Privacy
In force since
This page names every company that receives anything from this site, what each one handles, and the lawful basis for it. It is short because the site does little: there is no account to create, no advertising, no analytics, no profiling, and nothing stored on your device.
Who is responsible
Ergasa is one person: Dimitris Athanassiadis, in Greece. He is the controller for everything described here and the only person with access to any of it. Write to hello@dimitrisathanassiadis.com about any of it, including the requests set out at the foot of this page.
Reading the site
This site sets no cookies and stores nothing on your device, so there is no consent banner to dismiss — not as a design preference, but because there would be nothing to consent to. It counts nothing: there is no analytics script here, and no third party is told that you visited. Nor does it load any JavaScript from another domain, and its typefaces are served from this one rather than from Google. The only thing your browser fetches from anywhere else is an image inside an article, which comes from the CMS named in the table below.
What is left is the ordinary record of a web server. The site runs on Vercel, whose servers keep short-lived request logs: the IP address a request came from, the page it asked for, the time, and the browser’s user-agent string. The lawful basis is my legitimate interest in keeping the site up and abuse off it (Article 6(1)(f) GDPR). Vercel deletes those logs within days, I keep no copy, and I read them only when something is broken. Nothing is derived from them about you, and nothing about who reads what is measured anywhere else — because Article 5(3) of the ePrivacy Directive, which in Greece is Article 4(5) of law 3471/2006, only asks for consent where something is written to or read from your device, and this site does neither.
The contact form
The form asks for your name, your email address, what kind of property you operate, its size, whether you are looking at ΕΣΠΑ co-funding, and your message. This site writes none of it down: there is no database, no account and no record created here. It arrives as an email, so what exists afterwards is the message in my mailbox, and the copy Resend keeps of anything it has sent — around a month, in its dashboard. Ask me and I will delete both.
The lawful basis is Article 6(1)(b) GDPR: you are asking about a possible working relationship, and replying is a step taken at your request.
The alert list
The alert list does one thing: it tells you when a row in the Regulatory tracker changes. It is never bundled with anything else, and signing up asks for an address and nothing more.
Submitting the form stores nothing. The confirmation link carries your address cryptographically signed rather than saved, so an address that never confirms never becomes a contact I hold. Confirming stores the address with Resend, together with the date and the version of the wording you agreed to — which is the record of what you consented to, and when.
The lawful basis is your consent (Article 6(1)(a) GDPR). Every message the list sends can end it in one click, withdrawal takes effect immediately, and withdrawing does not make anything that happened before it unlawful. Be clear about what unsubscribing does and does not do: it stops the mail at once, and it leaves the contact in place, marked as opted out, because a record that you asked to be left alone is what stops a later import putting you back. Ask me to delete it outright and I will.
Two qualifications, because without them the paragraph above would be false. An address that never confirms still appears in Resend’s log of what it has sent, with the subject and body of the confirmation. And opening the confirmation link puts the signed token in a web request, so the address is in this site’s own short-lived request logs for as long as those are kept. Those two are the whole of the trace an unconfirmed address leaves.
Who else receives anything
| Processor | What it handles | Where | Transfer basis |
|---|---|---|---|
| Resend | Enquiries from the contact form; the alert list’s addresses and the messages it sends | United States | Standard contractual clauses, in the data processing agreement its terms incorporate |
| Vercel | Hosting; the request logs above | Frankfurt; a United States company | Standard contractual clauses, in the data processing agreement its terms incorporate |
| Hostinger | The WordPress the articles are written in; requests for images inside an article’s body | European Union | None needed — the data does not leave the EU |
About the last row, because it is the one thing on this page a reader could not work out for themselves. The photograph at the head of an article is fetched by this site’s own server and served again from this domain, so reading one costs the CMS nothing. An image placed inside the body of an article is not: your browser loads it from cms.ergasa.com directly, and that server sees your IP address and your browser’s user-agent the way any web server does. The CMS holds no other reader data — no account, no comment, no form.
Your rights
You can ask me for a copy of whatever I hold about you, ask me to correct it, ask me to erase it, ask me to restrict or stop a particular use of it, or ask for it in a portable form. Where I rely on your consent you can withdraw it; where I rely on legitimate interest you can object. In practice the whole of it is one address on the alert list and whatever you wrote to me, so most of these are answered the same day. Write to hello@dimitrisathanassiadis.com.
If you think I have handled it badly, you can complain to the Hellenic Data Protection Authority — Kifissias 1-3, 115 23 Athens, dpa.gr — or to the supervisory authority of the EU country you live in.
Changes to this page
The date at the top is the date this text took effect, and it changes when the text does. A processor or a purpose is added to this page before it is added to the site, and nothing collected before a change is used for a purpose that change introduces.