Contents
1. Who we are
The data controller for your personal data is:
EL-TRANSLATIONS Private Company (I.K.E.) incorporated under Greek law, trading as "EL-Translations", registered at Leof. Pentelis 2, 152 34 Chalandri, Attica, Greece, VAT No. EL801053620, Tax Office KEFODE Attica, General Commercial Registry (G.E.MI.) No. 147960403000, telephone +30 210 680 1333, email privacy@el-translations.com, hereinafter "EL-Translations" or the "Company".
Contact for data protection matters
For any question or request concerning the processing of personal data and the exercise of your rights, you may contact EL-Translations at privacy@el-translations.com.
2. What this notice covers
This Privacy Policy is a stand-alone notice under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and covers the processing of personal data through:
- the website
el-translations.com, - the training platform
moodle.el-translations.com(EL-Academy), - the e-shop and payment systems,
- contact and quote-request forms, including file uploads,
- the newsletter service,
- cookies and related technologies (see the Cookie Policy),
- supporting infrastructure (content delivery network, protection against automated abuse).
A distinctive feature of our activity. The subject matter of our services is the processing of documents that you submit to us. This is not an incidental function but our core activity. These documents may contain third-party data, special categories of data, or data relating to criminal convictions and offences.
3. What data we process, for what purpose, and on what legal basis
3.1 Communication and enquiries
Full name, email address, telephone number where provided, message content, and any details contained in attachments.
Purpose: handling enquiries, communication, providing information or a quote. Legal basis: Article 6(1)(b) (steps taken prior to entering into a contract, or performance of a contract); in the alternative, Article 6(1)(f) (legitimate interest in responding to enquiries).
3.2 Quote request with document upload
Full name, email, telephone (optional), document type, language pair, comments, and the file itself. In addition: information about how you arrived at the site, device type, country, and IP address.
Purpose: assessment, costing, response, preparation of the service. Legal basis: Article 6(1)(b) (steps prior to a contract); in the alternative, Article 6(1)(f).
3.2.1 Special categories (Article 9) and criminal-offence data (Article 10)
Where the document contains data under Article 9 (health, religious beliefs, biometric data) or Article 10, the basis in section 3.2 is not sufficient. An additional, distinct basis is required, which is not uniform but is determined on a case-by-case basis:
| Document category | Article 6 basis | Additional Article 9/10 condition |
|---|---|---|
| Medical or other sensitive documents of the client themselves | Article 6(1)(b) | explicit consent, Article 9(2)(a) |
| Documents necessary for a specific legal claim or judicial proceeding | Article 6(1)(b) or (f), case by case | Article 9(2)(f), only to the extent the processing is genuinely necessary |
| Religious certificates and other special-category documents | Article 6(1)(b) | explicit consent, Article 9(2)(a), unless a more specific exemption applies |
| Third-party data contained within a document | Article 6(1)(b) or (f), case by case | the applicable Article 9 exemption is documented per assignment; Article 14 also applies |
| Criminal records, criminal judgments and other Article 10 data | – | not accepted through the automated online flow; reviewed only manually, provided a specific lawful authorisation is documented and appropriate safeguards are applied |
Where the basis is explicit consent, it is requested via a separate, non-pre-ticked field at the point of submission, with a clear description of the special categories involved. This is not covered by general acceptance of terms. We record the exact text you saw, its version, and the time, so that what you consented to can be demonstrated precisely. You may withdraw it at any time, in the manner indicated at the same point.
Enhanced measures. Translation of special-category files is carried out by professional translators bound by a confidentiality clause, in accordance with the ISO 17100 standard (translation services, with review by a second linguist) and ISO 18587 (post-editing of machine-translation output). Assistive tools (translation memory, machine translation, or artificial intelligence) are used only where approved by EL-Translations, on a professional account with a contractual exclusion of using the content to train models, under an Article 28 processing agreement and a documented processing location. Free and consumer-grade tools are prohibited. Any such use on a special-category file is preceded by a separate, case-by-case assessment, and use is excluded wherever that assessment does not permit it.
Documents concerning third parties. Where a document concerns a third party (for example, a relative's medical file), we consider the duty to inform them under Article 14, subject to the disproportionate-effort exemption in Article 14(5)(b). The relevant documentation is kept and produced on request.
3.3 Ordering and performance of translation services
Identification and contact details, billing details, order details, files for translation and deliverables, communication history.
Purpose: performance of the contract, delivery, support, invoicing, compliance. Legal basis: Article 6(1)(b) (contract); Article 6(1)(c) (tax and accounting obligations).
3.4 Payments
Payments are processed by Stripe Payments Europe, Limited (Ireland). EL-Translations does not receive or store full card details.
Data: transaction details, amount, currency, payment reference, billing details, email. Purpose: completing payment, refunds, fraud prevention, accounting records. Legal basis: Article 6(1)(b) and 6(1)(c).
For the issuance of tax documents and their transmission to the myDATA platform, we work with an e-invoicing provider established in Greece.
3.5 EL-Academy and Moodle
Full name, email, billing details, enrolment programmes, progress, assessment or assignment results, technical log files to the extent required for security and support, support communications.
Purpose: account creation, enrolment, providing access, course administration, issuing certificates, support, security. Legal basis: Article 6(1)(b) (contract); Article 6(1)(c) (tax documents); Article 6(1)(f) (security and abuse prevention).
The Moodle platform is hosted on a server we manage, with Hostinger as infrastructure provider, at a data centre in Frankfurt, Germany, within the EEA.
YouTube videos inside the courses. Some courses include videos hosted by YouTube, a service of Google Ireland Limited, embedded in privacy-enhanced mode (address youtube-nocookie.com). The player is provided by Google: when you open a page containing a video, your browser contacts Google's servers to load it, and Google receives the technical details of that connection, such as your IP address and browser and device information. When you press play, it additionally receives data about the viewing of the video. Playback starts only through your own action, and you can follow the course without starting it: the course text and the short description under each video are available without playing the video.
Privacy-enhanced mode does not mean that Google receives no data; according to Google, "the view of a video shown in the Privacy Enhanced Mode of the embedded player will not be used to personalize the YouTube browsing experience" (help page "Embed videos & playlists", support.google.com). Google acts as an independent controller and applies its own privacy policy; it may transfer data to the United States (see section 5 and the EU-U.S. Data Privacy Framework). The above concerns the pages of the Moodle platform; for the el-translations.com website, section 3.7 applies. Purpose: providing the course material in video form. Legal basis: Article 6(1)(f) (legitimate interest: showing videos without video infrastructure of our own), with the right to object under section 8.
Optional programme evaluation. Each programme includes an optional questionnaire, the "Programme evaluation". Ratings are collected and, if you wish, free text; please do not write details that identify you in it. Reports show the answers anonymously and the results are visible only to the platform administrators. The Moodle platform keeps the link between an answer and your account internally only in order to accept one response per learner, and we do not use it to identify who gave which answer. Completing it is not a condition for completing the programme. Purpose: evaluating and improving the training service (ELOT ISO 29993). Legal basis: Article 6(1)(f) (legitimate interest). Retention: the answers remain in Moodle and, like your account, are not covered by the automated sweep in section 6 (see section 3.5.2); you may request their deletion or anonymisation under section 8.
3.5.1 Live training sessions
In programmes with live attendance, image and voice data may be processed (camera, microphone, conversation), on the basis of Article 6(1)(b). Where recording is planned, this is expressly disclosed before the session, with a separate legal basis, purpose, retention period and recipients stated. Where technically feasible, participation without activating the camera is available.
3.5.2 What happens to your Moodle account after your access ends
The expiry or suspension of access to a programme does not automatically result in deletion of your Moodle account. The account may be retained for evidence of the service provided, re-issuance of certificates, and managing access to other programmes.
⚠️ We state one limitation expressly. The automated sweep described in section 6 cleans our own database, but does not cover the Moodle account: your full name and email remain there. Their deletion or anonymisation takes place upon your request, under section 8. The result of the automated sweep is therefore pseudonymisation, not anonymisation, and we do not promise complete deletion without a request.
3.6 Newsletter
Data: email address, and evidence of consent (timestamp, consent text, policy version). Purpose: sending updates exclusively from EL-Translations. Legal basis: Article 6(1)(a) (consent) and Article 11 of Greek Law 3471/2006.
Every message includes an unsubscribe link. Withdrawal does not affect the lawfulness of processing carried out before it.
3.7 Cookies and related technologies
We use strictly necessary cookies for the website to function, and optional statistical, functional and advertising cookies only upon consent.
No third-party script loads and no event leaves the page before you give affirmative consent. Refusal is the default state. Full detail in the Cookie Policy; withdraw at any time via "Cookie settings".
3.8 Security and abuse prevention
We apply protection against automated abuse and rate-limit requests per email address or IP address within a one-hour window. Administrative access is protected by a separate authentication mechanism. Legal basis: Article 6(1)(f) (legitimate interest in security).
3.9 Job applicants and business partners
Covered by separate notices: the Job Applicant Notice and the Partners and Suppliers Notice.
3.10 The "NIMA" digital assistant
On certain commercial pages you may open the "NIMA" digital assistant and ask what you need, how much it costs, and how long it will take. This is an artificial intelligence assistant, not a human, and it discloses this itself on the first screen.
Processing begins only if you open it. If you do not use it, nothing is collected under this section.
What we process: the text you type, session counters, your IP address, the visit-origin information described in section 3.7, and the structured fields that result from the conversation (document type, languages, quantity). Legal basis: Article 6(1)(b) (steps prior to entering into a contract, at your own request).
We do not retain your conversation history. It remains in your browser and is sent only as limited context for the specific reply. No transcript is stored on our servers.
The assistant never asks you for your full name, email, phone number or document content, and does not accept files. You provide contact details only in the quote-request form, which you see and submit yourself. Please do not type personal details or document content into the conversation: the assistant does not need them to answer you.
No decisions are made about you. There is no automated decision-making within the meaning of Article 22: the assistant informs and prepares, and every binding quote and every assignment passes through a human. You may request a human at any time.
Documents of a criminal-record nature (Article 10) are not priced by the assistant and are routed to manual review, as set out in section 3.2.1.
Language-model provider. To respond, the assistant sends your text to Google Cloud EMEA Limited (Vertex AI service), which acts as a processor under an Article 28 agreement. Processing takes place in the EU region, with an explicit exclusion of model training on your data. The provider may temporarily retain the text of queries solely to detect abuse of its services; when that logging is waived for us, this notice will be updated.
Retention periods: IP address 24 hours; session and origin data 30 days; measurement events 12 months; a draft handed off to the quote-request form 1 hour, or until used. The related records are pseudonymous, not anonymous: the access and erasure rights in section 8 cover them wherever the session can be linked to you.
A separate Data Protection Impact Assessment has been prepared for this feature (1 August 2026), as committed in an earlier version of this notice.
4. Recipients and processors
| Recipient | Role | Location |
|---|---|---|
| Cloudflare, Inc. | Website, database and file-storage infrastructure | Global network; your files in a private area with an EU jurisdiction commitment |
| Stripe Payments Europe, Limited | Payment processing | Ireland (EEA) |
| Mailjet SAS | Message delivery | France (EEA) |
| Hostinger | Infrastructure for the Moodle platform | Frankfurt, Germany (EEA) |
| Google Ireland Limited (YouTube) | Hosting and playback of the videos embedded in the courses; independent controller | Ireland (EEA); possible transfer to the United States under the EU-U.S. Data Privacy Framework |
| BOX NOW Single-Member S.A. | Delivery of printed translations to a parcel locker, when you choose this option. Receives only your name, email and phone number, no address and no document content | Greece (EEA) |
| E-invoicing provider | Tax documents, myDATA | Greece |
| Google Workspace | Corporate email | Standard Contractual Clauses |
| Google Cloud EMEA Limited (Vertex AI) | Language-model provider of the digital assistant "NIMA" (section 3.10); processor, with no model training on your data | Ireland (EEA); processing in the EU region |
| Google, Meta, LinkedIn | Statistics and advertising | Third countries: only upon consent |
| Translation-production software providers (translation memory, quality assurance, machine translation) | Production and review of the translation | Within the EEA or under appropriate safeguards, with a processing agreement and no model-training terms |
| Professional translators and reviewers | Performance of the assignment | Bound by a written confidentiality clause |
| Competent authorities | Where required by law or order | – |
Full identification details: Cloudflare, Inc., 101 Townsend Street, San Francisco, California 94107, United States.
We do not sell or rent your data to third parties.
For files containing Article 9 data, the enhanced measures in section 3.2.1 apply: only approved professional tools, with a contractual exclusion of using the content to train models, and a separate case-by-case assessment. Article 10 data is not accepted through the automated online flow (see the table in section 3.2.1).
If you would like to know exactly which providers received your data, you are entitled to this and we will answer by name, upon an access request under section 8.
5. International transfers
Where personal data are transferred outside the European Economic Area (EEA), EL-Translations ensures that such transfers are carried out in accordance with Chapter V of the GDPR. Depending on the recipient and destination, transfers may be based on an adequacy decision of the European Commission, including, where applicable, the EU-U.S. Data Privacy Framework for participating U.S. organisations, or on appropriate safeguards under Article 46 GDPR, in particular the European Commission’s Standard Contractual Clauses, together with any supplementary measures required. Information about the transfer mechanism applicable in each case and a copy of the relevant safeguards may be obtained by contacting EL-Translations using the contact details provided in this Privacy Notice.
6. Retention periods
| Data | Period |
|---|---|
| Files submitted with a quote request | 30 days |
| Contact details of the quote request | 12 months |
| Order files | 30 days from the closing of the order |
| Invoices and mandatory tax records | Five years from the end of the relevant tax year, or longer if required by law, an audit, or a pending claim |
| EL-Academy enrolment records | Five years from 31 December of the year the invoice was issued (Article 13 of the Tax Procedure Code, Law 4987/2022), followed by pseudonymisation |
| IP address | 24 hours |
| Technical payment-transaction log files | 90 days |
| Tax-notification delivery records | 30 days |
| Newsletter: delivery details | Until you unsubscribe from the list |
| Newsletter: limited consent and withdrawal evidence record | Five years after withdrawal or the last message sent, whichever is later |
| Project details in the management system and corporate correspondence | Five years from project completion, unless a longer retention is required by law or a claim |
| Rolling backups | Up to 30 days, then replaced in the normal backup cycle |
The distinction between the two clocks for a quote request is deliberate: the documents themselves leave much earlier than the communication record evidencing that you asked us for a quote.
7. Automated decision-making
We do not carry out automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22.
8. Your rights
You have the right of access, rectification, erasure, restriction, portability, objection to processing based on legitimate interest, and withdrawal of consent where this is the basis, without affecting the lawfulness of processing carried out before withdrawal.
For requests: privacy@el-translations.com. We respond within one month, with a possible extension of two further months for complex requests, in which case we will inform you of the extension and the reasons for it.
Two limitations, stated honestly. Certain data cannot be deleted on request for as long as a legal retention obligation applies, in particular tax records. And, as explained in section 3.5.2, your Moodle account requires a separate request.
Complaint. You have the right to lodge a complaint with the Hellenic Data Protection Authority (1-3 Kifisias Ave., 115 23 Athens, www.dpa.gr).
9. Security
We apply technical and organisational measures proportionate to the risk: a private storage area with an EU jurisdiction commitment, automated deletion at regular intervals, access restriction, written confidentiality commitments from every associate, and vetting of our suppliers. We operate under the ISO 17100, ISO 18587 and ELOT ISO 29993 standards.
10. Validity and amendments
This notice applies from the date it is posted and may be amended. Every updated version is posted with a version reference and date, so that it is always possible to determine which text applied at a given point in time.