Privacy policy

Last updated: 3 October 2026

This site is operated personally by Dimitrios Rarras (demetriosrarras@gmail.com), a freelance full-stack developer based in Ioannina, Greece. This page explains what personal data I collect through the site and the tools I use with my clients, why, how long I keep it, and what rights you have under the EU General Data Protection Regulation (GDPR).

How the site is set up

The site's pages are static: they do not run a database and do not ask you for an account. The contact form and the tools for my clients, that is the client portal and the comments on websites, run on Rorsa Platform, a system I built and run myself, at platform.jimrarras.com.

What I collect, and why

1. Contact form submissions. If you fill in the form on this site, you send me your name, email address, and message, and optionally a phone number and the kind of project you have in mind. It also carries the page of this site you came to the form from, or the name of the website that brought you here, so I know what you read before writing. Rorsa Platform stores the submission together with your IP address, your browser type and the result of the spam check, so it can detect abuse, and emails it to me at demetriosrarras@gmail.com. Cloudflare Turnstile checks that the submission comes from a person rather than an automated script. I use the submission only to reply to you and do not pass it to any third party.
2. Appointment bookings. The calendar at the end of the home page runs on the Komvos Connect booking service (connect.komvosygeias.gr) and loads from there when you scroll near it. If you book an appointment, the details you enter in the calendar are stored by that service so I can see and confirm the booking.
3. Analytics (only if you accept). The Google Analytics 4 script loads only after you accept analytics cookies via the banner. It records page views, referrer, and rough geographic region, plus the fact that the form was sent or a phone, Viber, WhatsApp or email link was clicked, so I know which pages bring enquiries. It never captures your name, email, phone number, or anything you typed. If you decline or never answer, no analytics script loads at all.

I do not run advertising trackers, marketing pixels, or session recording on this site.

If you are a client of mine

If we work together, Rorsa Platform is my CRM and your client portal. In it I keep:

• Details of our work together: your business name, a contact email and phone number, and notes on our work.
• Your portal account, if you have one: name, email, your password only in a form that cannot be reversed (a hash), your language and, if you turn them on, two-step sign-in or your passkeys. For each session I keep the IP address and browser type, to keep the account secure.
• What you give me for the project: your answers to the first questions and to questionnaires, page texts, articles and the brand files you upload.
• Comments on the website: your name, the comment, the page and the spot you pointed at, your screen size and the version of the page. No IP address or browser type is stored with a comment.
• The monthly reports on your website.

The legal basis is our work together, that is the performance of a contract (Art. 6(1)(b) GDPR), and, for the security details of sessions, my legitimate interest in protecting the system (Art. 6(1)(f)).

I process the messages that visitors send through the form on your own website on your behalf: you are the controller and I am the processor (Art. 28 GDPR), on terms we agree in writing.

Every category of data, with how long each is kept, is listed in the platform's privacy policy.

Legal basis for visitors

• Contact form: your consent (you chose to submit it) plus my legitimate interest in replying to inquiries and protecting the form from abuse.
• Appointment bookings: your consent (you chose to book).
• Analytics: your explicit consent through the cookie banner. You can withdraw at any time by clearing the consent in your browser.

Retention

• Contact-form submissions are kept in Rorsa Platform for 24 months after they arrive and are then deleted automatically. Those rejected by the spam check are deleted after 30 days. You can ask me to delete a submission sooner, at any time, and I then also delete the copy that reached me by email.
• Client data is kept while we work together, and deleted afterwards if you ask me to, except what the law requires me to keep. Some of it is deleted automatically: portal sessions 30 days after they expire, comment links 90 days after they stop working, comments a year after the website's review is closed, answers to the first questions 90 days after the decision, questionnaires a year after they were answered, and monthly reports after two years.
• Analytics is aggregated and retained by the analytics provider per its own policy (typically 14 months for Google Analytics 4, configurable).

Third parties / sub-processors

• netcup (Austria): the server that runs Rorsa Platform, with its database and files, is in a netcup GmbH data centre in Austria.
• Email delivery: Rorsa Platform's emails, such as the notice of a new form submission or a portal invitation, go out through an email delivery provider, from servers in Frankfurt, Germany.
• Email (Google / Gmail): I receive contact-form messages via Gmail. Google's privacy terms apply:policies.google.com/privacy.
• Cloudflare Turnstile: checks that a form submission comes from a person rather than an automated script. Cloudflare's privacy terms apply:cloudflare.com/privacypolicy.
• Komvos Connect: the booking service behind the appointment calendar (connect.komvosygeias.gr).
• Google Analytics 4 (optional): applies only if you accepted analytics cookies, and its script does not load before that. Google's terms as above.
• Cloudflare (hosting): serves the site's static files. It may keep transient access logs (IP, user agent, timestamps) per its own security policy, on the terms linked above.

No data is sold or shared with marketing partners.

Storage in your browser

If you change the site's display preferences (text size, contrast, motion and so on), your choices are stored locally on your own device, in your browser's localStorage, under the key a11y-prefs-v1. They never reach me or anyone else. They are removed by the panel's Reset, or by clearing this site's data in your browser.

If you open a link I sent you to leave comments on a website, the comment tool keeps the link's code in localStorage (platform-review-token) along with two small notes: when you last saw the replies (platform-review-seen:…) and whether you have already seen the tips (platform-review-coach:…). If the link stops working, the code is removed the next time you open the page, and all of them are removed when you clear the site's data. Visitors without such a link load nothing from the comment tool.

Your rights

Under GDPR you have the right to:

• Request access to the data I hold about you
• Request correction of inaccurate data
• Request deletion ("right to be forgotten")
• Receive the data you gave me in a common file format (portability)
• Withdraw consent (you can revoke cookie consent in your browser at any time)
• Lodge a complaint with the Hellenic Data Protection Authority (dpa.gr/en)

To exercise any of these rights, email demetriosrarras@gmail.com. I respond within 30 days.

Changes to this policy

I update the "last updated" date above when the policy changes. If a change affects what the cookie banner asks you to accept, the banner appears again so you can choose afresh.

Contact

Dimitrios Rarras
Ioannina, Greece
demetriosrarras@gmail.com