Privacy Policy — pelekanos

Η Πολιτική Απορρήτου είναι προς το παρόν διαθέσιμη μόνο στα αγγλικά. Η ελληνική έκδοση έρχεται σύντομα. Με απλά λόγια: Τα δεδομένα σου.

pelekanos (“pelekanos”, “we”, “us”) operates the pelekanos mobile application, which connects volunteers with non-governmental organisations (“NGOs”) and their volunteering events. This policy explains what personal data we collect, why, how we protect it, and the rights you have under the EU General Data Protection Regulation (GDPR) and Greek data-protection law.

Questions or requests about your data: hello@pelekanos.org.

1. Data we collect

Data	Why we collect it
Email address and name	To create and secure your account, sign you in, and contact you about the service.
Account identifier (user ID)	To link your activity (registrations, reviews, favourites) to your account.
Location (only with your permission)	To show volunteering events near you and where they are on the map. Your location is processed on your phone: we do not send it to our servers and we do not store it. The map comes from Apple Maps on iPhone and iPad, and from Google Maps on Android. On Android, Google receives your IP address, the area of the map you are viewing and, if you allow location, your approximate position so it can show it on the map, under Google’s Privacy Policy. (Versions of the app from before October 2026 load the Android map from OpenStreetMap instead, whose servers receive your IP address and the area of the map you are viewing.) Like any online service, the providers that run our analytics, error reports and app updates receive your IP address, which can show your approximate area. You can use the app without granting location access.
Photos you upload (only with your permission)	So NGOs and volunteers can add and view event images.
Event registration details — and, for some events, sensitive information such as date of birth, identification number, allergies, or medical conditions	When you register for an event, the organising NGO receives the details needed to manage participation and safety. Sensitive details are only collected where an NGO requires them for a specific event, and are shared only with that NGO.
Attendance at events (only for events that use check-in)	When you scan the organiser’s check-in code, or the organiser ticks your name, we record that you attended, when, how (the organiser’s code, a printed poster, ticked by the organiser, or joining on the spot) and your volunteering hours. The organising NGO sees this for its own events, including who signed up but didn’t come. If an event allows it and you scan without having signed up, you join the event on the spot like a normal registration. The app’s scanner uses your camera only to read the code, on your phone: no picture is kept or sent to us.
Volunteering certificates (only if you make one)	When you make a certificate in the app, we save what it shows — your full name, the period, and the events the organisers confirmed with their hours — together with its reference code, so that the certificate can be checked as genuine. Only you can see your saved certificates. They are deleted when you delete your account.
Event confirmations and waiting lists	Before an event, the app asks “Still coming?”. If you answer “Yes, I’m coming”, we record that and when; “Can’t make it” cancels your registration. If you join the waiting list of a full event, we record that you joined and when, and tell you when a place opens. The organising NGO sees who confirmed and the names on its waiting list. Waiting-list entries are deleted a day after the event ends (or when it’s cancelled), when the organising NGO closes the waiting list (we let you know), and when you delete your account.
Weekly round-up of new events (only if you turn it on) — the causes and the one area you pick, and which events we have already sent you	To send you, once a week, new events that match what you chose. The area is one you pick from a list, not your phone’s location. Only you can see your choices; we keep them until you change them or delete your account. The list of events already sent to you is deleted within about a week after each event; it only exists so you never get the same event twice. You can turn the round-up off at any time in Profile → Notification settings.
Push notification token and language	To deliver notifications (e.g. event reminders, updates) to your device in your language. You can disable notifications at any time.
Usage and analytics data (only if you say yes) (e.g. screens viewed, actions taken, searches), linked to a random device identifier and, once you sign in, to your account identifier	To understand how the app is used and improve it. The app asks you once, and you can change your answer at any time (see section 2). (Versions of the app from before October 2026 collect it without asking.)
App update checks — a random installation ID, the app’s version details and, if the app fails to start after an update, the error message	Each time the app opens, it asks Expo whether a fix is available, so we can correct problems quickly without waiting for a store update. Expo also receives your IP address.
Diagnostics (crash and performance data)	To detect, diagnose and fix problems and keep the app stable.
Reports and blocks — what you report and why, who you block, reports about content you posted, and any account suspension	To keep the community safe and act on reports within 24 hours. Only our moderators see reports. The person reported or blocked is never told who reported or blocked them.
Your acceptance of the Terms of Service (which version, and when)	To record that you agreed to the Terms.

We do not use your data to track you across other companies’ apps or websites, and we do not sell your personal data.

2. Legal bases (GDPR Article 6 / 9)

Performance of a contract — to provide the account and core features you ask for.
Consent — for usage statistics (analytics), location access, photo and camera access, push notifications, and any sensitive (special-category) data such as health/medical information for an event. You can withdraw consent at any time (see below).
Legitimate interests — to keep the service secure, prevent abuse, and find and fix crashes and errors.
Legal obligation — where we must retain or disclose data to comply with the law.

How to withdraw your consent

Usage statistics: in the app, Profile → Legal → Usage statistics (NGO admins: My NGO → Legal → Usage statistics). From then on, the app stops sending them. The switch applies to the phone you change it on. (Versions of the app from before October 2026 have no such switch: install the current version to get it.)
Phone permissions (location, photos, camera, calendar) and notifications: turn access off in your phone’s Settings for pelekanos. You can also choose which notifications you get in the app: Profile → Notification settings (NGO admins: My NGO → Notification settings).
Health details and ID number for an event: cancel your registration for that event (possible until the event takes place), or clear them in Profile → Edit profile → Volunteer details and tap Save. The NGO then no longer sees them in the app. If you add them back later, an NGO you agreed to share them with for an event sees them again. To withdraw them for just one event that has already taken place, email hello@pelekanos.org. Copies an NGO has already kept outside the app (for example, a downloaded list of volunteers) are the NGO’s to manage — ask the NGO about those.
Photography consent: switch off Consent to photography at events in Profile → Edit profile → Volunteer details and tap Save.

Withdrawing consent does not affect what we did with your data before you withdrew it.

3. Who processes your data

Service providers (“processors”) help us run pelekanos. We have, or will have, data-processing agreements with all of them, and they process data only on our instructions. Where they offer a choice, we have them store data in Europe:

Supabase — authentication, database and file storage (Zurich, Switzerland).
Sentry — crash and performance diagnostics (EU region).
PostHog — product analytics (EU region).
Expo — delivery of push notifications and of app updates (receives your IP address, a random installation ID and technical version details).

We also use email providers — for the emails the app sends you (such as sign-up codes and password resets) and for the messages you send to our email addresses — and a website host for pelekanos.org, which receives the IP address of anyone who visits the site.

The following companies also receive some data, under their own privacy policies:

Apple and Google — if you choose “Sign in with Apple” or “Sign in with Google”, when they deliver push notifications to your device, and for maps: Apple Maps on iPhone and iPad, Google Maps on Android. Use of Google Maps is subject to the Google Maps/Google Earth Additional Terms of Service and Google’s Privacy Policy.
Google (Places API) — address searches by NGOs when they set where an event takes place. The search goes through our server: Google receives the words searched for, not who typed them or their IP address.
WhatsApp (Meta) — only if you choose to message us on WhatsApp from the app. This is optional: you can always email us instead. We then see your WhatsApp name, number and the messages you send, so we can reply; WhatsApp handles them under the WhatsApp Privacy Policy.
OpenStreetMap Foundation — only in versions of the app from before October 2026, for the map on Android and for NGOs’ address searches, under the OpenStreetMap Foundation Privacy Policy.

NGOs you register with act as independent controllers for the registration details they receive, and are responsible for their own handling of that data.

Everyone who receives your data from us — the service providers listed above and the NGOs you register with — will give it the same or equal protection as this policy describes.

4. How long we keep it

We keep your account data for as long as your account is active. Reports are kept while we handle them and are deleted 12 months after they are closed. Diagnostics and analytics data are retained for a limited period and then deleted or aggregated. When you delete your account (see below), we delete or anonymise your personal data, except where we must keep it to meet a legal obligation.

5. Deleting your account

You can delete your account and associated personal data directly in the app: Profile → Delete account. This removes your profile and most associated data from our systems.

You can also ask us to delete your account without using the app. See pelekanos.org/delete-account, which also explains exactly what is deleted and what is kept.

6. Your rights

Under the GDPR you have the right to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent at any time (section 2 explains how). To exercise these rights, contact hello@pelekanos.org. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr) or your local supervisory authority.

7. Children

pelekanos is not directed to children under 16. If you believe a child has provided us personal data without appropriate consent, contact us and we will delete it.

8. Security

We use industry-standard measures — including encryption in transit and access controls — to protect your data. No method of transmission or storage is completely secure, but we work to protect your information and review our practices regularly.

9. Changes to this policy

We may update this policy from time to time. We will revise the “Last updated” date above and, where appropriate, notify you in the app.