Privacy Policy
Last updated: 4 August 2026
Protecting your personal data matters to us. This Privacy Policy explains, in plain language, what data we collect through digiu.gr, why we collect it, how long we keep it and what rights you have.
All processing is carried out in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Greek Law 4624/2019.
1. Data Controller
The controller of your personal data is:
- Company
- DigiU — Digital Marketing Agency
- GEMI No.
- 041582006000
- Registered office
- Kaveiron 49, 54352, Thessaloniki, Greece
- Phone
- +30 2312 311 465
- [email protected]
We are not required to appoint a Data Protection Officer. For any matter concerning your data, please contact us directly using the details above.
2. What data we collect
We only collect the data needed to answer your request or to deliver our services.
2.1 Contact form
-
Full name
-
Email address
-
The content of your message
2.2 Booking form
-
Full name
-
Email address
-
Phone number
-
The date and time you selected
-
The service you are interested in (where indicated by the page you were on)
2.3 Client data
If we work together, we additionally process billing details (company name, VAT number, tax office, address), the contact details of your representatives, and access credentials you grant us (e.g. Meta Business, Google Ads, WordPress, hosting) strictly for the performance of the contract.
2.4 Technical data
Our hosting provider keeps server logs containing the IP address, the date and time of the request, the page requested and the browser type. These logs serve solely the security and technical operation of the website.
2.5 Accessibility preferences
If you use the accessibility toolbar (font size, contrast, etc.), your choices are stored locally on your device in the browser’s localStorage under the key “digiu-a11y”. They are never sent to us, are not linked to your identity, and you can delete them at any time via the “Reset settings” button or by clearing your browser data.
We do not collect special categories of data (health data, political opinions, etc.) and we do not carry out automated decision-making or profiling.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Replying to a message sent via the contact form | Art. 6(1)(b) GDPR — steps taken at your request prior to entering into a contract |
| Handling a booking request | Art. 6(1)(b) GDPR — pre-contractual steps |
| Delivering the agreed services and client support | Art. 6(1)(b) GDPR — performance of a contract |
| Invoicing and tax obligations | Art. 6(1)(c) GDPR — compliance with a legal obligation |
| Security and proper operation of the website | Art. 6(1)(f) GDPR — legitimate interest in protecting our systems |
| Sending informational material (where you ask for it) | Art. 6(1)(a) GDPR — consent, withdrawable at any time |
| Establishing or defending legal claims | Art. 6(1)(f) GDPR — legitimate interest |
Filling in the forms is optional. Without basic contact details, however, it is technically impossible for us to respond to your request.
4. Cookies and local storage
This website uses no tracking cookies, no advertising cookies, no statistics cookies and no analytics tools (such as Google Analytics or the Meta Pixel). This is why no consent banner is displayed.
The only information stored on your device is the accessibility preferences described in section 2.5. This is strictly necessary technical storage, triggered by your own action, and does not require consent.
If analytics or marketing cookies are added in the future, we will first request your explicit consent through an appropriate mechanism and update this policy.
5. Who receives your data
We never sell or rent your data. We share it only with partners acting as processors on our behalf under an Article 28 GDPR agreement:
-
Email delivery provider (Mailgun Technologies, Inc. — the European infrastructure is used, api.eu.mailgun.net): receives the details you enter in the forms so that the message reaches us.
-
Website hosting provider: stores the website files and technical logs.
-
Accountant / tax advisor: for issuing invoices and tax compliance.
-
Public authorities: only where there is a legal obligation.
In addition, the website loads content from third-party providers, which necessarily receive your IP address in order to deliver that content: fonts from Google (Google Fonts, fonts.googleapis.com / fonts.gstatic.com) and some decorative images from Unsplash (images.unsplash.com). These providers are established in the USA.
Our Facebook, Instagram and TikTok pages run on those companies’ own infrastructure, under their own privacy policies. For page insights we may act as joint controllers with those providers.
6. Transfers outside the European Economic Area
Form messages are routed through our email provider’s European infrastructure and remain within the EU.
For the US-based providers mentioned above, any transfer relies on the European Commission’s adequacy decision for the EU–US Data Privacy Framework or, alternatively, on Standard Contractual Clauses under Art. 46(2)(c) GDPR.
7. Retention periods
We do not keep data longer than necessary:
| Category | Retention |
|---|---|
| Contact messages that did not lead to a project | 12 months from the last communication |
| Booking requests that did not lead to a project | 12 months from the appointment date |
| Active client data | For the duration of the engagement |
| Data after the engagement ends | 5 years (general limitation period for claims) |
| Invoices and tax records | 10 years, as required by tax law |
| Access credentials to your accounts | Deleted within 30 days of the engagement ending |
| Server logs | Up to 12 months |
8. Data security
We apply appropriate technical and organisational measures, including: encrypted transmission (HTTPS/TLS) across all pages and forms, storage of server API keys in environment variables rather than in page code, access limited to the team members who need it, use of a password manager and two-factor authentication, and regular backups.
9. Your rights
As a data subject, you have the right to:
-
Access the data we hold about you and obtain a copy (Art. 15).
-
Rectify inaccurate data or complete incomplete data (Art. 16).
-
Erasure (“right to be forgotten”), where no legal retention obligation applies (Art. 17).
-
Restriction of processing in certain circumstances (Art. 18).
-
Data portability in a structured, commonly used format (Art. 20).
-
Object to processing based on legitimate interest (Art. 21).
-
Withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3)).
To exercise your rights, email us at [email protected] or write to our registered office. We respond without undue delay and in any event within one (1) month, extendable by a further two (2) months for complex requests, in which case we will inform you. Exercising your rights is free of charge. We may ask for additional information to verify your identity.
10. Right to lodge a complaint
If you believe the processing of your data infringes the law, you have the right to lodge a complaint with the Hellenic Data Protection Authority:
- Address
- 1-3 Kifissias Ave., 11523 Athens, Greece
- Phone
- +30 210 6475600
- Website
- www.dpa.gr
We would, however, appreciate the chance to resolve the matter directly with you first.
11. Minors
Our services are aimed at businesses and adults. We do not knowingly collect data from persons under 16. If we discover that we have received such data, we delete it immediately.
12. Our role in client projects
When we manage advertising accounts, websites or e-shops on behalf of our clients, we may access personal data of their own customers. In those cases we act as a processor, on the instructions of our client who is the controller, under a written data processing agreement pursuant to Art. 28 GDPR. We never use that data for our own purposes.
13. Links to other websites
Our website contains links to third-party sites (e.g. social media, Google Maps). We are not responsible for their content or privacy practices. We recommend that you read their respective policies.
14. Changes to this policy
We may update this policy to reflect changes in our services or in the law. The current version is always published on this page together with the date of last update. Material changes are communicated to our clients by email.
15. Contact
For any question about this policy or your data: [email protected] — +30 2312 311 465 — Kaveiron 49, 54352, Thessaloniki, Greece.
Any questions about the above? We are here to help.
Contact