Privacy Policy

Last updated: 22 August 2026

This policy explains what personal data Blue Autonomy ("we", "us") collects through this website and the Blue Autonomy Academy, why, and what rights you have. We keep data collection to the minimum needed to run the site and respond to you.

1. Who is responsible for your data

The data controller is Blue Autonomy, Driopidos 18, Athens, Greece 11147. For any privacy question or request, contact us at info@blueautonomy.gr or +30 6984585624.

2. Data you give us through the contact form

When you use the contact form we collect the name, email address, subject and message you enter. We use this only to read and reply to your enquiry. The message is delivered to our inbox using the third-party service EmailJS, which transmits the form contents on our behalf; we do not use it to build marketing lists. The legal basis is your consent, given by submitting the form, and our legitimate interest in answering enquiries.

3. Analytics cookies (only with your consent)

We use Google Analytics to understand, in aggregate, how the site is used. It sets cookies and shares data with Google. It does not run unless you click "Accept" on the cookie banner. If you decline, no analytics script is loaded and no analytics cookies are set. We ask Google to anonymise your IP address. You can change your choice at any time using the "Cookie settings" link in the footer.

Your consent choice itself is stored locally in your browser (localStorage), not in a cookie, and is not sent to us.

4. Academy accounts (academy.blueautonomy.gr)

The Blue Autonomy Academy runs on our own server at academy.blueautonomy.gr. You can read every free course and take every quiz without an account; in that case your progress stays in your own browser (localStorage) and never reaches us.

If you choose to create an account, we process:

• Your email address — it is how you sign in. There are no passwords: you receive a single-use sign-in link, valid for 15 minutes. An account is created only when a link is actually used, so a mistyped address never becomes an account.
• Your name, if you enter one — used to address you and to print on course certificates you earn. It is optional until you claim a certificate, which needs a name to print.
• Your course progress — which lessons you completed, your best quiz scores, and where you left off, so your learning follows you between devices.
• Technical session data — the time of your last sign-in and the browser identification string of the device you signed in from, kept to secure the account.

The legal basis is the performance of the service you asked for (Article 6(1)(b) GDPR). Sign-in and account emails are delivered by Brevo (Sendinblue, EU-based), acting as our processor; they are transactional messages, never marketing. We do not add you to any mailing list unless you separately ask us to.

The newsletter, if you ask for it: the subscribe boxes on the Academy, and the tick-box on a free course's enrolment form, are the only way onto our mailing list. We store your email address, the date you gave consent, the date you confirmed it and which page the form was on — nothing else, and no profile of what you read. The legal basis is your consent (Article 6(1)(a) GDPR), which is never a condition of anything: every free course, lesson and account works identically whether or not you subscribe. Confirmation is double opt-in — an address is added only after you click the link we email, and until then the pending request is deleted on its own within seven days. Campaign delivery is by Brevo (Sendinblue, EU-based), our processor. You can withdraw consent at any time from the switch on your account page or the unsubscribe link in any email we send, and deleting your account removes you from the list too.

Cookies: signing in sets one essential cookie (ba_sess) that identifies your session. It is strictly necessary for a signed-in account, contains no personal data itself, and expires after 90 days of inactivity. Signing out deletes it and ends the session on our server.

Your data, in your hands: from your account page you can download everything we hold about you as a single file (course certificates included, as PDFs), and delete your account outright — deletion is confirmed by email, then removes your account, progress and quiz history from our database permanently. No administrator step is needed. The only things retained afterwards are ordinary server logs (§7) and any certificates you earned, explained next.

Certificates: passing a course's final exam issues a PDF certificate carrying the name you chose, the course title, your score, the issue date and a certificate number. Anyone holding that number can confirm the certificate at academy.blueautonomy.gr/verify, which shows exactly those details and nothing else: no email address, no account information. Because employers and clients rely on that check, certificates are kept when you delete your account, under the printed name only, so we can still verify or re-send yours years later. The legal basis is our legitimate interest in keeping issued credentials verifiable (Article 6(1)(f) GDPR). If you want a certificate removed as well, email us at info@blueautonomy.gr: we can withdraw it from verification, remove your name from the record, or erase it completely. After a complete erasure the certificate can no longer be verified or re-issued, which is why we do not do it as a side effect of deleting an account.

5. Embedded videos

Talk pages embed videos from YouTube. The player loads only after you click play, and we use YouTube's privacy-enhanced domain (youtube-nocookie.com). Once a video plays, Google may receive data as described in its own privacy policy.

6. Other third parties

Fonts, icons, and search all run from our own server — no third-party requests. The only exception is the contact-form page, where the EmailJS script loads from the jsDelivr content-delivery network; requesting a file from a CDN necessarily reveals your IP address to that provider, as with any resource your browser loads.

7. Server logs and security

Our hosting provider keeps standard server logs (including IP addresses) for security and troubleshooting, and the site is served over HTTPS. These logs are kept only as long as needed for those purposes.

8. How long we keep your data

Contact-form enquiries are kept for as long as needed to handle your request and any follow-up, then deleted. Analytics data is retained according to our Google Analytics configuration. Academy account data is kept for as long as the account exists and is erased when you delete it; unused sign-in links expire after 15 minutes and are purged within 24 hours. Issued course certificates are kept indefinitely so they stay verifiable (§4), unless you ask us to remove one.

9. Your rights under the GDPR

You have the right to access, correct, or delete your personal data; to restrict or object to its processing; to data portability; and to withdraw consent at any time. If you have an Academy account, export and deletion are available directly from your account page (§4) — no request needed. For anything else, email us at info@blueautonomy.gr. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (dpa.gr).

10. Changes to this policy

We may update this policy from time to time. The "last updated" date above always reflects the current version.