How we handle your data.

Who we are

eleonwood.com is run by ELEONWOOD P.C. (“we”, “us”), a hospitality technology studio in Santorini, Greece, that makes websites, software and marketing for hotels, restaurants and spas.

We are the controller of the personal data described in this policy: we decide why and how it is used. For any question about it, or to exercise your rights, write to [email protected].

Legal name

ELEONWOOD P.C.

Registered address

Pyrgos Kallistis, 847 01 Thira, Greece

GEMI no.

196760138000

VAT no.

803430646

EUID

ELGEMI.196760138000

Chamber reg. no.

66005

What we collect

We collect only what you give us and what the site needs in order to work:

• Enquiries: your name and email address (required) and, if you choose to add them, your property or business name, phone number, what you are interested in (a package or a service), your timing and your message. We also record which page led you to the form: a package, a service or a case study. When you ask for a free website audit, we also keep your website’s address, which we visit to prepare the report.
• Anti-spam checks: your IP address is held for a few minutes, in server memory only, to limit how often the form can be sent. It is not stored with your enquiry. The form also uses a hidden field and a minimum-time check to filter out automated submissions.
• Technical request data: every request to the site carries your IP address, the time and the page requested. Our hosting provider and Cloudflare may keep this in technical logs, for security and operation, for limited periods that they set.
• Client details: if you become a client, the contact and invoicing details needed to carry out our agreement and invoice for it, and our correspondence about the work.

Why we use it, and on what legal basis

We use personal data only for the purposes below, each with its legal basis under Article 6(1) GDPR:

• To answer your enquiry and, if you want to go further, to prepare a proposal: steps taken at your request before entering into a contract (Article 6(1)(b)). Where you write on behalf of a business, also our legitimate interest in replying to and following up business enquiries (Article 6(1)(f)). This includes one automatic email, sent to the address you gave as soon as your enquiry or audit request reaches us, confirming that it arrived and saying what happens next. It contains no marketing, and your address is not added to any mailing list.
• To keep the site and the contact form secure and working, through rate limiting, spam filtering and technical logs: our legitimate interest in keeping the site secure (Article 6(1)(f)).
• To carry out work for our clients: the performance of our contract (Article 6(1)(b)) and our legal obligations, such as tax and accounting records (Article 6(1)(c)).
• To measure how the site is used, only if we enable analytics and you agree to it: your consent (Article 6(1)(a)). The cookies section below says whether analytics is in use.
• To measure which of our ads lead to visits and enquiries, and to show our ads to people who have visited the site, only if we run advertising tags and you agree to it: your consent (Article 6(1)(a)). The cookies section below says whether such tags are in use.

We never sell personal data. We send no newsletters or advertising you have not asked for, and we make no decisions about you by automated means, including profiling.

Who helps us process it

We share personal data only with the service providers below, which process it on our behalf as processors:

• Cloudflare, Inc. (United States, global network): DNS, content delivery (CDN) and security for eleonwood.com. Every request to the site passes through Cloudflare, so it processes IP addresses and request data.
• Railway Corporation (United States; its infrastructure may be outside the European Economic Area): hosting. Each enquiry is written to the server logs of our hosting service.
• Resend, Inc. (United States): email delivery. Enquiries may be forwarded to our inbox through this service, and the automatic confirmation of your enquiry is sent to you through it.
• Mux, Inc. (United States): video streaming. It delivers the films and videos on this site, so it processes the IP address of a visitor whose browser loads one.
• Cloudflare Turnstile (a service of Cloudflare, Inc.): checks that the contact form is being sent by a person and not by an automated program. It loads when you start filling in the form, or when the chat assistant shows you an enquiry to send, and for this check Cloudflare processes your IP address and technical information about your browser and device. It may ask you to confirm that you are a person.
• Supabase, Inc. (United States; our database is hosted in Frankfurt, Germany, within the European Union): database hosting. Each enquiry is stored in our database, and so are the records of our Clients Portal, described below.

We may also disclose personal data where the law requires us to, for example to a competent authority.

The Clients Portal

If you become a client, we open a private area for you, the Clients Portal, at eleonwood.com/portal. You enter it the first time through a one-time link in our invitation, and afterwards with a six-digit code that we send to your email address each time you sign in.

It holds what our work together needs:

• your contact details: your name, the name of your business, your email address and the package you chose;
• your answers to our questionnaire, your invoicing details among them, and the files and links you add: your logo, photos, videos, texts and any other material;
• our agreement and, once you sign it, the record of your signature: the business name and the full name you type, the time, the IP address of your connection, the identification your browser sends (its user agent) and a fingerprint (SHA-256) of the text you signed;
• the payments we ask you for and what became of each: its amount, when and how it was paid and, for a card payment, the order and transaction numbers Viva gives it;
• the invoices we issue to you;
• the design proposals we post for you, your approval with its time and the lists of changes you send;
• your support requests with the files you attach, our answers, and the support hours added and used;
• the notes you write for your website in the portal, until you change or delete them;
• the address where we let you see your website while we build it;
• when you last opened each page of the portal, so that it can show you what is new since then;
• the messages you and we write to each other in the portal, the photos and files sent with them, and when each was read.

These records are kept in our database, described above. The files you add, the files of our proposals and our invoices are kept in private storage at Cloudflare: none of them has a public address, and a file is downloaded only by you while you are signed in, or by us, through an address that works for five minutes.

The emails the portal sends you (the invitation, your sign-in codes and a note when an agreement, a payment, an invoice, a design proposal, a message from us or the preview link of your website is ready for you) are delivered through Resend.

If you pay by card, you pay on the page of Viva (Viva Payment Services, Greece). We send Viva your name, your email address, the amount and what the payment is for, and Viva processes your card under its own privacy policy. We never see or store your card details: Viva tells us only that the payment was completed, with its amount and its order and transaction numbers.

We use all of this to carry out our agreement with you (Article 6(1)(b) GDPR) and to meet our tax and accounting obligations (Article 6(1)(c)). The record of a signature is kept on the basis of our legitimate interest in being able to show what was agreed, and by whom (Article 6(1)(f)).

We keep these records for as long as we work together, and delete them when you ask. If you have signed an agreement, made a payment or been issued an invoice, we cannot delete them at once: we close your Clients Portal, so that nobody can sign in to it, and keep its records for as long as Greek tax and accounting law requires and for as long as a claim could arise from the agreement.

The chat assistant

The button in the lower right corner of each page opens a chat assistant that answers questions about Eleonwood from the pages of this site. Its replies are written by Claude, an AI model of Anthropic, PBC (United States), which we use through its API as our processor: each time you send a message, the conversation so far and the page you have it open on are sent to Anthropic to write the reply. Anthropic processes them under its commercial terms and keeps them for limited periods that it sets.

We do not keep the conversation. It stays in the open page only, and closing or reloading the page ends it. Our server logs record only that a reply was made (its language, how many messages the conversation had, how long it took), never what was written. Your IP address is held for about ten minutes after your last message, in server memory only, to limit how often the chat can be used. To answer common first questions faster, the server may keep in its memory, for up to 24 hours, the reply the assistant gave to the first question of a conversation, with a fingerprint of that question (never its words), and give the same reply when the same question is asked again. A first message with an email address or a phone number in it is never kept this way.

The assistant cannot send us anything itself. If you want to get in touch, it can prepare an enquiry from what you tell it (your name, email address and, if you give them, phone number and business name, with a summary of what you need) and show it to you. Nothing is sent unless you press its Send button: the enquiry then goes through the contact form, with the same checks, and is handled exactly as an enquiry from the contact form, as described above.

Please do not write sensitive personal data in the chat. Replies are generated automatically and may contain mistakes: anything about prices, timing or a commitment is binding only once we confirm it in writing. The legal basis is our legitimate interest in answering questions about our services (Article 6(1)(f) GDPR) and, for an enquiry you send, steps taken at your request before entering into a contract (Article 6(1)(b)).

Cookies, analytics and advertising

Nothing is set in your browser for analytics or advertising until you choose. On your first visit a banner asks. Your answer is kept in a cookie of this site named cc_cookie, for twelve months from the day you give or change it; after that the banner asks again. The cookie holds what you chose, when, the language of the banner and a random identifier of that choice, and the site reads it only in your browser, to apply your choice. You can change it at any time from Cookie settings at the foot of every page.

The site uses Google’s Consent Mode (version 2) in its basic form: until you agree, no Google tag loads at all. If you allow analytics, the site loads Google Tag Manager and Google Analytics 4, which set two cookies:

• _ga, to tell one visitor from another, lasting up to two years;
• _ga_<ID>, to keep a visit together, lasting up to two years.

They show us which pages are read, how people arrive and roughly where from (country and city, never your precise location). Google Analytics 4 does not log or store IP addresses.

Google Ireland Limited processes this data on our behalf, and it may be transferred to Google LLC in the United States under the EU–US Data Privacy Framework. The legal basis is your consent (Article 6(1)(a) GDPR). You can withdraw it at any time from Cookie settings, without affecting the processing carried out before; withdrawing also deletes this site’s analytics cookies.

The Marketing category stays off unless you switch it on. If you allow it, the site loads, through Google Tag Manager, the advertising tags of three companies: the Meta Pixel of Meta Platforms Ireland Limited, the TikTok Pixel of TikTok Technology Limited (Ireland) and Google Ads conversion tracking of Google Ireland Limited. Nothing of theirs loads before you choose, or at all unless you switch Marketing on.

These tags receive the pages you visit and actions such as sending an enquiry, with the identifiers they keep in cookies in your browser, and the technical data every request to the site carries, such as your IP address and your browser’s details. They use it to measure which of our ads lead to visits and enquiries, and to show our ads to people who have visited this site. They set these cookies:

• _fbp, Meta’s, to recognise your browser when you come back, lasting 90 days;
• _ttp, TikTok’s, to recognise your browser when you come back, lasting 13 months from its last use;
• _gcl_au, Google Ads’, to link a visit to the ad that led to it, lasting 90 days.

These companies are not our processors. For collecting the data on this site and passing it to them, we and Meta, and we and TikTok, are joint controllers under their terms for advertisers; Google receives the data as a controller under its own terms. What each of them does with it afterwards is its own responsibility, under its own privacy policy:

• Meta: https://www.facebook.com/privacy/policy/
• TikTok: https://www.tiktok.com/legal/page/eea/privacy-policy/en
• Google: https://policies.google.com/privacy

Meta and Google may transfer the data to the United States under the EU–US Data Privacy Framework. TikTok may transfer it outside the European Economic Area, relying on the safeguards it describes in its privacy policy, such as the European Commission’s Standard Contractual Clauses.

The legal basis is your consent (Article 6(1)(a) GDPR and, for the cookies, Article 4(5) of Greek Law 3471/2006). You can withdraw it at any time from Cookie settings at the foot of every page, without affecting the processing carried out before. From then on none of these tags loads; the cookies they have already set stay in your browser until they expire or you delete them.

The site sets its other cookies only when someone signs in, to the Clients Portal or to the studio’s own admin:

• __Host-ew-portal keeps a client signed in to the Clients Portal, for 90 days or until they sign out;
• __Host-ew-portal-code ties a sign-in code for the Clients Portal to the browser that asked for it, for up to 10 minutes;
• __Host-ew-admin keeps a member of the studio signed in to the admin, for 30 days or until they sign out;
• __Host-ew-admin-link ties an emailed sign-in link for the admin to the browser that asked for it, for up to 15 minutes;
• __prerender_bypass shows a signed-in member of the studio their unpublished changes, until they leave the preview or close the browser.

Cloudflare may also set strictly necessary security cookies to tell people apart from automated traffic and protect the site.

The cookie that keeps your answer, the sign-in cookies and Cloudflare’s are strictly necessary and need no consent under Article 4(5) of Greek Law 3471/2006. The language you choose is kept in the page address, not in a cookie or in your browser’s storage.

Content from other services

Fonts and images on this site are served from our own domain. We do not load Google Fonts, embed YouTube or Vimeo players or use social media widgets, so reading a page sends nothing to those services.

The films of our work (on the home page and in the case studies) and the videos in blog posts are streamed by Mux, Inc. (United States), a video delivery service. Nothing is asked of Mux before a video is about to play: a film of our work loads when it comes into view or when you point at its project, and a blog video when you press play. Mux then receives your IP address, your browser’s details and the video asked for, which it needs to deliver it. We switch off Mux’s viewing statistics and its cookie, so it sets no cookie and gathers no statistics about your viewing for us.

The share links at the end of each case study (LinkedIn, Facebook, WhatsApp, Viber and email) are plain links. Nothing is sent to those networks unless you click one; from then on, that network’s own privacy policy applies. The same is true of any link to another website.

Transfers outside the European Economic Area

Some of our providers are based in the United States or may process data outside the European Economic Area (EEA). Where they do, the transfer relies on an adequacy decision of the European Commission, including the EU–US Data Privacy Framework for providers certified under it, or on the Standard Contractual Clauses approved by the Commission.

You can ask us for more information about these safeguards at [email protected].

How long we keep it

• Enquiries that do not lead to work: deleted 12 months after our last contact, or sooner if you ask.
• Client data: kept for the duration of the engagement and afterwards for as long as Greek tax and accounting law requires us to keep invoicing records.
• IP addresses used to rate-limit the form: a few minutes, in server memory only.
• Technical request logs: kept by our hosting provider and Cloudflare for limited periods that they set.

How we protect it

The whole site is served over HTTPS, so what you send is encrypted on its way to us. Access to enquiries is limited to the people who handle them.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate data corrected (rectification);
• have your data erased;
• restrict how we use it;
• receive the data you gave us in a structured, machine-readable format and have it passed to another controller (portability);
• object to processing based on our legitimate interest;
• withdraw your consent at any time, where processing is based on consent, without affecting the processing carried out before.

To exercise any of these rights, write to [email protected]. We reply within one month. Where a request is complex, or we receive many, that period can be extended by two further months, as Article 12 GDPR allows; if so, we will tell you why within the first month. We may need to confirm your identity before acting on a request.

Complaints

If you believe we have mishandled your data, you can lodge a complaint with the Hellenic Data Protection Authority, Kifisias 1-3, 115 23 Athens, www.dpa.gr, or with the supervisory authority of the EU country where you live or work. We would welcome the chance to put things right first, at [email protected].

Children

Our services are aimed at businesses, and this site is not directed at children. We do not knowingly collect personal data from anyone under 15, the age of digital consent in Greece. If you believe a child has sent us their details, write to [email protected] and we will delete them.

Changes to this policy

We may update this policy when our services, our providers or the law change. The date at the top shows the current version, and any material change is noted on this page.