Privacy Policy
Last updated: September 14, 2026
Who is responsible
www.40roomors.com is run by 40Roomors, a tufting and textile arts studio in Thessaloniki, Greece, operated by Domniki Ntourou, who is the data controller for the processing described here.
- Email: 40roomorsrugs@gmail.com
- Phone: +30 693 733 0565, +30 695 593 4994
What we process, why, and for how long
| What | Data | Why and legal basis | How long |
|---|---|---|---|
| Contact form | Your name, email address and message, your consent tick and the time you sent it. Our form service also records the IP address and browser of the sending device and the result of the bot check. | To answer your enquiry. Your consent (Art. 6(1)(a) GDPR) and steps you ask for before any agreement with us (Art. 6(1)(b)). The technical data serves abuse prevention, our legitimate interest (Art. 6(1)(f)). | As long as we need it to reply and follow up, and at the latest 24 months after our last exchange, or sooner if you ask us to delete it. |
| Newsletter | Your email address, whether you are subscribed, and the date you were first added to our list. | To send you our newsletter. Your consent (Art. 6(1)(a)). | Until you unsubscribe, using the link in any newsletter or by emailing us. After that we keep only your address, marked as unsubscribed, so that we do not email you again; ask us and we delete it completely. |
| Site analytics (Google Analytics 4) | Pages viewed and their titles, the page you came from, actions such as scrolling, following a link to another site or starting a form, screen size, language, device, operating system and browser type, and approximate location. With your consent, an analytics cookie lets repeat visits from the same browser be recognised. | To understand how the site is used. Before you choose, and if you decline, Google Analytics sends measurement pings without cookies (Consent Mode). They contain no identifier stored on your device, but they include the page you view, browser and screen details and, as part of the connection, your IP address, which Google uses to estimate an approximate location and does not store. We rely on our legitimate interest in this basic measurement (Art. 6(1)(f)). Analytics cookies are set only with your consent (Art. 6(1)(a)). | Analytics data is kept for 14 months. |
| Bot protection | IP address and technical signals from your browser, processed by Cloudflare Turnstile on pages with a form. | To keep automated spam out of our forms. Legitimate interest (Art. 6(1)(f)). | We keep no copy of these signals; a contact form message records only the result of the check. Cloudflare processes them for the check and, as its own controller, to improve its bot detection, and publishes no fixed retention period (see its Turnstile privacy addendum). |
| Server logs | IP address, requested address, time and browser. | To run the site securely and investigate faults. Legitimate interest (Art. 6(1)(f)). | No longer than 30 days. |
| Choices stored in your browser | Your cookie choice and any display preferences you set. | To remember them. They stay on your device in your browser's local storage and are never sent to us. See the cookie policy. | Until you change them or clear this site's data. |
We do not sell your data, use it for profiling, or make automated decisions about you.
Who helps us
| Provider | Role | Location |
|---|---|---|
| Hetzner Online GmbH | Hosts the servers this site and its content system run on. | Germany |
| rorsa-platform, operated by Dimitrios Rarras | Receives and stores contact form submissions for us as our processor and emails them to us. Its servers are hosted by netcup; it sends the notification email through Amazon Web Services EMEA SARL (Amazon SES) and uses Cloudflare Turnstile. Submissions that fail its checks are deleted automatically after 30 days. | Austria and the EU |
| Resend (Plus Five Five, Inc.) | Stores the newsletter list and sends the newsletter. | United States |
| Google (Google Ireland Limited and Google LLC) | Google Analytics 4 measurement. Our own email account, where contact form messages arrive, is also provided by Google. | EU, United States and other countries where Google or its subprocessors have facilities |
| Cloudflare, Inc. | Turnstile bot protection on our forms, acting for us. Cloudflare also uses the same signals, as a separate controller under its own privacy policy, to improve its bot detection. | Global network; company based in the United States |
Transfers outside the EU
Transfers to the United States rely on the EU-US Data Privacy Framework, in which Resend (Plus Five Five, Inc.), Google LLC and Cloudflare, Inc. take part. Where the Framework does not apply, including any transfer to another country outside the European Economic Area, the transfer relies on the European Commission's Standard Contractual Clauses, which each of these providers includes in its data processing terms.
Your rights
You can ask us for access to your data (Art. 15 GDPR), to correct it (Art. 16), to delete it (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20) and to object to processing based on legitimate interest (Art. 21). Where we rely on your consent you can withdraw it at any time (Art. 7(3)); this does not affect processing that already took place. To exercise any right, email 40roomorsrugs@gmail.com. We reply within one month.
For a message you sent through our contact form, ask us rather than our form service: we are the controller and it acts on our instructions.
Complaints
You can complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1-3, 11523 Athens, www.dpa.gr, or to the authority where you live or work.
Changes
We update this policy when what we do changes. The date at the top shows the current version.