The Museum · Visitor information
Privacy & Personal Data Protection Policy
This is not a final policy. Information in square brackets requires institutional confirmation and legal review before publication.
1. Data Controller
This website provides information about the Museum. Its public name alone is not sufficient to identify the legal data controller. Before approval, the following must be completed: [CONFIRMED LEGAL NAME], [POSTAL ADDRESS OF THE ENTITY], [DATA PROTECTION EMAIL].
Data Protection Officer details are added only if one has been appointed or is required: [DPO, IF APPLICABLE]. The Museum's visiting address is not automatically considered the registered seat of the data controller.
Optional AI-Generated Exhibit Suggestions
Only if you submit your interest is the text sent via the Lovable AI Gateway to generate suggestions based on published descriptions. Please do not include personal or sensitive data. We do not store a history of interests or responses in the site's database. Only aggregate usage counters and service availability status are kept, with no visitor-identifying information.
The service uses Lovable Cloud and Lovable AI. Technical logs, recipients, retention periods, legal basis, and any provider data transfers require institutional review before the policy is finalized. The suggestions are automated and do not constitute curatorial judgment.
2. Actual Functions and Data Categories
This implementation does not include a contact form, online booking, accounts, newsletter, or payments. The published phone numbers open your device's calling app. The site does not store visit requests via any form.
Handling of a phone contact by the entity may involve contact details and information about the request. The precise method of record-keeping or logging has not been confirmed and must be described by the Museum.
Hosting and delivery of images or fonts may require technical request data, such as IP address and device information. The actual logs, recipients, and retention periods must be confirmed by the entity and the provider. Anonymization has not been verified.
3. Purposes and Legal Bases — Pending Approval
No single legal basis is assigned to each activity here. The mapping below provides a framework for legal review, not a statement of already-approved practice.
- Responding to phone inquiries / arranging visits: [CONFIRMATION OF THE GDPR ARTICLE 6 BASIS AND ACTUAL DATA INVOLVED].
- Secure operation and technical logs: [CONFIRMATION OF PURPOSE, NECESSITY, AND LEGAL BASIS]. The legitimate-interest basis under Article 6(1)(f), if applicable, requires proper assessment and is not presumed.
- Optional tracking: not present in this implementation. If added, consent requirements must be reviewed beforehand; continued browsing does not constitute consent.
4. Recipients, Providers, and Transfers
The site uses the Lovable platform for development and management of digital files. This alone does not identify all data processors or their contractual roles. [CONFIRMED HOSTING, FILE DELIVERY, AND TECHNICAL SUPPORT PROVIDERS].
Any transfers outside the EEA and applicable safeguards: [REVIEW OF PROCESSING COUNTRIES AND SAFEGUARDS]. It is not claimed that no international transfers occur without appropriate contractual and technical review.
5. Retention Period
No specific retention periods have been approved. Prior to finalization, separate criteria are needed for phone requests, any communication logs, and technical files: [APPROVED RETENTION PERIODS OR CRITERIA BY CATEGORY].
6. Rights and Requests
Subject to applicable law, you may request access, rectification, erasure, restriction, objection, and, where applicable, data portability. Where consent has been given, you may withdraw it without affecting the lawfulness of prior processing. Protection against decisions based solely on automated processing, as provided under the GDPR, also applies; no such function has been implemented on this site.
Requests will be submitted to [DATA PROTECTION EMAIL]. Until this is confirmed, the published phone numbers can be used to ask for the appropriate way to proceed. Please do not send sensitive information to an unconfirmed destination.
You have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).
7. Security
The site does not request personal data via any form. The project's existing safeguards remain in place. Confirmation of hosting, access, logging, and recovery measures is required before they are described as active: [APPROVED TECHNICAL AND ORGANIZATIONAL MEASURES]. No claim is made regarding certifications or absolute security.
8. Cookies and External Content
No statistical or advertising tracking tool has been added, nor is any map embedded. Fonts are served alongside the site's own files, without calling Google Fonts. The map is an external link, and visitors choose whether to open it. See the separate "Cookie Policy" notice for the status and limits of this review.
9. Updates
Date of institutional approval / last approved update: [APPROVAL DATE]. Any changes to functions or providers require a review of this notice. The draft must be approved by the entity and the relevant legal or data protection advisor.