Έλατα Ξηρολίβαδου

Privacy Policy

Last updated: March 2026

Introduction

The Agricultural Consortium of Xirolivado (hereinafter the "Consortium") is committed to protecting the personal data of its members and website visitors, in accordance with the General Data Protection Regulation (GDPR · EU Regulation 2016/679) and Greek data protection legislation (Law 4624/2019). This Privacy Policy explains what data we collect, how we use it, and what your rights are.

Data Controller

The data controller is the Agricultural Consortium of Xirolivado, headquartered in Koumaria, Imathia, Greece.

For data protection matters, you can contact us at: info@elata-xirolivadou.gr

Data We Collect

In the context of operating the Consortium and managing its members, we collect the following categories of data:

  • Identification data: Full name, email address, phone number, physical address.
  • Tax documents: ENFIA declarations, E9 forms, and other documents proving property ownership.
  • Ownership data: Ownership percentages, details of original share owners.
  • Automated verification results: Results of AI document verification (name, address, and ownership verification).
  • Technical data: Session cookies required for user login.

Purpose of Processing

Personal data is processed exclusively for the following purposes:

  • Member verification: Identification and confirmation of membership status and ownership percentages.
  • Consortium management: Maintaining the member registry, administrative communication, decision-making.
  • Communication: Sending announcements, updates, and responses to member requests.
  • Voting: Conducting member votes on Consortium decisions.

Legal Basis for Processing

The processing of your data is based on the following legal bases under the GDPR:

  • Legitimate interest (Article 6(1)(f) GDPR): Managing members and operating the Consortium constitutes a legitimate interest.
  • Explicit consent (Article 6(1)(a) GDPR): Upon registration, you provide explicit consent for the processing of your data. When submitting tax documents, you provide specific consent for processing sensitive data.
  • Legal obligation (Article 6(1)(c) GDPR): Record-keeping in accordance with Greek cooperative legislation.

Data Storage

Your data is securely stored in the following infrastructure within the European Union:

  • Supabase: Database and file storage (EU servers).
  • Vercel: Website hosting and serverless function execution (EU region).
  • Resend: Email delivery (EU infrastructure).

Data Retention Period

Your personal data is retained throughout the duration of your membership and for five (5) years after its termination, in accordance with Greek legal requirements for cooperative record-keeping. After this period, data is deleted or anonymised.

Third-Party Processors

For the operation of our website and services, we use the following third-party services:

  • Supabase (database and file storage): Storage of member details, documents, and ownership data.
  • Vercel (hosting): Website hosting and application execution.
  • Resend (email): Sending electronic notifications to members and the Board of Directors.
  • OpenRouter / Google (artificial intelligence): Document verification via AI. Documents are processed but not stored by the AI services.

Data Subject Rights

Under the GDPR, you have the following rights regarding your personal data:

  • Right of access: Request a copy of your data.
  • Right to rectification: Request correction of inaccurate data.
  • Right to erasure: Request deletion of your data (subject to legal exceptions).
  • Right to portability: Receive your data in a structured, commonly used, machine-readable format.
  • Right to restriction: Request restriction of processing.
  • Right to object: Object to processing based on legitimate interest.

To exercise any of the above rights, contact us at info@elata-xirolivadou.gr. We will respond within one (1) month of receiving your request. If you are not satisfied with our response, you have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

Cookies

Our website uses only essential functional cookies (session cookies) for user login. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

Automated Processing (AI)

During the member verification process, tax documents are automatically checked via artificial intelligence (AI) for name, address, and ownership percentage verification. This automated processing is not used for automated decision-making · the Board of Directors makes the final decisions on approving or rejecting applications. Documents are sent to AI services for processing only and are not stored by them.

Data Security

We take appropriate technical and organisational measures to protect your personal data, including:

  • SSL/TLS encryption for all communications.
  • Row Level Security in the database.
  • Role-based access control (member, board member, administrator).
  • Password encryption.

Policy Updates

This Privacy Policy may be updated from time to time. In the event of material changes, members will be notified via email or through an announcement on the website.

Data Protection Officer

The Consortium, as a small organisation, is not required to appoint a Data Protection Officer (DPO) under the GDPR. For any data protection enquiries, you can contact us at info@elata-xirolivadou.gr.

The competent supervisory authority is the Hellenic Data Protection Authority (HDPA), 1-3 Kifisias Avenue, 115 23 Athens, www.dpa.gr.