Privacy

Effective date: November 1, 2026

StoupaGreece.com is a public community website. Published photographs, captions, descriptions, event details and chosen public names can be viewed worldwide, shared, indexed by search engines and copied by others. Do not put confidential information in fields intended for publication. Public participation does not waive your data protection rights.

Verification email addresses, verification codes and nonpublic administrative records are not intended for publication. This notice explains how we handle both public content and the personal data needed to operate the service.

Who is responsible

DW Stack operates StoupaGreece.com from Niles, Illinois, USA and is responsible for deciding how the personal data described here is used. In this notice, “we”, “us” and “our” mean DW Stack. Where data protection law uses the term “data controller”, DW Stack fulfils that role.

Operator: DW Stack
Location: Niles, Illinois, USA
Privacy, permissions and removal contact: CS@DWStack.com

StoupaGreece.com is produced by a US company primarily for a US audience and can be accessed from other countries. This notice covers visits, submissions, verification, likes and related communications. Other DW Stack projects must provide information about their own processing. Applicable privacy rights depend on the law governing the particular processing, not solely on a visitor’s citizenship.

Information we collect and what becomes public

Public contributions. We receive the photographs, captions, descriptions, event information and chosen public name you submit. Contact details deliberately entered in public event fields will also be public. Use a public name you are comfortable displaying and do not include a personal address or private telephone number unless it is necessary and intended for publication.

Verification and administration. We receive your verification email address and keep the records needed to administer verification, submission status, moderation, permission choices and rights requests. A verification code expires after 60 minutes. Code expiry does not mean that all associated records are immediately deleted.

Technical information. Requests to the website may generate IP addresses, request times, requested pages, browser or device details, security events and session identifiers. Like controls may also use identifiers to count reactions and reduce duplicates. [CONFIRM THE DATA ACTUALLY RECORDED AND WHETHER ANY INDIVIDUAL LIKE ACTIVITY IS PUBLIC.]

Photo information. Images may reveal identifiable people, locations and details within the scene. Uploaded files may also contain embedded location or camera metadata. Remove unnecessary metadata before uploading. [INSERT THE VERIFIED HANDLING OF METADATA, ORIGINAL FILES AND PUBLIC IMAGE COPIES.]

Why we use personal data

Publication you request. We ask for your permission to publish your own personal data in a contribution, including your chosen public name and your image where included. You choose whether to contribute and may withdraw that permission. Browsing does not require publication consent. Where the GDPR applies, our legal basis for this publication is consent under Article 6(1)(a).

Service administration and security. We use necessary information to verify contributors, administer submissions, prevent spam and duplicate reactions, investigate abuse and respond to ordinary enquiries. Where the GDPR applies, we rely on legitimate interests under Article 6(1)(f): operating a reliable community service and protecting visitors and the website, balanced against the rights of the people concerned.

Legal duties and claims. We use necessary information to meet applicable legal obligations and may retain limited evidence needed for legal claims. Where the GDPR applies, the relevant bases are Article 6(1)(c) for obligations imposed by applicable EU or member-state law and Article 6(1)(f) for establishing, exercising or defending claims. A foreign-law disclosure is assessed separately where required.

Wider DW Stack use. The copyright licence in the Submission Terms does not itself supply permission to process every person’s personal data for every DW Stack project. For optional promotional reuse of your name or image beyond this website, we seek a separate choice identifying the purpose and the relevant projects or channels. Refusing that choice does not prevent a normal website submission. We obtain any additional permissions required for other people shown.

The verification email address is required to submit through this service. Without it we cannot complete verification. We do not treat verification as permission to send marketing emails. Optional public information and optional reuse choices are not required for ordinary browsing.

People shown or described by someone else

We may receive your personal data from a contributor, for example when you appear in a photograph or are named as an event contact. The contributor is the source of that information. Their acceptance of our terms does not automatically constitute your consent.

Where we rely on consent to publish an identifiable person’s information, we require valid permission from that person or an authorised representative. Where appropriate for incidental appearances or public event information, we may instead rely on a documented legitimate-interest assessment, taking account of necessity, reasonable expectations and potential harm. We do not treat being in a public place as unrestricted permission for promotional use.

We provide affected people with the information required by law unless a specific lawful exception applies. Contact us using the details above if you appear in a contribution and want information, correction or removal. You do not need to be the uploader.

Who receives information

Visitors receive published content. Authorised administrators and service providers may access information needed for website hosting, email delivery, maintenance and backups. Providers acting on our behalf receive appropriate instructions and contractual safeguards. We may disclose necessary information to professional advisers or competent authorities where legally required or justified for claims.

Current providers and processing locations: [INSERT HOSTING, EMAIL, BACKUP AND OTHER ACTUAL PROVIDERS, THEIR ROLES AND COUNTRIES, INCLUDING RELEVANT REMOTE ACCESS].

DW Stack administers the website from the United States, so information submitted to us may be handled there. Provider locations are identified above. For disclosures to separate recipients that are restricted international transfers under applicable law, we use the protections that law requires. [IDENTIFY ACTUAL TRANSFERS, DESTINATIONS AND APPLICABLE SAFEGUARDS AFTER VERIFICATION.] You can contact CS@DWStack.com for information about relevant safeguards. Accepting our terms does not waive transfer protections that apply by law.

Cookies and similar technologies

Cookies and browser storage can support verification, security, remembered-device choices and reaction controls. Their use and duration are described below. Choosing “Remember this device” is optional; use “Forget this device” to end remembered access on that device. It does not remove published contributions or all server records.

[INSERT THE VERIFIED COOKIE AND BROWSER-STORAGE INVENTORY: NAME, PROVIDER, PURPOSE, EXPIRY AND WHETHER CONSENT IS REQUIRED. INCLUDE WORDPRESS, THE THEME AND ALL ACTIVE PLUGINS, NOT ONLY THE SUBMISSION FORM.]

Storage or access that is strictly necessary for a service you expressly request may operate without cookie consent. Where consent is required, we ask before activating the technology and provide a way to refuse or withdraw as easily as accepting. First-party technology is not automatically exempt. Browser settings can also block or delete cookies, although some requested features may then stop working.

[INSERT A VERIFIED STATEMENT ABOUT ANALYTICS, ADVERTISING, EXTERNAL EMBEDS AND CAPTCHA. IF NONE ARE PRESENT, SAY SO ONLY AFTER CHECKING THE ENTIRE SITE.]

How long we keep information

We keep personal data for the purpose explained in this notice and remove or anonymise it when it is no longer needed. The following periods and criteria apply:

• Published contributions: while they remain relevant to the community publication and there is a lawful basis to display them, subject to withdrawal, objection and removal requests. Event listings: [INSERT THE ACTUAL POST-EVENT RETENTION OR ARCHIVING RULE].
• Verification records and remembered-device sessions: [INSERT CODE-RECORD DELETION PERIOD, SESSION EXPIRY AND INACTIVE CONTRIBUTOR-RECORD RETENTION]. The 60-minute code validity period is not a retention period for the whole record.
• Rejected, abandoned or unpublished uploads: [INSERT DELETION PERIOD AND THE EVENT THAT STARTS IT].
• Routine security logs, rate-limit records and like identifiers: [INSERT EACH RETENTION PERIOD]. Evidence of a specific incident may be retained longer while the incident or a related claim is being resolved.
• Permission evidence and request correspondence: while needed to demonstrate the permission relied on, resolve the request or address a specific legal claim, with periodic review. [INSERT THE ACTUAL REVIEW OR MAXIMUM RETENTION RULE].
• Backups: deleted information may remain in restricted backup copies until they expire after [INSERT MAXIMUM BACKUP PERIOD]. It is not used for ordinary publication, and relevant deletions are reapplied if a backup is restored.

A specific legal requirement or unresolved claim may justify keeping limited information longer. Such information is restricted to that purpose. We do not retain everything indefinitely simply because the website is public.

Security and limits of public publication

We use access controls and other measures appropriate to the information and risks involved. Nonpublic records and uploads not approved for publication must be protected against unauthorised access. No online service can guarantee absolute security.

Public content may be copied outside our control. Removing it from our website cannot guarantee that every external copy, search result or previously distributed publication disappears. This does not remove our own duties to respond to rights requests or take required steps concerning recipients and other controllers.

Your choices and rights

You can contact us about your personal data wherever you are. Depending on applicable law, you may have rights of access, correction, erasure, restriction, portability and complaint to a regulator. We apply the statutory conditions for each right and explain our response.

You may withdraw consent at any time, without affecting the lawfulness of processing before withdrawal. Use the available submission controls or contact CS@DWStack.com. We will stop consent-based use after withdrawal and address removal without undue delay. Limited records may remain where a separate, valid legal reason requires or justifies them.

You may object to processing based on legitimate interests for reasons relating to your circumstances. We will stop that processing unless the applicable legal grounds allow it to continue, and explain our decision. You may object to direct marketing at any time, in which case that marketing use must stop.

For a request concerning a post, include its link and enough detail to identify the information concerned. We may ask for proportionate information to confirm identity or authority when needed. Do not post identity documents publicly. We do not require a WordPress account to make a request.

We aim to respond to privacy requests without undue delay and within one month, and comply with any applicable legal deadline. Where the GDPR applies, we respond within one month unless its permitted extension applies. If complexity or the number of requests justifies that extension, we notify you within the first month; the extension may be up to two additional months. Requests are normally free of charge.

Erasure is not absolute. For example, a specific legal obligation, legal claim or applicable freedom-of-expression protection may affect the outcome. We explain any refusal and the available complaint or judicial remedies. A public-site label is not a reason by itself to refuse a request.

Where the GDPR applies to the processing, you may complain to a competent data protection authority. The Hellenic Data Protection Authority at www.dpa.gr may be competent where Greece is your habitual residence, place of work or the location of an alleged infringement. For a complaint about an unanswered or unsatisfactory rights request, follow the Authority’s procedure, including first exercising the right with us. Other rights and complaint routes under applicable law remain available.

Children and sensitive information

Contributors must be at least 18 under our Submission Terms. This is our submission rule, not a statement that all under-18 browsing is prohibited. Images of children require particular care and appropriate authority for the proposed use. We do not treat an adult uploader’s checkbox as unrestricted permission to use a child’s image.

Do not submit identity documents, sensitive personal records or unnecessary information revealing health, beliefs or similar private matters. A photograph or caption may reveal sensitive information even without naming a person. We may restrict or remove material that cannot lawfully be handled through this community service.

Automated checks and human review

Automated checks may allow publication, hold a contribution for review, reject it or restrict suspected abuse. These checks do not verify all permissions or guarantee accuracy. You may contact us to request human review of a moderation result. [CONFIRM WHETHER ANY PROCESS MAKES SOLELY AUTOMATED DECISIONS WITH LEGAL OR SIMILARLY SIGNIFICANT EFFECTS; IF SO, ADD THE REQUIRED EXPLANATION AND SAFEGUARDS.]

Changes to this notice

We update this notice when our practices change and show the effective date above. We provide further notice or obtain fresh consent when required. A revised notice does not retrospectively grant permissions for new uses.