European Union that does not profile and does not transfer data to third countries.
6. Transparency about transfers. If the tool sends data outside the EEA, the country, the legal basis for the transfer and the safeguards will be stated expressly.
7. Renewal of consent already given. The old record will be invalidated and the question will be put to everyone again. An old "accept" for the map will never be treated as covering analytics or the booking tool.
8. The same applies to every new addition (booking tool, advertising pixel, chat window, embedded video, third-party font or library from an external delivery network): first the policy, then consent, and activation last.

15. Your rights

With regard to any personal data arising from the above, you have the rights of access, rectification, erasure, restriction of processing, objection and data portability (Articles 15-22 GDPR), as well as the right to withdraw your consent at any time. Some of these rights are subject to legal conditions; for example, portability concerns data we process with your consent or for the performance of a contract, not the server's technical logs.

Contact the contact person for personal data matters, Achilleas Priftis, at home.design.ek@gmail.com or 697 297 9439. We respond within one month. If the request is complex or there are many requests, the time limit may be extended by two further months, in which case we will inform you within the first month of the extension and the reasons for it (Article 12(3) GDPR). Exercising your rights is free of charge.

If you believe that we are not honoring what we write here, you can lodge a complaint with the Hellenic Data Protection Authority:

Kifisias Avenue 1-3, 115 23 Athens, Greece · Phone: 210 6475600 · www.dpa.gr

16. Changes to the policy

We will update the text whenever something material changes on the website, and before the change goes live. The date at the top always shows the last update. If the change concerns items that require consent, we will ask you again.

The website is available in Greek, English and Italian. The Greek text is the original and the translations are made with the aim of rendering it faithfully. If you notice a discrepancy, let us know and we will correct it promptly; in any case, no translation discrepancy limits the rights granted to you by EU and Greek law, and you may rely on the text in the language in which we addressed you.

17. Contact

For anything concerning cookies, local storage or personal data:

Achilleas Priftis, ek Home Design (contact person for personal data matters) Kritis 67, Nea Ionia, 142 31 Athens Phone: 697 297 9439 · Email: home.design.ek@gmail.com

Last updated: [DD/MM/YYYY]