Privacy notice.

This page explains which personal data we process when you visit www.hellenicweb3.com or send us a message, why, who receives it and what your rights are, as required by Articles 13 and 14 of the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679).

The timoula app, which we also build, has its own privacy policy at timoula.com/privacy-policy.

1. Who we are (data controller)

The data controller is:

Registered name

Hellenic Web3 Studio Limited Partnership

Registered office

Konstantinoupoleos 63, 54642 Thessaloniki, Greece

GEMI no.

189480806000

Tax ID

803102130 (EU VAT: EL803102130)

Email

support@hellenicweb3.com

We have not appointed a Data Protection Officer (DPO), as our activities do not require one. For any question about your data, email us at support@hellenicweb3.com.

2. What data we process and why

Contact form and email

• Data: your name, email address, the service you are interested in (if you choose one), your message and the language of the page you sent it from. If you email us directly, whatever your email contains.
• Purpose: to reply to your request and, if you ask for it, to prepare a proposal or quote.
• Legal basis: Article 6(1)(b) GDPR (steps taken at your request before entering into a contract) and, for general questions, Article 6(1)(f) GDPR (our legitimate interest in replying to people who contact us).
• Do you have to provide it? No. Without a name, email address and message, however, we cannot reply.

Please do not send us special categories of data (for example health information) through the form.

Protecting the form from abuse

To keep the form free of spam, the server counts how many messages are sent from the same IP address. The IP address is held only temporarily in the server's memory, as a pseudonymised fingerprint (hash), for about 10 minutes, and is not stored anywhere else. The form also contains a hidden field that only automated programs fill in. Legal basis: Article 6(1)(f) GDPR (our legitimate interest in keeping the website secure).

Visiting the website

When you open a page, our hosting provider (Vercel) processes technical data such as your IP address, browser type, the time and the page requested, in order to deliver the page and protect the website from attacks. Legal basis: Article 6(1)(f) GDPR.

3. Cookies and storage on your device

This website uses no cookies, no analytics and no advertising tools, and stores nothing on your device. The language you choose is shown only in the page address (/en for English). Fonts are served from our own server, not by third parties.

One exception: if Vercel's security system suspects that a visit is automated, it may ask for a short check and set a security cookie. That cookie is strictly necessary to let you in and is not used for tracking.

4. Who receives the data

We use the following providers, who process data on our behalf (processors):

• Vercel Inc. (USA): website hosting and running the contact form. The form is configured to run on a server in Frankfurt, Germany.
• Resend (USA): delivering the form message to our mailbox. Emails are sent through Amazon Web Services infrastructure in Ireland.
• Microsoft 365, provided to us through GoDaddy: our company mailbox, where messages arrive and are kept.

We do not sell data or share it with third parties for advertising. We may disclose it to public authorities only when the law requires it.

5. Transfers outside the European Union

Vercel and Resend are based in the United States, so data may be transferred there. These transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, for providers certified under it, and/or on the Commission's Standard Contractual Clauses included in their data processing agreements (Article 46(2)(c) GDPR). You can ask us for more information about these safeguards.

6. How long we keep data

• Messages that do not lead to a project: up to 24 months after our last contact, then deleted.
• If we start working together: for as long as the project lasts and then for as long as tax and commercial law require.
• Provider logs (Vercel, Resend): for a short period, according to their settings.
• IP addresses used to protect the form: about 10 minutes, in server memory only and in pseudonymised form.

7. Your rights

You have the right to:

• access your data (Article 15 GDPR),
• have it corrected (Article 16),
• have it erased (Article 17),
• restrict its processing (Article 18),
• data portability (Article 20),
• object to processing based on our legitimate interest (Article 21).

To exercise any of these rights, email us at support@hellenicweb3.com. We reply without undue delay and within one month at the latest, free of charge. If we have reasonable doubts about your identity, we may ask for additional information to confirm it.

8. Right to lodge a complaint

If you believe that the processing of your data breaks the law, you can lodge a complaint with the Hellenic Data Protection Authority (ΑΠΔΠΧ), Kifisias Ave. 1-3, 115 23 Athens, Greece, www.dpa.gr, or with the authority in the EU country where you live or work. We would appreciate it if you contacted us first so we can try to resolve it.

9. Automated decisions

We do not make decisions based solely on automated processing and we do not create profiles.

10. Changes to this page

If the way we handle data changes, we will update this page and the date at the top.