Privacy Policy

Last updated: 3 September 2026

1. Who We Are

EPAPHY (“we”, “us”, “our”) is a Below-the-Line Activation & Experiential Marketing company based in Athens, Greece.

Data Controller: EPAPHY, 27 Fleming St, 135 61 Agioi Anargyroi, Athens, Greece — info@epaphy.com — +30 21 0831 5285

This Privacy Policy explains how EPAPHY collects, uses, stores and protects personal data in connection with the use of this website (epaphy.com), in accordance with the European Union General Data Protection Regulation (GDPR) and applicable Greek law.

If you have any questions regarding this policy or how we handle your personal data, you may contact us at info@epaphy.com.

2. What Data We Collect

When you visit or interact with this website, we may collect:

  • Technical data — IP address, browser type and version, device information, operating system, referral source, pages visited, and the time and duration of your visit.
  • Cookie and analytics data — see Section 6.
  • Contact form data — name (either your first name or the initials of your full name), email address, telephone number (if provided), and the content of your message.
  • Newsletter subscription data — email address, if you choose to subscribe (where applicable).

3. How We Use Your Data

We use the personal data collected through this website without subjecting it to further processing beyond what is necessary for the stated purposes, and only for as long as required, in order to:

  • Operate, maintain and improve the website.
  • Respond to enquiries submitted through the contact form.
  • Understand how visitors use the website through analytics tools.
  • Send newsletters or updates, where you have provided your consent (where applicable).
  • Comply with legal and regulatory obligations.

4. Legal Basis for Processing

We process personal data collected through this website on the basis of one or more of the following legal grounds:

  • Consent — when you submit a contact form, subscribe to a newsletter or accept non-essential cookies.
  • Legitimate interests — for security purposes, provided that such interests do not override your rights and freedoms.
  • Legal obligation — where processing is required by applicable law.

Where processing is based on your consent, you may withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

5. Sharing Your Data

We do not sell personal data. We may share data collected through the website, as described above, with:

  • Service providers that support the operation of our website, such as hosting providers, email delivery tools and analytics service providers, which act in accordance with our instructions and under appropriate data processing agreements.
  • Professional advisers, such as legal advisers and accountants, where necessary.
  • Public authorities, where required by law.

6. Cookies

This website uses cookies and similar technologies to ensure its proper operation, understand how visitors use the website and improve our content.

  • Essential cookies — these are necessary for the operation of the website and cannot be disabled.
  • Analytics cookies — these help us understand how the website is used (e.g. Google Analytics or similar services).
  • Marketing cookies — these are used only where applicable and only with your consent.

You may manage or withdraw your consent to the use of cookies at any time through our website’s cookie banner or through your browser settings.

7. Data Retention

We retain personal data related to the website only for as long as necessary for the purposes described in this policy.

8. Your Rights

Under the GDPR, you have the right to:

  • Access the personal data we hold about you.
  • Request the correction of inaccurate or incomplete data.
  • Request the deletion of your data (“right to be forgotten”), where applicable.
  • Request the restriction of or object to certain forms of processing.
  • Data portability — receive your data in a structured, commonly used and machine-readable format.
  • Withdraw your consent at any time where processing is based on consent.
  • Lodge a complaint with the Hellenic Data Protection Authority if you believe that your personal data has not been handled appropriately: www.dpa.gr.

To exercise any of the above rights, please contact us at info@epaphy.com. We will respond within the time limits prescribed by the GDPR.

9. Data Security

We implement appropriate technical and organisational measures to protect personal data collected through this website against unauthorised access, loss, misuse or alteration.

Although we take reasonable measures to protect your data, no method of transmitting or storing data over the internet is completely secure and, therefore, we cannot guarantee absolute security.

10. Children’s Data

This website is not directed at children, and we do not knowingly collect children’s personal data through it.

11. International Data Transfers

Where personal data collected through this website is transferred outside the European Economic Area (EEA) — for example, through a hosting or analytics service provider based outside the EEA — we ensure that appropriate safeguards are in place, such as the Standard Contractual Clauses approved by the European Commission.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements.

The “Last updated” date at the top of this page indicates when this policy was last revised. We recommend that you review this page periodically.

13. Data Controller

We designate a data controller for the personal data collected, which must be appropriate, relevant and strictly necessary for the purposes for which it is processed.

14. Contact

For any questions, requests or concerns regarding this Privacy Policy or your personal data, please contact us:

EPAPHY
27 Fleming St
135 61 Agioi Anargyroi
Athens, Greece
info@epaphy.com
+30 21 0831 5285