Controller and contact
Sofia Evgenia Tsourliani, tax registration Tsouriani Sofia Evgenia, AFM 112940608, 27 Sofianopoulou Street, 11145 Athens, Greece, is the controller for this website and her customer service. Contact sofiaevgenia.tsourliani@gmail.com or +30 694 640 8826 for privacy matters.
What we use and why
Enquiries: name, email and message, to answer and take steps you request before a contract (Article 6(1)(b)); general correspondence is handled under legitimate interests in responding (Article 6(1)(f)). Bookings: name, email, phone, service, date, location or map link, comments and booking/payment status, to arrange and perform the service (Article 6(1)(b)). Accounting and required records are processed to meet legal obligations (Article 6(1)(c)). Security: technical request data and server logs are used under legitimate interests in protecting the service (Article 6(1)(f)). Withdrawal declarations and receipts are processed to fulfil consumer-law obligations (Article 6(1)(c)) and handle the contract (Article 6(1)(b)). Google Analytics 4 (G-XCTGT01L9Y) loads on entry in this temporary mode, regardless of the notice buttons or a previously saved rejection. First-party _ga and _ga_<property> cookies distinguish visits and sessions, with six-month expiry (15,552,000 seconds), refreshed on use. Page views and booking steps can be measured, and the booking service may send a purchase event with available analytics identifiers. Contact details and health information must not be sent to Analytics. Advertising storage, advertising user data, Google Signals and advertising personalisation remain disabled. During this temporary mode, the Cookie notice controls do not stop Analytics or remove its cookies. You can use browser blocking/deletion tools or contact the controller to exercise your data protection rights. This notice does not collect effective prior consent to analytics.
Collection and required information
The contact form opens a draft in your own email application; nothing is sent unless you send it there. The website does not store that form. The booking calendar sends information to Massage Appointment. Contact, appointment and location details marked as required are necessary to arrange a visit; without them the booking may not be possible. Comments are optional. Clicking WhatsApp shares your communication and technical data with that service. A map link you supply is used to locate the appointment; this website does not automatically embed Google Maps.
Health data
Please do not send health details through the contact form, calendar comments or analytics. If relevant information is necessary to assess suitability, discuss it privately. The provider must explain the purpose, access and retention and obtain separate explicit consent under Article 9(2)(a), unless another lawful Article 9 exception applies. Refusal may make a particular treatment unsuitable; it does not authorise unrelated processing.
Recipients and international transfers
Data may be accessible to the hosting and technical providers, Massage Appointment for bookings, email providers including Gmail, the assigned practitioner and an accountant or authority when necessary. WhatsApp/Meta processes communications if you choose that channel. Google Ireland/Google group receives analytics data on entry during this temporary mode. Providers may process data outside the EEA. Transfers must rely on a valid adequacy decision (including the EU–US Data Privacy Framework only for a certified recipient and covered processing) or appropriate safeguards such as standard contractual clauses and required supplementary measures. Contact the controller for the relevant recipients and safeguards or a copy. We do not sell your data.
Retention
Enquiries are retained for up to 12 months after closure unless needed for a contract, obligation or dispute. Operational booking correspondence is retained for up to 24 months after the appointment, then deleted or minimised unless a legal obligation or claim requires longer. Accounting records and evidence of contracts or withdrawal are retained for the period required by Greek law and applicable limitation periods, with access restricted. Server logs rotate at 10 MiB; up to five archived files are retained for at most 14 days; the active log is retained until rotation. Google Analytics user/event retention is governed by the property's configured 2- or 14-month setting; contact us for the current setting. Cookie durations are in the cookie policy. Any necessary health information is retained only as separately explained and for the shortest necessary period.
Your rights
You may request access, rectification, erasure, restriction and, where applicable, portability. You may object to processing based on legitimate interests, and to direct marketing at any time. During this temporary mode, the Cookie notice controls do not stop Analytics or remove its cookies. You can use browser blocking/deletion tools or contact the controller to exercise your data protection rights. This notice does not collect effective prior consent to analytics. We normally respond within one month; a permitted extension of up to two further months is explained within the first month. Rights may be subject to legal conditions, and we may request proportionate identity verification. You can complain to the Hellenic Data Protection Authority at dpa.gr or the supervisory authority where you live or work. There are no solely automated decisions producing legal or similarly significant effects through this website.
Security and updates
We use HTTPS and restrict access to operational records. No transmission is completely risk-free. This policy covers the provider's processing; external services may also act as controllers for their own purposes and publish their own notices. Material changes are described here and fresh consent is sought when required.