Privacy Policy

Version: 29 September 2026.

Who we are

“InDancEdu Αστική Μη Κερδοσκοπική Εταιρία” , a civil non-profit organisation providing cultural education services, is the controller of personal data collected through this website.

Registered address: Krisila 34–38, Athens,

Postcode: 11635.

Tax identification number: 996718082,

Tax office: KEFODE ATTIKIS,

GEMI registration number: 158107201000.

For privacy questions or requests, contact info@indancedu.com.

Contact and programme enquiries

Our forms are intended for adults, parents and educators.

When you contact us or submit a form, we process your name, email address, school or organisation if provided, message and selected options. The submission time is also recorded. Required fields are marked; without them we cannot process the request.

We use these details to answer and manage your enquiry. General correspondence is processed on the basis of our legitimate interest in responding to people who contact InDancEdu. Where you request steps towards a contract with us, the basis is the necessary pre-contractual measures.

Please do not include sensitive data or children's personal details that are unnecessary for your enquiry.

When newsletter subscription is available, it is optional and based on your consent. The dedicated newsletter signup form uses a single step: a successful submission with an explicit subscription choice does not require a second email confirmation. We use your email address, selected newsletter categories and records confirming your choice to send InDancEdu news, activities and programmes through Ooops Workspace.

You can withdraw consent using the unsubscribe link in a message or by contacting info@indancedu.com. Withdrawal does not affect the lawfulness of processing before withdrawal. An expression of newsletter interest in an enquiry form is recorded separately from a completed subscription.

Newsletter unsubscribe and preference-management links contain a personal identifier so that your choice applies to the correct subscription. This differs from a campaign identifier shared by recipients of a campaign. An identifier can relate to a person even without an email address in the URL. Optional measurement of website visits from campaigns follows your analytics consent choice and is distinct from measuring email opens or clicks within an email.

Usage statistics and preference storage

Where enabled, we use Ooops Analytics to understand website usage and improve the website. Optional analytics are activated after your consent. You can change your choice through “Cookie settings”.

Statistics may include pages viewed, visit times, referral source, browser, device type, language, approximate geographic area and newsletter campaign attribution. Where form measurement is enabled, it records form views, starts, step completions and successful submissions. Form answers, names and email addresses are not sent as the content of these analytics events.

Privacy and accessibility preferences are stored to support the corresponding website functions. Information about storage technologies, their names, purposes, providers and duration is available in our Cookie Policy. You can submit a form without consenting to optional analytics.

Where information is stored

Enquiries and related correspondence are stored, according to their use, in Ooops Workspace and Workspace Drive, in email and on InDancEdu computers. Retention rules also apply to active copies of these records. Backups are distinct from active records, as explained below.

Who processes the data and where

Authorised InDancEdu personnel manage enquiries. Ooops Studio provides forms, contacts, file storage, email, newsletter and analytics services through Ooops Workspace and processes the relevant data to provide these services. Technical processing by the provider is distinct from users' access to the administration interface.

The Workspace infrastructure and database are hosted by OVHcloud in Gravelines, France (os-gra6 region). Files are stored in OVH Object Storage, also in Gravelines (GRA region). The Listmonk newsletter and Umami analytics applications run on the Workspace server.

Workspace system email and newsletter delivery uses Amazon SES in eu-north-1 (Stockholm, Sweden). Delivery requires information such as the recipient address, sender details and message content. The sending service's region does not determine the location of each recipient's email provider.

Cloudflare provides website hosting, domain services, content delivery and technical protection. Encrypted Workspace backups are stored in a specific Cloudflare R2 bucket with EU jurisdiction. This applies to that backup storage and does not mean that all Cloudflare services or all website data remain exclusively within the EU.

International processing and transfers

Content and email delivery, security and technical support may involve processing outside the European Economic Area. The storage regions described above are not an assurance of exclusively European processing.

Cloudflare's published data-processing terms provide for the EU–US Data Privacy Framework for covered transfers to the United States and the European Commission's Standard Contractual Clauses for restricted transfers to which they apply. The relevant clauses module depends on whether the customer acts as controller or processor. This describes the mechanisms in the published terms and does not assert that every potential data route has been individually verified.

Further information is available in OVHcloud's processing terms, the AWS data protection centre and the Cloudflare Customer DPA. For information about processing of your data and the relevant safeguards, contact info@indancedu.com. We do not sell your personal data.

Technical logs

Accessing the website and submitting requests may involve processing IP addresses, timestamps, request details and technical errors. The purposes are service delivery and operation, fault diagnosis, prevention of abuse and investigation of security incidents. Processing for these purposes relies on the legitimate interest in secure and reliable services and is distinct from optional analytics, which rely on consent.

In the shared Workspace infrastructure, the server journal has a 30-day retention limit. Container logs rotate with a limit of three 10 MiB files per container; the duration depends on the volume of logs and does not correspond to a fixed number of days. These limits concern the specified infrastructure records, not every record held by a provider. They are separate from the 90-day analytics limit.

Retention

Routine contact and programme enquiries are retained for up to 12 months after submission. This limit covers submissions, related correspondence and their active copies in Workspace, email and computers. Linked contact information used solely for the enquiry is also deleted; a separate active newsletter subscription follows its own retention rules. Where an enquiry leads to a collaboration, a legal obligation or a specific need to establish, exercise or defend legal claims, only necessary information is retained for the relevant purpose and period.

Active newsletter subscription details are retained while the subscription remains active. Sending stops when you unsubscribe. Any separate retention of limited suppression information and consent evidence serves a different purpose from keeping the subscription active.

Detailed usage analytics are retained for up to 90 days.

Backups

Deletion from active systems does not mean simultaneous deletion from backups already created. Backup retention must be distinguished from the 12-month enquiry and 90-day analytics limits.

Remote backups follow a rolling policy of 7 daily, 4 weekly and 12 monthly restore points. Older points no longer selected by this policy are pruned. These are counts of restore points, not a guarantee that every backup is deleted after 30 days or has an absolute maximum age of 12 months.

Remote backups are encrypted before upload to R2. The 30-day protection against deletion is a minimum lock period, not a deadline for deleting all backups. Older restore points are pruned under the rolling retention policy. Backups support recovery following data loss or a technical incident and are distinct from active records used in daily operations.

Published activity photographs

We cover children's faces with graphics in published activity photographs unless written consent for the relevant use has been obtained from a parent or legal guardian during the activity. Covering a face does not by itself rule out identification from other details; we also review the overall image before publishing.

Selected published photographs are retained and displayed over the long term to document and present past InDancEdu activities, provided the purpose and publication channels are covered by the relevant consent. The necessity of retention and publication is reviewed at least annually, considering the image’s relevance to the activity, the continuing need to display it and the privacy of the children depicted. Material whose use is no longer justified is removed and deleted or effectively anonymised. Annual review is an InDancEdu procedure, not a statutory deadline.

Consent can be withdrawn at any time. Following withdrawal, use based on that consent stops and the relevant material is removed from channels we manage without undue delay. Withdrawal does not affect the lawfulness of earlier use. We do not wait for an erasure request to remove material that is no longer needed.

To raise a concern about an image or withdraw consent, contact info@indancedu.com and identify the relevant photograph or page.

Your rights

Subject to the GDPR's conditions, you may request access, rectification, erasure or restriction, object to processing based on legitimate interests, and request portability where applicable. You may withdraw consent at any time.

Send requests to info@indancedu.com. We respond without undue delay and at the latest within one month of receipt. If the complexity or number of requests requires an extension of up to two further months, we inform you within the first month and explain why. Requests are generally handled free of charge. We request additional information necessary to verify identity only where we have reasonable doubts. You may lodge a complaint with the Hellenic Data Protection Authority.

We update this policy when the website or our processing practices change. The effective version date is displayed on the page.