Privacy policy

Who we are

ncmp architects is the controller of the personal data described in this policy. You can reach us at:

• 22 Vizantiou st.
• 171 21 N. Smyrni, Athens, Greece
• Email: ncmp.architects@gmail.com
• Telephone: +30 210 933 6879

What this policy covers

This policy covers ncmparchitects.gr, the public website. It explains what personal data the site processes, why, on what legal basis, who else sees it, and what you can ask us to do about it.

It does not cover the separate professional relationship between the studio and its clients, which is governed by the terms of the engagement in question.

We process personal data under the General Data Protection Regulation (Regulation (EU) 2016/679) and Greek Law 4624/2019.

When you visit the site

The site has no accounts, no sign-up, and no tracking. Simply reading it does not require you to give us anything.

Like any web server, ours records technical information about each request in order to serve the page and to keep the service secure and available:

• your IP address
• the page you requested and the page you came from, if any
• your browser and operating system (the user-agent string)
• the date and time of the request

Why, and for how long

The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in operating a working, secure website: serving the right content, diagnosing faults, and defending against abuse such as automated scraping or denial-of-service traffic.

These technical logs are kept for a short operational period and are not used to build a profile of you, are not combined with anything else, and are not sold or shared for marketing.

Error monitoring

We may run server-side error monitoring so that faults are reported to us rather than left for visitors to discover. It is a server-only tool: no monitoring code runs in your browser, there is no performance tracing and no session recording or replay.

When the server hits an error, the report can include the address of the page involved and technical request details, which may include your IP address. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in keeping the site working.

Cookies

This site sets no analytics, advertising, or profiling cookies. There is no Google Analytics, no tag manager, no advertising pixel, no social media embed, and no third-party font or script loaded on any public page. The typefaces and images are served from our own server.

Because the only cookies in use are strictly necessary or functional ones, no consent banner is required and none is shown. The cookies that may be set are:

• A language cookie (NEXT_LOCALE), set on every visit to record which language version you are being shown: the one you pick when you switch languages, and otherwise the one inferred from your browser’s settings. Functional; set by our own software, and it holds no identifier for you.
• Security and bot-protection cookies, where a content delivery network sits in front of the site, set by it to tell real visitors apart from automated traffic. Strictly necessary.
• A session cookie (payload-token) for the studio’s own editors when they sign in to the content management system at /admin. It is never set for ordinary visitors.

When you contact us

The contact page carries an email address and a telephone number. There is no form on this website. Nothing you type is captured by the site itself, and the site keeps no database of enquiries.

When you write or call, we receive whatever you choose to tell us: typically your name, your email address or phone number, and the content of your message. We use it for one purpose: to read your enquiry and reply to it.

The legal basis is your request to take steps prior to entering into a contract (Art. 6(1)(b) GDPR) where the enquiry concerns possible work, and otherwise our legitimate interest (Art. 6(1)(f) GDPR) in answering people who get in touch.

Correspondence is kept in the studio mailbox for as long as the enquiry is live and, where it does not become a project, for up to 24 months afterwards, so that we can pick up a conversation that resumes. Project correspondence is retained for the life of the engagement and for as long as professional and tax obligations require.

Who else is involved

We do not sell personal data and we do not share it for anyone else’s marketing. A small number of service providers process data on our behalf, under contract and on our instructions:

• Our hosting provider, which runs the server the site is served from.
• Our content delivery and security provider, where one is used, which sits in front of the site to deliver it quickly and filter malicious traffic, and which processes visitors’ IP addresses and request metadata for that purpose.
• Our error-monitoring provider, where enabled, which receives server error reports. It receives nothing from your browser.
• Our email provider, which carries and stores the correspondence you send to the studio mailbox.

Transfers outside the EEA

Some of these providers are established outside the European Economic Area or operate global infrastructure. Where personal data is transferred outside the EEA, the transfer is covered by an adequacy decision of the European Commission or by Standard Contractual Clauses together with the additional safeguards those clauses require.

You may ask us for details of the safeguards applied to a particular transfer using the contact details above.

What we do not do

For the avoidance of doubt, this website does not:

• run analytics or any other audience measurement
• build profiles or take automated decisions about you, including profiling as defined in Art. 22 GDPR
• operate a newsletter or any marketing list
• host advertising or share data with advertising networks
• knowingly collect data from children

Your rights

Under the GDPR you have the right to ask us for access to the personal data we hold about you, to have it corrected or erased, to have its processing restricted, to receive it in a portable form, and to object to processing that rests on our legitimate interest.

To exercise any of these rights, write to ncmp.architects@gmail.com. We will respond within one month, and will tell you if we need longer because the request is complex. We may need to ask you for enough information to be sure who you are before we act.

We have not appointed a Data Protection Officer, as the studio is not required to have one. Requests go to the address above.

Complaints

If you believe we have handled your personal data improperly, we would like the chance to put it right, so please tell us first. You also have the right to lodge a complaint with the Greek supervisory authority:

Hellenic Data Protection Authority, 1-3 Kifissias Ave., 115 23 Athens, Greece. www.dpa.gr

Changes to this policy

If the site changes in a way that affects personal data, a contact form for instance, this policy will be updated before that change goes live.