Privacy Policy – emste-charity.org

1. Who we are

The controller of your personal data is the Grand Charity of National Grand Lodge of Greece (Μέγα Αγαθοεργό Σώμα της Εθνικής Μεγάλης Στοάς της Ελλάδος), hereinafter “the Charity”, “we” or “us”.

This policy explains what data we collect through emste-charity.org, why we use it, who has access to it and what rights you have, in line with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Greek Law 4624/2019.

Contact details for data protection matters

  • Postal address: P.O. Box 21034, Athens 11401, Greece
  • Email: info@emste-charity.org

2. What data we collect

We only collect the data you give us and the data needed to run the website securely.

Where

What data

Contact form

Subject, first name, last name, email, phone (optional), the text of your message

Newsletter

Email address

Donations and purchases (once enabled)

Full name, email, phone, billing/shipping address, tax ID if a receipt is requested, amount and transaction history. Card details are handled only by the payment provider; we never see them.

Technical connection data

IP address, browser and device type, date and time of visit, in the server’s log files

We do not ask for special categories of data (e.g. health or religion). If you include such information in your message, for example in a request for support, we use it only to assess and respond to your request, based on your explicit consent given by sending it.

Each processing activity relies on one of the legal bases of Article 6 GDPR. We do not sell or rent your data to anyone.

Purpose

Legal basis

Replying to your message or to a volunteering, partnership or support request

Our legitimate interest in replying to those who contact us (Art. 6(1)(f)) or steps prior to entering into a contract (Art. 6(1)(b))

Sending the newsletter

Your consent (Art. 6(1)(a)), which you can withdraw at any time via the “unsubscribe” link in every email

Processing a donation or purchase and sending a receipt

Performance of a contract (Art. 6(1)(b))

Keeping accounting and tax records for donations and purchases

Legal obligation (Art. 6(1)(c))

Website security and protection against spam and bots

Legitimate interest (Art. 6(1)(f))

4. Cookies

We only use strictly necessary cookies, for language selection, the donation/shopping cart and security. We do not use analytics, advertising or social media cookies.

The full list of cookies, with the name, purpose and duration of each, is in our Cookie Policy.

Our fonts are hosted on our own server, so no connection is made to Google. The share buttons (Facebook, X, LinkedIn, Pinterest, Telegram) are plain links and load nothing from these networks unless you click them.

5. Who has access to the data

Only authorised members of the Charity who handle your request have access to your data. To run the website, we use the technical services of the providers below, for example for hosting the website and sending emails. These providers do not receive your data for their own use. They act as “processors” on our behalf (Article 28 GDPR), are bound by contractual confidentiality terms, and process the data only as far as needed for the service they provide to us and only on our instructions.

Provider

Role

Bluehost (Newfold Digital, Inc., USA)

Hosting of the website and database, and sending emails from the forms

Cloudflare, Inc.

Protecting the forms from spam and bots through Turnstile. Processes IP address and browser characteristics, not for advertising

Newsletter provider (not yet enabled)

Sending the newsletter. The provider will be named here once the service is enabled.

Payment provider (not yet enabled)

Processing card payments for donations and purchases. The provider will be named here once donations are enabled.

Smartup

Technical support and maintenance of the website

We may also disclose data to public authorities where required by law (e.g. tax authorities). We do not sell or give data to third parties for their own purposes.

6. Transfers outside the European Economic Area

Some providers, such as Bluehost and Cloudflare, are based in the USA and may process data outside the EEA. In these cases, the transfer is made with the safeguards provided by the GDPR: the EU-U.S. Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

7. How long we keep data

We keep data only for as long as needed for the purpose it was collected for, and delete it afterwards.

Data

Retention

Contact form messages

Deleted at the end of each year, if older than 2 years

Newsletter

Until you unsubscribe

Donations and purchases

As required by tax law (usually 5 years from the end of the financial year)

Server log files

Up to 90 days

8. Your rights

You can exercise the following rights free of charge by writing to info@emste-charity.org. We will reply within one month.

  • Access: to find out whether we hold data about you and what it is.
  • Rectification: to have inaccurate data corrected or incomplete data completed.
  • Erasure: to have your data deleted, unless the law requires us to keep it.
  • Restriction: to have processing temporarily paused.
  • Objection: to object to processing based on our legitimate interest.
  • Portability: to receive your data in a readable format.
  • Withdrawal of consent: at any time, without affecting processing carried out before.

If you believe that the processing of your data breaks the law, you have the right to lodge a complaint with the Hellenic Data Protection Authority, 1-3 Kifisias Ave., 115 23 Athens, Greece, www.dpa.gr.

9. Security, minors and changes

Security. The website uses an encrypted connection (HTTPS) and access to data is limited to authorised persons. If a breach affecting you occurs, we will inform you and the Hellenic Data Protection Authority as required by the GDPR.

Minors. The website is intended for adults. We do not knowingly collect data from persons under 15 without the consent of their parents (Article 21, Law 4624/2019).

Changes. We may update this policy, for example when donations or the shop are enabled. The current version is always available on this page.

Last updated: 08/10/2026