Privacy Notice
How we collect, use, and protect your personal data
Data Controller
Inkludio Training Single Member P.C.
Valtetsiou & Tripoleos, Larisa 41336, Greece
VAT: EL802984528 | G.E.MI.: 186773840000
Contact: info@inkludio.gr
Last update: 09 February 2026
What we collect & why
1. What data we collect
When you submit the registration form, we may collect the following personal data: your name, surname, nationality, email address, preferred course dates, English language level (CEFR), school level or organisation, subject(s) taught, confirmation of public funding (such as Erasmus+ or other public funding), invoice type, and any information you choose to include in the free-text "Notes" field.
We collect nationality for two reasons. First, it allows us to make appropriate pedagogical and cultural adaptations to course activities, given the international composition of our participant groups. Second, where applicable, it helps us meet the reporting and statistical requirements of Erasmus+ or other EU-funded programme rules.
If invoicing is required, we may also collect the billing details necessary to issue a legal invoice.
2. Why we use your data
We use your personal data for the following purposes:
- To process and manage your course registration, allocate your seat, and communicate with you about the course.
- To issue the Course Confirmation Document and the practical information pack, including venue and access details.
- To deliver the training and share essential course materials before, during, and after the course.
- To prepare attendance records and issue the Certificate of Completion (subject to attendance and completion rules as well as full payment).
- To carry out a short course evaluation and feedback activity aimed at improving the quality of the training.
- To fulfil our legal and accounting obligations, including invoicing.
- Where relevant for Erasmus+ or other public funding: to provide basic attendance, certification, and invoicing evidence to you and to the sending organisation, and to meet reasonable audit and documentation requests.
We do not use your data for newsletters, direct marketing, or any unrelated purposes. We do not sell your data.
3. Legal basis for processing
Contractual necessity
Processing is necessary to take steps at your request before providing the service and to perform the service itself. This covers registration and course delivery (Article 6(1)(b) GDPR).
Legal obligation
Processing is necessary to comply with our legal obligations, including accounting and tax requirements (Article 6(1)(c) GDPR).
Legitimate interests (course evaluation)
Course evaluation feedback is processed on the basis of our legitimate interests in improving training quality (Article 6(1)(f) GDPR), limited to what is necessary.
For the legal basis applicable to photographs and videos, please see Chapter 03 below.
4. Mandatory nature of data provision
Providing the data requested in the registration form is necessary for us to process your registration, communicate with you, allocate a seat, and issue attendance and certification documentation. If you do not provide the required data, we may not be able to register you or issue the certificate.
Sharing, retention & rights
5. Who we share your data with
We share personal data only when necessary and only for the purposes described above. The categories of recipients include:
- Our accountant or financial service provider, for invoicing and accounting obligations.
- IT and communications providers (email, online forms, cloud storage, website hosting).
- Payment service providers or banks, to process payments where applicable.
- An external photographer or videographer, if engaged for course coverage.
- Social media platforms, only where you have given your consent to public dissemination of photographs or videos.
- Sending organisations or schools, where invoicing or certification evidence is requested or required for public funding administration.
Where required, our service providers act under written data-processing agreements and only on our documented instructions.
6. International data transfers
Some of the service providers listed above may process personal data outside the European Economic Area (EEA). Where this occurs, we take reasonable steps to ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR. These safeguards may include the use of Standard Contractual Clauses approved by the European Commission, or reliance on adequacy decisions where applicable.
7. How long we keep your data
We retain personal data for five years from the end of the relevant fiscal year. This retention period serves the purposes of accounting compliance, legal compliance, and reasonable audit or evidence needs linked to publicly funded participation.
This period is aligned with Greek accounting and tax record-keeping obligations, including Law 4308/2014 (Article 7) and the Code of Tax Procedure, Law 4174/2013 (Article 13), as amended and codified.
8. Your rights
Under the GDPR, you have the following rights:
- The right to access your personal data and receive information about how it is processed.
- The right to rectification if your data is inaccurate or incomplete.
- The right to erasure (deletion) of your data, where the conditions for erasure are met.
- The right to restriction of processing in certain circumstances.
- The right to object to processing based on legitimate interests.
- The right to data portability (Article 20 GDPR).
- Where processing is based on consent, the right to withdraw consent at any time.
To exercise any of these rights, please contact us at info@inkludio.gr.
You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) at www.dpa.gr.
Media, automation & updates
9. Photographs and videos
What we collect
During the course, we may take photographs or make video recordings that include your image and, where applicable, audio.
Purposes
(a) Public dissemination and communication
We may use photographs or videos on our website, social media channels, and printed or digital materials to present the course and its outcomes.
(b) Internal documentation
We may use photographs or videos as evidence of course delivery, for internal reporting, and for quality documentation. These materials are not published publicly.
Legal basis
- Public dissemination: We rely on your consent (Article 6(1)(a) GDPR).
- Internal documentation: We rely on our legitimate interests in documenting course delivery and maintaining quality assurance (Article 6(1)(f) GDPR).
Refusing or withdrawing consent for public dissemination will not affect your participation in the course in any way.
Retention
- Public dissemination materials: maximum 3 years.
- Internal documentation materials: maximum 5 years.
To withdraw your consent or object, please email info@inkludio.gr with the course dates and, if possible, a screenshot or link to the relevant material.
10. Automated decision-making
We do not carry out any automated decision-making or profiling that produces legal effects concerning you or that similarly significantly affects you.
11. Changes to this notice
We may update this Privacy Notice from time to time to reflect changes in our practices or in legal requirements. The updated version will be made available on our website and, where appropriate, communicated to you directly.
