Legal
Privacy Policy
Last updated: 28 October 2026
This policy explains what personal data Adding soon (“Velk”, “we”, “us”) collects when you visit velk.gr or contact us, why we collect it, and the rights you have under the EU General Data Protection Regulation (GDPR) and applicable national law.
1. Who is responsible
The data controller is Adding soon, Adding soon, Adding soon Adding soon, Greece. VAT: Adding soon. Email: hello@velk.gr. We have not appointed a Data Protection Officer because we are not required to; questions about privacy go to the email above.
2. What we collect and why
| Data | Purpose | Legal basis | Kept for |
|---|---|---|---|
| Name, email, company (optional), budget range and your message from the contact form | Replying to your enquiry and preparing a quote | Steps at your request before entering a contract (Art. 6(1)(b) GDPR) | Up to 24 months after our last contact if no contract follows, then deleted, both from our portal and from the notification email in our inbox |
| Contract, billing and project communication data | Delivering services, invoicing, legal obligations | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) | For the period required by tax and commercial law |
| Reviews from client companies: company name and logo, star rating and review text | Publishing client reviews on our website | Your consent (Art. 6(1)(a) GDPR), given on the review form; you can withdraw it at any time by emailing us and the review is removed | Until you withdraw consent or we stop showing the review; unused invite links expire after 60 days |
| The website address you enter in the free site check | Running the speed and SEO check you asked for | Your request (Art. 6(1)(b) GDPR) and our legitimate interest in offering the tool (Art. 6(1)(f)) | Not stored with your details. The result is cached on our server for up to 30 minutes so a repeated check is instant, then deleted |
| Technical data: IP address, browser, date and time of request | Delivering the site securely, preventing abuse and spam | Legitimate interest in a secure website (Art. 6(1)(f)) | Server logs are kept for a maximum of 14 days; for spam protection we keep only a one-way encrypted fingerprint of the IP address for up to 24 hours, which cannot be turned back into the address |
We do not use analytics, advertising or tracking tools, we do not build profiles, and we never sell your data. We do not make decisions about you by automated means.
3. Do you have to give us your data?
No. Without your name, email and message we simply cannot reply to your enquiry. You can always email us directly instead of using the form.
4. Who we share it with
Only with service providers who help us run our business and who are bound by a data processing agreement under Art. 28 GDPR:
- Hosting and email provider: Website hosting, email and server logs, under a data processing agreement (Art. 28 GDPR) (servers in the EU)
- Cloudflare, Inc.: Fast and secure delivery of the website (CDN), protection against attacks, and the Turnstile anti-spam check on forms (USA, certified under the EU–US Data Privacy Framework)
When you use the free site check, our server sends only the website address you entered to Google PageSpeed Insights (Google LLC, USA, certified under the EU–US Data Privacy Framework). Your IP address and browser details are not passed to Google, because the request comes from our server, not your browser.
Our forms and the login page are protected by Cloudflare Turnstile, which checks that a real person is submitting them. For this, Cloudflare briefly processes technical data such as your IP address and browser characteristics, based on our legitimate interest in preventing spam and abuse (Art. 6(1)(f) GDPR). It is not used for advertising.
We also disclose data where the law requires it, for example to tax authorities or courts.
5. Transfers outside the EU
We aim to keep all data inside the European Economic Area. If a provider processes data outside the EEA, we only do so where an adequacy decision exists (such as the EU–US Data Privacy Framework) or with Standard Contractual Clauses approved by the European Commission.
6. Fonts, embeds and external links
All fonts and assets on this website are hosted on our own server, so loading the site does not send your data to Google or other third parties. Project pages may link to websites we built for clients. Those sites are operated by our clients and have their own privacy policies.
7. Cookies
The public website sets no tracking cookies, only strictly necessary security cookies from Cloudflare. Our internal admin area uses one strictly necessary login cookie. See the Cookie Policy.
8. Your rights
You have the right to:
- access the data we hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17);
- restrict processing (Art. 18);
- receive your data in a portable format (portability, Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw consent at any time, without affecting processing that took place before.
To exercise any right, email hello@velk.gr. We reply within one month. You also have the right to complain to a supervisory authority, in particular the Hellenic Data Protection Authority.
9. Security
The site is served over encrypted HTTPS. Access to enquiries is limited to authorised staff behind a password-protected admin area. Passwords are stored only as salted hashes.
10. Children
Our services are aimed at businesses. We do not knowingly collect data from children under 15.
11. Changes
We will update this page if our practices change. The date at the top always shows the latest version.