Privacy notice

Who is responsible (controller and roles)

The eCouncil platform operator is the controller for personal data processed on this marketing website and in the operations console used to administer the platform. When eCouncil hosts services on behalf of a Municipality, the Municipality is the controller for its citizens' data and the platform operator acts as a processor under a data-processing agreement. The operator's legal entity, registered address, and Data Protection Officer (DPO) contact are published in the site footer and provided on request.

What personal data we process on this site

On this website and in the control-plane console we process a limited set of data:

• Contact and early-access data you provide (name, organisation, email) when you request a demo or get in touch
• Operator and administrator account data for users of the operations console (identity, role, organisation)
• Security and audit logs needed to operate the platform securely
• We do not run advertising or third-party tracking on this site

Why we process it and our legal basis

Each purpose has a legal basis under Article 6 GDPR:

• To respond to demo requests and enquiries you send us (Art. 6(1)(b) and 6(1)(f))
• To provide and secure the operations console to authorised platform administrators (Art. 6(1)(b) and 6(1)(f))
• To keep the platform and its data secure and to maintain accountability records (Art. 6(1)(c) and 6(1)(f))
• With your consent, where we ask for it explicitly — which you may withdraw at any time (Art. 6(1)(a))

Citizen data hosted on behalf of municipalities

Personal data of citizens lives exclusively within each Municipality's own tenant of the platform, where the Municipality is the controller. As platform operator we process that data only on the Municipality's documented instructions, as its processor, and never use it for our own purposes. The control-plane that this site serves does not hold citizen personal data.

How we protect data

We apply technical and organisational security measures appropriate to the data (Art. 32):

• Sensitive national identifiers within tenant services are stored encrypted, with access restricted and individually logged
• Access is limited to authorised personnel on a need-to-know basis
• We keep audit records for accountability
• We do not sell personal data

Service providers and international transfers

We use a limited set of providers that process data on our behalf under data-processing agreements (for example identity, hosting, search, storage, email, mapping, and — where enabled — AI providers). Where a provider operates outside the European Economic Area, transfers are made only with a valid transfer mechanism under Articles 44–49 GDPR.

Cookies and local storage

We keep on-device storage to the minimum needed to run the service. There are no advertising or tracking cookies. We use an essential sign-in session for the console (managed by our identity provider) and store your interface and consent preferences in your browser.

Your rights

Under the GDPR you have the right to access (Art. 15), rectify (Art. 16), erase (Art. 17), restrict or object to (Art. 18 and 21), and port (Art. 20) your personal data, and to withdraw consent at any time where processing is based on consent (Art. 7).

How to exercise your rights or complain

To exercise any of these rights, or for citizen-data requests relating to a specific Municipality, contact our Data Protection Officer using the details in the site footer; citizen requests are forwarded to the relevant Municipality as controller. We respond within one month (Art. 12). You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr) or your local supervisory authority.