1. Who we are
The data controller is the Volunteer Greek Rescue Team of Drymos (ΕΘ.ΕΛ.Ο.Δ ΔΡΥΜΟΥ), Drymos, Thessaloniki, Greece.
For any data protection matter contact info@etheloddrimou.gr or +30 6937174509.
2. What we collect
We only collect what you give us:
- Volunteer application: identity details (first and last name, father's name, date of birth, ID card number, tax number, social security number AMKA), address, phone numbers, email, emergency contact, certifications and licences with their photos and files, and a password (stored only in hashed form).
- Blood type: this is health data (a special category). You provide it optionally, so that it is known in case of injury during an operation.
- Contact form: name, email, subject and your message.
- Member and admin sign-in: one essential session cookie that keeps you signed in.
3. Why we use it and on what legal basis
- To review your application and organise your participation in the team — based on your consent (GDPR Art. 6(1)(a)) and on steps taken before you join as a member (Art. 6(1)(b)).
- Blood type — based on your explicit consent (Art. 9(2)(a)).
- To reply to messages you send us — based on our legitimate interest in answering people who contact us (Art. 6(1)(f)).
- Where civil protection volunteering law requires details to be passed to the competent authorities — to comply with a legal obligation (Art. 6(1)(c)).
4. Who has access
Only the authorised team members who handle applications can see your data. Documents you upload (ID, licences, certifications) are never public and can only be opened by the administrators.
We do not sell data or share it for advertising. The website is hosted on Cloudflare's infrastructure, which acts as a processor on our behalf.
5. How long we keep it
Members' details are kept for as long as you take part in the team and for as long as the law additionally requires. Applications that are not accepted, and contact messages, are deleted once no longer needed. When an application is deleted, its files are deleted with it.
6. Cookies and storage on your device
We do not use analytics or advertising cookies. The only cookie is the essential session cookie set when you sign in to your account.
Your browser's local storage keeps only your choice on the cookie notice and your emergency go-bag checklist. They are never sent to us.
YouTube video thumbnails are loaded from Google's servers. The player itself loads only when you press play, in privacy-enhanced mode (youtube-nocookie.com). Google's privacy policy applies to these.
7. How we protect it
Connections to the site are encrypted (HTTPS), passwords are stored only as a cryptographic hash, and access to the admin panel is limited to authorised administrators.
To protect our forms from automated abuse (spam, bots, password guessing), we briefly count how many submissions come from each connection. We do not store your IP address — only an irreversible cryptographic fingerprint of it, deleted within about a day. Where enabled, Cloudflare Turnstile checks that a submission comes from a person, under Cloudflare's privacy policy. The legal basis is our legitimate interest in keeping the site secure (GDPR Art. 6(1)(f)).
8. Your rights
At any time you can ask for:
- access to your data and a copy of it
- correction of inaccurate details
- erasure
- restriction of, or objection to, processing
- portability of your data
- withdrawal of your consent, without affecting the lawfulness of earlier processing
9. Contact and complaints
To exercise your rights, email info@etheloddrimou.gr. We will reply within one month at the latest.
If you believe the processing breaches the GDPR, you have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).