Privacy Policy

1. Data Controller

The controller of your personal data is Effrosyni Anagnostopoulou, Psychologist, based in Pallini, Greece, at 30 Fidippidou Street, email info@eanagnostopoulou.gr. As a sole practitioner, she is not required to appoint a Data Protection Officer (DPO); however, for any matter relating to your data you may contact her directly at the email above.

2. What Data We Collect

• Contact Form & Appointment Booking: full name, email, phone number, and any content you choose to share in your message (which may include information about your mental health — see Section 3).
• Minors' Data: when a booking concerns a minor, we collect the parent's/guardian's contact details and basic information about the minor (name, age) necessary to provide the service.
• Remote Sessions: during online sessions, technical connection data (e.g. the email/account used with the videoconferencing platform) may be processed by a third-party video-call provider. We do not record or video-tape sessions ourselves unless expressly agreed otherwise.
• Digital Product Purchases (Gumroad): payment processing for the audio guides is handled via the Gumroad platform. We never store your card details; we only receive order information (email, product, amount) to the extent required for accounting/tax purposes.
• Browsing Data (Cookies/Analytics): see Section 6.

3. Special Categories of Data (Health Data)

Given the nature of our services, we may process "special categories of data" within the meaning of Article 9 GDPR, such as information about your physical or mental health that you voluntarily share with us (e.g. in the contact form or during sessions). Processing of this data is based on your explicit consent (Article 9(2)(a) GDPR) and/or on the provision of mental health care by a professional bound by a duty of confidentiality (Article 9(2)(h) GDPR). This data is subject to enhanced security and confidentiality measures, consistent with the Code of Ethics for Psychologists.

4. Minors' Data

Where our services are provided to a minor, processing of their data is based on the consent of the person(s) exercising parental responsibility, together with the minor's own consent/involvement to the extent appropriate to their age and maturity. The parent/guardian may exercise the rights described in Section 11 on the minor's behalf, subject to any confidentiality rights the minor may have vis-à-vis the parent arising from the professional confidentiality of the therapeutic relationship.

5. Purposes & Legal Bases of Processing

We process your data for the following purposes and legal bases:

• Provision of psychological support services / performance of a contract (Article 6(1)(b) GDPR, together with Article 9(2)(h) for health data).
• Responding to inquiries via the contact form (consent — Article 6(1)(a), and/or legitimate interest — Article 6(1)(f)).
• Processing digital product purchases (performance of a contract — Article 6(1)(b)).
• Keeping accounting/tax records (legal obligation — Article 6(1)(c), under the Greek Tax Procedure Code).
• Statistical analysis of website traffic (Google Analytics) (consent via the cookie banner — Article 6(1)(a)).

6. Cookies & Google Analytics

We use cookies together with a consent tool (cookie banner) shown on your first visit, through which you can accept, reject, or customize your preferences by cookie category (strictly necessary / statistics-analytics). Strictly necessary cookies are placed without requiring consent, as they are essential for the website to function.

We use Google Analytics to understand how visitors use our site and to improve their experience, only where you have given the relevant consent via the cookie banner. This data (e.g. anonymized IP address, browser type, pages visited, visit duration) is not intended to identify you personally. You can withdraw your consent at any time via the cookie banner/cookie settings on the website.

7. Data Recipients & Third-Party Processors

Your data may be shared with the following recipients, to the extent required for each purpose:

• Website hosting / infrastructure provider.
• Google Ireland Limited / Google LLC (Google Analytics) — this may involve transfer of data outside the EEA (USA), under the safeguards of the EU-US Data Privacy Framework and/or Standard Contractual Clauses.
• Gumroad, Inc. (payment processing for digital products) — a US-based company, with equivalent transfer safeguards.
• Videoconferencing platform provider used for remote sessions (e.g. Google Meet / Zoom / doxy.me).
• Email/communications service provider.
• Public authorities, where required by law (e.g. tax or judicial authorities).

We do not sell or rent your data to third parties for advertising purposes.

8. International Data Transfers

Some of the above providers (Google, Gumroad) are based in, or process data in, countries outside the European Economic Area. In such cases, transfers take place on the basis of appropriate safeguards (e.g. the EU-US Data Privacy Framework adequacy decision, the European Commission's Standard Contractual Clauses), in accordance with Articles 44 et seq. GDPR.

9. Data Retention Periods

• Contact-form messages that did not result in a professional relationship: up to 12 months.
• Client records/clinical session notes: for as long as required by the Code of Ethics for Psychologists and sound clinical practice, at minimum 5 years from the last session, unless a longer period is required by law.
• Purchase receipts/accounting records: in accordance with the retention period set by the Greek Tax Procedure Code (generally 5 years, subject to extension).
• Google Analytics data: in accordance with the retention settings of our Google Analytics account.

After the above periods expire, data is securely deleted or anonymized.

10. Data Security

We implement appropriate technical and organizational measures (such as HTTPS encryption, restricted access to client files, and the use of reputable service providers) to protect your data against unauthorized access, loss, or disclosure, while observing the professional confidentiality obligations of the psychology profession.

11. Your Rights (GDPR)

You have the right, at any time, to ask the data controller for:

• Access to the data we hold about you.
• Rectification of inaccurate or incomplete information.
• Erasure of your data ("right to be forgotten"), subject to any legal record-keeping obligations.
• Restriction of processing under certain conditions.
• Portability of the data you have provided, in a structured, commonly used format.
• Objection to processing, where it is based on legitimate interest.
• Withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

We do not carry out automated decision-making or profiling that produces legal effects concerning you.

To exercise your rights, email info@eanagnostopoulou.gr. We will respond within one (1) month of receiving your request, in accordance with Article 12 GDPR.

12. Right to Lodge a Complaint

If you believe that the processing of your data violates the GDPR, you have the right to lodge a complaint with the Hellenic Data Protection Authority (Leof. Kifisias 1-3, 115 23 Athens, Greece, tel. +30 210 6475600, www.dpa.gr), or with the supervisory authority of your habitual residence within the EU.

13. Changes to This Policy

We reserve the right to update this Privacy Policy, in particular to reflect changes in legislation or in the services/tools we use. The version in force is always published on the website with an indication of the last update date.

14. Contact

For any question regarding this Policy or your data, you can email info@eanagnostopoulou.gr.