Privacy Policy

The website potamiacarnival.gr («the site») is operated by the cultural association «Λαογραφικός & Πολιτιστικός Σύλλογος Ποταμιάς “ΔΙΟΝΥΣΟΣ”» («the association», “we”), a non-profit σωματείο under Greek law (Civil Code arts. 78–106, Ν.281/1914), seated in Potamia, Thassos. The association is the data controller for all personal data processed through the site.

• Privacy contact: thomas@creativityfilms.gr
• Postal contact: —

We have not appointed a Data Protection Officer; we are a small volunteer association and are not required to. The contact above reaches the current board.

2.1 Just visiting

• Server logs (IP address, user agent, requested URL, timestamp): kept short-term by our hosting provider for security and debugging. Legal basis: legitimate interest (running a secure service).
• Analytics: first-party, cookieless and aggregate — page views, referrers, approximate country (derived server-side from IP, which is not stored with the count) and device class. No advertising identifiers, no cross-site tracking, no profile of you. Legal basis: legitimate interest (understanding what the village actually reads).
• Cookies: see §7. A plain visit sets at most a theme/language preference cookie — no consent banner is needed because we run no tracking cookies.

2.2 Creating an account

If you register (to comment, submit a float, or manage association business): email address (verified), password (stored only as a salted hash), optional display name, and your role on the site. A session cookie after sign-in (§7). Sign-in emails (verification, password reset, magic links) are sent via our email provider (§4).

Legal basis: performance of a contract (the account you asked for). You can delete your account yourself at any time — see §6.

2.3 Signing in with Google or Facebook (when enabled)

If you choose social sign-in we receive from the provider only your name, email address and profile picture. We use the email solely to create or match your account (accounts are keyed by verified email) and we store name and email like any other account. We do not receive or store your social-network password, friends, contacts or posts, and we never post on your behalf.

Google user data is handled per the Google API Services User Data Policy, including the Limited Use requirements — we use it only to authenticate you, never for advertising, and never sell it.

Data deletion. You can delete your account and all associated data at your account page → “Delete account”, or request deletion by emailing thomas@creativityfilms.gr. Deleting your account also deletes the data received from the social provider. This paragraph is the deletion-instructions URL registered with Meta and Google.

Legal basis: performance of a contract, at your initiative.

2.4 Forms (contact, digital archive, raffle claims, floats, sponsorship)

• Contact form: name, email, message — to answer you. Kept until resolved, then archived or deleted.
• Digital-archive appeal: your contact details and whatever you tell us about the material you hold. If you send us footage or photos, §3 applies to their content.
• Raffle claims: name and contact details, checked against the winning number, then passed to the association members handling prizes. Deleted after the prize cycle closes.
• Float submissions: the float's name, description and participant names, plus the scripts, music and files the float owner uploads. Participant lists exist so the parade can be organised and are not published beyond what appears in the parade programme.
• Sponsorship and offers of help: name, business name, contact details, what you write and what you upload (logo, business card), so that we can get in touch. The site takes no payments.
• All public forms carry an anti-bot check (Cloudflare Turnstile, §4) and a rate limit.

Legal basis: performance of a contract / legitimate interest (running the carnival you are writing to us about).

2.5 Association elections (members only)

For board elections run through the site, the voter roll (member name + email) is processed under the association's statute and Greek association law (legal basis: legitimate interest / legal obligation of the association to run elections; membership itself is a fact you gave us on joining).

By design, the ballot is anonymous at the database level: who-has-voted is stored separately from ballot contents with no linking key, nobody — including administrators — can connect your vote to you, and published tallies contain only anonymous receipt codes.

2.6 Comments

Your display name and comment text are public by nature. Moderation history is kept internally. Legal basis: your action of posting.

2.7 AI-assisted features

Some logged-in features (e.g. float script/music assistance, admin social-media tooling) send the text or prompt you type to AI providers (§4) to generate a draft. Don't put personal data in prompts; we don't send your account data with them. AI features are marked in the interface, AI output is a draft you review — never something published automatically — and AI-generated content that could be mistaken for real footage or real people is labelled as generated (EU AI Act art. 50). Legal basis: performance of the feature you invoked.

The carnival is a public village event that has been filmed and photographed since 1992. The site publishes this archive: parade films, event coverage, photo albums, historical material.

• Legal basis for appearing in crowd/parade footage: legitimate interest (documenting a public cultural event, GDPR art. 6(1)(f)), alongside the freedom-of-expression/information balance of Ν.4624/2019 art. 28.
• We film openly at announced public events. Performers in the parade are the point of the footage; spectators appear incidentally as members of a crowd.
• If you appear in archive material and object, email thomas@creativityfilms.gr with the page/video and timestamp. We will assess promptly and in good faith — blurring, trimming or removing where your rights outweigh the archival interest, especially for minors or sensitive contexts. See also the takedown procedure in the Terms.
• Live streams show the public event as it happens; the same contact route applies to recordings.

We use a small set of service providers, each bound by GDPR processor terms:

We sell data to no one and share personal data with no one else, except if legally compelled (court order, competent authority).

Where a provider processes data outside the EEA, transfers rest on an adequacy decision (EU–US Data Privacy Framework) or Standard Contractual Clauses.

Under GDPR arts. 15–22 you can ask us for: access (a copy of your data), rectification, erasure, restriction, portability, and to object to legitimate-interest processing (including archive footage, §3).

• Self-service: your account page lets you see your data and delete your account (removes account, sessions and personal fields; public comments are anonymised; legally-required association records are retained).
• By request: through the contact form, choosing “My data / deletion”, or by emailing thomas@creativityfilms.gr. We answer within one month (GDPR art. 12(3)).
• If unsatisfied, you may complain to the Greek DPA: Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (www.dpa.gr, Κηφισίας 1-3, 115 23 Athens).

We use no advertising or cross-site tracking cookies and therefore show no cookie banner (Ν.3471/2006 art. 4(5) exempts strictly-necessary and user-requested-preference cookies):

Third-party embeds (YouTube, Vimeo, Twitch players; possible map embeds) load from those providers when you open a page containing them and are governed by their own privacy policies. Where technically supported we use privacy-enhanced embed modes. If we ever add advertising pixels (e.g. Meta Pixel), we will introduce a consent banner first and update this policy — today there are none.

The site is a village-carnival site meant for all ages; we don't target children with data collection. Accounts require a working email address; children under 15 (the Greek age of digital consent, Ν.4624/2019 art. 21) may not open an account without parental consent. Archive footage containing minors is treated with priority under §3 objections.

Passwords are stored hashed, transport is TLS-only, role-based access limits who can see what, admin actions on sensitive systems are audit-logged, and the election ballot box is structurally anonymous (§2.5). No system is perfect; if a breach ever puts your rights at risk we will notify the DPA within 72 hours and affected users without undue delay (GDPR arts. 33–34).

We will post changes here with an updated date; substantive changes affecting account holders are announced by email or on-site notice.

The Greek text is the legally binding one. This English version is provided for convenience; where the two differ, the Greek governs.