Privacy Policy

What microgreens.org.gr does with your data, measured 30 July 2026: no cookie banner and no consent collected for cookies or tracking. No cookies on a first visit from the EU, EEA, UK or Switzerland — but cookies and remarketing everywhere else. Google Analytics, Ads and Fonts load on every page.

This policy explains what happens to your data when you use microgreens.org.gr, and what rights you have under the EU General Data Protection Regulation (GDPR) and Greek data-protection law.

It describes how the site actually behaves, measured on 30 July 2026 by loading pages with all cookies and stored data cleared and recording every network request the browser made. Where the site falls short of the standard we want to meet, this policy says so rather than claiming otherwise. That is the same approach we take in our accessibility statement.

The short version: this site loads Google Analytics, Google Ads and Google Fonts on every page, for every visitor, before you interact with anything and without asking your permission first. There is no cookie banner, and no consent is collected for cookies or tracking. What happens next depends on where you are. If you are in the EU, the EEA, the UK or Switzerland, a regional Google setting means no cookies are set on a first visit — but information about your visit, including your IP address, still reaches Google. If you are anywhere else, that setting does not apply to you: advertising and analytics cookies are set and remarketing requests are made on your very first visit, without you ever having been asked. The sections below set out exactly what is sent, when, and where this does not meet what the law expects.

Who we are (data controller)

This website is operated by the European Voluntary and Educational Center (EVEC Athens), a non-profit organisation based in Athens, Greece.

What we collect directly from you

Contact and enquiry forms

The site carries two contact forms, built with Fluent Forms — one on the contact page, and one inside the “Get in touch” popup that opens from the header. Because the header is site-wide, that second form is loaded on every page of this site, including the one you are reading now. It sits idle until you open the popup, but its code is present on every page. Both ask for the same five things: your name, email address, phone number, company name and your message. Only your email address and message are required; the phone and company fields can be left empty and there is no disadvantage to leaving them empty.

When you submit a form, the data is sent to this website’s own server — not to a third-party form service — and emailed to the EVEC team. We use it only to reply to you and to keep a record of the correspondence. We do not add you to any mailing list and we do not pass your details to anyone else. Legal basis: our legitimate interest in answering enquiries (GDPR Art. 6(1)(f)).

Comments

When you leave a comment on an article, we collect what you type into the comment form — name, email address, optional website and the comment itself, plus a star rating on recipe pages — together with your IP address and browser user-agent string, which WordPress records to help detect spam. We do not set any cookies when you comment. WordPress’s optional “remember my details” checkbox is switched off on this site, so no comment cookie is offered and none is stored. Legal basis: your consent, given by the deliberate act of submitting the comment for publication (Art. 6(1)(a)), and our legitimate interest in preventing abuse (Art. 6(1)(f)). This is the only place on the site where consent is a legal basis, and it is therefore the only consent you can withdraw: ask us and we will delete the comment. It is entirely separate from the analytics and advertising described below, for which no consent is asked for or collected.

Site search

The search box submits to this site’s own server. Your search terms are not sent to an external search provider.

We do not operate a newsletter or any mailing list. There is nothing on this site to subscribe to, and we do not collect email addresses for marketing.

What happens automatically on every page

The following load on every page of this site, on a first visit, before you click anything and without being asked.

Google Fonts

This site’s typefaces (Open Sans and League Spartan) are loaded from Google’s servers at fonts.googleapis.com and fonts.gstatic.com, not from our own. They are not self-hosted. Because your browser has to fetch the files directly from Google, your IP address is transmitted to Google every time you open a page here, along with the address of the page you are on and basic details of your browser. This happens before any consent step and cannot currently be avoided while using the site. Self-hosting these fonts would remove the transfer entirely, and doing so is on our list.

Google Analytics and Google Ads

We use Google Analytics 4 and Google Ads, loaded through the Google Site Kit plugin, to see how the site is used and to measure our campaigns. In practice this means the following tags load on every page:

  • A Google tag container (GT-WPL25FJZ) installed by Site Kit.
  • Two separate Google Analytics 4 properties, G-5T0LQ7MQYD and G-1VBF4M4EHS. Two are running because a second measurement tag was added alongside the one Site Kit manages. Your visit is therefore reported to Google twice.
  • A Google Ads tag (AW-8175687453), which exists to measure advertising conversions and to build remarketing audiences — that is, to allow advertising to be shown to people who have visited this site.
  • A request to pagead2.googlesyndication.com, part of the same advertising system.

Even when these tags are running in their restricted, “consent denied” state and set no cookies, they still send Google: your IP address, the full address of the page you are viewing, the page title, your screen size and browser and device characteristics, and a randomly generated visitor identifier. This includes the page you are reading right now. Google acts as an independent controller for advertising purposes under its own terms.

Cookies: what is set, and when

On a first visit from the EU, the EEA, the UK or Switzerland, this site sets no cookies at all. We verified this from inside that region by clearing everything, loading the homepage, an article and this page, and confirming that no cookie was stored and that the server sent no cookie-setting instruction. That result depends entirely on the regional default described in the next section: from outside those countries the Google cookies listed below are set on the first visit instead, without any request for consent. The only cookie we would ever set ourselves is WordPress’s own login cookie, which is set for site administrators when they sign in and never for an ordinary reader. Leaving a comment sets no cookie either: as the comments section above says, the “remember my details” option is switched off, so no comment cookie is offered and none is stored.

If the Google tags move into their unrestricted state, the following are created immediately: _gcl_au (Google Ads), _ga, _ga_1VBF4M4EHS and _ga_5T0LQ7MQYD (Google Analytics), plus an entry called _gcl_ls in your browser’s local storage. At the same time your browser begins contacting Google’s advertising infrastructure — doubleclick.net, google.com/pagead and related addresses — to add you to advertising audience lists. That is advertising, not measurement, and the section below explains when it happens.

Consent: what we do, and what we do not do

This is the part of this policy most likely to matter to you, so we will be direct about it.

This site has no cookie banner and no consent mechanism for cookies or tracking. There is no consent settings panel, no “accept” or “reject” control, and no cookie preferences page. For the analytics, advertising and fonts described above we do not ask you for consent, and there is currently no way for you to give it or withhold it on this site.

There is exactly one exception, and it is not a cookie. Publishing a comment is a deliberate act you choose to take, and that act is your consent to publish what you wrote (Art. 6(1)(a)), as the comments section above explains. It sets no cookie, sends nothing to Google, and has no effect on the tags described here. It is also, for that reason, the only consent on this site that you can later withdraw — ask us and we will delete the comment.

What we do have is Google Consent Mode, configured with a single regional default. It tells Google to treat all seven consent signals as denied for visitors in a fixed list of 32 country codes: the 27 EU member states plus Iceland, Liechtenstein, Norway, the United Kingdom and Switzerland. There is no equivalent worldwide default, nothing on the site ever sends Google a consent update, and there is no mechanism that can change that setting once the page has loaded. The consequences run in two directions, and both are worth stating plainly:

  • If you are in the EU, EEA, the UK or Switzerland: no advertising or analytics cookies are set, and none can be, because nothing on the site ever sends Google a consent update. The analytics and advertising tags still load and still send Google the data listed above — your IP address among it — on every page.
  • If you are anywhere else — for example the United States, Canada, Australia, Japan, or any country in Africa, Asia or Latin America — the regional default does not apply to you, so Google Consent Mode treats consent as granted by default. The cookies listed above are set and the advertising and remarketing requests are made, without you ever having been asked.

Where this falls short, stated plainly: EU law requires that non-essential analytics and advertising technologies be loaded only after the visitor has given informed consent, and that transfers such as the Google Fonts request be disclosed and, in practice, avoidable. This site does not meet that standard today. The tags load before any consent step; visitors outside Europe receive cookies and remarketing without being asked; and the fonts are fetched from Google on every page view. We are not claiming consent as the legal basis for this processing, because we collect no consent for tracking. Fixing this means adding a real consent banner that blocks these tags until you choose, adding a worldwide “denied” default, and self-hosting the fonts. Until that work is done, this policy tells you what is happening so you can decide for yourself.

What you can do in the meantime. Because we offer no on-site control, the only controls available to you are your own: block or delete cookies in your browser settings, use a content blocker or privacy-focused browser, use your browser’s private mode, or install Google’s Analytics opt-out add-on. You can also write to us at evec.microgreens@gmail.com and object to this processing, and we will act on it.

Content embedded from other services

Most pages on this site embed nothing from anyone. There are three exceptions, and they behave differently from one another:

  • Google Slides on the toolkits page. The four teaching toolkits on our toolkits page are slide decks hosted on Google Slides and displayed inside the page. They load as you scroll to them, without asking. When one loads, Google receives your IP address and the address of the page. Only that page is affected.
  • Author photographs on articles. Article pages show an author avatar loaded from Gravatar, a service run by Automattic. The image address contains a scrambled (hashed) form of the author’s email address — not yours — but loading it does send your IP address to Automattic.
  • The map on the contact page. This one is click-to-load: nothing is requested from Google Maps until you press “Show map”. If you never press it, no map request is made and no data goes to Google from that component.

There are no social-media tracking pixels on this site. Our Facebook, Instagram and TikTok presences appear only as ordinary links in the footer; nothing is loaded from those companies unless you click through to them. There are no embedded videos that load automatically, and no reCAPTCHA.

Server logs, hosting and security

Our hosting provider, Hostinger, automatically records standard server-log data — IP address, date and time of access, and the pages requested — to keep the site secure and running. We also run an activity-logging plugin (WP Activity Log) that records administrative actions taken on the site and the IP addresses associated with login attempts; this is about protecting the site’s own accounts, not about tracking readers. Legal basis: our legitimate interest in the security and stability of the site (Art. 6(1)(f)).

How long we keep your data

  • Enquiry-form messages: kept while we handle your request and for up to 24 months afterwards, then deleted.
  • Comments: retained as long as the comment is published, so we can recognise follow-up comments.
  • Analytics: held by Google according to the retention period configured in the two Analytics properties. See the note below — we have not yet published that value.
  • Server logs: for a short period as set by our host, then rotated.

Who your data goes to, and where

We do not sell your personal data and we do not share it with anyone for their own marketing. It reaches only the providers that make this website work: Hostinger (hosting), Google (fonts, analytics, advertising and the embedded slide decks) and Automattic (the Gravatar author images). Google and Automattic are based in the United States. Where data is transferred outside the EU/EEA, those providers rely on safeguards including the EU–US Data Privacy Framework and Standard Contractual Clauses. We have not negotiated separate terms with them beyond their standard ones.

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict or object to the processing of your personal data, and the right to data portability. To exercise any of these, write to evec.microgreens@gmail.com and we will respond.

The GDPR also gives you the right to withdraw consent at any time. On this site that right attaches to exactly one thing: a comment you chose to submit for publication. Ask us and we will delete it. For everything else described above — the analytics, the advertising and the fonts — there is no consent for you to withdraw, because we never asked you for any. The practical equivalents there are the browser-level controls described above, and writing to us to object.

If you believe your data has been handled unlawfully, you have the right to lodge a complaint with the Greek supervisory authority:

Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα)
Kifissias Avenue 1–3, 115 23 Athens, Greece
Website: www.dpa.gr — Email: complaints@dpa.gr

What we have not been able to confirm

Everything above was checked against the site’s actual behaviour. Three details sit in parts of the system we could not inspect the same way, so rather than assert them we are naming them, and we will publish the answers here once we have them:

  • Whether the contact form stores your IP address alongside your message. Fluent Forms can be configured either way and we have not verified which setting is active on this installation.
  • The exact mailbox that contact-form submissions are delivered to. They go to the EVEC team; we have not confirmed the specific address configured in the form’s notification settings.
  • The data-retention period set in the two Google Analytics properties, which determines how long Google keeps visit-level data.

If any of these matters to you before we get to it, ask us at evec.microgreens@gmail.com and we will look it up and tell you.

Changes to this policy

We will update this page when the site changes — including, we hope, to record that the consent banner exists and that the gaps described above have been closed.

Last reviewed 30 July 2026. This review replaced several statements that were no longer true: a newsletter section describing a mailing list this site does not operate; a reference to cookie settings that do not exist; a comment cookie opt-in that the comment form does not offer; and the claim that analytics and advertising ran only after visitors accepted them. Google Fonts, the second Analytics property, Google Ads remarketing, the Gravatar author images and the phone and company form fields were previously undisclosed and are now described above. A same-day correction then removed three internal contradictions: the “no cookies on a first visit” finding was measured from inside the EU and is now stated as holding only for the 32 countries covered by the regional default, with the opposite outcome stated for everywhere else; the legal basis for comments is now reconciled with the fact that no consent is collected for tracking; and the second contact form is now correctly described as present on every page, not only the homepage. A further correction the same day removed the last of those contradictions: this page had still said in two places that no consent is collected at all, which conflicted with the comment consent described above. Those statements are now scoped to cookies and tracking, and the single exception — publishing a comment — is stated in the consent section itself.

Co-funded by the European Union.
This portal presents the microgreens methodology; the organisation behind it is EVEC Athens — the European Voluntary and Educational Center (evec.org.gr). Views and opinions expressed are those of the author(s) only and do not necessarily reflect those of the European Union or the European Commission. Neither the European Union nor the granting authority can be held responsible for them.

Open licence. Except where stated otherwise, the educational materials on this portal are licensed under CC BY 4.0 — free to use, adapt and share, including commercially, with credit. See the licence terms.

Accessibility. We aim for WCAG 2.1 AA and publish what does and does not yet meet it — see the accessibility statement. If anything here blocks you, tell us and we will send the material in a format that works for you.