PRIVACY
Privacy & cookies policy
Last updated: 2 October 2026
We keep as little data as we can. This page explains what we keep when you visit createidea.gr or send us a message, why, for how long, and how to have it deleted.
Who is responsible
The controller is Michalis Koumtzis (Createidea), Kavala, Greece. For anything about your data, write to mkoumtzis@gmail.com.
Contact form
When you send a message we keep your name, email and whatever you write (project type, budget, timeline, message). We use it only to reply and, if we work together, for the proposal and the project. It is stored in Createidea's client management system and reaches us by email.
Legal basis: steps taken at your request before entering into a contract (GDPR Art. 6(1)(b)).
Visit statistics (Google Analytics)
Only if you click "Accept" in the cookie notice, Google Analytics 4 by Google Ireland Ltd is loaded. It measures which pages you open, from which country and device, and where you came from. Google does not store IP addresses in Analytics. We have turned off Google signals and any use for advertising. Data may be transferred to Google LLC in the US, which is certified under the EU-US Data Privacy Framework.
If you decline, Google's script is not loaded at all.
Legal basis: your consent (GDPR Art. 6(1)(a)), which you can withdraw any time from "Cookie settings" at the bottom of every page.
Cookies and browser storage
Necessary: a session cookie and XSRF-TOKEN, which protect the forms from abuse. They expire when the session ends. Your cookie choice is kept in your browser (localStorage) for 12 months.
Statistics, only with consent: Google Analytics' _ga and _ga_…, for up to 2 years. They are deleted when you withdraw consent.
We use no advertising cookies. Fonts are served from our own server, not from Google.
Security and server logs
Like any server, ours logs the IP address, browser, page and time of each request. For the forms' sending limits, the IP address is kept temporarily, for up to 24 hours. We use this only for the security and operation of the site, and it is deleted automatically.
Legal basis: legitimate interest in keeping the site secure (GDPR Art. 6(1)(f)).
Who else processes it
We do not sell data or share it for advertising. We only use the providers the site needs:
• DigitalOcean: hosting of the site and its database;
• Resend: sending the contact form emails;
• Google: Analytics only, and only with consent.
Where data leaves the EU, the transfer is covered by the EU-US Data Privacy Framework or by standard contractual clauses (GDPR Art. 45 and 46).
How long we keep it
Messages are kept as long as our conversation needs and, if we work together, as long as the law requires for the project (e.g. tax records). If no project follows, they are deleted within 2 years, or sooner if you ask. Google Analytics data is deleted automatically after 14 months.
Your rights
You can ask for access to your data, correction, deletion, restriction of processing or a machine-readable copy, object to processing, and withdraw your consent. Write to mkoumtzis@gmail.com and we will reply within one month. If you believe we do not comply with the law, you can complain to the Greek Hellenic Data Protection Authority.
If you run a business: details from public sources
To offer our services to businesses, we find businesses in public sources: the OpenStreetMap map and the open data of the Greek General Commercial Registry (GEMI). We keep the business name, town, activity and website, and we check the public side of the site. For a sole trader, the business name is the person's name. We keep no tax numbers, and no emails or phone numbers from GEMI, and we send no bulk messages.
If we never get in touch, a sole trader's details are deleted within 12 months. You can ask for deletion at any time by sending your domain or GEMI number to mkoumtzis@gmail.com; a later search will not find you again. More on the LeadScanBot page.
Legal basis: legitimate interest in offering our services to businesses (Article 6(1)(f) GDPR), with a right to object.