Privacy notice

Who we are

We are EVEC Athens (European Voluntary and Educational Center), a non-profit youth NGO registered in Greece, and we are the data controller for the information described here. Our registered office is Kallistratous 89, 157 71 Zografou, Athens, Greece. Our day-to-day office — where you can visit us or send post — is Polifimou 17, 157 71 Zografou, Athens, Greece. This notice covers the website evec.org.gr.

If you have any questions about your privacy or this notice, you can write to us at erasmus@evec.org.gr. For reference, our legal name is European Voluntary and Educational Center, our Greek VAT number (ΑΦΜ) is 997127685, and our EU identifiers are OID E10172681 and PIC 909448430.

What information we collect

We only collect what we need, and most of the time that means information you choose to give us. This includes:

• Contact form. When you message us, we collect your name, your email address, an optional organisation name, and the content of your message.
• Programme applications. If you apply to take part in one of our activities, we collect the details needed to assess and run your participation. These are handled under the specific call you are applying to.
• Safeguarding checks. For roles that involve contact with people under 18, we ask you to provide a criminal-record certificate (ποινικό μητρώο). This is information about criminal convictions and offences, and we treat it accordingly — we record only that a valid certificate was seen and the date it was checked. We do not retain a copy of the certificate itself.
• Safeguarding and complaints records. If you raise a safeguarding concern or make a complaint, we record what was reported, who was involved, and what we did about it. Depending on what is reported, this can include sensitive information such as health or wellbeing details. Access is limited to the people who need it to act on the report.
• Newsletter. We are preparing an email newsletter. If and when it launches, we will use only an address you choose to give us, to send occasional updates, and every email will include an unsubscribe link.
• Technical data. Like most websites, our host keeps standard server logs (such as your IP address, browser type, and the pages requested) so the site can run and stay secure.
• Cookies. Small files stored by your browser, described in the Cookies section below.

Why we use it and our legal basis

We use your information to reply to and handle your enquiries and applications. Depending on the situation, our legal basis is your consent and/or taking steps toward an agreement with you (for example, arranging your participation in an activity).

We also use technical data to keep the site secure and working properly, which is our legitimate interest in running a safe, reliable website.

Safeguarding. Where we ask for a criminal-record certificate, or record a safeguarding concern, we are acting to protect children and vulnerable participants. Our basis for the underlying processing is our legitimate interest, and where applicable our legal obligations, in keeping participants safe. For the sensitive categories involved, we rely on the substantial-public-interest and vital-interests grounds that Greek and EU law provide for safeguarding, and we process criminal-record information only to the extent Greek law permits for this purpose. We keep this processing to the minimum needed — see How long we keep your information and our safeguarding policy.

To be clear: we do not sell your personal data. We do not currently show third-party advertising on the site. If we introduce advertising (such as Google AdSense) in the future, we will update this notice, and it will run only after you accept non-essential cookies — see the Cookies and Third parties sections below.

Where your enquiry came from

When you send us a form, we attach a short technical note to it: the page you were on, the address that referred you, any campaign or advertising parameters that were in the link you clicked, and how many seconds the page was open before you sent it. We use this only to understand which of our pages and adverts actually reach people, and to recognise automated spam.

Nothing is stored on your device for this. We set no cookie and use no other storage, so if you arrive on one page and send the form from a different one, the connection is simply not made — we would rather lose the information than track you across the site. The note is kept with your enquiry and deleted together with it.

Legal basis: our legitimate interest in knowing whether our outreach reaches the young people it is meant for (Article 6(1)(f) GDPR). You can object at any time by writing to erasmus@evec.org.gr.

Cookies

We use essential cookies that the site needs to function. For anything beyond that, a consent banner lets you accept or decline non-essential cookies, so the choice is yours.

Beyond essential cookies, we use analytics cookies (Google Analytics) to understand how the site is used. If we add advertising cookies (such as Google AdSense) in future, they will be listed here first. Until you make a choice, these are set to denied and no analytics or advertising identifiers are stored on your device — you can accept or decline, and you can change your choice at any time. See Third parties for exactly how that works.

Where advertising is enabled in future, Google may use cookies to show ads and, where you consent, make them more relevant to you; you can opt out of personalised advertising at any time in your Google Ad Settings.

Third parties and embedded content

Our website is hosted by Hostinger, which acts as our data processor and stores the site and its server logs on our behalf.

Some pages load resources from other providers. The Contact page embeds a Google Map; when this happens, your browser contacts that provider directly to fetch the content. Our web fonts are self-hosted, so they do not call out to third parties.

We use Google Analytics to measure site usage and Google Ads to understand which of our adverts bring people to the site. Both are operated by Google, which processes the related data under its own privacy policy.

To be precise about how consent works here, because the distinction matters: Google’s measurement code is present on the page from the start, but until you make a choice it is told that consent is denied. In that state it does not store or read advertising or analytics identifiers on your device, and any signal it sends carries no identifier for you. If you accept non-essential cookies, that instruction changes to granted and normal measurement begins. If you decline, it stays denied. You can change your choice at any time.

One embed on our home page — an Instagram post, served by Meta — is still requested as the page loads, before you answer the banner. Meta therefore learns your IP address, and if you are signed in to Instagram in the same browser, that you visited the page. Two things that used to behave this way no longer do: the OneSignal push script has been switched off entirely, and the map on our Contact page now loads only when you click it.

If we enable Google AdSense advertising in future, we will update this notice before it goes live.

Embedded content from another website behaves as if you had visited that site yourself, so it may collect data about you according to that provider’s own privacy practices.

How long we keep your information

We keep personal information only as long as necessary for the purpose it was collected for, after which it is deleted or anonymised. In practice:

• Enquiries sent through a form on this site — up to 24 months from your last contact with us.
• Applications that did not lead to a placement — up to 24 months, so we can consider you for a later call. Tell us if you would rather we delete them sooner, and we will.
• Participant records for EU-funded projects — five years after the final payment of the project. The EU grant rules ask for three years on grants under €60,000 and five years above that; we apply the longer period to every project, so the same rule protects everyone regardless of which project they took part in.
• Criminal-record checks — we keep only a note that a valid certificate was seen and the date, for the duration of your role plus 12 months. The certificate itself is not retained.
• Safeguarding and complaint records — kept for as long as needed to act on the matter and to meet our obligations to participants and funders. Records involving a child are kept longer, because concerns can surface years later.
• Server logs — kept by our host for a short rolling period for security and diagnostics.
• Newsletter — until you unsubscribe.

Two practical points about how this works. What you send through a form is stored in this website’s own database as well as reaching us by email, so that an application cannot be lost simply because an email goes astray — and the 24-month deletion above is carried out automatically by the site, not by hand. We also record the IP address your form submission came from. We keep it for 180 days and then erase it automatically, while the enquiry itself stays for the 24 months described above. We use it for one thing only: recognising abuse, such as the same address sending repeated bogus applications, and checking whether the traffic our adverts pay for really comes from where we are told it does. Our basis is our legitimate interest in protecting the organisation (Article 6(1)(f) GDPR). It plays no part in deciding whether you are eligible — an IP address shows where a device was, not where a person legally lives, and legal residence is what the European Solidarity Corps rules actually ask about. You can object at any time: erasmus@evec.org.gr.

International transfers

Some of the providers we rely on (for example, Google) may process data outside the European Economic Area. Where that happens, appropriate safeguards apply, such as the European Commission’s standard contractual clauses.

Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct data that is inaccurate or incomplete.
• Delete your data (the right to be forgotten).
• Restrict how we process your data.
• Object to certain processing.
• Portability — receive your data in a portable format.
• Withdraw consent at any time, where our processing relies on consent.

To exercise any of these, email erasmus@evec.org.gr. You also have the right to complain to the Hellenic Data Protection Authority (HDPA) at www.dpa.gr.

Children and young people

Many of our activities involve young people. Where a participant is under 18, we seek consent from a parent or guardian as part of the specific programme they are taking part in, and staff or volunteers in roles involving contact with under-18s are asked for a criminal-record certificate.

How we protect participants, and how to raise a concern about someone’s safety, is set out in our safeguarding and participant protection policy. If you want to complain about how we handled something, including how we used your information, our complaints procedure explains how.

Changes to this notice

We may update this notice from time to time. The “Last updated” date at the top of the page always shows the current version.

Contact us

For any privacy questions, email us at erasmus@evec.org.gr or call +30 21 2104 2017.

By post: EVEC Athens, Polifimou 17, 157 71 Zografou, Athens, Greece. (Our registered office is Kallistratous 89, 157 71 Zografou, Athens — but post reaches us faster at Polifimou 17.)