Privacy policy

This Policy explains in plain language which personal data we collect from visitors to this website, why we collect it, how long we keep it, who we share it with and what rights you have. It is written for this specific website only: it does not describe services or technologies we do not use.

1. Who we are (data controller)

The controller of your data is the business ek Home Design, which builds custom kitchen cabinetry and wardrobes.

For any matter concerning your personal data (questions, exercising your rights, complaints), contact the owner of the business, Achilleas Priftis, directly at the details above. He handles your requests personally.

2. What this Policy covers

The Policy covers the processing of data that takes place through this website. To be clear about what the website does and does not do:

• It is a static website presenting the business and its projects.
• There are no user accounts, no online store, no payments, no newsletter and no comments.
• There is one single form, the "Book an appointment" form on the Contact page. What you enter reaches us as an email message (section 3.1).
• We do not use web analytics tools, there are no advertising trackers (pixels), there is no chat window and no A/B testing of page variants is run.
• The website's font and code are hosted locally, on the same servers as the website. No call is made to any external font service (such as Google Fonts) or to a third-party content delivery network.
• As you browse, the only case in which third-party content may load is the Google map on the Contact page, and only if you allow it (sections 8 and 9). The same will apply to the Calendly appointment booking tool once it is activated (sections 3.6 and 8).

The Policy does not cover third-party websites you may reach through our links (see section 8). Cookies and local storage are also covered by a separate Cookie policy, which supplements section 9.

3. What data we collect

3.1 Data you provide in the "Book an appointment" form

The form is on the Contact page and includes the following fields:

Together with the request we receive the date and time the message was received and the language of the page from which it was submitted (Greek, English or Italian), so that we can reply in your language.

How the request reaches us. The form does not store anything on the website. When you press the "Send request" button, your details are transmitted in encrypted form to a small program (a Cloudflare Worker) operated on our behalf by our technical partner, Instatok (section 7). The program checks that the full name and phone have been filled in, composes an email message and delivers it, through the Resend email delivery service, to our mailbox home.design.ek@gmail.com. The message is sent from the address ekhome@instatok.gr. The program does not store your details and keeps no database: once the message is delivered, your data exists only in our mailbox.

Notice at the point of collection. Below the form fields there is a short notice about the purpose for which your details are used and a link to this Policy. We do not ask you to "consent" with a checkbox, because the legal basis for the processing is not consent (section 5).

Technical measure against automated submissions. The form includes a hidden field that visitors do not see and do not fill in. Only automated programs (bots) fill it in, and in that case the request is silently ignored. This measure collects none of your data and uses no third-party service (such as reCAPTCHA).

About the free-text field: whatever you write there, you send on your own initiative. Please do not include sensitive information (such as health data). If you mention details of another person (such as a housemate or your engineer), make sure you have informed them; we use those details only to handle the specific request and, if asked, we inform that person in accordance with Article 14 GDPR.

3.2 Technical data logged by the hosting server

As with every website, the server hosting it automatically logs certain technical details for each visit:

• the IP address of your connection (a number that can indirectly lead to your identification and is considered personal data),
• the browser and operating system you use (the so-called "user agent" string),
• the page or file you requested, the date and time, the response code and the volume of data,
• where applicable, the referring page (where you came from) and country or region indications generated by the hosting provider.

We do not use these details to identify you or to build visitor profiles. They serve the operation, stability and security of the website. The same applies to the call the form makes to the transmission program (3.1): it passes through the same network and is subject to the same technical logging.

3.3 Data that stays on your device

The website sets no cookies of its own. It uses only your browser's local storage, for two things: (a) to remember your choice about loading the map, for 6 months, and (b) to remember any settings you make in the accessibility tool (text size, contrast and so on). These entries remain on your device and are never sent to us: we do not know what you answered or what you set. Details in section 9.

3.4 Data that reaches third parties because of technical choices

The only such case today is the embedded Google Maps map on the Contact page: when it loads (and only if you allow it), Google receives your IP address and may set cookies of its own (section 8). Once the Calendly booking tool is activated, exactly the same will apply: it will load only with your consent (section 8).

Apart from that, the website's images, font and code are loaded from our own servers. Simply browsing does not reveal your visit to any other company, other than the hosting provider that technically serves the page (section 7).

3.5 What we do not collect

We do not collect special categories of data (health, beliefs, biometrics and so on), we do not collect payment data through the website, we do not buy or enrich contact lists and we do not track your behavior on other websites.

3.6 Booking data through Calendly (applies only when the integration is active)

We plan to add an online appointment booking tool from the Calendly service to the Contact page. As long as the integration is not active, nothing described in this subsection happens and nothing is loaded from Calendly. Once it is activated:

• The booking takes place inside a Calendly window that loads only after you allow it (section 8).
• To book, you fill in your full name and email and choose a day and time. You may also be asked for a phone number, so that we can confirm the appointment.
• These details are recorded in our Calendly account and in our calendar and are communicated to us by email. Calendly acts as a processor on our behalf (section 7) and itself sends you the confirmation and reminders for the appointment.
• The legal basis is the same as for the form: steps taken at your request prior to entering into a contract (section 5).

4. Are you required to give us your data?

No. You can browse the entire website without providing any details. Filling in the form is entirely optional. If, however, you choose to request an appointment, your full name and phone are necessary: without them we cannot contact you to arrange and confirm the appointment. The remaining fields simply help us serve you better.

The technical data in section 3.2 is generated unavoidably by the way the internet itself works and cannot be avoided if you visit the website.

5. Purposes of processing and the legal basis for each

Why we do not ask for consent for the form. When you ask us for an appointment, using your details is necessary in order to serve you. It would make no sense to ask for it as a separate "permission" and present it as a precondition; that is why the form has no consent checkbox. You are informed before you submit (section 3.1) and you can ask us to stop at any time (section 13).

We do not use your details to send marketing messages. If we ever want to do so, we will first ask for your separate, clear consent.

6. How long we keep the data

We keep data only for as long as needed for the purpose for which we collected it:

After these periods expire, the data is securely deleted or irreversibly anonymized.

7. Who has access (recipients and processors)

We do not sell or rent your data to anyone. Access is limited to:

1. The owner and any staff of ours who deal with appointments and projects, and only to the extent needed for their work.
2. Instatok (sole proprietorship of Antonis Kavidas, Tax ID 146129547, Sevasteias 39, Nea Ionia 142 31, Athens, instatok.gr): building, hosting and technical maintenance of the website, as well as operation of the program that transmits the form, as a processor under a contract in accordance with Article 28 GDPR. It has technical access to data only during support work and does not use it for its own purposes. For this work it uses, with our approval, the two sub-processors listed in points 3 and 4 (Article 28(2) and (4) GDPR).
3. Cloudflare, Inc. (USA), sub-processor of Instatok: hosting platform and delivery network for the website, and execution of the form program. Cloudflare serves the pages and runs the program from its global network, that is, from the data center closest to the visitor; for visitors from Greece this is as a rule within the EU, although processing in another region, including the USA, cannot be ruled out (section 10). The form program does not store data.
4. Resend, Inc. (USA), sub-processor of Instatok: the service through which the form message is delivered to our mailbox. It processes the request details only to transmit the message and keeps them for a short period, solely for delivery and technical verification of sending.
5. Google (Gmail): the mailbox in which we receive and store the form messages. The service is provided by Google Ireland Limited, with infrastructure and access by Google LLC (USA). The messages remain in the mailbox for the period set out in section 6.
6. Google (map): only if you allow the map to load. For the collection and transfer triggered by the embed on our page we are also responsible; for what Google subsequently does with that data, it acts as an independent controller (section 8).
7. Calendly, LLC (USA): only once the integration is activated and only if you allow it to load. For the booking data it acts as a processor on our behalf, under the data processing agreement included in its terms. For the operation of its own platform (its own cookies, security, service statistics) it acts as an independent controller, under its own privacy policy (calendly.com/privacy).
8. Accountant and legal advisors, if a collaboration goes ahead and to the extent required by law or for the defense of claims.
9. Public authorities (for example tax authorities, courts, the HDPA), when we are legally required to provide them with data.

We do not use a font service (such as Google Fonts) or a third-party content delivery network for third-party libraries: all website files (font, images, code) are loaded from our own deployment. Cloudflare itself operates as the website's delivery network (point 3): it is our hosting provider, not an additional third party.

From every processor we require adequate security guarantees, a confidentiality commitment and processing only on our instructions.

8. The Google Maps map, the Calendly booking tool and external links

Map. The Contact page contains an embedded Google map so that you can easily find the showroom. This is third-party content. When the map loads:

• Google receives your IP address and technical details of your device and browser,
• it may set or read cookies on your device,
• if you are signed in to a Google account, the visit may be associated with that account.

For this reason the map loads only after you give your consent. Until then, in its place you see a simple box explaining that the map has not loaded, with a "Load map" button and a plain link to Google Maps. No call to Google is made unless you click. If you change your mind, withdrawal actually removes the map from the page (section 13).

What Google does with that data is governed by its own privacy policy (policies.google.com/privacy) and we cannot control or modify it. For our own responsibility (that is, for the fact that the embed happens only with your consent and only then), contact us (section 12).

Calendly booking tool (applies only when the integration is active). Once activated, the Contact page will also contain an appointment booking window from Calendly, LLC (USA). It is third-party content and will be treated exactly like the map: it will not load before you give your consent, with a separate toggle in "Cookie settings". When it loads, Calendly receives your IP address and technical details of your device and browser and may set cookies of its own. Until you allow it, in its place you will see a box with a load button; our form and phone number remain available, so you lose no way of booking. What is collected during the booking itself is described in section 3.6. Calendly's privacy policy is at calendly.com/privacy.

Other external links. The website contains plain links to third-party websites, such as the link that opens our address in Google Maps in a new tab or the link to the website's developer. Nothing is loaded from those websites while you are on ours. When you click such a link, the processing of your data there is the responsibility of that website, which we do not operate and cannot control. We recommend that you read its privacy policy.

9. Cookies and local storage

The website sets no cookies of its own, neither for analytics, nor for advertising, nor for preferences.

The two entries ek-consent and ekhome-a11y-v1 are strictly necessary in order to respect the choices you yourself make, which is why they do not require separate consent under Article 4(5) of Law 3471/2006. They contain no identifying information. By contrast, Google's cookies (and Calendly's, once activated) are not necessary for the service you request and require your prior consent, under the same provision and HDPA Guidelines 1/2020.

In the box shown on your first visit, declining is as easy as accepting, no option is pre-selected and declining does not deprive you of any other website function. You can change your choice at any time from the "Cookie settings" link in the footer of every page, and you can also delete cookies and locally stored data from your browser settings.

10. Data transfers outside the European Economic Area

We prefer providers and configurations that keep data within the EU. However, some of our providers are companies based in or with infrastructure in the USA, so a transfer outside the EEA may take place:

• Cloudflare, Inc. (USA), through Instatok: hosting, delivery network and execution of the form program. Pages are served and the program runs from the nearest data center, but the company is based in the USA. The transfer relies on the EU-US Data Privacy Framework (European Commission adequacy decision of July 10, 2023), provided the provider is certified at the time of the transfer, and/or on the Standard Contractual Clauses (Implementing Decision (EU) 2021/914) included in Cloudflare's data processing agreement, under Articles 45 and 46 GDPR.
• Resend, Inc. (USA), through Instatok: delivery of the form message. The transfer relies on the EU-US Data Privacy Framework, provided the provider is certified at the time of the transfer, and/or on the Standard Contractual Clauses included in Resend's data processing agreement, under Articles 45 and 46 GDPR.
• Google (map): only for the embedded map and only if you allow it. The services are provided by Google Ireland Limited, with a possible transfer to Google LLC (USA) under the EU-US Data Privacy Framework and/or Standard Contractual Clauses.
• Google (Gmail, USA): the receiving mailbox. The transfer relies on the EU-US Data Privacy Framework (Google LLC is certified) and/or on the Standard Contractual Clauses, under Articles 45 and 46 GDPR.
• Calendly, LLC (USA), only when the integration is active and only if you allow it: loading of the booking window and storage of the booking details. The transfer relies on the EU-US Data Privacy Framework, provided the provider is certified at the time of the transfer, and/or on the Standard Contractual Clauses included in Calendly's data processing agreement, under Articles 45 and 46 GDPR.

Where a transfer relies on Standard Contractual Clauses, supplementary measures also apply (such as encryption in transit). You can request a copy or description of these safeguards at the contact details in section 1.

11. Your rights

The GDPR gives you the rights below. You exercise them free of charge, in the way described in section 12.

11.1 Right of access (Article 15). To learn whether we process your data and, if so, to receive a copy of it together with information about the purposes, the recipients and the retention period.

11.2 Right to rectification (Article 16). To have us correct inaccurate details (such as a wrong phone number) or complete incomplete ones.

11.3 Right to erasure, the "right to be forgotten" (Article 17). To have us delete your data when it is no longer necessary or when you lawfully object and there is no other legal basis. The right does not apply when retention is required by law (such as tax records) or is necessary for legal claims.

11.4 Right to restriction of processing (Article 18). To have us "freeze" the use of your data (for example while its accuracy or the merits of your objection are being checked) without deleting it.

11.5 Notification obligation (Article 19). We communicate every rectification, erasure or restriction to every recipient who has received your data, unless this proves impossible or involves disproportionate effort. On request, we inform you who those recipients are.

11.6 Right to data portability (Article 20). For the data you gave us that we process by automated means on the basis of a contract or consent, to receive it in a structured, commonly used and machine-readable format or, where technically feasible, to have it transmitted directly to another controller.

11.7 Right to object (Article 21). To object, on grounds relating to your particular situation, to processing based on our legitimate interest (purposes 5.5 and 5.6, and 5.1 where it relies on legitimate interest). We will stop the processing unless we demonstrate compelling legitimate grounds that override your rights. If processing for direct marketing purposes ever takes place, you have an absolute right to object, with no justification required.

11.8 Right not to be subject to automated decision-making and profiling (Article 22). We make no decisions concerning you based solely on automated processing and we do not profile visitors or customers.

11.9 Right to withdraw consent (Article 7(3)). See section 13.

11.10 Right to lodge a complaint (Article 77). See section 14.

12. How to exercise your rights

Submit your request to the contact person for personal data matters, Achilleas Priftis, in whichever of the following ways suits you:

• By email: home.design.ek@gmail.com
• By phone: 697 297 9439
• By post: ek Home Design, Kritis 67, Nea Ionia, 142 31 Athens
• In person at the showroom, by appointment.

It is enough to tell us which right you are exercising and give us the details that will allow us to locate your record (for example the full name and phone number you entered in the form).

• Identity verification: if we have reasonable doubts about your identity, we may ask for additional details. We do not ask for more than necessary and we do not keep copies of identity documents longer than required.
• Time limit: we respond without delay and at the latest within one (1) month of receipt. If the request is complex or there are many requests, the time limit may be extended by two (2) further months, in which case we inform you of the reasons within the first month.
• Cost: exercising your rights is free of charge. Only for manifestly unfounded or excessive requests, in particular because of their repetitive character, may we charge a reasonable fee or refuse, giving reasons.
• If we do not act on your request, we explain why and inform you of the possibility of lodging a complaint with the HDPA and seeking a judicial remedy.

13. Withdrawing consent and stopping communication

For the map (and, once activated, for the Calendly booking window), where processing relies on your consent, you can withdraw it at any time, as easily as you gave it: from the "Cookie settings" link in the footer of every page or by deleting the locally stored data from your browser. Withdrawal immediately removes the embedded content from the page and stops any new call to the third-party provider. Withdrawal does not affect the lawfulness of processing carried out before it.

For the appointment request, where we do not rely on consent, you can tell us at any time (by a message or phone call to the details in section 12) that you do not wish us to continue. We stop communicating immediately and delete your details, unless there is another lawful basis for keeping them (such as a pending contract or a tax obligation), in which case we explain this to you.

14. Right to lodge a complaint with the Data Protection Authority

If you believe that the processing of your data violates the law, you have the right to lodge a complaint with the supervisory authority (Article 77 GDPR, in conjunction with the provisions of Law 4624/2019 on the Authority's powers). We would, however, appreciate it if you contacted us first; the matter is usually resolved quickly.

Hellenic Data Protection Authority (HDPA)

• Address: Kifisias Avenue 1-3, 115 23 Athens, Greece
• Phone: +30 210 6475600
• Fax: +30 210 6475628
• Email: contact@dpa.gr
• Website: www.dpa.gr (complaints can also be submitted online)

You also have the right to an effective judicial remedy against the Authority or against the controller (Articles 78-79 GDPR).

15. Data security

We take appropriate technical and organizational measures (Article 32 GDPR), proportionate to the limited volume and nature of the data we handle:

• Encrypted connection (HTTPS/TLS) on all pages and when the form is sent.
• No visitor database and no user accounts: the website is static, the form transmission program stores no data and requests reach the business as email messages.
• The recipient of the messages is fixed inside the transmission program and cannot be changed by the visitor, so the form cannot be used to send messages to third parties.
• Protection against automated submissions with a hidden field, without any third-party service.
• Local hosting of the website's font and code, so that your browsing is not revealed to third-party providers.
• Loading of the map (and of the Calendly window, once activated) only after consent, with real withdrawal that removes the embed.
• Restricted access to the mailbox and customer files, only by persons who need it for their work: [fill in the measures actually applied, for example strong passwords, two-factor authentication, device encryption, backups].
• Confidentiality commitment of staff and partners and data processing agreements under Article 28 GDPR with processors.
• Software updates for the website by its developer, Instatok, as part of technical maintenance.

No transmission of data over the internet is completely secure. In the event of a breach likely to put your rights at risk, we will notify the HDPA within 72 hours and, where the risk is high, you as well, without undue delay (Articles 33-34 GDPR).

16. Minors

The website and our services are addressed to adults and the appointment request must be submitted by an adult. We do not knowingly collect children's data.

Where consent is required for information society services (for example for loading the map), it is valid from the age of 15, in accordance with Article 21 of Law 4624/2019; below that age, the consent of the holder of parental responsibility is required.

If we become aware that we have received a minor's details without the required consent, we delete them immediately. If you are a parent or guardian and believe that your child's details have been given to us, contact us (section 12).

17. Automated decisions and profiling

We make no decisions by solely automated means that produce legal effects or similarly significantly affect you, and we do not profile. Every communication, quote and decision is made by a person at the business.

18. Changes to this Policy

The Policy may be updated, for example if a new feature is added to the website (such as activation of the Calendly booking tool), if a provider changes or if the legal framework changes.

• Each new version is posted on this page with an updated date and version number at the top.
• Material changes (for example new purposes, new recipients, new cookies) will be clearly highlighted on the website and, where processing relies on consent, new consent will be requested.
• If we ever need to use your data for a different purpose from those in section 5, we will inform you before that processing and, where required, ask for your consent (Article 13(3) GDPR).
• We keep an archive of previous versions and make it available to you on request.

We recommend that you check this page before sending us any details.

19. Governing law, courts and language

This Policy is governed by the General Data Protection Regulation (EU) 2016/679, Law 4624/2019 and Law 3471/2006. Our relationship with a consumer is additionally subject to the protective provisions of Law 2251/1994.

We do not designate exclusive jurisdiction. If a dispute arises, the competent courts are those determined by the provisions of the Greek Code of Civil Procedure and, for consumers, by Regulation (EU) 1215/2012, which allows you to bring proceedings in the courts of your place of residence. You also retain the right under Article 79 GDPR to bring proceedings in the courts of the Member State of your habitual residence.

The original text of this Policy is in Greek. Where translations are available (English, Italian), they are provided for your convenience and, in the event of a discrepancy, the Greek text prevails; no translation discrepancy can limit the rights the law grants you.

Contact: ek Home Design, Achilleas Priftis, Kritis 67, Nea Ionia, 142 31 Athens · 697 297 9439 · home.design.ek@gmail.com