Privacy policy

Data controller

The controller of the personal data described on this page is NORIA GROUP Ε.Ε. (“Noria”, “we”), a limited partnership under Greek law.

• Registered office: 71 Grammou Street, 151 24 Marousi, Greece
• VAT number: EL802974340
• General Commercial Registry (GEMI) number: 186546103000
• Email: info@noria.gr
• Phone: +30 21 0014 0120

What this page covers

It covers people who read noria.gr, people who write to us or call us, and the people at our clients and partners we deal with in our work.

Two cases have their own page: data we process on behalf of our clients is described under Client data, and business contact that we start ourselves under If we contacted you.

When you read the website

The website asks you for nothing in order to read it. It has no social media buttons or embedded third-party content, and it loads fonts, images and video only from its own server, not from other services.

Audience measurement and advertising tools run only if you say yes to their category. The provider of each tool then receives from your device details such as your IP address, the pages you view, the type of device and an identifier in a cookie. If you say yes to measurement, we also record three actions that show us whether the website brings contacts: sending the form, clicking a phone link and clicking an email link. Only the action is recorded, with the link's address or, for the form, the services you chose; never what you wrote. Which tools are switched on is shown at all times on the Cookies page. Without your consent, nothing is stored on your device except your answer itself.

Like every website, the server that hosts it records technical details of each request: the IP address, the date and time, the page requested and the type of browser. We use them only to run the website and protect it from abuse, not to identify you or build a profile.

When you write to us

If you write to us through the form on the Contact page, we receive what you fill in: your name, email and message and, if you give them, your phone, your business, the services that interest you and when you would like to start. With it come the language of the page, the time it was sent and, if you came from an industry page or a specialist topic page, which one.

If you write to us directly at info@noria.gr, we receive your address, your name and whatever you write. In both cases we use your details only to reply to you. Please do not send us sensitive information such as health details; we do not need it to reply.

How the form reaches us

When you press “Send”, the page sends the message to the website's server, in Frankfurt. The server checks it and, without storing it, forwards it to an automation service based in the European Union, which sends it as an email to info@noria.gr, with your address as the reply-to address, and keeps it with your contact details as a record in our CRM, for the periods set out under How long.

To keep the form free of spam, it has a hidden field and a minimum time to fill it in; anything that looks automated is discarded and not forwarded. We do not use reCAPTCHA or any other third-party service. The server uses your IP address only in its memory, to accept at most 5 messages per 10 minutes from the same connection; apart from the technical log kept for every request, it neither stores nor forwards it.

If sending fails, the page offers to open the same text in your own email app or to copy it. It then reaches us only if you send it yourself, from your own email.

When you call us

We see the number you call from, unless you have withheld it, and we keep notes of the conversation as far as we need them to answer you or prepare a proposal.

If we work together

For a collaboration we keep the details of the people at your business we work with (name, role, work email and phone), our correspondence and meeting notes, and the invoicing details the law requires.

Purposes and legal bases

We use each piece of information for a specific purpose, on one of the legal bases of the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), as applied in Greece by Law 4624/2019:

• To reply to you, through the form or by email, and send you a proposal: because you asked us to, as a step before a possible contract (Article 6(1)(b) GDPR). For general questions, our legitimate interest in answering whoever writes to us (Article 6(1)(f)).
• To carry out a collaboration: the contract (Article 6(1)(b)) and, for the people at our clients, our legitimate interest in working with those the client appoints (Article 6(1)(f)).
• For invoicing and our tax and accounting obligations: legal obligation (Article 6(1)(c)).
• To run the website and keep it secure, and to protect the form from automated and bulk messages (a hidden field, a minimum time to fill it in, a limit per connection): our legitimate interest in it working properly and being protected from abuse (Article 6(1)(f)).
• For audience measurement and advertising: only your consent (Article 6(1)(a) GDPR and Article 4(5) of Greek Law 3471/2006), which you can withdraw at any time from “Cookie settings” at the bottom of every page.
• To establish or defend legal claims, should it ever be necessary: our legitimate interest (Article 6(1)(f)).
• To tell you about our services by email: only if you are already a client and for similar services, or if you asked us to (Article 11 of Greek Law 3471/2006). Every such message gives you a way to stop it.

No automated decisions

We do not take decisions about you by purely automated means. We do not build profiles, with one exception that is yours to decide: if you say yes to advertising cookies, the advertising providers may show you our ads because you visited the website. A person reads and answers every message.

If you do not give us your details

You need to give us nothing to read the website. In the form we need your name, email and message to reply; the other fields are optional. To work together we need the details the law requires for the contract and invoicing.

Who sees your details

Only the people on our team who need your details for the work see them. We do not sell or rent them. Others receive browsing details for their own advertising only if you say yes to advertising cookies. Anyone who processes your details on our behalf is bound by contract to use them only on our instructions. The only recipients are:

• The provider of our email and working documents. Messages from the form arrive there too.
• The provider that hosts the website, for the technical details of requests and for form messages, which pass through its server without being stored.
• The automation service, based in the European Union, that delivers form messages to our email and keeps them in our CRM.
• Our telephone provider, for call details.
• Our accountant and the tax authorities, for invoicing details.
• If you say yes to measurement or advertising tools, their providers, as listed on the Cookies page. The advertising providers also use the details for their own purposes, under their own responsibility and their own policies.
• Legal advisers, courts or public authorities, only when the law requires it or to defend legal claims.

Transfers outside the European Union

Some of our providers, such as our email provider and our hosting provider, may process data outside the European Economic Area, for example in the United States. This happens only with the safeguards of the GDPR: the adequacy decision on the EU–US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) or the European Commission's standard contractual clauses.

Server functions, such as the form, run in Frankfurt; pages and files, however, are delivered to you from the nearest node of a global network, which may be outside the EEA. If you would like to know which provider processes what and under which safeguard, or to receive a copy of the safeguards, write to info@noria.gr.

For measurement and advertising tools, the country and the safeguard for each one are shown on the Cookies page. Any provider we add will be listed here or on that page, and transfers outside the EEA happen only with such safeguards.

Security

We protect your details with measures that match the risk: encrypted connections, personal accounts and access only for those who need it. If an incident puts your data at risk, we inform the Hellenic Data Protection Authority and, where necessary, you, as the GDPR requires.

How long we keep your details

We keep each piece of information only as long as its purpose requires and then delete it. If a dispute or an inquiry by an authority is pending, we keep what relates to it until it is closed.

• Messages, from the form or by email, the record of the contact in our CRM, and notes from contact that did not lead to a collaboration: 12 months from the last contact.
• Correspondence, documents and the CRM record of a collaboration: for its duration and five years after it ends.
• Invoices and accounting records: as long as tax and accounting law requires.
• Technical server logs: up to 1 day.
• Your answer about cookies: 6 months, on your device only. The tools' cookies: as long as the Cookies page says.
• A request not to receive our messages: we keep only the address and the request, for as long as we need to honour it.

Your rights

You have the right:

• To know whether we process your data and to receive a copy (Article 15 GDPR).
• To ask us to correct anything that is wrong or incomplete (Article 16).
• To ask us to erase your data when there is no reason to keep it (Article 17).
• To ask us to restrict processing, for example while we consider an objection (Article 18).
• To receive the data you gave us in a machine-readable format, where processing is based on a contract or consent (Article 20).
• To object to processing based on our legitimate interest; for direct marketing we always stop, without further explanation (Article 21).
• To withdraw any consent at any time, without affecting what happened before (Article 7(3)).

How to exercise them

Write to us at info@noria.gr. We reply free of charge within one month at the latest; if a request is complex, this can be extended by two further months and we will tell you. We may ask for something that confirms your identity, so that we do not give your data to someone else.

We have not appointed a Data Protection Officer (DPO). A person on our team handles your requests directly.

Complaint to the Authority

If you believe we have not respected your rights, you can lodge a complaint with the Hellenic Data Protection Authority: 1-3 Kifisias Avenue, 115 23 Athens, tel. +30 210 6475600, www.dpa.gr. If you wish, write to us first; it is often resolved faster.

Children

The website and our services are meant for businesses and professionals, not for children. If we learn that a minor has sent us personal details, we delete them.

Changes to this page

When the way we process data changes, for example if we add a new provider or a new kind of tool, we update this page before the change and change the date at the top. Which measurement and advertising tools are switched on is shown at all times on the Cookies page. If you would like an earlier version, ask us.