Privacy policy

Version 1.0 · Last updated 2026-11-12

Popular Greece helps you find places worth seeing. We collect as little personal data as we can. This policy explains what we process, why, for how long, who else receives it, and your rights under the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The controller of your personal data is Dimitris Kougioumtzis, established in Greece, who runs Popular Greece. Contact for anything about your data: dimitris@dimkoug.com. We have not appointed a Data Protection Officer because the law does not require one for a service of this kind.

2. When you visit the site

Server logs

Every time your browser requests a page, image or data from us, our servers (web server, cache and application server) record technical data: your IP address, date and time, the address requested (including any search terms or map coordinates contained in it), the response status, the referring page and your browser's user-agent string. We use these logs to deliver the site, keep it secure, stop abuse and fix errors. Legal basis: our legitimate interest in running a secure, working service (Art. 6(1)(f) GDPR). Logs are deleted after 14 days, unless a specific entry is needed to investigate an attack.

Analytics (only if you agree)

If you click “Accept” in the cookie banner, we load Google Analytics 4 (provided by Google Ireland Ltd) to count visits and see which pages are useful. Google then receives your IP address, a random identifier stored in cookies, the pages you view, your approximate location derived from the IP address, and device and browser information. Google Analytics 4 does not log or store IP addresses for EU users. We do not use advertising features, and we do not combine this data with anything that identifies you. Legal basis: your consent (Art. 6(1)(a) GDPR). If you click “Reject”, or make no choice, Google's script is not loaded at all and nothing is sent to Google. You can change your choice at any time with the “Cookie settings” link at the bottom of every page; withdrawing consent deletes the analytics cookies. Analytics data is kept for 2 months.

“Near me”

If you use “Near me”, your browser asks for your permission before sharing your location. Your device determines the coordinates; we send them to our server only to find nearby places. We do not store your location in our database; the coordinates can appear in the server logs described above and are deleted with them. Legal basis: your request (Art. 6(1)(b) GDPR) and your browser permission, which you can revoke in your browser settings.

Drawing an area

When you draw an area on the map, its shape is sent to our server to find places inside it. On the older “Draw & Select” page you can also save a selection under a name you choose; it is stored without any link to you. Please do not put personal data in that name.

Maps and photos from other organisations

To show you the map and photos, your browser loads content directly from other organisations, which therefore receive your IP address and browser information:

Map tiles from the OpenStreetMap Foundation (tile.openstreetmap.org, United Kingdom), under its own privacy policy.
Photos from Wikimedia Commons (Wikimedia Foundation, United States), where a page shows one, under its own privacy policy.

These organisations act as independent controllers. Legal basis: our legitimate interest in showing a map and pictures, which the service cannot work without (Art. 6(1)(f) GDPR). Fonts and map libraries are served from our own server, so no data goes to font or script providers.

3. When you create an account

Accounts are being introduced. When you create one, we process:

Account data: your email address, a display name you choose, and your password stored only as a one-way hash (we never see or store the password itself). Your email address must be confirmed. Accounts never confirmed are deleted after 7 days.
Emails we send you: confirmation, password reset and security alerts (password or email change, sign-in from a new device). These are sent through Microsoft 365 (Microsoft Ireland Operations Ltd), which processes your email address and the message on our behalf.
Security data: to stop people guessing passwords we record the IP address and the number of failed sign-in attempts per account and per address; to warn you about sign-ins from a new device we keep a signed device cookie in your browser, and the alert email shows the time, IP address and a short label such as “Firefox on Windows”; a sign-in cookie keeps you logged in, and we record each sign-in session (identifier, start and expiry, no IP address) so you can log out everywhere. Failed-attempt records are deleted after 30 days, session records within a day after they expire.
Breached-password check: when you choose a password we check it against known data breaches using the “Have I Been Pwned” service. Only the first 5 characters of a cryptographic hash of the password are sent, which cannot be traced back to you or your password.

Legal bases: performing our agreement with you, i.e. providing the account you asked for (Art. 6(1)(b) GDPR); our legitimate interest in protecting accounts against takeover (Art. 6(1)(f) GDPR) for the security data. Account data is kept until you delete your account, which you can do at any time in the account settings (see section 9). Deleting it removes your account, your lists, your sign-in sessions and the security records for your address straight away; we then send a confirmation to that address.

4. When you save and share lists

With an account you can save lists of places: we store the list name, an optional description, the places and their order, and at most one area you drew. Lists are private. If you share a list, we create an unguessable link; anyone who has the link can see the list name and description, your display name, the places and the drawn area. Making the list private again disables the link. Legal basis: performing our agreement with you (Art. 6(1)(b) GDPR). Lists are kept until you delete them or your account.

5. When you email us

If you write to us, we use your email address and message to reply. Legal basis: our legitimate interest in answering you (Art. 6(1)(f) GDPR) or, for requests about your rights, our legal obligation (Art. 6(1)(c) GDPR). We keep the correspondence as long as needed to deal with it and to show that we handled rights requests properly.

6. Who receives data

We do not sell your data and do not share it for advertising. Service providers that process data on our behalf (processors), under data processing agreements:

Hetzner Online GmbH – hosting; our servers are located in Finland (EU).
Microsoft 365 (Microsoft Ireland Operations Ltd) – sending account emails (when accounts are available) and our email.
Google Ireland Ltd – Google Analytics, only if you consent.

Independent recipients your browser contacts directly: OpenStreetMap Foundation (map tiles) and Wikimedia Foundation (photos), as described in section 2. We may disclose data to authorities when the law requires it.

7. Transfers outside the EU

Our servers are in the EU. Google and Microsoft may process data in the United States; both are certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision, and they also use the Commission's Standard Contractual Clauses. The OpenStreetMap Foundation is in the United Kingdom, which also has an adequacy decision. The Wikimedia Foundation is in the United States and receives your IP address when your browser loads a photo from it.

8. How long we keep data

Data	Kept for
Server logs (IP address, request)	14 days
Security records (sign-in attempts, IP addresses)	30 days
Accounts never confirmed	7 days
Account data and lists	Until you delete them or your account
Google Analytics data (only with consent)	2 months
Your cookie choice	See the cookie table below

9. Your rights

Under the GDPR you have the right to:

access your data and get a copy (Art. 15);
rectification of inaccurate data (Art. 16);
erasure (“right to be forgotten”, Art. 17);
restriction of processing (Art. 18);
data portability: receive the data you gave us in a machine-readable format (Art. 20);
object to processing based on legitimate interests (Art. 21);
withdraw your consent at any time, without affecting earlier processing (Art. 7(3)), using “Cookie settings” at the bottom of every page.

If you have an account, you can download all your data and delete your account yourself in the account settings (“Download my data” gives you a machine-readable JSON file; “Delete account” asks for your password). For anything else, or if you prefer, email dimitris@dimkoug.com. We reply within one month (extendable by two months for complex requests, in which case we tell you) and may ask you to confirm your identity, for example by writing from your account's email address. It is free of charge.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live or work. In Greece this is the Hellenic Data Protection Authority.

10. Cookies

Cookies are small files your browser stores for a website. We use strictly necessary cookies, which do not need consent, and analytics cookies, which are set only if you click “Accept”. We do not use advertising cookies.

Name	Type	Purpose	Lifetime
`pg_consent`	Strictly necessary	Remembers whether you accepted or rejected analytics cookies, and for which policy version.	180 days
`pg_lang`	Strictly necessary (preference)	Remembers the language you chose (Greek or English), so the home page opens in your language straight away. It holds only “el” or “en” and does not identify you.	365 days
`csrftoken`	Strictly necessary	Security protection for forms and requests (CSRF). It does not identify you.	364 days
`populargreece_sessionid`	Strictly necessary	Keeps you signed in when you log in. Not set for ordinary visitors.	14 days
`pg_refresh`	Strictly necessary (accounts)	Keeps you securely signed in. Set only when you log in to your account, not readable by JavaScript, and removed when you log out.	14 days
`pg_device`	Strictly necessary (account security)	A signed list of the accounts that have signed in from this browser, so we can email you when someone signs in to your account from a new device. Set only when you log in.	365 days
`_ga`	Analytics (only with consent)	Google Analytics: a random identifier used to count visitors.	730 days
`_ga_88PL6BYY2Y`	Analytics (only with consent)	Google Analytics: keeps the state of your current visit.	730 days

We do not let other organisations set cookies through our pages for advertising or tracking; the OpenStreetMap and Wikimedia privacy policies linked above describe how they handle the requests your browser sends them. You can also delete or block cookies in your browser settings; blocking necessary cookies can stop parts of the site from working.

11. Children, security and other information

Minimum age: you must be at least 16 years old to create an account. Browsing the site needs no account.
No automated decisions: we do not make decisions about you based solely on automated processing, and we do not profile you (Art. 22 GDPR).
You are not obliged to give us personal data. Without an email address and password we cannot create an account for you; the rest of the site works without one.
Security: all traffic is encrypted (HTTPS), passwords are stored as hashes, sign-in attempts are rate-limited, and access to our servers is restricted.

12. Changes to this policy

We will update this policy when our processing changes. The version and date at the top show the current text. If a change affects your cookie choice, we will ask you again. For important changes affecting account holders we will also notify you by email.