At Chryso Lefou, we are committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our website chrysolefou.com (the "Website"). This policy complies with the General Data Protection Regulation (GDPR), Greek Law 4624/2019, and Cyprus Law 125(I)/2018.
1. Data Controller
The data controller responsible for your personal data is: Chrysо Lefou Email: [email protected] For any questions regarding your personal data or this Privacy Policy, please contact us using the information above.
2. Data We Collect
2.1 Account Information
When you create an account, we collect: • Email address • Password (never stored in plain text) • Profile picture (only if you sign in with Google, taken from your Google profile) • Account creation and last sign-in timestamps • User ID (automatically generated) • Sign-in method (email or Google) • Email verification status
2.2 User Preferences
When you use our service, we may collect: • Saved recipes, festivals, and blog posts (items you bookmark for later) • Festival reminder preferences (if you ask us to remind you about a festival) • Language preference (English or Greek) • Browser and device information
2.3 Contact Form Data
When you submit our contact form: • Name • Email address • Subject • Message content • Submission timestamp
2.4 Analytics and Performance Data
We automatically collect: • Web Vitals (Core Web Vitals, page load metrics) • Performance data (navigation timing, resource loading) • Error logs and stack traces (when errors occur) • Device type and browser information • Pages visited and interaction patterns (Google Analytics only if you accept analytics cookies) • IP address, used briefly to limit excessive search requests and to protect forms against automated abuse
2.5 Cookies
We use the following types of cookies: • Essential Cookies: Required for signing in and for the website to work • Analytics Cookies: To understand how visitors use our website (Google Analytics only after you give consent) • Performance Cookies: To monitor and improve website performance
3. How We Use Your Data
We process your personal data for the following purposes: • Account Management: To create, maintain, and authenticate your user account • Service Provision: To provide access to recipes, save your favorite recipes, and personalize your experience • Communication: To respond to your inquiries and contact form submissions • Website Improvement: To analyze website usage and improve functionality, performance, and user experience • Security: To detect and prevent fraud, abuse, and security incidents • Legal Compliance: To comply with applicable laws and regulations
4. Legal Basis for Processing
Under GDPR, we process your data based on: • Consent: When you create an account, subscribe to newsletters, or submit contact forms • Contract: To fulfill our obligations when you use our services • Legitimate Interests: To improve our services, ensure security, and analyze website performance • Legal Obligation: To comply with applicable laws and regulations
5. Third-Party Services
We work with a small number of carefully selected service providers who process data on our behalf, only for the purposes described in this policy and under data processing agreements. A list of our current providers is available on request at [email protected].
Hosting and Database
Purpose: Running the website and securely storing account data and saved items Data: Email, user ID, saved items, preferences
AI Assistance
Purpose: Recipe translation and content assistance for our editorial team Data: Recipe content only; no personal data of visitors is sent
Google Sign-In
Purpose: Optional sign-in with your Google account Data: Email address and basic profile information from your Google account Privacy Policy: https://policies.google.com/privacy
Email Delivery and Newsletter
Purpose: Account emails (sign-up confirmation, password reset), festival reminders, replies to your messages, and the newsletter if you subscribe Data: Email address, language preference, and the content of the email
Website Analytics
Purpose: Understanding how the website is used and improving performance. Google Analytics is loaded only after you accept analytics cookies Data: Pages visited, device and browser information, approximate location Privacy Policy: https://policies.google.com/privacy
Error Monitoring
Purpose: Detecting and fixing technical errors Data: Technical error information, with personal data masked
Spam and Abuse Protection
Purpose: Protecting our forms from spam and automated abuse Data: Technical browser and device signals, IP address
Video Embedding
Purpose: Showing recipe videos Data: None; videos are embedded in YouTube privacy-enhanced mode Privacy Policy: https://policies.google.com/privacy
6. Cookies and Tracking
We use cookies to: • Maintain your login session (essential) • Remember your language preference (functional) • Analyze website performance (analytics) You can control cookies through your browser settings. However, disabling essential cookies may limit your ability to use certain features of our website.
Cookie Details:
| Cookie Name | Type | Purpose | Duration |
|---|---|---|---|
| sb-* | Essential | Authentication session | 7 days |
| Analytics | Analytics | Performance tracking | Session |
7. Data Retention
We retain your personal data for as long as necessary to fulfill the purposes outlined in this Privacy Policy: • Account Data: Retained until you delete your account • Saved Items and Reminders: Retained until you remove them or delete your account • Newsletter Subscription: Retained until you unsubscribe • Contact Form Submissions: Retained for up to 2 years • Technical Data for Abuse Prevention (such as IP addresses): Deleted automatically within a short period • Analytics Data: Aggregated and anonymized data retained indefinitely • Error Logs: Retained for 90 days • Consent Records: Retained for 5 years as required by GDPR
8. Your Rights Under GDPR
As a user in the European Union, Cyprus, or Greece, you have the following rights:
- Right of Access: Request a copy of your personal data
- Right to Rectification: Correct inaccurate or incomplete data
- Right to Erasure: Request deletion of your data ("right to be forgotten")
- Right to Restriction: Limit how we process your data
- Right to Data Portability: Receive your data in a structured, machine-readable format
- Right to Object: Object to processing based on legitimate interests
- Right to Withdraw Consent: Withdraw consent at any time (does not affect prior processing)
- Right to Lodge a Complaint: File a complaint with your local data protection authority
To exercise these rights, please contact us at [email protected]. We will respond within 30 days.
9. Data Protection Authorities
If you are not satisfied with our response, you may lodge a complaint with:
- Greece: Hellenic Data Protection Authority (www.dpa.gr)
- Cyprus: Commissioner for Personal Data Protection (www.dataprotection.gov.cy)
- EU: Your local data protection authority
10. Data Security
We take appropriate technical and organizational measures to protect your personal data: • All data is encrypted in transit • Passwords are never stored in plain text • Email addresses are verified before an account is activated • You can only access your own account data; administrative access is restricted to authorised staff • Technical data used to prevent abuse is kept only briefly and deleted automatically • Our forms and services are protected against spam and automated abuse • We regularly review the security of our website and address issues promptly No system is completely secure. If we become aware of a personal data breach that affects you, we will notify you and the competent supervisory authority as required by GDPR.
11. International Data Transfers
Your data is primarily stored on servers within the European Union. Some service providers may process data outside the EU. When this happens, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission.
12. Children's Privacy
Our Website is not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately, and we will delete such information.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of significant changes by posting a notice on our Website or sending an email to registered users. The "Last Updated" date at the top indicates when this policy was last revised.
15. Google API Services User Data
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We only use Google user data to provide and improve our authentication services and do not transfer this data to third parties except as necessary to provide our services.
14. Contact Information
For questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: Email: [email protected] Website: www.chrysolefou.com/contact We are committed to working with you to resolve any privacy concerns.