Privacy Policy

1. General information

We are pleased that you are visiting our website. The protection of your personal data is very important to us. Below, we inform you about the collection, processing, and use of personal data when using our website aronisvisions.com, in accordance with the General Data Protection Regulation (GDPR). Personal data is any information relating to an identified or identifiable natural person. All data on this website is processed under the responsibility of Elisabeth Aronis.

Aronis Visions is not a production company. It is the shared name under which two independent freelancers, Elisabeth Aronis (photography) and Manos Aronis (film), work together.

2. Controller

The controller for the processing of personal data on this website is:

Elisabeth Aronis
Freelance photographer, working under the name Aronis Visions
71307 Heraklion, Crete, Greece
VAT identification number: 178951797
info@aronisvisions.com
+30 693 962 0293

A data protection officer has not been appointed, as this is not legally required.

3. Privacy policy

3.1 Legal framework

Personal data is processed in accordance with:

• Regulation (EU) 2016/679 (GDPR)
• Greek Law 4624/2019 (implementing measures for GDPR)
• Greek Law 3471/2006 (electronic communications & cookies)
• Directive 2002/58/EC (ePrivacy Directive)

3.2 Categories of personal data

We may process the following categories of personal data:

• Identification data (name, company name)
• Contact data (email address, phone number)
• Communication content
• Contractual and service-related data
• Billing and tax-related data (where applicable)
• Technical data (IP address, browser type, device information)
• Usage and analytics data (if implemented)
• Cookie-related data

Special categories of data under Article 9 GDPR are not intentionally collected.

3.3 Legal bases for processing (Art. 6 GDPR)

Processing is based on one or more of the following legal grounds:

• Art. 6(1)(a) GDPR – consent
• Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures
• Art. 6(1)(c) GDPR – compliance with legal obligations
• Art. 6(1)(f) GDPR – legitimate interests

Legitimate interests may include:

• Responding to client inquiries
• Ensuring IT security and website functionality
• Organising and developing our freelance work

Where consent is required, it may be withdrawn at any time with effect for the future.

Where processing is based on legitimate interests pursuant to Article 6(1)(f) GDPR, an assessment has been carried out to ensure that such interests are not overridden by the rights and freedoms of data subjects (Recital 47 GDPR).

3.4 Purposes of processing

Personal data is processed for:

• Handling inquiries and communication
• Providing our freelance photography and film services
• Contract initiation and execution
• Accounting and tax compliance
• Website security and performance monitoring
• Business analysis and improvement

No newsletter or active marketing communications are currently conducted.

3.5 Recipients of personal data

Personal data may be shared with:

• Hosting provider (Netlify)
• IT and technical service providers
• Email and communication platforms
• Analytics providers (if used)
• Accounting and legal advisors

Where required by law, service providers are bound by data processing agreements in accordance with Article 28 GDPR.

Personal data is not sold.

3.6 International data transfers

If service providers are located outside the European Union or European Economic Area (EEA), personal data may be transferred to third countries.

Such transfers are based on:

• European Commission adequacy decisions (Article 45 GDPR), or
• Standard Contractual Clauses (Article 46 GDPR).

Where required, additional safeguards are implemented in line with the Court of Justice of the European Union ruling in case C-311/18 (Schrems II).

Further information regarding applied safeguards may be requested via email.

3.7 Data retention

Personal data is retained only for as long as necessary for the respective purpose.

• Contractual and tax-related data: 5–10 years (Greek law)
• Inquiry-related data: up to 3 years after last contact
• Technical and log data: only for security and functionality
• Analytics data: 14 months

Upon expiration, data is securely deleted or anonymized.

3.8 Data subject rights

Under GDPR, users have the right to:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Withdraw consent at any time

Requests can be submitted via email to: info@aronisvisions.com

Requests are handled without undue delay and within one (1) month (Art. 12 GDPR).

Users have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA).

3.9 Data security

Appropriate technical and organisational measures are implemented (Art. 32 GDPR), including:

• Access control
• Secure hosting
• Password protection
• SSL/TLS encryption

3.10 Automated decision-making

No automated decision-making or profiling (Art. 22 GDPR) takes place.

3.11 Personal data breach

In the event of a personal data breach:

• The competent supervisory authority will be notified within 72 hours where required (Art. 33 GDPR).
• Affected data subjects will be informed where a high risk exists (Art. 34 GDPR).
• Internal procedures are in place to ensure compliance.

3.12 Data protection officer

A data protection officer has not been appointed. Article 37 GDPR does not apply, as:

• Activities do not involve large-scale systematic monitoring
• Activities do not involve large-scale processing of special categories of data
• Controller is not a public authority

Appropriate internal data protection measures are implemented.

4. Hosting (Netlify)

This website is hosted by Netlify, Inc., USA.

When you visit our website, Netlify automatically collects and stores information in server log files, which your browser transmits automatically. This may include:

• IP address
• Date and time of the request
• Browser type and version
• Operating system
• Referrer URL

This data is processed to deliver the website and to ensure technical stability and security.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure and reliable website)

We have concluded a data processing agreement with Netlify in accordance with Art. 28 GDPR. Data may be transferred to the USA; such transfers are based on the EU-U.S. Data Privacy Framework (where the provider is certified) or on Standard Contractual Clauses (Art. 46 GDPR).

For more information: Netlify Privacy

5. Cookies and consent management

When you first visit our website, a cookie banner asks for your consent. Statistics and marketing services are only loaded after you have given your consent. Without consent, no such cookies are set and no such data is transferred.

• Necessary → required for the website to work, e.g. storing your cookie choice in your browser (local storage)
• Statistics → Google Analytics, only after consent
• Marketing → Google Ads and Meta Pixel, only after consent

Your choice is stored in your browser and can be changed or withdrawn at any time with effect for the future via “Cookie settings” at the bottom of every page.

Legal basis: § 25 (2) TDDDG / Art. 6(1)(c) and (f) GDPR for necessary storage; § 25 (1) TDDDG / Art. 6(1)(a) GDPR (consent) for statistics and marketing.

We use Google Consent Mode: until you consent, Google services are set to “denied” and do not store any cookies.

6. Google Analytics

With your consent, this website uses Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).

Google Analytics uses cookies to analyze your use of the website. Information may include:

• Pages visited
• Time spent on pages
• Device and browser information
• Approximate location (region/city)

IP anonymization is enabled.

Legal basis: Art. 6(1)(a) GDPR and § 25 (1) TDDDG (consent via cookie banner)

Data may be transferred to the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework.

Retention: 14 months

Consent can be withdrawn at any time via “Cookie settings”.

More information: Google Privacy

7. Advertising (Google Ads and Meta Pixel)

With your consent, we use Google Ads (Google Ireland Limited) and the Meta Pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) to measure the success of our advertising and to show relevant ads on Google, Instagram and Facebook.

For this purpose, cookies or similar technologies are used and information such as pages visited, device data and an online identifier may be transferred to Google or Meta.

Legal basis: Art. 6(1)(a) GDPR and § 25 (1) TDDDG (consent via cookie banner)

Data may be transferred to the USA. Google LLC and Meta Platforms, Inc. are certified under the EU-U.S. Data Privacy Framework. For the Meta Pixel, we and Meta are joint controllers for the collection and transfer of data (Art. 26 GDPR).

Consent can be withdrawn at any time via “Cookie settings”.

More information: Google Privacy · Meta Privacy

8. Contact by email

Our contact page contains a letter form. When you send it, your own email program opens with a prepared message to us; the form itself does not transmit any data to us or third parties. If you contact us by email or phone, the data you provide (e.g., name, email address, message) will be used only to respond to your inquiry.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in answering inquiries)

Your data will be deleted once the inquiry is fully processed and no statutory retention obligations apply.

9. Instagram

We maintain an online presence on Instagram (Meta Platforms Ireland Limited). Our website only links to our Instagram profile; no data is transferred to Instagram until you click the link.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in marketing and online presence)

More information: Instagram Help

Note: For the operation of our Instagram profile, joint controllership may apply under Art. 26 GDPR.

10. YouTube

Our website does not embed YouTube videos. Our films are linked: only when you click “Watch on YouTube” does a new window open on YouTube (Google Ireland Limited), where YouTube's privacy policy applies.

More information: YouTube Privacy

11. Fonts

This website uses the fonts Inter and GFS Didot. The fonts are hosted locally on our own server; no connection to Google or other font providers is established when you visit the website.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a consistent presentation)

12. Your rights as a data subject

You have the right to:

• Access your personal data (Art. 15 GDPR)
• Rectification of incorrect data (Art. 16 GDPR)
• Erasure of data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to data processing (Art. 21 GDPR)
• Lodge a complaint with a supervisory authority (Art. 77 GDPR)
• Withdraw consent at any time

13. Data retention

Personal data is stored only as long as necessary or required by law:

• Email inquiries → deleted after processing, unless statutory retention obligations apply
• Server log files (Netlify) → according to Netlify's retention periods
• Analytics → 14 months
• Advertising → according to Google and Meta policies
• Cookie choice → stored in your browser until you change or delete it

14. Changes to this privacy policy

We reserve the right to update this privacy policy to reflect legal or technical changes.

Last updated: 27.10.2026

15. Supervisory authority

For questions or complaints, you can contact the Hellenic Data Protection Authority (HDPA):
https://www.dpa.gr