Privacy Policy · Michael Siaterlis

This is a small static website. There are no user accounts, no advertising networks, no cross-site tracking, and nothing is ever sold to anyone.

1. Data controller

The controller for data collected through mswriter.eu is Michael Siaterlis, author, based in Greece.

For anything related to personal data, write to support@mswriter.eu or use the contact form.

2. When data is collected

In these cases only: when you send a message through the contact form, when you subscribe to the newsletter, when you state your choice in the consent banner, when you explicitly allow traffic measurement, and in the technical server logs kept for security reasons. Simply reading the pages requires nothing else from you.

3. What is collected, why, and on what legal basis

3.1 Contact form

Data: your name, email address and the text of your message. Your IP address is recorded briefly, solely to limit how many submissions can be made in a given period.
Purpose: to receive your message and reply to it.
Legal basis: Article 6(1)(b) GDPR (steps taken at your request), together with Article 6(1)(f) (legitimate interest in preventing abuse of the form).
Recipients: the message is delivered through Amazon SES (region eu-central-1, Frankfurt, inside the EU) to the support@mswriter.eu mailbox.
Retention: correspondence is kept for as long as needed to handle your request and in any case no longer than 24 months. The rate-limiting IP counter is discarded within minutes.

3.2 Newsletter subscription

Data: your email address.
Purpose: updates about new books, texts and events.
Legal basis: your consent, Article 6(1)(a) GDPR.
Processor: Mailchimp (Intuit Inc., USA). The form is submitted directly to Mailchimp servers.
Withdrawal: every message carries an unsubscribe link. Alternatively, write to support@mswriter.eu and you will be removed straight away.
Retention: until you unsubscribe or ask to be removed.

3.3 Recording your consent

Tool: MS-Consent, the banner shown on your first visit. It is served from consent.mslogic.gr, a server we control.
Data: your choice (accept or reject), the time it was made, the configuration version, an anonymous consent identifier, and the technical details of the request. Your name and email are never recorded, and the entry is not linked to any other data on the site.
Purpose: to be able to demonstrate, if needed, that consent was given or withdrawn and when.
Legal basis: Article 6(1)(c) GDPR, read together with Article 7(1), which requires the controller to be able to demonstrate consent.
Recipient: the record is stored on infrastructure we control (supabase.ms-host.net). It is not passed on to third parties.
Retention: for as long as your choice remains valid, plus a reasonable period afterwards so that it stays available as evidence.

3.4 Traffic measurement

Tool: Umami, self-hosted on a server we control. It sets no cookies, creates no persistent visitor identifier, and does not follow you across other websites.
Data: aggregated, anonymous figures such as the page viewed, country, device type and referral source.
Legal basis: your consent. If you do not give it, the script is never loaded at all.

3.5 Protecting the form from automated submissions

Tool: Cloudflare Turnstile (Cloudflare, Inc., USA), on the contact page only.
Data: IP address and technical browser characteristics, used to tell a person apart from an automated script.
Legal basis: legitimate interest, Article 6(1)(f) GDPR. The check is necessary for the form to work, so it runs regardless of your choice about traffic measurement.

3.6 Server logs

Data: IP address, date and time, requested page, response code, browser type.
Purpose: security, troubleshooting, prevention of attacks and abuse.
Legal basis: legitimate interest, Article 6(1)(f) GDPR.
Retention: up to 30 days, with automatic rotation.

4. Cookies and local storage

The site uses no advertising or tracking cookies. What is stored on your device is functional, and consists of the following:

msconsent (first-party cookie, 180 days): stores your choice in the consent banner, so you are not asked again on every page.
msc_cid (first-party cookie, 180 days): an anonymous identifier linking your choice to its record, so that consent can be demonstrated. It is not used for tracking and is not linked to your name or email.
msc_last (browser local storage): keeps track of when your choice was last recorded, so the record is not written again on every page you open.
Cloudflare Turnstile: may store a temporary technical token on the contact page, solely to complete the check.

You can change your choices at any time from the consent icon at the bottom left of every page.

5. Where the site is hosted

The site runs on a private server in the Hetzner Online GmbH data centre in Helsinki, Finland, that is, inside the European Union.

6. Transfers outside the European Economic Area

Two of the providers used are established in the United States: Mailchimp (newsletter) and Cloudflare (form protection). Transfers to them rely on the EU-US Data Privacy Framework and on the European Commission's standard contractual clauses. No other recipient is located outside the EEA.

7. Your rights

Under the GDPR (Regulation EU 2016/679) and Greek Law 4624/2019, you have the right to:

access the data concerning you,
have inaccurate data corrected,
have your data erased (the "right to be forgotten"),
restrict processing,
receive your data in a portable format,
object to processing based on legitimate interest,
withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise any of these rights, write to support@mswriter.eu. You will receive a reply within one month of your request.

If you believe your data is being handled unlawfully, you have the right to lodge a complaint with the Hellenic Data Protection Authority (1-3 Kifissias Avenue, 115 23 Athens, www.dpa.gr).

8. Security

All traffic to the site is encrypted (HTTPS). Credentials for the email delivery and captcha services are stored outside the publicly served directory, with restricted access permissions. No method of transmission is completely secure, but the measures in place are proportionate to the risk and to the nature of the data involved.

9. Children

This site is not directed at children. No data concerning children under the age of 15 is knowingly collected. If such data comes to light, it is deleted immediately.

10. Links to other websites

Some pages link to external sites, for example retailers that sell the books. This policy does not cover those sites, and reading their own privacy policies is worthwhile.

11. Changes to this policy

This policy may be updated, for instance if a new feature is added to the site. The date of the most recent update appears at the top of the page.