PRIVACY POLICY (GDPR)

1. Data controller

The data controller is the Crete Visual Arts Association, based in Heraklion, Crete.
Contact email: art@cretavisualarts.com

2. Data we collect

We may collect the following personal data:

• Full name
• Email address
• Information submitted through the membership registration form
• Messages submitted via contact forms (if applicable)
• Technical data (IP address, browser type, and essential cookies)

3. Purpose of processing

Personal data is processed exclusively for:

• Membership registration and management
• Communication with members or interested parties
• Informing about Association activities
• Ensuring proper website functionality

4. Legal basis for processing

Processing is based on:

• User consent
• Compliance with legal obligations
• Legitimate interests of the Association for its operation and organization

5. Data retention

Personal data is retained only for as long as necessary for the purposes for which it was collected or as required by law.

6. User rights

Users have the right to:

• Access their personal data
• Rectify inaccurate data
• Request erasure (“right to be forgotten”)
• Restrict processing
• Object to processing
• Data portability

To exercise these rights: art@cretavisualarts.com

7. Data sharing

Personal data is not sold or shared with third parties, except where required by law or for technical support of the website.

8. Security

The Association takes reasonable technical and organizational measures to protect personal data.

9. Social media

The website may in the future include links to official social media pages of the Association. Use of these platforms is governed by their respective privacy policies.