Privacy Policy
Last updated: 7 November 2026
Visual Creative Lab uses your personal data only to answer your enquiry, prepare a quote and deliver the project you commission. We do not sell your data, and we do not use it for marketing without your consent.
This policy covers visualcreativelab.com, our enquiry form, our chatbot, and contact with us by email or phone. It follows the EU General Data Protection Regulation 2016/679 ("GDPR") and Greek Law 4624/2019.
1. Who is responsible for your data
The data controller is:
- Name: Sotirios Apostolou, trading as "Visual Creative Lab"
- VAT number: EL105356881
- Address: Smirnis 31, 12242 Aigaleo, Greece
- Email: hello@visualcreativelab.com
- Phone: +30 697 839 2358
We have not appointed a Data Protection Officer (DPO), as one is not required for a business of our size and type. For any privacy question, email hello@visualcreativelab.com.
2. What data we collect
| Category | What it includes | Source |
|---|---|---|
| Contact details | Name, email, phone, preferred contact method | Form, email, phone |
| Business details | Company name, industry, website or Instagram account | Form (when you choose "Company") |
| Enquiry details | Services or package, project description, one-off or ongoing work, preferred date, shoot location, reference links, how you found us, your message | Form, chatbot |
| Files you upload | Photos, videos or PDFs (jpg, png, webp, pdf, mp4, mov), only when a service needs your own material | Form |
| Consents | Acceptance of this policy and, if you opt in, consent to receive news by email | Form |
| Technical data | IP address and time of submission, to protect against spam and abuse | Automatic |
| Project history | Notes, quotes, project stage, correspondence | Created by us |
We do not ask for sensitive data (health, religion and similar). Please do not include it in your message.
If you send us details of other people (for example colleagues for corporate headshots), please make sure they know.
3. Why we use it and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Answering your enquiry, contacting you, preparing a quote | Steps before entering a contract, at your request (6(1)(b)) |
| Delivering the project: shooting, editing, delivery | Performance of a contract (6(1)(b)) |
| Invoicing and tax records | Legal obligation (6(1)(c)) |
| Protecting the form from spam and abuse | Legitimate interest (6(1)(f)) |
| Organising enquiries in our internal system (CRM) | Legitimate interest (6(1)(f)) |
| Occasional emails about new services or offers | Consent (6(1)(a)), optional and withdrawable at any time |
We need your contact details to reply to you. Without them we cannot handle your enquiry.
Photos and videos from shoots. We use project material in our portfolio or social media only if we agree this in writing with the client. The client is responsible for obtaining consent from people who appear in the material, unless we agree otherwise.
4. Automated processing and AI
We use an AI service to help us handle enquiries faster. No decision with legal or similarly significant effect on you is made by AI alone; a person on our team reviews every quote and every project decision.
The AI is used to:
- sort incoming enquiries by type of service and flag requests outside our scope (for example weddings or private events);
- draft suggested replies, which we review before sending, or send an automatic first reply acknowledging your enquiry;
- power the chatbot on our website, which answers general questions about our services and published package prices.
For this, the content of your enquiry or chat message is sent to our AI provider (Anthropic, maker of Claude). Under its business terms the provider processes the data on our behalf and does not use it to train its models. Please do not share sensitive information in the chatbot.
5. Who receives your data
Only our team sees your data. We share it with the providers below, who process it on our behalf under data processing terms, and with public authorities only where the law requires it.
| Provider | Role | Location |
|---|---|---|
| Top.Host | Website hosting, database, uploaded files | Greece / EU |
| Top.Host | Sending and receiving email | Greece / EU |
| Anthropic (Claude) | AI features described in section 4 | USA |
| Cloudflare (Turnstile) | Spam protection on the form, if enabled | USA / global |
| Epsilon Net | Invoicing software and e-invoicing, for clients only | Greece |
Transfers outside the EU. Where a provider is in the USA, the transfer relies on the EU–US Data Privacy Framework, where the provider is certified, or on the European Commission's Standard Contractual Clauses.
6. How long we keep it
| Data | Kept for |
|---|---|
| Enquiries that do not lead to a project | 24 months from our last contact, then deleted |
| Files you uploaded with an enquiry | 12 months, or deleted earlier on request |
| Client and project data | For the duration of the collaboration and 5 years after, for legal claims |
| Invoices and tax records | As long as Greek tax law requires (usually 5 years, up to 20 in some cases) |
| Marketing consent | Until you withdraw it |
| IP addresses for spam protection | Up to 1 hour for rate limiting; kept with the enquiry record for security |
7. Cookies, security and children
Cookies. The enquiry form itself sets no tracking cookies. If we use analytics or advertising tools, they run only after you accept them in the cookie banner. Details are in our Cookie Policy.
Security. The site uses HTTPS. Access to our CRM is limited to our team with personal passwords. Uploaded files are stored in a protected folder on our hosting and are not publicly listed.
Children. Our services are for businesses and adults. We do not knowingly collect data from anyone under 15. If you believe a child has sent us data, contact us and we will delete it.
8. Your rights
You can ask us at any time to:
- access the data we hold about you and get a copy;
- correct data that is wrong or incomplete;
- delete your data, unless we must keep it by law;
- restrict how we use it;
- receive your data in a common machine-readable format (portability);
- object to processing based on our legitimate interest;
- withdraw consent for marketing emails, using the unsubscribe link or by emailing us.
Email hello@visualcreativelab.com. We reply within one month. We may ask you to confirm your identity first.
9. Complaints
If you think we have mishandled your data, please tell us first so we can fix it. You also have the right to complain to the Hellenic Data Protection Authority: Kifisias 1-3, 11523 Athens, www.dpa.gr.
10. Changes to this policy
We may update this policy when our services or tools change. The date at the top shows the latest version. If a change is significant, we will tell clients by email.
11. Contact
Sotirios Apostolou — Visual Creative Lab
Smirnis 31, 12242 Aigaleo, Greece
hello@visualcreativelab.com · +30 697 839 2358