This policy explains what personal data we process when you visit the site or contact us, why, on what legal basis, for how long, and what rights you have — under the General Data Protection Regulation (EU) 2016/679 (“GDPR”), Greek Law 4624/2019 and Greek Law 3471/2006.
1. Data controller
ΣΚΟΛΙΚ ΣΒΙΤΛΑΝΑ, trading as “Makeup by Fotini”. Email: fotinibeautyartist@gmail.com · Phone: +30 698 060 3282. Full details are in the Legal Information.
2. What data we process and why
When you contact us
The site has no contact form: we communicate through Instagram, WhatsApp, phone or email. When you message or call us, we process your name, your contact details (username, phone number or email), the content of your messages and the details of your event (date, place, number of people).
- Purpose: to reply, to arrange and to provide the service you ask for.
- Legal basis: steps prior to entering into a contract and performance of a contract (GDPR Art. 6(1)(b)).
If you choose to tell us about skin sensitivities or allergies, so the makeup is safe for you, we use that information only for that purpose, based on your explicit consent (GDPR Art. 9(2)(a)), which you can withdraw at any time.
Appointments and invoices
For every appointment that takes place, we keep the details Greek tax law requires for issuing receipts and invoices. Legal basis: compliance with a legal obligation (GDPR Art. 6(1)(c)).
When you visit the site
The site’s server automatically logs technical details of each request: IP address, date and time, the page requested, the referring page and browser type. Purpose: the security and proper operation of the site. Legal basis: legitimate interest (GDPR Art. 6(1)(f)).
The site loads no third-party content or scripts: fonts, images and videos are hosted on our own server. The links to Instagram, WhatsApp, Facebook, TikTok, YouTube and Google are plain links — they send no data to those services unless you click them.
3. Cookies
Under Article 4(5) of Greek Law 3471/2006:
- Necessary cookie
fot_consent: stores only your cookie choice, for 6 months. It does not require consent, because without it the site cannot remember your choice. - Analytics (Google Analytics 4): only if you give your consent (GDPR Art. 6(1)(a)). They show us which pages are read and on what kinds of devices, so we can improve the site. Google Analytics 4 uses pseudonymous identifiers and does not store IP addresses. Without your consent, the script is not loaded at all.
You can change or withdraw your consent at any time from , which is also at the bottom of every page. Withdrawal does not affect the lawfulness of processing carried out before it.
4. Instagram, Facebook and WhatsApp
When you contact us through Instagram, Facebook or WhatsApp, your data is also processed by Meta Platforms Ireland Limited (Instagram, Facebook) and WhatsApp Ireland Limited, as independent controllers, under their own privacy policies. For the statistics of our pages on those platforms (Insights), Meta and we are joint controllers, under Meta’s Page Insights Controller Addendum.
5. Recipients and transfers outside the EU
- Website hosting: OVH SAS (France), as processor. The servers are in Canada, for which the European Commission has adopted an adequacy decision (2002/2/EC).
- Google Ireland Limited — for analytics only, and only with your consent — as processor. Data may be transferred to Google LLC in the USA on the basis of the adequacy decision for the EU-U.S. Data Privacy Framework.
- Meta and WhatsApp, as described in section 4.
- Our accountant and the tax authorities, where the law requires it.
We do not sell your data or share it with third parties for advertising.
6. How long we keep data
- Messages and contact details: up to 12 months after the service is completed or after our last contact, unless the law requires longer retention.
- Tax records: 5 years from the end of the tax year (Greek Law 4987/2022, Art. 13(2)), or longer where the law requires.
- Server logs: deleted automatically, as they are overwritten once the log reaches a fixed maximum size.
- Google Analytics: 2 months.
- fot_consent cookie: 6 months.
7. Your rights
You have the right of access (GDPR Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interest (Art. 21), as well as the right to withdraw any consent at any time. To exercise them, contact us at fotinibeautyartist@gmail.com or +30 698 060 3282. We reply without undue delay and at the latest within one month.
You also have the right to lodge a complaint with the Hellenic Data Protection Authority: 1-3 Kifisias Ave., 115 23 Athens, Greece · tel. +30 210 6475600 · contact@dpa.gr · www.dpa.gr.
8. Other
We do not make decisions based solely on automated processing, and we do no profiling. Providing your contact details is necessary to book an appointment; without them we cannot provide the service. We protect data with appropriate technical and organisational measures, such as an encrypted connection (HTTPS).
If this policy changes, we will publish the new version here, with a new “last updated” date.