Privacy Policy

01

Data controller

The data controller for personal data collected through zogana.gr is Dr Sofia Zogana, Consultant Ophthalmic Surgeon.

Contact: 6 Aiantos Street, 146 71 Nea Erythraia, Greece · +30 697 421 2356 · info@zogana.gr.

02

Scope

This Policy applies to the processing of data when you visit the website, use the contact form or communicate through the contact details published on it.

It does not describe in detail the processing of health data in connection with a medical examination or treatment. The practice provides separate information about that processing where required.

03

Personal data we collect

Depending on how you use the website, the following categories of data may be processed:

• Contact form data: full name, email address, optional telephone number, subject and message.
• Direct communication data: information you provide when contacting the practice by telephone or email.
• Technical data: IP address, date and time, device or browser type, requested page and technical server security logs.
• Abuse-prevention data: a temporary cryptographic fingerprint derived from the IP address to limit repeated submissions, together with technical form-verification fields.

04

Purposes and legal bases

Personal data are used only for specified, lawful purposes:

• Responding and arranging a visit: to respond to your enquiry or take steps before providing a service, under Article 6(1)(b) GDPR and, where required, your consent.
• Operation and security: for technical support, abuse prevention and website protection, based on the legitimate interest in secure and reliable operation under Article 6(1)(f) GDPR.
• Legal obligations and claims: where retention or disclosure is necessary to comply with the law or to establish, exercise or defend legal claims.

05

Health data

The public contact form is not designed to collect special categories of personal data, such as medical histories or examination results. Please do not include this information in your message.

If you choose to send health information, we will limit its use to what is strictly necessary to handle your enquiry and may ask you to continue through a more appropriate channel. Where required, processing is based on your explicit consent or another specific legal basis under Article 9 GDPR.

06

Recipients and service providers

Access to personal data is limited to people who need it for the relevant purpose. Carefully selected hosting, email, technical support and security providers may act as processors under contractual confidentiality and data-protection obligations. Personal data may also be disclosed to public authorities where required by law.

07

What happens when you submit the form

Contact form details are sent by email to the practice’s authorised contact account. The website does not create a separate record of messages in the WordPress database.

To prevent repeated bulk submissions, a non-reversible fingerprint derived from the IP address is stored temporarily for up to 10 minutes together with the number of attempts. A security nonce and a hidden verification field are also used.

08

Cookies and similar technologies

The website uses necessary cookies for security, language selection and storing consent preferences. With your permission, Google Analytics 4 is also used through Google Site Kit to produce aggregate usage statistics. We do not use advertising cookies or create advertising profiles.

Complianz and WP Consent API manage your choices, while Google Consent Mode V2 communicates the relevant signal to Google Analytics. You may accept, reject or change your choices at any time. Full details are available in the Cookie Policy.

09

Map and external links

The Contact page embeds an OpenStreetMap map. When the map loads, the provider may receive technical data such as your IP address, request time and browser details, as described in its own Privacy Policy.

Links to other services, such as directions, are activated only when you choose them and are governed by the relevant provider’s policies.

10

Transfers outside the EEA

Some technical providers or third-party infrastructure may process data outside the European Economic Area. Where a transfer takes place under our responsibility, a recognised safeguard is used, such as an adequacy decision or approved standard contractual clauses, together with supplementary measures where required.

11

Retention periods

Contact enquiries are retained until they have been handled and then only for as long as reasonably necessary for continuing correspondence, record-keeping or legal obligations. Where there is no active relationship or other lawful reason, they are deleted or anonymised in accordance with the internal retention policy.

Technical security logs are retained for a limited period determined by security needs and the hosting provider’s settings. The temporary form rate-limit fingerprint expires automatically after 10 minutes.

12

Your rights

Subject to the conditions of the GDPR, you have the right to be informed and the rights of access, rectification, erasure, restriction, data portability and objection. You may also withdraw consent without affecting the lawfulness of processing carried out before withdrawal. These rights are not absolute and may be subject to lawful exceptions.

• To exercise a right, send a clear request to info@zogana.gr. Reasonable proof of identity may be requested.
• You will receive a response without undue delay and in principle within one month, in accordance with Article 12 GDPR.
• You have the right to lodge a complaint with the Hellenic Data Protection Authority, 1-3 Kifissias Avenue, 115 23 Athens, Greece, email: contact@dpa.gr.

13

Security and children

Reasonable technical and organisational measures are applied to protect personal data against loss, alteration, unauthorised access or disclosure. No transmission over the internet can, however, be guaranteed to be completely secure.

The website provides information about paediatric ophthalmology, but the contact form is intended for adults. Information about a child should be provided only by a parent or legal guardian and only to the extent strictly necessary.

14

Changes and contact

This Policy may be updated when website functionality, providers or the legal framework change. The current version and date of the latest update are always published on this page.

For questions about data protection, email info@zogana.gr.