Privacy policy
Last updated:
This policy explains how personal data is used when you visit gettfest.gr, contact Europalso or take part in GETTfest through app.gettfest.gr. Personal data means information that identifies, or can identify, an individual.
1. Scope
This notice covers website visitors, registered event visitors, speakers and people contacting us about exhibiting, sponsorship or presentations. Where applicable, it also covers admission badges and attendance records managed through the platform.
The GETTfest platform privacy notice provides additional information about forms, registration approval, QR badges, check-in, event feedback and authorised staff access. Read it alongside the information shown on the form you use. Cookie choices made on the main website do not automatically apply to the platform.
2. Data controller and contact details
The data controller is the Panhellenic Association of Language School Owners and Teachers, trading as EUROPALSO, the organiser of GETTfest.
- Contact address: 100 Akadimias Street, Athens, Greece.
- Data Protection Officer (DPO): dpo@europalso.gr.
- Telephone: +30 210 3830752.
Contact the DPO with data-protection questions, requests to exercise your rights or questions about this policy. You can also write to the address above, marking your letter for the attention of the DPO.
3. Categories of data and how we obtain it
Depending on the service you use, you may provide, or the service may generate:
- Identity and contact details, such as your name, email address and telephone number.
- Professional information, such as your organisation, role, country, region and participation interests.
- Enquiries and proposals, including messages, speaking topics and information about exhibiting, sponsorship or a presentation.
- Participation records, such as registration status, an admission badge and the time of an access check at the event or an individual activity.
- Technical information needed to operate services securely, such as IP addresses, browser information, request times and security logs.
- Records of submissions and choices, such as submission times and evidence of consent where required.
Most data comes directly from you. Technical information may be generated while you browse or use the platform. If you provide another person’s details, you must have appropriate authorisation and make the relevant privacy information available to them.
Do not enter health information, identity-document numbers or other sensitive or unnecessary details in free-text fields. If you need a specific arrangement for your attendance, contact the team first so that the appropriate communication process and privacy information can be established.
4. Purposes and lawful bases
Processing takes place for specific purposes, using the lawful basis appropriate to each situation under Article 6 GDPR:
| Purpose | Lawful basis |
|---|---|
| Receiving and managing a participation or business enquiry | Steps requested by you before entering into a contract, or performance of a contract where applicable; legitimate interests when communicating with an organisation’s representatives. |
| Visitor registration and processing for which the form requests specific consent | Consent for the stated purpose, where this is the basis used by the relevant procedure. |
| Safe event organisation, access management, handling requests and operational reporting | Legitimate interests in organising, securing and supporting GETTfest, with regard to participants’ rights. |
| Protecting services from abuse and investigating technical incidents | Legitimate interests in security and reliable operation. |
| Meeting obligations imposed by law | Compliance with a legal obligation. |
| Optional Google Analytics measurement and promotional communications that require consent | Prior consent, which can be withdrawn. |
When relying on legitimate interests, we consider whether processing is necessary, your reasonable expectations and the effects on your rights. You can ask the DPO for further information and exercise your right to object.
Reading or acknowledging a privacy notice does not, by itself, constitute blanket consent to every use of personal data. Where consent is needed, it must relate to specific, clearly described processing.
5. Required and optional information
Forms identify the fields needed for the particular procedure. Without necessary information, we may be unable to complete a registration, consider an enquiry or contact you. Optional information is not a condition for accessing unrelated services.
Rejecting analytics cookies does not prevent you from browsing gettfest.gr or accessing participation links.
6. Event communications and optional updates
Communications needed to manage an enquiry or registration, such as participation details or an admission badge, are distinct from optional promotional communications.
Where consent is requested for newsletters or promotional messages, that choice must be separate. You can withdraw it using an unsubscribe option in the relevant communication, where available, or by contacting the DPO. You do not need to give a reason to object to direct marketing.
7. Cookies, local storage and analytics
On gettfest.gr, Google Analytics does not load until you choose to accept analytics. No requests are sent to Google Analytics without that choice. Acceptance and rejection are available at the same level of the cookie notice.
| Technology | Purpose | Browser storage duration |
|---|---|---|
gettfest_cookie_consent in local storage | Remembering your choice, without using it for analytics or advertising | Your choice is valid for 180 days. An expired value is removed on your next visit. |
gettfest_cookie_consent_check in local storage | Temporarily checking that changes to privacy preferences can be saved | Removed after the check; it contains no user identifier. |
_ga and _ga_*, if you accept analytics | Recognising a browser and measuring website use through Google Analytics | Up to 180 days, subject to shorter browser limits or deletion by you. |
| Session and security cookies on the participation platform | Access, form security and abuse prevention | As described in the platform’s separate notice and operation. |
Analytics may include pages visited, actions such as link clicks, device and browser information, referral sources and approximate geographical location. We do not send names, email addresses or telephone numbers as event parameters from the main website. Our Google tag configuration does not enable Google Signals or advertising personalisation.
You can change your choice at any time using “Cookie settings” in the footer. Withdrawing consent disables analytics tracking, removes Analytics cookies that the website can delete and reloads the page to stop the already-loaded library. Withdrawal does not automatically delete data previously sent lawfully; contact the DPO to make a related request.
Your choice applies to the main website and its language versions in the same browser. If local storage is blocked, the choice applies to the current page and may be requested again on the next page. The app.gettfest.gr platform has its own essential functions and notice; that notice states that its public forms do not use advertising cookies.
8. Recipients and access to data
Authorised Europalso personnel and event staff can access participation data to the extent needed for their roles. Hosting, email-delivery, security, technical-support and backup providers may be used to operate the services.
The main website uses Cloudflare to host and deliver content. Google Analytics is also used if you accept analytics. The platform describes its use of Cloudflare Turnstile where form protection is enabled.
Personal data is not sold. Sponsoring or exhibiting does not automatically give a partner access to visitor details or contact lists. Any separate disclosure must have a specific purpose, an appropriate lawful basis and prior information. Data may also be disclosed to competent authorities where legally required.
9. Transfers outside the European Economic Area
International technical providers may process data outside the European Economic Area. Such transfers require an appropriate mechanism under Chapter V GDPR, such as an applicable adequacy decision or standard contractual clauses, together with any necessary supplementary measures.
The DPO can provide information about recipients and safeguards relevant to the particular service, and how to obtain further details. This policy does not mean that every provider stores all data exclusively in Greece or the European Union.
10. Retention
For participation-related platform data, the published platform notice specifies 12 months after the event ends. Longer retention may be necessary for a legal obligation, an outstanding request, incident investigation or protection of legal rights. Anonymous aggregate information may be kept for historical and operational evaluation.
For other data, retention is determined by its purpose and necessity:
- Correspondence and enquiries: until the request has been dealt with and, where necessary, to document obligations or manage claims.
- Consent or objection records: for as long as needed to demonstrate and respect your choice.
- Technical logs: for the period necessary for operation and security, considering any incident investigation and the provider’s settings.
- Analytics records: according to the configured retention period of the GA4 property and the type of data. A cookie’s browser lifetime is not the same as the retention period on the provider’s servers. Ask the DPO for information about the setting in use.
Once the purpose ends and there is no other lawful need to retain the data, it should be deleted or anonymised. Backup copies and necessary exceptions are considered separately; they do not justify indefinite retention.
11. Event feedback
The platform describes a separate anonymous feedback questionnaire whose responses are not linked to registration or entry activity. Do not include identifying information about yourself or others in optional free-text answers. The relevant notice also explains technical abuse prevention and retention of responses.
12. Security
Protection relies on technical and organisational measures appropriate to the risks, including encrypted HTTPS connections, restricted access, role separation on the platform and protection against abusive requests. No system can guarantee absolute security.
Contact the DPO about an incident that may involve personal data. Do not send passwords or more information than is needed to describe the issue initially.
13. Your rights
Depending on the lawful basis and GDPR conditions, you can request:
- Access: information about processing and a copy of your data.
- Rectification: correction of inaccurate or completion of incomplete information.
- Erasure: where the legal conditions apply and further retention is not required.
- Restriction: in the circumstances provided by law.
- Objection: to processing based on legitimate interests and, without giving reasons, to direct marketing.
- Portability: where processing is automated and based on consent or a contract.
- Withdrawal of consent: at any time, without affecting the lawfulness of earlier processing.
Not every right applies in the same way to every processing activity. For example, a legal retention obligation may limit the erasure of particular records.
14. Making a request
Email dpo@europalso.gr or write to the DPO at 100 Akadimias Street, Athens. State the service or event concerned, your contact details and the right you wish to exercise.
If there are reasonable doubts about the requester’s identity, only the additional information necessary to confirm it may be requested. A response is normally provided within one month of receipt. An extension of up to two additional months may be needed because of the complexity or number of requests. You must be informed within the original month, with reasons for the extension.
Exercising your rights is generally free of charge. Any lawful exception or refusal must be explained, together with information about the available remedies.
15. Complaints
You can complain to the Hellenic Data Protection Authority. Information and the complaint procedure are available on its official website, www.dpa.gr. You do not have to contact us first to exercise this right.
16. Children, photography and specific situations
Where children take part, appropriate information is required and, where the law requires it, involvement or consent from a person with parental responsibility. Do not provide a child’s details without the necessary authorisation.
Registering for or attending an event does not, by itself, constitute blanket consent to photography, filming or promotional use of your image. Such activities require specific information, an appropriate lawful basis and separate consent where required.
We do not use browsing on the main website to make solely automated decisions that have legal or similarly significant effects on you. Technical badge-validation and access-permission checks are distinct from such decisions. Contact the team and DPO with questions about your registration or access.
17. Embedded maps and external services
The venue page includes an OpenStreetMap map, which loads when you approach that section. Loading it sends technical information, such as your IP address and browser details, to the provider. Your Google Analytics choice does not control this function. See the OpenStreetMap privacy policy.
If you follow a link to Google Maps, a social network or another third-party website, that provider’s notices and choices apply. Share buttons take you to the relevant service; they are not embedded advertising pixels.
18. Updates
This policy may be updated when services, processing activities or legal requirements change. The date of the latest update appears at the top of the page. A change in wording does not, by itself, provide fresh consent for a different processing purpose.
For the participation platform, also read the app.gettfest.gr notice. Contact the DPO at dpo@europalso.gr for any clarification.