Skip to content
Thomascodelab
Back to site
Legal · 01 / 02

Last updated:

Privacy policy

This page explains what personal data Thomascodelab collects when you visit this website or get in touch, why, and what you can do about it. It is short because the studio collects very little.

Contents
  1. 01Who is responsible
  2. 02What is collected
  3. 03Why it is used
  4. 04Cookies and browser storage
  5. 05Statistics, hosting, outside services
  6. 06Who receives your data
  7. 07How long it is kept
  8. 08Your rights
  9. 09Changes to this policy
  10. 10Contact

In short

  • This website sets no cookies and builds no profiles of its visitors.
  • The only personal data you give is what you write yourself: in the contact form, an email or a WhatsApp message.
  • It is used to reply to you, to prepare a quote and, if you become a client, to deliver and invoice your project.
  • It is never sold and never added to a marketing list.

01Who is responsible for your data

Thomascodelab is a web design studio run by Thomas Dimitrios Tzoumakas, a sole trader based in Athens, Greece (tax number, ΑΦΜ: 155910628). He is the data controller: he decides how and why your personal data is used, and he is responsible for it under the EU General Data Protection Regulation (GDPR). In this policy, “the studio” means Thomas in that role.

For anything to do with this policy, write to thomascodelab@gmail.com.

02What is collected

When you use the contact form

The form asks for your name, your email address, the type of project, a budget range (optional), your message and, if you choose to attach one, a file such as a filled-in project brief.

Your submission is delivered to the studio’s Gmail inbox by FormSubmit (formsubmit.co), a form-delivery service that handles it on the studio’s behalf.

Please do not include sensitive information, such as health details or passwords. A web design enquiry never needs it.

When you email or message directly

If you write by email or on WhatsApp instead, the studio receives your email address or phone number, your name as it appears there, and whatever you choose to say or send.

When you become a client

The details needed to carry out your project and to issue invoices, such as your business and billing details, together with the content you supply for your website.

When you browse the site

The site does not ask who you are. Three kinds of technical data are involved, described in sections 4 and 5: aggregate visitor statistics, the hosting provider’s standard server logs, and your IP address, which reaches the services that deliver the site’s fonts and scripts.

You are never obliged to provide information. Without a way to reach you and a description of what you need, though, the studio cannot reply or prepare a quote.

03Why it is used, and on what legal basis

The GDPR requires a legal basis for every use of personal data. These are the studio’s:

Replying to your enquiry and preparing a quote
Steps taken at your request before entering into a contract GDPR Art. 6(1)(b)
Carrying out and delivering your project
Performance of a contract with you GDPR Art. 6(1)(b)
Keeping invoicing records
A legal obligation under Greek tax law GDPR Art. 6(1)(c)
Aggregate visitor statistics
The studio’s legitimate interest in knowing how the site is used and keeping it working well GDPR Art. 6(1)(f)

Your data is not used for anything else. The studio does not sell it, does not add you to marketing lists, and makes no decisions about you by automated means.

04Cookies and browser storage

This website sets no cookies, which is why you will not see a cookie banner.

It keeps two small items in your own browser so that the site behaves sensibly:

  • Your language choice (English or Greek), kept in the browser’s localStorage so the site opens in the same language next time.
  • A marker that you have already seen the site’s intro, kept in sessionStorage so it does not replay on every page. It is removed when you close the tab.

Neither item is sent to the studio or to anyone else, and neither is used to track you. You can remove them at any time by clearing this site’s data in your browser settings.

05Statistics, hosting and outside services

Visitor statistics

Visits are counted with Cloudflare Web Analytics. It uses no cookies, does not follow you across other websites and does not build personal profiles. The studio sees totals only, such as how many people visited a page.

Hosting

The site is hosted on Cloudflare Pages. Like any web host, Cloudflare keeps standard server logs, which include the IP addresses that requests come from.

Fonts and scripts

Fonts are loaded from Google Fonts, and scripts from the cdnjs and jsDelivr content delivery networks. To send those files to your browser, these services receive your IP address, as any such network does.

06Who receives your data

The studio shares personal data only with the services it needs in order to operate:

  • FormSubmit delivers contact form submissions to the studio’s inbox, acting as a processor on the studio’s behalf.
  • Google provides the Gmail inbox where enquiries and correspondence arrive, and Google Fonts.
  • Cloudflare hosts the site and provides the visitor statistics.
  • cdnjs and jsDelivr deliver the site’s scripts.
  • WhatsApp, only if you choose to message the studio there. WhatsApp handles those messages under its own privacy policy.

Some of these providers are based outside the European Economic Area or run servers there, mainly in the United States. Where data is transferred, it is covered by the safeguards those providers apply under EU data protection law, such as the EU–US Data Privacy Framework or standard contractual clauses.

07How long it is kept

  • Enquiries that do not become projects are deleted within 24 months.
  • Client and invoicing records are kept for as long as Greek tax law requires.
  • The items in your browser stay there, not with the studio: the language choice until you clear it, the intro marker until you close the tab.

08Your rights

Under the GDPR you have the right to:

  • Access. Ask for a copy of the personal data held about you.
  • Rectification. Have it corrected if it is inaccurate or incomplete.
  • Erasure. Have it deleted when there is no longer a reason to keep it.
  • Restriction. Ask for its use to be paused in certain cases.
  • Portability. Receive the data you provided in a commonly used format.
  • Objection. Object to processing that is based on legitimate interest.
  • Withdrawal of consent. Where processing relies on your consent, withdraw it at any time, without affecting what was done before.

To use any of these rights, email thomascodelab@gmail.com. It costs nothing, and the studio will reply within one month, as the GDPR requires.

If you believe your data has been handled wrongly, you can complain to the Hellenic Data Protection Authority at www.dpa.gr. The studio would appreciate the chance to put things right first, but you are not required to ask.

09Changes to this policy

If the way the studio handles data changes, this page will be updated and the date at the top will change. The current version is always the one on this page.

10Contact

Questions about this policy or about your data go to Thomas directly.

Data controller

Thomas Dimitrios Tzoumakas Thomascodelab · Sole trader · Athens, Greece · Tax no. (ΑΦΜ) 155910628