Last updated: 27 October 2026
1. Introduction
The Penguin Project respects your privacy and is committed to protecting your personal data.
This Privacy Policy explains how personal information is collected, used, stored, and protected when you visit https://thepenguinproject.eu/ (the “Website”) or communicate with us.
We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Greek data protection legislation.
2. Data Controller
The controller responsible for the processing of personal data through this Website is:
The Penguin Project
Legal business name: [To be completed]
Registered address: [To be completed]
Email: maria@thepenguinproject.eu
Telephone: +30 697 066 6558
Website: https://thepenguinproject.eu/
For any privacy-related questions or requests, you may contact us using the email address above.
3. Personal Data We Collect
Depending on how you interact with the Website, we may process the following categories of personal data.
3.1 Information You Provide
When you contact us through the Website’s contact form or by email, we may collect:
Your name.
Your email address.
Your telephone number, if provided.
Your company or organisation, if provided.
The content of your message.
Any additional information you voluntarily include in your communication.
We use this information to respond to your enquiry and communicate with you regarding our services or potential collaborations.
3.2 Technical and Usage Information
When you access the Website, certain technical information may be processed automatically, including:
IP address.
Browser type and version.
Device and operating system information.
Date and time of access.
Pages requested and technical server logs.
Referring website, where available.
This information may be processed for Website operation, security, troubleshooting, and performance monitoring.
3.3 Website Analytics
We intend to use Google Analytics 4 (GA4), a web analytics service provided by Google, to understand how visitors interact with our Website.
Subject to the visitor’s applicable cookie and analytics consent preferences, Google Analytics may process information such as:
Pages visited and interactions with the Website.
Approximate geographical location.
Device and browser characteristics.
Traffic sources.
Session and engagement information.
Online identifiers associated with analytics technologies.
Analytics information helps us evaluate Website performance, improve navigation, and understand how visitors use our content.
Where consent is legally required, analytics technologies will not be activated until the visitor has provided valid consent.
Visitors will be able to manage or withdraw their consent through the Website’s cookie preference mechanism.
We also intend to use Google Search Console to monitor the Website’s presence and performance in Google Search. Search Console generally provides search performance and indexing information to Website administrators and does not, by itself, require the installation of visitor-tracking cookies.
4. Purposes and Legal Bases for Processing
We process personal data only where there is an appropriate legal basis under Article 6 of the GDPR.
Responding to enquiries: Processing contact details and messages to respond to requests, discuss services, or take steps prior to entering into a potential agreement. The legal basis may be legitimate interests or pre-contractual necessity, depending on the nature of the enquiry.
Website operation and security: Processing necessary technical information to maintain Website functionality, prevent misuse, and protect our systems. The legal basis is our legitimate interest in operating a secure and reliable Website.
Website analytics: Processing analytics-related information to measure and improve Website performance. Where required, this processing is based on your consent.
Legal compliance: Processing information where necessary to comply with applicable legal obligations.
We do not use information submitted through the contact form for unsolicited marketing communications without an appropriate legal basis.
5. Contact Form and Communications
When you submit a message through our contact form, the information you provide is used to process and respond to your enquiry.
Providing the information required by the form is voluntary, but we may be unable to respond if essential contact details are missing.
We do not sell contact information or share it with third parties for their independent marketing purposes.
6. Cookies and Similar Technologies
The Website may use essential cookies required for its proper functioning and, subject to consent where required, optional analytics cookies.
A cookie consent management system will allow visitors to accept, reject, or modify their preferences regarding non-essential cookies.
Detailed information about cookie categories, providers, purposes, and retention periods will be available in our separate Cookie Policy.
7. Data Sharing and Service Providers
We may share personal data with trusted service providers only where necessary for the operation of the Website and our business activities.
Such providers may include:
Website hosting and technical maintenance providers.
Email and communication service providers.
Google, in connection with Google Analytics and Search Console.
Website security and cookie consent management providers.
Where required, appropriate contractual and organisational safeguards are applied to protect personal data.
We do not sell personal data.
8. International Data Transfers
Some service providers, including Google, may process personal data outside the European Economic Area (EEA).
Where such transfers occur, we seek to ensure that they are covered by a valid legal transfer mechanism, such as an applicable adequacy decision or Standard Contractual Clauses, together with supplementary measures where required.
Further information about applicable safeguards may be requested using our contact details.
9. Data Retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, unless a longer retention period is required by law.
Our intended retention practices are as follows:
Contact form submissions and general enquiries: Up to 12 months after the last relevant communication, unless continued retention is necessary for an ongoing business relationship, a legal obligation, or the establishment, exercise, or defence of legal claims.
Technical and security logs: Up to 24 months where justified by security and operational requirements, subject to the actual hosting and security configuration.
Analytics data: According to the retention settings configured in Google Analytics and the applicable consent preferences.
Business and contractual records: For the periods required by applicable tax, accounting, and other legal obligations.
When personal data is no longer necessary, it is deleted, anonymised, or securely archived where legally appropriate.
10. Data Security
We implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss, or destruction.
These measures may include encrypted connections, access restrictions, software updates, security monitoring, and controlled access to administrative systems.
Despite these precautions, no method of electronic transmission or storage can be guaranteed to be completely secure.
11. Your Rights Under the GDPR
Subject to the conditions and limitations of applicable law, you have the right to:
Access: Request information about the personal data we hold about you.
Rectification: Request correction of inaccurate or incomplete data.
Erasure: Request deletion of your personal data where applicable.
Restriction: Request that certain processing activities be restricted.
Data portability: Receive certain personal data in a structured, commonly used, machine-readable format where applicable.
Objection: Object to processing based on legitimate interests in circumstances provided by law.
Withdrawal of consent: Withdraw previously given consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
To exercise your rights, please contact maria@thepenguinproject.eu.
We will respond to requests within the time limits established by applicable data protection legislation.
12. Right to Lodge a Complaint
If you believe that your personal data has been processed unlawfully, you have the right to lodge a complaint with the competent supervisory authority.
In Greece, the competent authority is the:
Hellenic Data Protection Authority (HDPA)
Website: https://www.dpa.gr/
You may also contact us directly so that we can review and address your concerns.
13. Third-Party Websites and Social Media
The Website may include links to third-party websites and social media platforms, including Facebook and Instagram.
When you follow these links, your personal data may be processed by the relevant third-party provider under its own privacy policy.
We encourage visitors to review the privacy policies of external services before providing personal information.
14. Automated Decision-Making
We do not use personal data collected through this Website to make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.
15. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in Website functionality, data processing practices, service providers, or legal requirements.
Any revised version will be published on this page with an updated revision date.
16. Contact
For questions regarding this Privacy Policy or the processing of your personal data, please contact:
The Penguin Project
Email: maria@thepenguinproject.eu
Telephone: +30 697 066 6558
Website: https://thepenguinproject.eu/