1 · Who is responsible
The controller for all personal data processed on within.gr is:
Sofia Palamidou, P. Regkou 13, 54645 Thessaloniki, Greece · sofia@within.gr · +30 694 205 9330.
We are not required to appoint a data protection officer; for every privacy question, write directly to sofia@within.gr.
2 · What we process, why, and for how long
Visiting the site. Our hosting provider processes the data your browser sends — IP address, browser type, pages requested, time of access — to deliver the pages, keep the site secure and detect abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Server logs are deleted or anonymised after 30 days at the latest.
Contacting us. When you e-mail or call, we process what you send us to answer you. Legal basis: legitimate interest, or contract if your question concerns a booking. Kept as long as the conversation needs, then archived under the retention rules.
Session requests. To request a session you send us your name, e-mail and preferred time — by e-mail or, once activated, through the scheduling tool Cal.com. Legal basis: contract (Art. 6(1)(b)). Booking and invoice records are kept as long as Greek tax law requires (currently at least five years).
Workshop registration. Registrations for workshops run through external forms or directly with the co-host (e.g. Google Forms, e-mail to the studio). There, the respective provider’s privacy policy applies; we receive only what is needed to run the workshop.
The letter (newsletter). Name and e-mail. Legal basis: consent (Art. 6(1)(a)), which you can withdraw at any time — every letter has an unsubscribe link that works on the first click. Kept until you unsubscribe; the proof of your consent is kept as long as the law requires.
Health-related information. What you choose to share in a consultation — sleep, digestion, stress, what you have tried — may include health data (Art. 9 GDPR). We process it only with your explicit consent, given before your first session; only Sofia reads it; it is never used for marketing and never shared. You can withdraw this consent at any time; your consultation notes are then deleted, unless a legal obligation requires keeping a record. Legal basis: Art. 9(2)(a) GDPR.
Cookies & similar technologies. The site works without cookies. The only thing stored on your device is your choice in the cookie banner (local storage, 6 months) — this needs no consent (Greek law 3471/2006). Measurement or marketing tools are activated only if you accept them in the banner, and you can change your mind anytime via “Cookie settings” in the footer. Details: cookie policy.
3 · Who helps us (recipients)
We use a small number of service providers, each bound by a data-processing agreement (Art. 28 GDPR), each receiving only what its job needs:
· Hosting: Vercel Inc., USA — the site is delivered from Vercel’s global network, with points of presence in the EU.
· Image delivery: BunnyWay d.o.o., Slovenia (EU).
· Newsletter: The Rocket Science Group LLC (Mailchimp / Intuit), USA.
· Scheduling: Cal.com Inc., USA — only once online booking is activated.
· Workshop registration forms: Google Ireland Ltd. (Google Forms), Ireland — only for the workshops that use it.
Transfers outside the EU. Vercel, Mailchimp and Cal.com are based in the USA. These transfers rest on the EU–US Data Privacy Framework and/or EU standard contractual clauses (Art. 46 GDPR). Copies of the safeguards are available from us on request.
Beyond these providers we share nothing — no selling of data, no advertising networks without your consent, no profiling, no automated decision-making (Art. 22 GDPR). Fonts are hosted on our own site — no request is made to Google when you visit.
4 · What you must provide
Nothing on this site requires registration to read. To book a session, the data marked as required is genuinely needed — without it we simply cannot provide the service. Health-related information is always voluntary: you decide what you share.
5 · Minors
Bookings are made by adults. Where sessions concern a minor (our services address ages 6+), the booking, the consent and all communication run through a parent or legal guardian.
6 · How we protect it
The site runs exclusively over encrypted connections (TLS). Consultation notes are readable only by Sofia; our systems have access controls, backups and security monitoring.
7 · Your rights
You have the right to access your data (Art. 15), to correction (Art. 16), deletion (Art. 17), restriction (Art. 18) and portability (Art. 20) — and to withdraw any consent at any time, with effect for the future. One e-mail to sofia@within.gr is enough; we answer within a month.
Right to object (Art. 21 GDPR). Where we process your data on the basis of legitimate interest, you may object at any time for reasons arising from your particular situation — and at any time, without any reason, to direct marketing. Write to sofia@within.gr.
If you believe we handle your data wrongly, you can complain to the supervisory authority: Hellenic Data Protection Authority, Kifissias Ave. 1–3, 115 23 Athens, dpa.gr, complaints@dpa.gr — though we would be glad to hear from you first.
8 · Changes
When the services change — a new provider, a new feature — this policy changes with them. The current version always lives at this address, with the date of the last update at the top.