Ukrainian Educational Hub in Greece
(UA EduHub Greece)
Privacy Policy
Website: https://greece.eduhub.org.ua
Version 1.0 | Effective date: 30 March 2025 | Last reviewed: 1 July 2026
1. Introduction
This Privacy Policy explains how Ukrainian Educational Hub in Greece (UA EduHub Greece) collects, uses, stores, shares and protects personal data when individuals visit our website, register for our activities, communicate with us, volunteer, donate, or otherwise interact with our educational, cultural, social and humanitarian programmes.
We process personal data in accordance with Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR), applicable Greek data protection law, including Law 4624/2019, and our internal data protection, child safeguarding, transparency, complaints and volunteer policies.
2. Who We Are
Ukrainian Educational Hub in Greece (UA EduHub Greece) is a non-commercial educational and social initiative operating in Greece. For this Privacy Policy, UA EduHub Greece acts as the data controller for personal data processed through https://greece.eduhub.org.ua and related activities, unless another controller is specifically identified.
| Item | Details |
|---|---|
| Controller | Ukrainian Educational Hub in Greece (UA EduHub Greece) |
| Website | https://greece.eduhub.org.ua |
| Activities | Educational, cultural, integration, digital literacy, community, humanitarian and volunteer programmes |
| Contact route | Contact form and contact details published on the official website |
| Supervisory authority | Hellenic Data Protection Authority (HDPA) |
3. Scope of this Policy
This Policy applies to personal data processed in connection with the website, online or offline event registrations, educational and cultural programmes, newsletters, photographs and videos, volunteer and partner engagement, donations, grant reporting, requests, complaints and feedback.
This Policy does not replace specific consent forms, parental consent forms, photography notices, volunteer agreements, safeguarding procedures or donor agreements. Where a specific notice is provided for a particular activity, it should be read together with this Policy.
4. Definitions
| Term | Meaning |
|---|---|
| Personal data | Any information relating to an identified or identifiable natural person |
| Processing | Any operation performed on personal data, including collection, storage, use, disclosure, deletion or anonymisation |
| Controller | The organisation that determines the purposes and means of processing |
| Processor | A service provider that processes data on behalf of the controller |
| Consent | A freely given, specific, informed and unambiguous indication of wishes |
| Special categories | Sensitive data such as health data, biometric data, religious beliefs or similar protected categories |
| Child | A person under 18 years of age for safeguarding and parental consent practices |
5. Data Protection Principles
• Lawfulness, fairness and transparency: we explain why and how data are processed.
• Purpose limitation: data are used only for specified, explicit and legitimate purposes.
• Data minimisation: we collect only data necessary for the relevant activity.
• Accuracy: we take reasonable steps to keep data accurate and up to date.
• Storage limitation: data are retained only for as long as necessary.
• Integrity and confidentiality: we protect data against unauthorised access, loss or misuse.
• Accountability: we maintain procedures and records to demonstrate compliance.
6. Categories of Personal Data We May Collect
| Category | Examples |
|---|---|
| Website visitors | IP address, browser, device, pages visited, cookie preferences, approximate location derived from technical data |
| Participants | Name, surname, age group, email, telephone, language, programme selected, attendance records, accessibility needs when voluntarily provided |
| Children and parents | Child’s name, age, programme, parent/guardian name and contact details, parental consent, emergency information where necessary |
| Volunteers and trainers | Contact details, experience, language skills, availability, role, agreements, training records, safeguarding acknowledgements |
| Donors | Name, contact details, donation amount, donation date, payment reference, receipt information, preferences for acknowledgement |
| Communications | Emails, messages, feedback, complaints, requests and related correspondence |
| Media | Photos, videos, audio recordings, testimonials and quotes, subject to applicable consent and notices |
| Special categories | Only where necessary and lawful, e.g. accessibility or health-related information voluntarily provided for safe participation |
7. Purposes and Legal Bases for Processing
We process personal data only where we have a valid legal basis under GDPR. Depending on the context, the legal basis may be consent, performance of an agreement, compliance with legal obligations, legitimate interests, vital interests, or explicit consent for special categories of data.
| Purpose | Description | Legal basis |
|---|---|---|
| Programme registration | To register participants, confirm attendance, manage waiting lists | Consent; legitimate interests; performance of an agreement |
| Communication | To send confirmations, reminders, updates and respond to inquiries | Consent; legitimate interests |
| Child safeguarding | To ensure safe participation and obtain parental permissions | Legal obligation; legitimate interests; consent |
| Photos and videos | To document activities, inform the community and report to donors | Consent where required; legitimate interests for non-intrusive group documentation |
| Donations | To process donations, issue acknowledgements and maintain records | Legal obligation; legitimate interests; performance of a donation arrangement |
| Reporting | To prepare aggregated or necessary reports for donors and partners | Legitimate interests; legal/contractual obligations |
| Website security | To prevent fraud, spam, abuse and cyber incidents | Legitimate interests; legal obligation |
| Newsletter | To send newsletters and updates where a person subscribes | Consent |
8. Website Visitors, Cookies and Analytics
When you visit our website, certain technical information may be processed automatically to make the website function, maintain security, remember cookie choices and understand general website performance. We do not use website analytics to identify individual visitors unless they voluntarily submit information through a form.
A separate Cookie Policy may provide a detailed cookie register, including cookie names, providers, duration and purpose. Where the website uses a cookie banner, users should be able to accept, reject or manage non-essential cookies.
9. Registration Forms and Participation
When you register for an activity, we may collect information necessary to administer the activity, communicate with you, manage participant numbers, ensure safety, support accessibility needs and keep appropriate project records.
Registration data may be used for attendance, certificates, participant support, programme evaluation and donor reporting. Aggregated statistics may be used in public reports without identifying individuals.
10. Children and Minors
Protecting children is a priority. We process children’s personal data only when necessary for educational, cultural, social or safeguarding purposes and only with appropriate parental or guardian involvement and consent where required.
Children’s photographs or videos are published only where appropriate consent and safeguarding assessment have been obtained. Parents or guardians may request access, correction, withdrawal of consent or deletion, subject to legal, safeguarding and reporting obligations.
11. Photographs, Videos, Audio and Testimonials
We may take photographs, videos or audio recordings during activities to document our work, inform the community, promote educational and cultural participation, prepare reports to donors and partners, and preserve organisational history.
We will not sell photographs or videos of participants. We will not intentionally publish images that expose a child or vulnerable person to foreseeable harm, stigma, exploitation or discrimination.
12. Donations and Payments
If you make a donation or support our activities, we may process data necessary to record the donation, issue acknowledgements, comply with accounting obligations, prevent fraud, and report on the use of funds in accordance with donor, legal and transparency requirements.
Payment processors and banks may process transaction data under their own legal obligations. We do not store full payment card details on our website unless a compliant payment provider specifically supports such processing.
13. Newsletters and Communications
Where we offer newsletters or updates, we send them only to individuals who have subscribed, requested information or where another lawful basis applies. Every marketing or newsletter email should include a practical way to unsubscribe or withdraw consent.
Operational messages related to registration, safety, schedule changes or participation are not marketing messages and may be sent where necessary to administer the activity.
14. Volunteers, Trainers, Staff and Partners
We process data relating to volunteers, trainers, staff and partners to manage cooperation, assign roles, coordinate activities, ensure safeguarding, maintain accountability and comply with legal, donor and organisational obligations.
15. Data Sharing and Third-Party Processors
We do not sell personal data. We share personal data only when necessary, lawful and proportionate. Recipients may include hosting providers, IT support, form providers, email providers, payment processors, professional advisers, auditors, competent authorities, project partners and donors where required for lawful reporting.
16. International Transfers
Our website hosting is located in the European Union. Some digital service providers, such as global cloud, email, analytics or social media providers, may process data outside the European Economic Area. Where such transfers occur, we rely on appropriate GDPR safeguards, such as adequacy decisions, Standard Contractual Clauses, contractual commitments, technical safeguards and minimisation.
17. Hosting and Technical Infrastructure
The website https://greece.eduhub.org.ua is hosted by 8host. Based on the hosting provider’s published information, the computing and storage resources for its services are located in a Tier III data centre in Amsterdam, Netherlands, within the European Union.
18. Security Measures
We use appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, alteration, disclosure or destruction. Measures are proportionate to the nature, scope, context and risk of processing.
19. Data Retention
We retain personal data only for as long as necessary for the purposes for which they were collected, including legal, accounting, audit, safeguarding, donor reporting and legitimate organisational purposes. When data are no longer needed, they are securely deleted, anonymised or archived with restricted access.
20. Your Rights under GDPR
Subject to the conditions and limitations of GDPR, you have the right to access, rectify, erase, restrict processing, object, request data portability, withdraw consent and lodge a complaint with a competent supervisory authority.
To exercise your rights, contact us through the contact details or contact form published on the website. We may need to verify your identity before responding. We aim to respond within one month, unless the request is complex or numerous, in which case the period may be extended as allowed by GDPR.
21. Complaints and Supervisory Authority
If you are concerned about how we process your personal data, please contact us first so that we can review and resolve the matter. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA), which is the competent supervisory authority in Greece.
22. Personal Data Breaches
A personal data breach means a security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. If we become aware of a breach, we will assess the risk, take containment measures and notify the competent supervisory authority and affected individuals where required by GDPR.
23. Automated Decision-Making and Profiling
We do not use personal data for automated decisions that produce legal or similarly significant effects on individuals. We do not use children’s personal data for behavioural advertising or profiling.
24. Links to Other Websites and Social Media
Our website may contain links to third-party websites, platforms or social media pages. We are not responsible for the privacy practices of those third parties. When you leave our website, you should review the privacy notice of the relevant third-party service.
25. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect legal, technical or organisational changes. The latest version will be published on the website and will indicate the date of the most recent review.
26. Contact and Practical Privacy Notices
For privacy-related requests, please use the official contact details or contact form published on https://greece.eduhub.org.ua. Please include sufficient information to identify your request, but do not send unnecessary sensitive information by email or contact form.
Detailed Cookie Categories
| Type | Purpose | Basis | Choice |
|---|---|---|---|
| Essential cookies | Required for website operation, security, language and consent choices | Legitimate interests | Cannot usually be disabled on the website |
| Functional cookies | Remember user preferences where enabled | Consent or legitimate interests | May be disabled |
| Analytics cookies | Help understand aggregate usage and improve the website | Consent where required | May be disabled |
| Third-party content | YouTube, social media embeds or maps may set cookies | Consent where required | Subject to third-party policies |
Media Use Rules
| Situation | Rule |
|---|---|
| Close-up identifiable photo or interview | Consent should be obtained before publication |
| Children | Parental/guardian consent and safeguarding review are required |
| Large public event group photo | May be based on notice and legitimate interests where appropriate, with opt-out possibilities where feasible |
| Sensitive situations | Avoid publication without explicit consent and risk assessment |
| Withdrawal | Requests for removal will be reviewed and actioned where legally and practically possible |
Data Retention Schedule
| Data | Purpose | Indicative retention |
|---|---|---|
| Website logs | Security and troubleshooting | Usually up to 12 months unless needed for security investigation |
| Cookie preferences | Remember user choices | As set in the cookie tool or until reset |
| Registration forms | Activity administration and reporting | Up to 2 years after the activity, unless donor/legal obligations require longer |
| Attendance records | Certificates, reporting, programme evaluation | Up to 5 years for project accountability |
| Child consent forms | Safeguarding and proof of consent | For the duration of the activity plus necessary safeguarding period |
| Photos/videos | Documentation, communication, reporting | Until consent is withdrawn where consent is the basis, or while legitimate publication purpose remains valid |
| Donation/accounting records | Accounting, audit and legal compliance | As required by Greek accounting/tax law and donor rules, commonly up to 10 years |
| Complaints and incidents | Resolution, safeguarding, accountability | As long as necessary for safety, legal and accountability purposes |
| Newsletter data | Sending updates | Until unsubscribe or withdrawal of consent |
| Volunteer files | Coordination, safeguarding and accountability | During cooperation plus necessary audit/safeguarding period |
Annex A. Short Website Privacy Notice
Ukrainian Educational Hub in Greece (UA EduHub Greece) processes personal data to operate this website, register participants, communicate about programmes, manage donations, document activities and comply with legal and donor obligations. We process data in accordance with GDPR. You may request access, correction, deletion, restriction, portability, objection or withdrawal of consent by contacting us through the official contact details on this website. Please read the full Privacy Policy for details.
Annex B. Consent Text for Registration Forms
I have read the Privacy Policy of Ukrainian Educational Hub in Greece (UA EduHub Greece) and consent to the processing of my personal data for registration, participation, communication and programme administration purposes. I understand that I may withdraw my consent at any time where consent is the legal basis for processing.
Annex C. Photo and Video Notice
Photography and video recording may take place during this activity for documentation, communication and reporting purposes. If you do not wish to appear in identifiable photos or videos, please inform the organisers before or during the event. For children, separate parental/guardian consent is required where applicable.
Annex D. Cookie Banner Text
We use essential cookies to make our website work and, with your consent, analytics cookies to understand how the website is used. You can accept all cookies, reject non-essential cookies or manage your preferences. Read our Privacy Policy and Cookie Policy for more information.
Annex E. Data Subject Request Form
| Field | To be completed |
|---|---|
| Full name | |
| Email or contact details | |
| Relationship to UA EduHub Greece | |
| Type of request | Access / Rectification / Erasure / Restriction / Portability / Objection / Withdrawal of consent |
| Description of request | |
| Date | |
| Signature if submitted on paper |
Annex F. Legal and Organisational References
• Regulation (EU) 2016/679 (General Data Protection Regulation).
• Greek Law 4624/2019 implementing and supplementing GDPR in Greece.
• Greek Law 3471/2006 regarding electronic communications and related privacy rules.
• Internal GDPR/data protection policy, child safeguarding policy, transparency policy, complaints policy and volunteer/staff code of conduct of UA EduHub Greece.
Document Control
| Version | Date | Description | Owner |
|---|---|---|---|
| 1.0 | 01/07/2026 | Publication-ready bilingual Privacy Policy for website use | UA EduHub Greece |
| This document should be reviewed if the website adds new analytics, payment providers, CRM systems, online learning platforms, marketing pixels or other new processing activities. |
|---|
