Privacy Policy

1. Who is responsible

This website is run by Michael Economou (registered name ΟΙΚΟΝΟΜΟΥ ΜΙΧΑΗΛ, OIKONOMOU MICHAIL), a sole proprietorship trading as "oncut", Nikolaou Gennimata 20, 11524 Athens, Greece, the controller of the personal data described below. VAT number (ΑΦΜ) 047366074, General Commercial Registry (Γ.Ε.ΜΗ.) 171173703000; the full details are on the legal notice.

For anything about your personal data, write to info@oncut.gr. We have not appointed a Data Protection Officer, as our activities do not require one.

This policy covers www.oncut.gr. Our software site, apps.oncut.gr, has its own privacy policy.

2. What we process and why

a) When you contact us

The contact form asks for your name, email address, an optional phone number and your message. The same applies when you email or call us directly. We use this only to answer you and, where you ask about a project, to prepare and discuss a quote.

Legal basis: steps you ask us to take before a possible contract (Article 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Article 6(1)(f)). Enquiries that do not lead to work together are deleted after 12 months. If you become a client, we keep what the project and the law require, for example invoices for the period tax law sets.

b) Visiting the website

Like any web server, ours records technical data about each request: IP address, date and time, the page requested, browser and device type, and the referring page. This is needed to deliver the site, keep it secure and find faults (legitimate interest, Article 6(1)(f)). These logs are kept only as long as needed for that and are then removed in the hosting provider's regular log rotation.

c) Spam protection

The contact form is protected by Cloudflare Turnstile, which checks technical signals from your browser to tell people from bots. It may use a strictly necessary security cookie (such as cf_clearance) when a challenge is shown. Legal basis: legitimate interest in protecting the form from abuse (Article 6(1)(f)).

d) Videos

Our films stream from the Bunny.net content delivery network, which receives your IP address and ordinary request data in order to send you the video. The player software (HLS.js and Plyr) is served by this site itself. The player remembers your volume setting in your browser's local storage (plyr); nothing about it is sent to us. Legal basis: legitimate interest in showing our work efficiently (Article 6(1)(f)).

e) Reviews

The reviews section shows reviews that clients published on our Google Business Profile, with the name they chose to show there. They are fetched by our server through the Featurable service; loading this page does not send your data to either.

f) Analytics, and only with your consent

We use Google Analytics 4 to understand how visitors use the site, for example which films are watched and which pages lead to an enquiry. It loads only after you click "Accept" in the cookie banner. If you decline, or do nothing, no analytics script runs and no analytics cookies are set.

When it runs, Google Analytics processes an online identifier, the pages you view and how you interact with them, approximate location, and device and browser information, and sets the cookies _ga and _ga_<id> for up to two years. Google signals and advertising personalisation are switched off: the data is used for measurement only, never for advertising. Google keeps it for no longer than 14 months.

Legal basis: your consent (Article 6(1)(a) GDPR and Article 4(5) of Greek Law 3471/2006). Your choice is stored in your browser (oncut_cookie_consent) and is not sent to us. You can change it at any time with "Cookie settings" at the bottom of every page; declining afterwards switches analytics off and removes its cookies. More in Google's privacy policy.

We do not sell personal data, we do not use it for advertising, and we do not make automated decisions about you.

3. Who else sees it

Only the service providers we need to run the site:

• Pointer (Greece): hosting of the website and of our email, where enquiries are stored.
• Cloudflare: Turnstile spam protection.
• BunnyWay (Bunny.net) (Slovenia): video delivery.
• Google (Google Ireland Limited): Analytics, only if you consented.
• Featurable: fetching our public Google reviews, server to server.

We may also disclose data to our accountant or legal advisers, or to authorities, where the law requires it or to establish, exercise or defend legal claims.

4. Transfers outside the EU

Google, Cloudflare and the code networks may process data in the United States or other countries outside the European Economic Area. Where they do, the transfer relies on the EU-U.S. Data Privacy Framework for certified companies, or on the European Commission's Standard Contractual Clauses. Ask us at info@oncut.gr for details of the safeguard behind a particular transfer.

5. Your rights

You can ask us for access to your personal data, and to correct, erase, restrict or object to its processing, or to receive it in a portable form. Where we rely on your consent, you can withdraw it at any time without affecting what was done before. Write to info@oncut.gr; we answer within one month.

You can also complain to the Hellenic Data Protection Authority (dpa.gr) or to the authority of the EU country where you live.

6. Children

This site is meant for adults. The only processing on it that relies on consent is analytics, and Greek law (Law 4624/2019, article 21) lets children under 15 give that consent only together with a parent or guardian.

7. Security

The site is served only over HTTPS, with strict security headers. The contact form checks where requests come from and limits how often they can be sent, and enquiries are kept in a mailbox only we can access.

8. Changes

When our processing changes, this page changes with it, and the date at the top shows the latest revision. This policy is governed by the GDPR and Greek law.