Privacy Policy

Last updated: 9 October 2026

1. Introduction

AIRIS DESIGN STUDIO respects your privacy and is committed to handling personal data responsibly and in accordance with applicable data protection law, including the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Greek legislation.

This Privacy Policy explains what personal data may be collected when you visit this website or contact the studio, why it is processed, how it may be shared, how long it may be retained, and what rights you may have.

2. Who is responsible for your personal data?

The data controller is Design Printing Enterprise IRIS APOSTOLIDOU, operating under the trade name AIRIS DESIGN STUDIO, based in Greece.

For questions about this Privacy Policy or to exercise your data protection rights, contact:

Email: info@airisdesignstudio.com

3. What personal data may be collected?

Depending on how you use the website, the studio may process the following information:

  • Contact information: your first name, last name, email address and company name, if provided.
  • Message content: the information you choose to include when contacting the studio, such as details about a project or enquiry.
  • Technical information: limited information that may be recorded by the website hosting provider when the website is accessed, such as IP address, browser information, access timestamps and server logs, where applicable.
  • Business communications: information contained in correspondence relating to enquiries, proposed projects and ongoing professional relationships.

Please do not include sensitive personal information in a contact form unless it is genuinely necessary.

4. Why is personal data processed?

Personal data may be processed for the following purposes:

  • To respond to enquiries and messages.
  • To discuss potential projects and provide information about the studio’s services.
  • To communicate with existing clients and manage professional relationships.
  • To maintain the security, availability and proper functioning of the website.
  • To comply with legal obligations and establish, exercise or defend legal claims where necessary.

The studio does not intend to sell personal data or use it for unrelated third-party marketing.

5. Legal basis for processing

Depending on the circumstances, the studio relies on one or more of the following legal bases under the GDPR:

  • Steps taken at your request before entering into a contract: for example, responding to a project enquiry or discussing a potential commission.
  • Performance of a contract: where processing is necessary to fulfil an agreement with you.
  • Legitimate interests: for reasonable business communication, website security and the establishment, exercise or defence of legal claims, where those interests are not overridden by your rights.
  • Legal obligation: where information must be retained or processed to comply with applicable law.
  • Consent: where consent is legally required for a particular activity.

Where processing relies on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. Contact form and third-party service providers

If you contact the studio through the website’s contact form, the information you submit will be used to receive and respond to your enquiry.

The website may use third-party providers for hosting, form delivery, spam prevention and related technical services. Where a provider is used, the information necessary to perform its function may be processed by that provider in accordance with its own terms and privacy documentation.

The website’s contact form is delivered through Web3Forms, a form-handling service operated by Web3Creative. When you submit the form, the information you enter is sent to Web3Forms, which processes it on the studio’s behalf in order to deliver it to the studio by email. Web3Forms states that it operates from India, uses sub-processors, and relies on standard contractual clauses for transfers of personal data from the European Economic Area. The form is also protected by hCaptcha, an anti-spam service provided by Intuition Machines, Inc., which may process technical information such as your IP address and information about how you interact with the form in order to distinguish people from automated software. For details, see the Web3Forms Privacy Policy, the Web3Forms Data Processing Agreement and the hCaptcha Privacy Policy.

The studio does not control the independent privacy practices of third-party providers. However, it should take reasonable steps to select appropriate providers and protect personal data handled through the website.

7. Hosting, storage and international transfers

The website is intended to be hosted through a website hosting provider. That provider may process technical information necessary to deliver and secure the website.

Personal data may also be processed by service providers used to deliver contact-form messages or other website functions. Depending on the provider and its infrastructure, data may be processed outside the European Economic Area (EEA).

Where personal data is transferred outside the EEA, the transfer must be subject to an appropriate mechanism under applicable data protection law, where required. Information about the relevant provider and transfer safeguards should be confirmed against the services actually used by the website.

8. How long is personal data retained?

Personal data is retained only for as long as reasonably necessary for the purpose for which it was collected, unless a longer period is required or permitted by law.

In general:

  • Enquiries that do not lead to a project may be retained for a reasonable period to manage follow-up communications and maintain business records.
  • Client and project correspondence may be retained for the duration of the professional relationship and for an appropriate period afterwards where needed for record-keeping or legal claims.
  • Financial and accounting records are retained for the periods required by applicable law.
  • Technical logs are retained according to the hosting provider’s applicable retention practices.

When personal data is no longer necessary and no legal reason for retention remains, it should be deleted or anonymised where appropriate.

9. Cookies and similar technologies

The website may use technologies that are strictly necessary for its operation, security and delivery.

This policy does not assume that the website uses analytics, advertising or tracking cookies. If such tools or other non-essential tracking technologies are added, the website must be reviewed and, where required, an appropriate consent mechanism must be implemented before those technologies are activated.

You can also manage cookies through your browser settings. Disabling certain necessary technologies may affect website functionality.

10. How personal data is protected

Reasonable technical and organisational measures should be used to protect personal data against unauthorised access, accidental loss, alteration or disclosure.

No method of transmitting or storing information can be guaranteed to be completely secure. The studio will take reasonable steps appropriate to the nature of the information and the services used.

11. Your rights under the GDPR

Subject to the conditions and exceptions provided by law, you may have the right to:

  • Request access to your personal data.
  • Request correction of inaccurate or incomplete data.
  • Request erasure of personal data.
  • Request restriction of processing.
  • Object to processing where the relevant legal conditions are met.
  • Request data portability where applicable.
  • Withdraw consent where processing is based on consent.
  • Lodge a complaint with a competent data protection supervisory authority.

To exercise your rights, email info@airisdesignstudio.com. The studio may need to verify your identity before responding. Requests will be handled within the time limits required by applicable law.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority, the Greek supervisory authority for data protection. Its website is https://www.dpa.gr/en.

12. Links to other websites

This website may contain links to third-party websites, including social media platforms. Those websites operate independently and have their own privacy policies and practices.

The studio is not responsible for the privacy practices of third-party websites. Please review their policies when visiting them.

13. Changes to this Privacy Policy

This Privacy Policy may be updated when necessary to reflect changes to the website, the services used or applicable legal requirements. The current version will be published on this page with its latest revision date.

14. Contact

For questions about this Privacy Policy or the handling of your personal data, contact:

AIRIS DESIGN STUDIO
Design Printing Enterprise IRIS APOSTOLIDOU
Email: info@airisdesignstudio.com