Privacy Policy
Last updated: 20 September 2026
Who is responsible
This website is operated from Greece by Vasiliki (Kiki) Papadioti under the name Kiki Papadioti — A Papa Square Edition House. The business contact email is papadiotik@gmail.com .
Information we receive
When you submit an appointment request, you provide your name, email address and message, and may also provide a phone or WhatsApp number, city and country, and preferred appointment type. The shorter contact form requests your name, email and message. Please do not include payment card details, health information or other sensitive personal data in the message. We may also receive ordinary correspondence you send in response.
Why we use it
We use enquiry information to read and respond to your request, arrange a consultation or appointment, discuss a proposed creation and maintain relevant correspondence. We do not use enquiry details to add you to a marketing list through these forms. For requests about a possible purchase or private commission, the legal basis is taking steps at your request before a contract (GDPR Article 6(1)(b)). For general contact and appointment administration that is not tied to a possible contract, the legal basis is our legitimate interest in answering enquiries and organising appointments (Article 6(1)(f)), balanced against your rights. We do not use these forms to collect marketing consent. The form checkbox confirms that you have read this policy; it is not consent to receive marketing.
Services that receive information
The website is delivered through Cloudflare Pages. Form submissions are sent to Formspree, which receives the fields you submit and technical information associated with the request so it can deliver, store and protect submissions. Authorised people handling enquiries may access the resulting messages. Your email provider may receive a copy if Formspree email notifications are enabled. Read Cloudflare’s privacy information and Formspree’s privacy information for their service details.
Transfers outside the EEA
Our service providers may process information outside the European Economic Area. Cloudflare publishes a data processing addendum that describes its transfer safeguards, including EU standard contractual clauses where applicable. Formspree states that information may be processed in the United States and other countries and that it takes steps to protect international transfers. See Formspree’s privacy policy for its published information. You may request details of the safeguards applicable to your enquiry using the contact details above.
How long we keep information
We delete or anonymise enquiries that do not become a commission within 12 months after the last relevant contact. Active discussions may be kept while the enquiry is being handled. If a commission or purchase follows, records may be kept for the period required by applicable accounting, tax or legal rules. This retention period includes copies held in our Formspree account, notification mailbox and other records.
Your choices and rights
Depending on the circumstances and applicable law, you may request access, correction, deletion or restriction of your personal data, object to certain processing, or request portability. Where processing relies on consent, you may withdraw it. Contact papadiotik@gmail.com or use our contact form to make a request. You may also complain to the Hellenic Data Protection Authority or another competent supervisory authority.
Website storage and security
The supplied website code does not add analytics or advertising trackers. Hosting and form services may process technical information needed to deliver and protect the site and submissions. See the Cookie Policy for browser storage. We take reasonable steps to limit access to enquiries; no internet transmission can be guaranteed completely secure.
Updates
This policy should be updated when the site adds new tools, changes its form process or changes its retention practice. The date on this page will be revised when the published policy changes.