Privacy Policy
Last updated: 2026-06-29 · Version: legal-content/v1
This Privacy Policy explains how TBD — pending operator confirmation (trading as “Umlaut”, “we”, “us”), registered at TBD — pending operator confirmation (Bucharest, Romania), collects, uses and protects your personal data when you visit TBD — pending domain assignment, in accordance with the EU General Data Protection Regulation (EU) 2016/679 (GDPR) and Greek Law 4624/2019.
1. Data Controller
The controller of your data is TBD — pending operator confirmation. For any matter relating to your personal data you can contact TBD — pending operator confirmation or email TBD — pending operator confirmation.
2. What data we collect
- Information you give us: your email address and any details you submit through forms (e.g. newsletter signup, contact form, order/booking).
- Technical data: IP address, browser type, pages visited — strictly to the extent necessary to operate and secure the site.
- Cookie/analytics data: only where you have given consent (see the Cookie Policy).
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Sending the newsletter / answering enquiries | Consent — Art. 6(1)(a) |
| Fulfilling an order / booking / contract | Performance of a contract — Art. 6(1)(b) |
| Security & correct operation of the site | Legitimate interest — Art. 6(1)(f) |
| Audience statistics | Consent — Art. 6(1)(a) |
4. Recipients & processors
We do not sell your data. We share it only with third-party providers acting as processors on our behalf, under a data-processing agreement (DPA): Plausible Analytics (privacy-respecting web analytics, no cookies, no cross-site tracking). Where a provider is located outside the EEA, the transfer is covered by Standard Contractual Clauses (SCCs).
5. Retention
We keep your data only for as long as needed for the purposes above or as required by law. Newsletter signup data is kept until you unsubscribe.
6. Your rights (GDPR)
As a data subject you have the following rights, which you can exercise free of charge at TBD — pending operator confirmation:
- Access to your data (Art. 15).
- Rectification of inaccurate data (Art. 16).
- Erasure (“right to be forgotten”, Art. 17).
- Restriction of processing (Art. 18).
- Portability of your data (Art. 20).
- Objection to processing (Art. 21).
- Withdrawal of consent at any time, without affecting the lawfulness of prior processing.
You also have the right to lodge a complaint with the supervisory authority: the Hellenic Data Protection Authority (HDPA), 1-3 Kifissias Ave., 115 23 Athens, www.dpa.gr.
7. Security
We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or disclosure.
8. Changes to this Policy
We may update this Policy. The version in force carries the date and version number at the top of the page.