Privacy Policy, Cookie Policy and Terms of Use

Last updated: 31 July 2026

Effective from: 31 July 2026

1. Introduction

This document describes how NAMA CONSULTING ENGINEERS AND PLANNERS S.A. ("NAMA", "we", "us" or "our") processes personal data of visitors to the website www.namanet.gr (the "Website"), which cookies and similar technologies the Website uses, and the terms under which you may use the Website.

We process personal data in accordance with Regulation (EU) 2016/679 (the "GDPR"), Greek Law 4624/2019, and Greek Law 3471/2006 on the protection of personal data in the electronic communications sector.

This policy applies only to the Website. It does not apply to processing carried out by NAMA in the context of its professional activities, its contractual relationships, or its recruitment procedures, nor to third-party websites that may be linked from the Website.

2. Data controller

NAMA has not appointed a Data Protection Officer, as it is not required to do so under Article 37 GDPR. Please direct any privacy-related enquiry to the contact details above.

3. Summary — what this Website does and does not do

The Website is an informational presentation of NAMA's work and services.

The Website does not:

• contain any contact form, registration form, newsletter subscription, or any other form through which you may submit data to us;
• offer user accounts, log-in, or any personalised area;
• process payments or accept orders;
• operate a booking or appointment system;
• carry out advertising, retargeting, or the building of marketing profiles;
• carry out profiling or automated decision-making producing legal or similarly significant effects on you (Article 22 GDPR);
• sell personal data, or disclose it to third parties for their own commercial purposes.

NAMA does not maintain any server-side database of Website visitors. The personal data described in this policy is either processed on our behalf by the third-party providers listed in Section 5, on their own infrastructure, or stored locally on your own device by those providers' scripts (in cookies, browser local storage, or cache). We ourselves access only aggregated or pseudonymised reports.

4. Personal data we process and the legal basis for doing so

Even though the Website collects no data from you through any form, the mere act of visiting a website necessarily involves the processing of certain data — above all, your IP address, which is personal data under the GDPR — and the loading of the Website's functional components (video, map, images, fonts) transmits technical data to the providers that supply them.

4.1 Technical delivery, hosting and security

Provider: Cloudflare, Inc. (Cloudflare Pages)

To transmit the Website to your device and to keep it secure and available, the following are processed automatically: your IP address, the date and time of the request, the pages and files requested, the HTTP status code, the volume of data transferred, the referring URL, your browser type and version, and your operating system.

• Purpose: delivering the Website, ensuring network and information security, defending against attacks and abusive traffic, diagnosing faults.
• Legal basis: Article 6(1)(f) GDPR — our legitimate interest in operating a secure, functional and available website. Recital 49 GDPR expressly recognises network and information security as a legitimate interest.
• Storage on your device: none. Cloudflare Pages does not set cookies on this Website.

4.2 Aggregated audience measurement

Provider: Cloudflare, Inc. (Cloudflare Web Analytics)

We use Cloudflare Web Analytics to obtain aggregate statistics on Website traffic. The service is transmitted through a lightweight beacon (cloudflareinsights.com). It does not use cookies, does not use local storage, and does not employ device fingerprinting to track visitors across sites or over time. It reports data only in aggregate (page views, referrers, country, browser and device category).

• Purpose: understanding overall Website traffic in aggregate form.
• Legal basis: Article 6(1)(f) GDPR — our legitimate interest in understanding the use of our Website. As no information is stored on or read from your device, no consent is required under Article 4(5) of Law 3471/2006.

4.3 Error and performance monitoring — Sentry

Provider: Functional Software, Inc. (Sentry), processed in the European Union

We use Sentry to detect and diagnose technical errors so that we can keep the Website working correctly. When an error occurs, Sentry receives technical diagnostic data: the error and stack trace, the URL and page state, your browser and operating system, approximate device information, and your IP address. We do not use Sentry's session-replay feature. Sentry event data for this Website is ingested and stored in Sentry's European Union region (de.sentry.io); it is therefore not transferred to a third country.

• Purpose: detecting, diagnosing and correcting technical faults; ensuring the security and integrity of the Website.
• Legal basis: Article 6(1)(f) GDPR — our legitimate interest in a functioning, secure and error-free website.
• Storage on your device: none set by the Sentry error SDK.

4.4 Behavioural analytics and session replay — Microsoft Clarity

Provider: Microsoft Corporation / Microsoft Ireland Operations Limited

We use Microsoft Clarity to understand how visitors use and interact with the Website through behavioural metrics, heatmaps and session replay, in order to improve the Website and our services.

Clarity loads only if you give your consent through the cookie banner. Until you click to consent, Clarity is not initialised: it sends nothing and stores nothing. If you consent, Clarity then processes, in pseudonymous form: the pages viewed and their order; mouse movements, clicks, taps and scrolling; session duration; screen resolution and device type; browser and operating system; referring URL; approximate geographic location derived from the IP address; and your IP address. It reconstructs this into a replay of your visit. On this Website, Clarity is additionally configured not to set cookies, so no _clck, _clsk, CLID or MUID cookies appear even after you consent. Clarity masks sensitive content by default, and the Website contains no input fields.

Microsoft acts both as our processor and, for certain purposes described in the Microsoft Privacy Statement, as an independent controller of the data collected through Clarity — including for its own analytics and advertising purposes. For more information about how Microsoft collects and uses your data, please see the Microsoft Privacy Statement.

• Purpose: analysing user behaviour, optimising the Website, security.
• Legal basis: Article 6(1)(a) GDPR — your consent, and Article 4(5) of Law 3471/2006. Clarity is loaded only after you consent through the banner. You may withdraw your consent at any time, as easily as you gave it, via the cookie-settings link on the Website; withdrawal does not affect the lawfulness of processing carried out beforehand.
• Opt-out: independently of the banner, you may also opt out of Clarity's telemetry via Microsoft's mechanism at https://choice.microsoft.com/.

4.5 Video hosting — Wistia

Provider: Wistia, Inc.

Videos on the Website are hosted and delivered by Wistia and load as part of the Website's normal functionality. When a page containing a Wistia video loads, or when you play a video, your IP address, browser data, and information about your interaction with the video player (plays, pauses, watch duration, progress) are transmitted to Wistia. Wistia stores data in your browser's local storage on the domain fast.wistia.net (an account-loaded flag and, for each video, a resume position) so that a video can continue where you left off. Wistia does not set cookies on our domain.

• Purpose: delivering the video content that forms part of the Website.
• Legal basis: Article 6(1)(f) GDPR — our legitimate interest in presenting our work through video as an integral part of the Website. The local-storage entries are used to provide and resume that playback.

4.6 Interactive map — Mapbox

Provider: Mapbox, Inc.

We use Mapbox to display an interactive map, which loads as part of the Website's normal functionality. When the map loads, your IP address and technical request data are transmitted to Mapbox, which serves the map tiles. Mapbox stores in your browser's local storage a telemetry identifier and event data relating to your interaction with the map (mapbox.eventData), and caches map tiles in the browser's Cache Storage (mapbox-tiles) for performance. Mapbox does not set cookies.

• Purpose: displaying our locations and project sites on an interactive map that forms part of the Website.
• Legal basis: Article 6(1)(f) GDPR — our legitimate interest in providing an interactive map as an integral part of the Website. See the note in Section 6.4 on the telemetry component.

4.7 Image hosting and delivery — ImageKit

Provider: ImageKit (Saffron Edge Pvt. Ltd. / ImageKit.io)

The photographs and images on the Website are stored, optimised and delivered through ImageKit's content delivery network (ik.imagekit.io). When an image loads, your IP address and standard request data (browser, referring page) are transmitted to ImageKit so that the correctly sized and formatted image can be served.

• Purpose: efficient delivery and optimisation of the Website's images.
• Legal basis: Article 6(1)(f) GDPR — our legitimate interest in delivering the Website's visual content efficiently.
• Storage on your device: none beyond the browser's ordinary image cache.

4.8 Fonts and icons — Google Fonts and Google Material Icons

Provider: Google LLC / Google Ireland Limited

The Website uses typefaces and icons supplied by Google, which load as part of the Website's presentation. Where these are loaded from Google's servers (fonts.googleapis.com and fonts.gstatic.com), your IP address and browser data are transmitted to Google at the moment the page loads. Google Fonts sets no cookies and stores nothing on your device, so no consent is required under Article 4(5) of Law 3471/2006; the only processing is the transmission of your IP address to Google.

• Purpose: the consistent typographic presentation of the Website.
• Legal basis: Article 6(1)(f) GDPR — our legitimate interest in a consistent visual presentation. (Self-hosting these assets would remove the transmission to Google entirely; see the note in Section 6.4.)

4.9 Content management — Contentful

Provider: Contentful GmbH, Berlin, Germany

Some news and blog articles shown on the Website are stored in Contentful and retrieved through its GraphQL API. Where this retrieval takes place in your browser, your IP address and request data are transmitted to Contentful. Contentful does not set cookies for this purpose and does not track you.

Separately, and unrelated to Contentful, the Website's own front-end JavaScript caches content and checksums in your browser's local storage (content_collection_*, content_checksum_*) to speed up page loads. These entries are set by NAMA as first-party storage; Contentful is not involved in them.

• Purpose: delivering the news articles you have requested (Contentful); caching content in your browser for performance (NAMA's own front-end).
• Legal basis: Article 6(1)(f) GDPR — our legitimate interest in operating the Website using a content management system and in caching content for performance. The local-storage cache is first-party and functional.

4.10 Language preference

The Website remembers the language you use or are redirected to, by means of the i18n_redirected and lang cookies. This is functionality you have requested by choosing a language.

• Legal basis: Article 6(1)(f) GDPR, and Article 4(5) of Law 3471/2006 — these cookies are necessary to provide a service (your chosen language) that you have expressly requested, and are therefore exempt from consent.

4.11 If you contact us directly

The Website publishes an email address and a telephone number. If you choose to contact us, we will process the data you provide (your name, contact details, and the content of your message) in order to respond to you.

• Legal basis: Article 6(1)(f) GDPR — our legitimate interest, and yours, in responding to your enquiry; or Article 6(1)(b) GDPR where your enquiry concerns a prospective contract.
• Retention: for as long as necessary to handle your enquiry and, thereafter, for the period necessary to establish, exercise or defend legal claims. Where a contractual or commercial relationship results, the general limitation period under Greek law (Article 249 of the Greek Civil Code — twenty years, or five years for the claims listed in Article 250) and the record-keeping obligations of tax legislation (Article 13 of Law 4174/2013 — generally five years from the end of the year in which the relevant tax year expires) apply.

4.12 Link to LinkedIn

The Website contains a plain hyperlink to our LinkedIn page. It is not a plugin or an embed: no data is transmitted to LinkedIn unless and until you click the link, at which point LinkedIn's own privacy policy applies.

5. Recipients of personal data

We do not disclose personal data to any recipient other than the providers below, each of which processes data solely in the context of the corresponding function.

We may also disclose personal data to public authorities where we are required to do so by law, and to our legal or other professional advisers where necessary to establish, exercise or defend legal claims.

6. Cookies and similar technologies

Cookies are small text files placed on your device by a website. Similar technologies (local storage, cache storage, pixels, SDKs) achieve comparable results. Under Article 4(5) of Law 3471/2006, which transposes the ePrivacy Directive, storing information on or accessing information already stored on your device requires your prior consent, except where this is strictly necessary to provide a service you have expressly requested.

6.1 Categories

• Strictly necessary / functional — required for the Website to work and to remember your basic choices (such as your language and your consent choices). Set without consent, as the law permits.
• Functional third-party content — local storage and cache set by content that forms part of the Website (video, map, images, editorial content) and that loads to provide that functionality.
• Analytics (consent required) — Microsoft Clarity. It is not loaded at all until you accept it through the cookie banner; on this Website it is additionally configured not to set cookies (see Section 4.4).

6.2 Cookies

Strictly necessary / functional (no consent required)

No other cookies are set. Microsoft Clarity is loaded only after you accept it through the banner and, on this Website, is additionally configured not to set the _clck, _clsk, CLID, MUID or related cookies (see Section 4.4).

6.3 Other local storage and cache

The following are not cookies but store data on your device to provide the Website's functionality:

6.4 Your control over cookies and storage

• Consent banner. When you first visit the Website, a banner lets you accept or reject analytics (Microsoft Clarity). Rejecting is as easy as accepting, and Clarity is not loaded unless and until you accept. Your choice is stored in the nama_consent cookie.
• Withdrawing consent. You may change or withdraw your choice at any time via the cookie-settings link on the Website, and you may also opt out of Clarity via Microsoft's mechanism at https://choice.microsoft.com/.
• Browser controls. You may block or delete cookies, local storage and cache through your browser settings, and you may load the Website without the fonts, video or map by using content-blocking extensions. Blocking strictly necessary items may cause the Website to malfunction.

7. Transfers outside the EEA

Some of our providers process data in the United States or other third countries: Cloudflare, Microsoft (Clarity), Wistia, Mapbox, ImageKit and Google.

Our EU-based providers do not involve a third-country transfer for the relevant processing: Sentry ingests to its European Union region, and Contentful is established in Germany (although Contentful's own sub-processors may involve transfers under the safeguards below).

Third-country transfers are safeguarded as follows:

• EU–US Data Privacy Framework. Where the provider is certified under the EU–US Data Privacy Framework, transfers are covered by the European Commission's adequacy decision of 10 July 2023 (Article 45 GDPR). Microsoft, Google and Cloudflare are certified under the Framework. You can verify the current status of any organisation on the official list at https://www.dataprivacyframework.gov/list.
• Standard Contractual Clauses. For providers not covered by an adequacy decision (which may include Wistia, Mapbox and ImageKit — please verify their current status), transfers are based on the Standard Contractual Clauses adopted by the European Commission by Implementing Decision (EU) 2021/914 (Article 46(2)(c) GDPR), supplemented where necessary by additional technical and organisational measures following a transfer impact assessment.

You may request a copy of the relevant safeguards by writing to us at the address in Section 2.

8. Retention

NAMA does not itself store, on its own servers, any personal data relating to your visit to the Website. Retention is determined by each provider and by the duration of the cookies and storage listed in Section 6.

Where personal data is processed on the basis of your consent, it is deleted or anonymised once you withdraw consent, subject to the provider's technical deletion cycles.

9. Your rights

Under Articles 15 to 22 GDPR, you have the right to: access your data; rectification of inaccurate data; erasure; restriction of processing; data portability; to object, on grounds relating to your particular situation, to processing based on our legitimate interest (Article 21); and to withdraw consent at any time without affecting the lawfulness of prior processing (Article 7(3)).

Please note an important limitation. The identifiers used by the analytics and monitoring services described above are pseudonymous, and we hold no additional information capable of linking them to you. Under Article 11(2) GDPR, where we are not in a position to identify you, the rights of access, rectification, erasure, restriction and portability do not apply unless you provide additional information enabling your identification. If you wish to exercise those rights in relation to such data, please supply, so far as possible, the relevant identifier and the approximate date and time of your visit.

How to exercise your rights. Write to ekontak@namanet.gr or to the postal address in Section 2. We will respond without undue delay and in any event within one month of receipt, extendable by a further two months where necessary; we will inform you of any such extension within one month. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

Right to lodge a complaint. If you consider that the processing of your personal data infringes the GDPR, you may lodge a complaint with the Greek Data Protection Authority:

Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα) 1–3 Kifissias Avenue, 11523 Athens, Greece Tel: +30 210 6475600 — Web: https://www.dpa.gr

You also have the right to an effective judicial remedy under Article 79 GDPR.

10. Children

The Website is aimed at a professional and business audience and is not directed at children. We do not knowingly process the personal data of children. Under Article 8 GDPR as implemented by Article 21 of Law 4624/2019, in Greece the processing of a child's personal data on the basis of consent in relation to information society services is lawful where the child is at least 15 years old; below that age, consent must be given or authorised by the holder of parental responsibility. If you believe that a child has provided us with personal data, please contact us and we will delete it.

11. Security

We and our providers apply appropriate technical and organisational measures under Article 32 GDPR, including encryption in transit (HTTPS/TLS), protection against automated and malicious traffic at the network edge, and minimisation of the data collected. No transmission over the internet can be guaranteed to be entirely secure; we therefore cannot guarantee absolute security, but we take reasonable steps to protect your data.

12. Changes to this policy

We may amend this policy to reflect changes in the Website, in the services we use, or in the applicable law. The current version is always available at https://www.namanet.gr/privacy-policy and is identified by the date at the head of this document. Where a change materially affects processing carried out on the basis of your consent, we will seek your consent again.

Terms of Use

13. Acceptance

By accessing and using the Website, you accept these terms. If you do not accept them, please do not use the Website.

14. Purpose and content of the Website

The Website presents NAMA's activities, projects and services for information purposes only. Its content does not constitute an offer, a proposal, a technical study, professional or engineering advice, or a recommendation of any kind, and must not be relied upon as a substitute for professional advice appropriate to your specific circumstances. Any professional relationship with NAMA arises only from a written agreement.

15. Intellectual property

The Website and its content — including texts, photographs, drawings, plans, videos, graphics, logos, trade marks, distinctive features and software — are the property of NAMA or of its licensors and are protected by Law 2121/1993 on copyright and related rights, by industrial property legislation, and by the corresponding EU and international provisions.

You may view the content and reproduce it for your personal, non-commercial use. Any other use — in particular reproduction, republication, adaptation, translation, distribution, public performance, or commercial exploitation, in whole or in part — is prohibited without our prior written consent. Third-party trade marks appearing on the Website are the property of their respective owners.

16. Permitted use

You agree not to use the Website in any manner that is unlawful, that may damage or impair its operation or security, that involves unauthorised access to it or to any connected system, or that involves the automated collection of its content (scraping, data mining) without our permission.

17. Accuracy and availability

We make reasonable efforts to keep the content of the Website accurate and current, but we give no warranty, express or implied, as to its accuracy, completeness or timeliness. The Website is provided "as is" and "as available". We do not warrant uninterrupted or error-free operation, nor that the Website or the servers on which it is hosted are free of harmful elements. We reserve the right to modify, suspend or discontinue the Website or any part of it at any time.

18. Links to third-party websites

The Website may contain links to third-party websites, including our LinkedIn page. These are provided for your convenience. We exercise no control over their content, their privacy practices or their availability, and we accept no responsibility for them. Following such a link is at your own risk and the terms and privacy policy of the destination site will apply.

19. Limitation of liability

To the fullest extent permitted by law, NAMA shall not be liable for any indirect, incidental, consequential or special damage arising from your access to or use of, or inability to use, the Website or its content. Nothing in these terms excludes or limits liability which cannot lawfully be excluded or limited, including liability for wilful misconduct and gross negligence.

20. Governing law and jurisdiction

These terms and any dispute arising out of or in connection with the Website are governed by Greek law. The courts of Athens shall have exclusive jurisdiction, without prejudice to any mandatory provision conferring jurisdiction elsewhere, and without prejudice to your right to lodge a complaint with the Hellenic Data Protection Authority or to a judicial remedy under Article 79 GDPR.

21. Severability

If any provision of these terms is held invalid or unenforceable, that provision shall be severed and the remaining provisions shall continue in full force and effect.

22. Contact

NAMA CONSULTING ENGINEERS AND PLANNERS S.A. 30–32 Perrikou Street, 11524 Athens, Greece Email: ekontak@namanet.gr — Tel: +30 210 6974600