In short: joomlaboratory.com is a personal blog. I collect your name and email only if you use the contact form. Analytics and advertising cookies (Google Analytics, Microsoft Clarity, Google Ads) are used only if you accept them. The site is hosted in the European Union.
1. Who is responsible for your data
This policy explains how joomlaboratory.com (the “Website”) collects and uses personal data, in line with the EU General Data Protection Regulation 2016/679 (GDPR), Greek Law 4624/2019 and Greek Law 3471/2006 on electronic communications (cookies).
Data controller: Panagiotis Kiriakopoulos, private individual
Location: Athens, Greece
Email:
The Website is a personal, non-commercial blog. I have not appointed a Data Protection Officer, as the processing does not meet the thresholds of GDPR Article 37. For any privacy question, write to the email above.
2. What data I collect
I collect only the data listed below. I do not ask for or knowingly receive special categories of data (health, religion, etc.).
| Source | Data | How it is collected |
|---|---|---|
| Contact form | Name, email address, message content, date and time of submission | You provide it when you submit the form |
| Google Analytics 4 | Pseudonymous identifiers (cookie ID), pages viewed, referrer, device and browser type, approximate location (country/city, derived from the IP address), session duration and events | Cookies and scripts, only after consent |
| Microsoft Clarity | Pseudonymous identifiers, mouse movements, clicks, scrolls and page interactions (session replays and heatmaps), device and browser data. Form inputs are masked | Cookies and scripts, only after consent |
| Google Ads | Ad click identifiers (GCLID), conversion events, cookie IDs used for measurement and remarketing | Cookies and scripts, only after consent |
| Server logs and Joomla | IP address, date/time, requested URL, user agent, HTTP status; a technical session cookie | Automatically, when your browser connects to the server |
3. Why I use your data and on what legal basis
Every processing activity rests on one legal basis under GDPR Article 6(1).
| Purpose | Data | Legal basis |
|---|---|---|
| Reply to your message | Contact form data | Art. 6(1)(f) – legitimate interest in answering messages sent to me |
| Measure traffic and improve content | Google Analytics data | Art. 6(1)(a) – consent; Art. 4(5) Law 3471/2006 |
| Understand usability and fix design problems | Microsoft Clarity data | Art. 6(1)(a) – consent |
| Measure ad performance and show relevant ads (remarketing) | Google Ads data | Art. 6(1)(a) – consent |
| Deliver the Website securely, prevent abuse and spam | Server logs, session cookie | Art. 6(1)(f) – legitimate interest in security and operation |
| Comply with legal obligations, defend legal claims | Any relevant data | Art. 6(1)(c) – legal obligation; Art. 6(1)(f) – legitimate interest |
You may withdraw consent at any time, as easily as you gave it. Withdrawal does not affect processing carried out before it. Where I rely on legitimate interest, you can object (see section 8).
5. Who receives your data
I never sell your data. It is shared only with the providers below, under data processing agreements (GDPR Art. 28) or, where they act independently, under their own terms.
| Recipient | Role | Service | Location |
|---|---|---|---|
| Hostinger.com | Processor | Web hosting, server logs, email | [HOSTING COUNTRY], European Union |
| Google Ireland Ltd, Gordon House, Barrow Street, Dublin 4, Ireland | Processor (Analytics); independent or joint controller for some Ads purposes | Google Analytics 4, Google Ads | EU, with possible transfers to the USA |
| Microsoft Ireland Operations Ltd, One Microsoft Place, Leopardstown, Dublin 18, Ireland | Joint controller (Clarity) | Microsoft Clarity | EU, with possible transfers to the USA |
Data may also be disclosed to public authorities when the law requires it, or to legal advisers to defend a legal claim.
Provider policies: Google Privacy Policy · How Google uses data from sites · Microsoft Privacy Statement · Clarity terms
6. Transfers outside the EU
The Website and contact-form data are hosted in the European Union. Google and Microsoft may process analytics and advertising data in the United States.
These transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (July 2023), under which Google LLC and Microsoft Corporation are certified. As a fallback, the providers use the Commission's Standard Contractual Clauses (GDPR Art. 46). You may request a copy of the relevant safeguards by email.
7. How long data is kept
Data is kept only as long as the purpose requires, then deleted or anonymised.
| Data | Retention |
|---|---|
| Contact form messages | 24 months after the last communication, then deleted |
| Google Analytics (user and event data) | 14 months, then automatically deleted (aggregated reports are anonymous) |
| Microsoft Clarity | Session recordings up to 30 days (longer only if a specific recording is flagged); aggregated heatmaps and metrics up to 13 months |
| Google Ads | Remarketing lists up to 180 days; other data per Google's settings |
| Server logs | 30 days, unless needed to investigate a security incident |
| Consent records | As long as needed to prove consent, up to 3 years |
8. Your rights
You can exercise any of these rights free of charge by emailing
Access Art. 15
Get a copy of your data and information on how it is used.
Rectification Art. 16
Correct inaccurate or incomplete data.
Erasure Art. 17
Have your data deleted where there is no reason to keep it.
Restriction Art. 18
Limit how your data is used while a dispute is resolved.
Portability Art. 20
Receive the data you provided in a machine-readable format.
Objection Art. 21
Object to processing based on legitimate interest, and to direct marketing at any time.
Withdraw consent Art. 7(3)
Change your cookie choices at any time via Cookie settings (Check cookie link at bottom left).
Complaints
You may lodge a complaint with the Hellenic Data Protection Authority, Kifisias 1-3, 115 23 Athens, Greece, tel. +30 210 6475600, www.dpa.gr, or with the supervisory authority in your EU country of residence. I would appreciate the chance to resolve your concern first.
9. Other information
- Security
- HTTPS/TLS encryption, up-to-date Joomla core and extensions, restricted admin access with two-factor authentication, anti-spam protection on forms and regular backups. If a breach risks your rights, the Authority is notified within 72 hours and you are informed where required (GDPR Art. 33–34).
- Children
- The Website is not aimed at children. I do not knowingly collect data from anyone under 15, the age of digital consent in Greece (Law 4624/2019, Art. 21).
- Automated decisions
- No decisions with legal or similarly significant effects are made solely by automated means, including profiling (GDPR Art. 22). Ad personalisation by Google happens only with your consent.
- Changes
- This policy may be updated when the Website or the law changes. The “Last updated” date at the top shows the current version; significant changes will be announced on the Website.
- Contact
- Panagiotis Kiriakopoulos, Athens, Greece ·
This email address is being protected from spambots. You need JavaScript enabled to view it.