Privacy policy

Who we are

We are EVEC Athens (European Voluntary and Educational Center), a non-profit youth NGO registered in Greece, and we are the data controller for the information described here. Our registered office is Kallistratous 89, 157 71 Zografou, Athens, Greece. Our day-to-day office — where you can visit us or send post — is Polifimou 17, 157 71 Zografou, Athens, Greece. This notice covers the website evec.org.gr and the EVEC Volunteer Academy, including its Android app (listed on Google Play as “EVEC Volunteer Academy”), which shows this website full-screen. The Academy has its own section below: EVEC Volunteer Academy.

If you have any questions about your privacy or this notice, you can write to us at academy@evec.org.gr. For reference, our registered legal name is EVROPAIKO ETHELONTIKO KAI EKPAIDEFTIKO KENTRO (in Greek, ΕΥΡΩΠΑΪΚΟ ΕΘΕΛΟΝΤΙΚΟ ΚΑΙ ΕΚΠΑΙΔΕΥΤΙΚΟ ΚΕΝΤΡΟ; in English, European Voluntary and Educational Center), our Greek VAT number (ΑΦΜ) is 997127685, and our EU identifiers are OID E10172681 and PIC 909448430.

What information we collect

We only collect what we need, and most of the time that means information you choose to give us. This includes:

• Contact form. When you message us, we collect your name, your email address, an optional organisation name, and the content of your message.
• Programme applications. If you apply to take part in one of our activities, we collect the details needed to assess and run your participation. These are handled under the specific call you are applying to.
• Safeguarding checks. For roles that involve contact with people under 18, we ask you to provide a criminal-record certificate (ποινικό μητρώο). This is information about criminal convictions and offences, and we treat it accordingly — we record only that a valid certificate was seen and the date it was checked. We do not retain a copy of the certificate itself.
• Safeguarding and complaints records. If you raise a safeguarding concern or make a complaint, we record what was reported, who was involved, and what we did about it. Depending on what is reported, this can include sensitive information such as health or wellbeing details. Access is limited to the people who need it to act on the report.
• Newsletter. We are preparing an email newsletter. If and when it launches, we will use only an address you choose to give us, to send occasional updates, and every email will include an unsubscribe link.
• Technical data. Like most websites, our host keeps standard server logs (such as your IP address, browser type, and the pages requested) so the site can run and stay secure. When you sign in to the EVEC Volunteer Academy, the Academy also records your IP address with that sign-in (see EVEC Volunteer Academy).
• Cookies. Small files stored by your browser, described in the Cookies section below.
• EVEC Volunteer Academy. If you join our online Academy, on this website or in its Android app, we keep an account for you with your work, messages and progress. What it holds is listed in its own section below.

Why we use it and our legal basis

We use your information to reply to and handle your enquiries and applications. Depending on the situation, our legal basis is your consent and/or taking steps toward an agreement with you (for example, arranging your participation in an activity). If you join the EVEC Volunteer Academy, the purposes and legal bases for your Academy account are set out in its own section below.

We also use technical data to keep the site secure and working properly, which is our legitimate interest in running a safe, reliable website.

Safeguarding. Where we ask for a criminal-record certificate, or record a safeguarding concern, we are acting to protect children and vulnerable participants. Our basis for the underlying processing is our legitimate interest, and where applicable our legal obligations, in keeping participants safe. For the sensitive categories involved, we rely on the substantial-public-interest and vital-interests grounds that Greek and EU law provide for safeguarding, and we process criminal-record information only to the extent Greek law permits for this purpose. We keep this processing to the minimum needed — see How long we keep your information and our safeguarding policy.

To be clear: we do not sell your personal data. We do not currently show third-party advertising on the site. If we introduce advertising (such as Google AdSense) in the future, we will update this notice, and it will run only after you accept non-essential cookies — see the Cookies and Third parties sections below.

EVEC Volunteer Academy (website and Android app)

The EVEC Volunteer Academy is our free online programme for volunteers aged 15 and over, with lessons, tasks that our team reviews, messages with staff, drachmas (the Academy’s points) and certificates. You can use it on this website or in our Android app, which is listed on Google Play as “EVEC Volunteer Academy” by EVEC Athens. The app shows this website full-screen, so this notice applies inside the app too, including any other page of the website you open from it. A few things are different inside the app: Google’s measurement tags (Tag Manager, Analytics and Ads) and content embedded from social media or other websites do not load; the forms and the map on pages outside the Academy are replaced by a note; the home page is not shown; and the cookie banner is not shown (see Cookies). EVEC Athens is the data controller for the Academy. This section adds to the rest of the notice; where it is more specific, it is the part that applies to the Academy.

Who can join. You must be at least 15. If you are 18 or over, you register yourself and confirm your email address. If you are 15, 16 or 17, a parent or guardian registers you first: they give their own name and email address, your first name and the initial of your surname, and agree for you. We hold nothing about you before they do. They then receive an invitation link for you, and with it you set up your own profile and give your own agreement. Greek law allows people aged 15 and over to agree to online services themselves; we ask a parent or guardian as well. An account set up this way has no email address of its own, so Academy emails for you go to your parent or guardian.

What the Academy holds about you.

• Your account. Your first name and the initial of your surname (we never ask for your full surname); your email address, if you registered yourself; your username; your password, stored only as a bcrypt hash, a scrambled form that cannot be turned back into the password; your month and year of birth (not the day), from which we work out your age group; your region and, if you give it, your town; the languages you speak and your interests; and, if you registered yourself while we still asked, how much time you said you had each week.
• Your parent or guardian, if you are under 18. Their full name and email address.
• What was agreed. A record of each agreement: what it was about, yes or no, whether you or your parent or guardian gave it, the name of the person who gave it, the date, and which version of this notice and of the form applied. It includes four optional choices about publicity: your name on our website, your name on social media, tagging your personal social-media account, and your face appearing in photos or video. For under-18s, the parent or guardian makes these four choices.
• Your work. What you write and submit for tasks, in every version, with any link you add and our feedback; what you write in lessons, with your quiz answers and scores; contributions you send us, such as a link to your Google Doc with a note; graphics you propose for other volunteers’ articles (a link and a short note) and the stars you give; and, when our team approves one of your articles for publishing and opens a call for graphics for it, the call’s title and the link to your Google Doc (or, if you asked for one, to a copy of the article that EVEC made).
• Social-media actions (18 or over only). If you are 18 or over and claim drachmas for following or engaging with EVEC’s own accounts, we keep what you did and a share link to your screenshot (Google Drive, Google Photos, Dropbox, OneDrive or iCloud). We remove the link as soon as we decide on the claim. Volunteers aged 15 to 17 are not shown these actions and cannot claim them.
• Messages. Your messages with our staff, each up to 2,000 characters, with an optional link to a Google Doc or Drive file.
• Reports. If you use “Report a problem” (at the foot of every Academy screen) or report a graphic proposed for one of your articles, we keep what you chose and what you wrote. A problem report goes into your Messages thread, where you can see it; a report about a graphic is kept with that graphic, which leaves the graphics call at once. Each report also sends an email alert to academy@evec.org.gr and to our safeguarding lead, with the kind of report and your Academy reference only, never your words.
• Drafts. What you type into a task or into a lesson’s writing box is saved to your account on our server as you type, so that it is not lost if the app closes. A draft is not work you have sent: nobody reviews it and no staff screen shows it, although it is included if you ask us for a copy of your data. It is deleted when you send the work, 90 days after you last changed it, or with your account.
• Drachmas and certificates. A ledger of the drachmas you earn and spend, with the reason for each entry, and the certificates you have. Your printable record shows your first name, initial and Academy reference.
• Account details we create. Your Academy reference (such as V-2026-012), cohort, level, status and language; your notification settings; the date you confirmed your email address; the last date you used the Academy; the date of any deletion warning we sent; and the notices waiting for you in the app.
• Sign-in and security records. For each sign-in: a scrambled copy of the code that keeps you signed in, your IP address, and when the sign-in was last used. For each emailed link (to confirm your email, reset your password, or accept a parent’s invitation): a scrambled copy of the link’s code and the IP address it was requested from. To stop password guessing, we also count attempts each hour, using scrambled versions of the username or email and of the IP address.
• An activity log. Short entries recording what happened and when, for example that you signed in. It identifies you only by your Academy reference, never by your name or email address.
• Phone notifications, if you switch them on. The address that your browser’s push service gives us for your device. The notification itself carries no text: it only tells the app to check what is new.

We do not ask for your full surname, full date of birth, phone number, home address, school or photographs, and you cannot upload files to the Academy: you share work as links. One early lesson asks what, if anything, makes taking part hard for you. You never need to give health, religious or other sensitive details there; if you choose to, they stay with your lesson writing and are deleted with your account.

On your device. The Academy keeps only these on your phone or computer:

• “evec_academy_session” (cookie) — keeps you signed in. It holds a random code, cannot be read by scripts on the page, is sent only over HTTPS, and expires 30 days after your last visit.
• “evec_academy_link” (cookie) — when you open a password-reset or invitation link from one of our emails (or a parent or guardian opens our link about publishing their child’s work), it holds the link’s one-time code for at most 30 minutes (password reset) or 60 minutes (invitation or publishing permission), so that the code never appears in the page address. Scripts on the page cannot read it, and it is deleted as soon as the link is used.
• “evec_app” (cookie) — set only when pages open in our Android app. It holds the value “1” and nothing that identifies you or your device, and lasts a year. Because the app runs inside a browser on your phone (usually Chrome) and shares its cookies, this cookie also keeps Google’s measurement tags from loading when you open evec.org.gr in that same browser; the cookie banner still appears there.
• “evec_lang” (stored on the device) — in the app, the language you chose while signed out, so that the app opens in that language next time. Once you sign in, your account’s language decides.
• “evec_start_hidden” (stored on the device) — set if you press “Hide” on the “Start here” card, so that the card stays hidden on that device. It holds “1” and nothing about you.
• “evec_app_mode” (in the tab’s session storage) — tells the site, for that tab only, that it is open inside the app. It goes when the tab closes.
• Words not yet saved — drafts are saved to your account on our server as you type (see “Drafts” above). While a save to our server has not gone through (for example offline), the words are also kept in this tab’s session storage, with your Academy reference so that they never appear in another account; they are cleared once the server has them, when the tab closes, or when you sign out.
• The offline page — the Academy, in the app or in your browser, keeps one page on the device, in your language, to show when you have no connection. It holds no personal data.

On the website, the Google tags described in Cookies and Third parties run on Academy pages too, under the same consent rules. Inside the Android app, Google’s measurement tags (Tag Manager, Analytics and Ads) do not load.

Why we use it, and our legal basis.

• Running the Academy for you — your account, lessons, tasks and their review, drachmas and certificates, messages with staff, and the emails and optional phone notifications that go with them. Basis: the agreement you give when you register, and for under-18s the agreement of a parent or guardian together with your own (consent, Article 6(1)(a) GDPR). You can withdraw it at any time with “I want to leave” or by writing to us; we then stop, and you can no longer take part.
• Priority for active volunteers — volunteers who earn drachmas count as active volunteers, and when EVEC selects participants for its programmes, active volunteers get priority, alongside each programme’s own criteria (priority, never a guaranteed place). So when you apply to one of our programmes, the staff selecting participants may check whether you are an active Academy volunteer and how many drachmas you have earned. They use only that, never what you wrote in lessons, tasks or messages. Basis: our legitimate interest in recognising people who already volunteer with us (Article 6(1)(f) GDPR). You can object at any time by writing to academy@evec.org.gr, and a parent or guardian can do so for an under-18; we then do not use your Academy record for priority, and your application is judged on the programme’s own criteria alone.
• Publicity — only what was agreed in the four optional choices (consent). To change a choice, write to academy@evec.org.gr; the change applies from then on, and we take your name off work already published if you ask. When you register, you — or, for under-18s, your parent or guardian — give us on a separate tick a licence to publish work the team approves on volunteer.org.gr, evec.org.gr, microgreens.org.gr and EVEC’s Instagram, Facebook, TikTok, YouTube and LinkedIn accounts; the work stays yours.
• Under 18: a parent’s or guardian’s permission to publish. We publish work by a volunteer under 18 — articles, graphics and other content that our team approves — only with their parent’s or guardian’s permission. The parent or guardian gives it on the registration form (the publishing tick), or, if they registered their child before the form asked this, answers yes or no from a link we email to them when their child’s work is approved; the link works once and for 30 days. The places are volunteer.org.gr, evec.org.gr, microgreens.org.gr and EVEC’s Instagram, Facebook, TikTok, YouTube and LinkedIn accounts. The child’s first name appears with the work only if the parent or guardian chose that, and the work stays the child’s. We record the answer, its date, how it was given and the parent’s or guardian’s name, as we record every consent. A parent or guardian can change their mind at any time by writing to academy@evec.org.gr: we record a “no” straight away, and for a “yes” we email them a new link. Their latest answer is the one we follow.
• Keeping participants safe — staff can read messages and submitted work, and the reports described above, so that any concern is noticed and acted on. The legal basis is the one described under Safeguarding in Why we use it and our legal basis.
• Security and preventing abuse — sign-in records, IP addresses and attempt counters. Basis: our legitimate interest in keeping accounts and the service secure (Article 6(1)(f) GDPR).
• Reporting to the funders of our projects — giving the funders and auditors of the projects the Academy belongs to the report without names described under “What others can see” below. Basis: our legitimate interest in meeting the reporting and audit duties of our grant agreements (Article 6(1)(f) GDPR).
• Records without your name after deletion — kept for five years so that we can account for our work in the reports and audits of EU-funded projects. Basis: our legitimate interest in meeting those reporting and audit duties (Article 6(1)(f) GDPR).
• Measuring the website and our adverts — as described in Cookies and Third parties.

Who can see it at EVEC. You see your own file in the app. Academy staff — our administrators and the team members we give Academy access — see your reference, first name and initial, age group and region in their lists, and on your page your drachmas, your history and the work you submit; they also see the names and links on graphics proposals. Staff screens do not show your email address. Because the Academy includes under-18s, conversations with staff are never private to one person: every message between you and staff can be read by every Academy staff member, including our safeguarding lead. Staff see your lesson writing where a lesson sends it to them to read. Administrators can also export your data (including your email address and your parent or guardian’s details) to answer a request, erase your record, and suspend an account while a concern is looked into. When you apply to one of our programmes, the staff selecting participants use only whether you are an active Academy volunteer and your drachma total, unless you have objected (see “Priority for active volunteers” above). Reports are read by Academy staff, including our safeguarding lead; once our team marks a report as a safeguarding concern, only the safeguarding lead and our administrators can read it. We never tell the person a report is about who sent it.

What others can see.

• Other volunteers. If our team opens a call for graphics for one of your articles, the other active volunteers get the article’s title and, while the call is open, the link to your Google Doc so that they can read it, at any age; Google may show them the name on your Google account. If you do not want that, say so in your note when you send the article, and our team gives them a copy that EVEC made instead. You then see the graphics sent in as anonymous entries (A, B, C) and rate them without knowing who made them.
• The public. If we publish your article or graphic, we credit you by name only if “name on the website” was agreed: adults by first name and initial, under-18s by first name only. Otherwise the credit reads “EVEC Academy volunteer”.
• Funders and auditors. We report on the Academy to the bodies that fund the projects it belongs to — for EU projects, the National Agency that manages the Erasmus+ or European Solidarity Corps grant (in Greece, INEDIVIM for Erasmus+ Youth and the Solidarity Corps) — and to the auditors who check those projects for them or for the EU. For this, Academy staff can download a report with one row per volunteer. It has no names, email addresses, usernames or other contact details. Your row holds exactly: your Academy reference; your cohort; your age group; your region; your town; your languages; your account’s status, level and language; the dates you registered and confirmed your email address; whether a parent or guardian registered you; and your activity totals — how many tasks you were given, how many you sent in, how many were approved and how many were abandoned, the estimated minutes of your approved work, the drachmas awarded for your tasks, how many times work was sent back to you for changes, and the dates of your first task and of the last review. These rows are pseudonymised, not anonymous: while your account exists we can link the reference back to you, and details such as age group and town could point to one person in a small place. So they are still personal data under the GDPR, and this notice applies to them. We give them only for reporting on and accounting for those projects, on the basis of our legitimate interest in meeting the reporting and audit duties of our grant agreements (Article 6(1)(f) GDPR), and you can object (see Your rights). A funder or auditor keeps what it receives under its own rules. If your account is deleted, your row stays in the report for the five years we keep records without your name, but without your age group, region, town and languages.

Who else receives Academy data.

• Hostinger, our host, stores the Academy’s database, backups and server logs on our behalf (a processor).
• Google, as our email service. Academy emails — confirmations, password resets, invitations, task feedback and notices to parents and guardians — are sent through Google’s Gmail service, which therefore handles each recipient’s address, first name and the content of the email. Replies go to academy@evec.org.gr.
• Google’s measurement tools. On the website, Google Tag Manager, Google Analytics and Google Ads load on Academy pages as on the rest of the site and, as everywhere on the site, use cookies only if you accept them in the cookie banner (see Cookies and Third parties). Inside the Android app they do not load. When someone submits the Academy sign-up form on the website, a signal goes to Google Ads so that we can see which adverts lead to sign-ups. Google Analytics processes data on our behalf; for the data Google Ads receives, Google is an independent controller under its own privacy policy.
• Google Docs and Drive. When you share a link to a Google Doc or Drive file, our server asks Google whether the link opens and fetches a small preview image. Google receives the file’s address from our server, not from your device.
• Push services. If you switch on phone notifications, we send an empty message to your device through your browser’s push service: Google’s for Chrome and Android, Mozilla’s for Firefox, Apple’s for Safari. It carries no name and no text.
• Meta. On the website, the Instagram post on our home page loads as described in Third parties. The home page is not shown inside the app (the app opens the Academy instead), and no Instagram or other social-media content loads there.

We do not sell Academy data, and we do not pass it to anyone not listed in this notice unless the law requires us to. Google, Meta and the push services may process data outside the European Economic Area; the safeguards described in International transfers apply.

How we protect it. The whole site, and so the whole app, works only over encrypted HTTPS connections, and browsers are told never to connect without encryption (HSTS). Passwords are stored only as bcrypt hashes. Sign-in and password-reset attempts are limited each hour; emailed links expire (30 minutes for a password reset, 24 hours for an email confirmation, 14 days for an invitation, 30 days for a parent’s or guardian’s answer about publishing); and the sign-in cookie cannot be read by scripts. Only named staff accounts can open the Academy’s staff screens.

How long Academy data is kept.

• Your account and everything in it — while you use it, until you delete it (see Deleting your Academy account). If you leave with “I want to leave”, the record stays until you ask us to delete it or the 24-month rule below deletes it.
• Accounts not used for 24 months — deleted automatically, in the same way as if you had deleted the account yourself. Opening the Academy while signed in counts as use; receiving a notification without opening it does not. Thirty days before the deletion date we send one warning email: to your own email address or, if a parent or guardian set up the account, to theirs. Signing in before that date cancels the deletion. The rule also covers accounts that have left the programme (their warning simply gives the date), but not an account that we have suspended while a safeguarding concern is looked into.
• Registrations never confirmed — deleted after 7 days.
• A parent’s invitation that is never used — deleted after 14 days; the parent or guardian is told.
• Sign-ins, with their IP address — until 30 days after the sign-in was last used. Emailed links, with their IP address — deleted shortly after they expire.
• Attempt counters — deleted each night once their hour has passed.
• Proof links for social-media actions — removed when we decide on the claim, and after 30 days at most.
• Drafts — until you send the work, 90 days after you last changed them, or when your account is deleted.
• Reports — kept with your messages, or with the graphic they are about, until your account is deleted; then what you wrote in them and anything linking them to you are removed. Reports our team marked as a safeguarding concern (one you sent, or one about something you made) are kept after that, under our safeguarding-records rule (see How long we keep your information), without your name, email or username.
• Notices in the app — about 60 days; a few general announcements stay until the account is deleted.
• Phone-notification addresses — until you switch notifications off, the address stops working, you leave, or your account is deleted.
• After deletion — only records without your name, for five years from the day the account was deleted; then those are deleted too (details in Deleting your Academy account). Until then, they can still appear, without your name, in the report for funders and auditors described above.

Your rights in the Academy. You have all the rights listed in Your rights. To get a copy of your data (we can also give it in a portable format), to correct something, to change a publicity choice, or to have a particular text you submitted deleted, write to academy@evec.org.gr. You can delete your whole account yourself (see below). If you are under 18, you can make these requests yourself, and so can your parent or guardian; we handle each young person’s account on its own. We answer within one month. If you are not satisfied, you can complain to the Hellenic Data Protection Authority at www.dpa.gr.

Deleting your Academy account

You can delete your EVEC Volunteer Academy account yourself at any time, on this website or in the Android app (“EVEC Volunteer Academy” by EVEC Athens on Google Play, package com.EVECvolunteeracademy.myapp). Deletion happens immediately and cannot be undone. You are welcome to register again later, as a new member.

• In the app or on the website. Sign in, open the My file tab and choose Delete my account. Enter your password again, type the word DELETE (the Greek ΔΙΑΓΡΑΦΗ works too) and confirm. You are signed out at once and we email a confirmation. If you have forgotten your password, sign out, use “Forgotten your password?” on the sign-in screen, and then come back.
• If you cannot sign in (for example, after using “I want to leave”), see our page Delete your Academy account, or email academy@evec.org.gr from the address on the account, giving your username. If you no longer have access to that address, write from any address with your username; before deleting anything, we ask for the month and year you were born and where you said you live when you signed up, and we also email the address on the account. A parent or guardian can write from the address they registered with, giving the child’s first name and username. We complete the request within one month.

Who is told. If you registered yourself, the confirmation goes to your own email address. If a parent or guardian set up your account, it has no email address of its own, so the email goes to your parent or guardian at the address they registered with, even if you have turned 18 since. So if you are 15, 16 or 17 and delete your account, your parent or guardian is told.

What is deleted. Your name and initial, email address, username, password, month and year of birth, region, town, languages, interests and available time; your parent or guardian’s name and email address; your sign-ins and emailed links, with their IP addresses; your phone-notification addresses; everything you wrote or sent — task work in every version, lesson writing and quiz answers, messages with staff (both sides), contributions, graphics proposals and the ratings on them, the ratings you gave, social-media claims, the reports you sent, and the drafts you had not sent (on our server and on the device you used); and your notices in the app. Any call for graphics for your articles is emptied and closed, and any task still open is closed.

What is kept, without your name, for five years. Your Academy reference number; the ledger of drachmas earned and spent; the record of tasks you were given, with their dates and outcomes but none of your text; and an activity log without personal data, which also shows when agreements were given or withdrawn (with the names removed) and basic settings such as cohort, level and language. None of this contains your name, email address or anything you wrote. We keep it so that we can account for EU-funded projects in their reports and audits, and during those five years it can still be given, without your name, to the funders, National Agencies and auditors of those projects (see “What others can see” in EVEC Volunteer Academy). We delete it five years after the day your account was deleted.

Reports our team marked as a safeguarding concern (one you sent, or one about something you made) are also kept, under our safeguarding-records rule, without your name, email or username.

What deletion cannot reach. Work already published on our website or social media stays published; write to academy@evec.org.gr and we will take your name off it. Emails already sent stay in the inboxes they reached, and copies can remain in the mailbox we send from. Copies already downloaded (for example, a copy of your data we sent you), reports already given to funders or auditors, and our host’s backups are not changed; backups are replaced by newer ones over time. Data that Google Analytics and Google Ads have already received stays under their own retention settings (inside the app they do not load). Files in your own Google Docs or Drive are yours: we cannot delete them.

Leaving is not deleting. “I want to leave”, in the same tab, closes your access and withdraws your consent but keeps your record. After leaving you can no longer sign in, so if you then want everything deleted, write to academy@evec.org.gr; otherwise the record is deleted 24 months after you last used the Academy, as described above.

Where your enquiry came from

When you send us a form on this website, we attach a short technical note to it: the page you were on, the address that referred you, any campaign or advertising parameters that were in the link you clicked, and how many seconds the page was open before you sent it. We use this only to understand which of our pages and adverts actually reach people, and to recognise automated spam. The EVEC Volunteer Academy sign-up form does not keep this note.

Nothing is stored on your device for this. We set no cookie and use no other storage, so if you arrive on one page and send the form from a different one, the connection is simply not made — we would rather lose the information than track you across the site. The note is kept with your enquiry and deleted together with it.

Legal basis: our legitimate interest in knowing whether our outreach reaches the young people it is meant for (Article 6(1)(f) GDPR). You can object at any time by writing to academy@evec.org.gr.

Cookies

We use essential cookies that the site needs to function. For anything beyond that, a consent banner lets you accept or decline non-essential cookies, so the choice is yours. Inside the app we use only the cookies the app needs to work, so it does not show the cookie banner.

Beyond essential cookies, we use analytics cookies (Google Analytics) to understand how the site is used, and Google Ads measurement cookies to see which of our adverts bring people here. If we add cookies that show advertising (such as Google AdSense) in future, they will be listed here first. Wherever you are visiting from, these wait for your choice: until you make one, they are set to denied and no analytics or advertising identifiers are stored on your device. On the website, you can accept or decline, and you can change your choice at any time in Cookie Preferences — on the cookie banner, or later with the small gear-shaped button at the bottom of the page. Inside the app there is nothing to choose: Google’s measurement tags do not load there, so the app sets none of these cookies. See Third parties for exactly how that works.

Where advertising is enabled in future, Google may use cookies to show ads and, where you consent, make them more relevant to you; you can opt out of personalised advertising at any time in your Google Ad Settings.

Third parties and embedded content

Our website, including the EVEC Volunteer Academy, is hosted by Hostinger, which acts as our data processor and stores the site, its database, its backups and its server logs on our behalf. Emails sent by the website — form notifications and every Academy email — are delivered through Google’s Gmail service, which handles them on our behalf.

Some pages load resources from other providers. The Contact page embeds a Google Map; when this happens, your browser contacts that provider directly to fetch the content. Our web fonts are self-hosted, so they do not call out to third parties.

We use Google Analytics to measure site usage and Google Ads to understand which of our adverts bring people to the site, including a signal when someone submits the EVEC Volunteer Academy sign-up form on the website. Both load on every page of the website, including its Academy pages, together with Google Tag Manager. Inside the Android app none of the three loads. We send data to two Google Analytics properties, and on one of them Google signals is switched on: for visitors who are signed in to a Google account and allow ad personalisation, this lets Google give us reports about groups of users across devices. Google Analytics processes data on our behalf; for the data Google Ads receives, Google acts as an independent controller. Google processes all of this under its own privacy policy, and explains how it uses information from sites that use its services.

To be precise about how consent works here, because the distinction matters: Google’s measurement code is present on every page of the website from the start (not inside the app), but until you make a choice it is told that consent is denied, wherever you are visiting from. In that state it does not store or read advertising or analytics identifiers on your device, although Google may still receive basic signals without cookies, such as which page was viewed. If you accept non-essential cookies, that instruction changes to granted and normal measurement begins. If you decline, it stays denied. You can change your choice at any time.

One embed on our home page — an Instagram post, served by Meta — is still requested as the page loads, before you answer the banner. Meta therefore learns your IP address, and if you are signed in to Instagram in the same browser, that you visited the page. Two things that used to behave this way no longer do: the OneSignal push script has been switched off entirely, and the map on our Contact page now loads only when you click it. (The EVEC Volunteer Academy has its own phone notifications, which stay off unless you switch them on; see EVEC Volunteer Academy.)

If we enable Google AdSense advertising in future, we will update this notice before it goes live.

Embedded content from another website behaves as if you had visited that site yourself, so it may collect data about you according to that provider’s own privacy practices.

How long we keep your information

We keep personal information only as long as necessary for the purpose it was collected for, after which it is deleted or anonymised. In practice:

• Enquiries sent through a form on this site — up to 24 months from your last contact with us.
• Applications that did not lead to a placement — up to 24 months, so we can consider you for a later call. Tell us if you would rather we delete them sooner, and we will.
• Participant records for EU-funded projects — five years after the final payment of the project. The EU grant rules ask for three years on grants under €60,000 and five years above that; we apply the longer period to every project, so the same rule protects everyone regardless of which project they took part in.
• Criminal-record checks — we keep only a note that a valid certificate was seen and the date, for the duration of your role plus 12 months. The certificate itself is not retained.
• Safeguarding and complaint records — kept for as long as needed to act on the matter and to meet our obligations to participants and funders. Records involving a child are kept longer, because concerns can surface years later.
• Server logs — kept by our host for a short rolling period for security and diagnostics.
• Newsletter — until you unsubscribe.
• EVEC Volunteer Academy accounts — until you delete your account, or automatically after 24 months without use, with one warning email 30 days before. After deletion, records without your name are kept for five years from the day of deletion and then deleted; this is a separate period from the project rule above. Details: EVEC Volunteer Academy.

Two practical points about how the website’s enquiry and application forms work (the EVEC Volunteer Academy keeps its records on its own schedule, described in its section). What you send through a form is stored in this website’s own database as well as reaching us by email, so that an application cannot be lost simply because an email goes astray — and the 24-month deletion above is carried out automatically by the site, not by hand. We also record the IP address your form submission came from. We keep it for 180 days and then erase it automatically, while the enquiry itself stays for the 24 months described above. We use it for one thing only: recognising abuse, such as the same address sending repeated bogus applications, and checking whether the traffic our adverts pay for really comes from where we are told it does. Our basis is our legitimate interest in protecting the organisation (Article 6(1)(f) GDPR). It plays no part in deciding whether you are eligible — an IP address shows where a device was, not where a person legally lives, and legal residence is what the European Solidarity Corps rules actually ask about. You can object at any time: academy@evec.org.gr.

International transfers

Some of the providers we rely on may process data outside the European Economic Area: Google (Analytics, Ads, Tag Manager, the Gmail service that carries our emails, and Docs and Drive), Meta (the Instagram post on our home page), and the push services of Google, Mozilla and Apple that deliver Academy phone notifications. Where that happens, appropriate safeguards apply, such as the European Commission’s standard contractual clauses.

Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct data that is inaccurate or incomplete.
• Delete your data (the right to be forgotten).
• Restrict how we process your data.
• Object to certain processing.
• Portability — receive your data in a portable format.
• Withdraw consent at any time, where our processing relies on consent.

To exercise any of these, email academy@evec.org.gr. We reply within one month of receiving your request. If you have an EVEC Volunteer Academy account, you can also delete it yourself, on the website or in the app — see Deleting your Academy account. You also have the right to complain to the Hellenic Data Protection Authority (HDPA) at www.dpa.gr.

Children and young people

Many of our activities involve young people. Where a participant is under 18, we seek consent from a parent or guardian as part of the specific programme they are taking part in, and staff or volunteers in roles involving contact with under-18s are asked for a criminal-record certificate. In the EVEC Volunteer Academy the minimum age is 15: a parent or guardian registers anyone under 18 first, the young person then gives their own agreement, and 15- to 17-year-olds can delete their own account, in which case their parent or guardian is told — see EVEC Volunteer Academy.

How we protect participants, and how to raise a concern about someone’s safety, is set out in our safeguarding and participant protection policy. If you want to complain about how we handled something, including how we used your information, our complaints procedure explains how.

Changes to this notice

We may update this notice from time to time. The “Last updated” date at the top of the page always shows the current version.

Contact us

For any privacy question or request, including deleting your data, email us at academy@evec.org.gr or call +30 21 2104 2017.

By post: EVEC Athens, Polifimou 17, 157 71 Zografou, Athens, Greece. (Our registered office is Kallistratous 89, 157 71 Zografou, Athens — but post reaches us faster at Polifimou 17.)