Privacy policy
Last updated: September 28, 2026
Data controller
The data controller is: Λάζαρος Χατζής. Contact person for personal data matters: Λάζαρος Χατζής. Email: info@olaketo.gr.
Which data we process
Account: email, display name, password (stored only as a non-reversible hash), language, notification settings, when you declared that you are an adult. If you sign in with Google, the identifier Google gives us; if you open your account with Google, also the email and name from there.
Sessions: for each active session, a description of the device and browser, the country and the time of last use, so that you can see and revoke them. We do not store the IP address in your account.
Security: counters of failed attempts and usage limits, and an audit log of administrative actions.
Comments, saved items, ingredient lists, notifications: whatever you write or save as a member.
Contact messages: name, email and the text you send us.
Consents: what you accepted or refused, when, and under which version of the text.
Visit statistics: only if you accept them in the cookie settings, we count visits with our own tool (Plausible, running on our own server), without cookies and without profiles. Your IP address is used only for a daily anonymous fingerprint and is not stored.
Cookies: see the “Cookies” page.
We do not sell data and we do not build advertising profiles of members.
Health data
We do not ask for health data in order to use the site. If you write something about your own health in a comment, our filter recognises it and the comment is stored only after you give explicit consent at that moment (Article 9(2)(a) of the General Data Protection Regulation). You withdraw it by deleting the comment. If you delete your account, these comments are permanently deleted — they are not anonymised.
Tools: the calculation runs on your device. If you are a member and choose to save the result of a tool (calories, macros, electrolytes), we keep only the result — not the details you typed — and only after you give explicit consent at that moment (Article 9(2)(a) of the General Data Protection Regulation). We keep one result per tool; you can delete it from your account whenever you wish, which withdraws your consent.
Why, and on which legal basis
The “Legal bases” table at the end of this page shows, for each activity, the legal basis of the processing.
Who else sees data
We use a few providers who act on our behalf. The “Processors” table at the end of this page shows who each one is, what it sees, where it is located and on which basis data are transferred. Only the site’s own texts (articles, recipes, diet plans, food names, products, glossary, frequently asked questions) are sent to the machine translation model — never comments, questions or member data. Notification emails contain only a link, never the text of a comment.
How long we keep data
Account: for as long as it is active. An inactive account is notified at 24 months and deleted at 30.
Unconfirmed registration: 7 days.
Notifications: 6 months.
Contact messages: 12 months after they are closed.
Audit log: 24 months; after that the identity of the person is removed.
Usage limit counters: 30 days.
Cookie consent records: 24 months.
Your rights
You have the right of access, rectification, erasure, restriction, objection, portability and withdrawal of your consent.
From the “My data” page of your account you can download a copy of your data and delete your account.
For anything else, send a message from the “Contact” page under the subject “Personal data”. We reply within one month at the latest.
If you believe the processing breaks the law, you have the right to lodge a complaint with the Hellenic Data Protection Authority.
Minors
The site is not addressed to minors; accounts are for adults.
Security
Connections are encrypted, passwords are stored as a hash with a modern algorithm, two-step verification is available, and access to the administration area is limited by role and logged.
Changes
If this policy changes substantially, we will inform members inside the site. The date of last update is shown on the page.
Legal bases
For each activity, the basis under Article 6 of the General Data Protection Regulation and, where health data are concerned, under Article 9.
| Activity | Article 6 | Article 9 |
|---|---|---|
| Member account: registration, sign-in, active sessions, language | 6(1)(b) — performance of the contract (terms of use) | Not required |
| Security: usage limits, lockout after failures, two-step verification, audit log | 6(1)(f) — legitimate interest: protecting the accounts and the site | Not required |
| Comments, product reviews, saved items, comment and review reports | 6(1)(b) — performance of the contract | Not required |
| The member’s ingredient lists (from a recipe, a diet plan or a selection of recipes) | 6(1)(b) — performance of the contract | Not required |
| Food error reports (also from visitors, with a limit per IP address) and food suggestions from members | 6(1)(f) — legitimate interest: accuracy of the food database; closed reports are deleted 12 months after they are closed | Not required |
| Company registration (application: company name, country, contact name and email) and business accounts; click counting on their links keeps only daily totals, with no visitor details | 6(1)(b) — steps prior to the contract at the applicant’s request, and performance of the contract | Not required |
| Comments and product reviews containing information about the member’s own health | 6(1)(a) — consent | 9(2)(a) — explicit consent, given at the moment of submission and withdrawn by deleting the comment or the review |
| Questions to an expert (“Ask the expert”) and their answers | 6(1)(a) — consent | 9(2)(a) — explicit consent, given when the question is submitted and withdrawn by deleting or withdrawing it |
| Directory of professionals: application, registration check and public profile of doctors and dietitians | 6(1)(a) — consent | 9(2)(a) — explicit consent, given with a separate box in the application and withdrawn by withdrawing the profile |
| Saving a tool result (calories, macros, electrolytes) in the member’s account | 6(1)(a) — consent | 9(2)(a) — explicit consent, given with a separate box at every save and withdrawn by deleting the result |
| Notifications inside the site and email when someone replies to a comment or a review and about the question to the expert (with a switch) | 6(1)(b) — performance of the contract | Not required |
| Newsletter: emails with new articles, recipes and guides to those who signed up and confirmed their subscription from their email (double opt-in) | 6(1)(a) — consent, withdrawn with one click from every email | Not required |
| Contact form messages | 6(1)(f) — legitimate interest: replying to whoever writes to us | Not required |
| Rights requests, register of deleted accounts, proofs of consent | 6(1)(c) — compliance with a legal obligation | Not required |
| Necessary cookies | 6(1)(f) — legitimate interest; exempt from consent as strictly necessary (Greek law 3471/2006, Article 4(5)) | Not required |
| Visitor statistics (our own tool, no cookies and no visitor profiles) and advertising cookies | 6(1)(a) — consent, withdrawn from «Cookie settings» | Not required |
| Machine translation of published articles | No personal data are processed | Not required |
| Server error tracking (Sentry) | 6(1)(f) — legitimate interest (finding and fixing faults); personal details are removed from every error report before it leaves | Not required |
Processors
The providers that process data on our behalf. Where an item has not been defined yet, null is shown.
| Provider | What it sees | Article 28 contract | Location | Transfer basis |
|---|---|---|---|---|
| Content delivery and protectionCloudflare, Inc. | All traffic to the site in clear text, because it terminates the encryption: IP addresses, pages requested, anything submitted in forms. | Cloudflare Data Processing Addendum | USA, with a worldwide server network | EU–US Data Privacy Framework and standard contractual clauses |
| Server hostingHetzner Online GmbH | Hosts the server, the database and the backups. | Hetzner Data Processing Agreement (Article 28), accepted on our account on 21 September 2026 | EU — Helsinki, Finland (HEL1 data centre) | No transfer outside the EU |
| Email deliveryAmazon Web Services EMEA SARL (Amazon SES) | The recipient’s address and the content of the site’s emails: confirmation, password reset, notifications that contain only a link, newsletter. | AWS Data Processing Addendum (AWS GDPR Data Processing Addendum, part of the service terms) | EU — Frankfurt (eu-central-1 region) | The data stay in the EU; for any access from the USA the EU–US Data Privacy Framework and standard contractual clauses apply |
| Server error trackingFunctional Software, Inc. (Sentry) | Technical details of a server error: error type, place in the code, page path without parameters. Never form contents, cookies, account details or IP address. | Sentry Data Processing Addendum (part of the service terms) | EU — Frankfurt, Germany (EU data region) | The data stay in the EU; for any access from the USA the EU–US Data Privacy Framework and standard contractual clauses apply |