01 Who we are (data controller)
This Privacy & Cookie Policy explains how Fun Up (“Fun Up”, “we”, “us”) collects, uses, and protects your personal data when you visit our website (funup.gr), request a quote, book our event-entertainment services, or subscribe to our updates. We process personal data in accordance with Regulation (EU) 2016/679 (the GDPR), Greek Law 4624/2019, and Greek Law 3471/2006 on electronic communications.
The data controller responsible for your personal data is:
- Legal entity: KAIKILIA ZEMPILA (ΚΑΙΚΙΛΙΑ ΖΕΜΠΙΛΑ), sole proprietorship, trading as “Fun Up”
- Registered address: Yposminagou Parousi 96, 176 76, Athens, Greece
- VAT number (ΑΦΜ): 165956362
- Phone: +30 697 308 7713
- Email: [email protected]
Given the nature and scale of our processing, we are not required to appoint a Data Protection Officer (DPO) under Article 37 GDPR. For any matter concerning your personal data you can contact us directly, using the details above.
02 What data we collect and where it comes from
Data you give us directly
| When | Data collected |
|---|---|
| Quote request form | First and last name, phone number, email address, event date, event type, event location, estimated guest count, how you heard about us, your message, and your SMS communication preferences (two separate checkboxes: service messages and marketing messages) |
| Booking & invoicing (if you book with us) | Billing details — name, tax ID (ΑΦΜ) and tax office (ΔΟΥ) where invoicing requires it, payment and transaction details |
| Newsletter / marketing sign-up | Email address (and mobile number, if you choose to give it) |
Data collected automatically
When you browse the site we automatically collect limited technical data — IP address, browser and device type, pages visited, and cookie identifiers — through the cookies and tracking tools described in section 04. Optional cookies are only set with your consent.
You are not obliged to provide your data. However, without the form data we cannot reply to your enquiry, and without billing data we cannot enter into or perform a booking contract with you.
03 Why we use your data and our legal basis
| Purpose | Legal basis |
|---|---|
| Responding to your quote request and preparing an offer | Steps taken at your request before entering a contract — Art. 6(1)(b) GDPR |
| Providing the services you book (delivery, set-up, running the event, communication about your booking) | Performance of a contract — Art. 6(1)(b) GDPR |
| Invoicing and accounting | Compliance with our legal obligations under Greek tax legislation — Art. 6(1)(c) GDPR |
| Sending offers about similar services to existing customers by email/SMS | Our legitimate interest in direct marketing — Art. 6(1)(f) GDPR and Art. 11(3) of Law 3471/2006. You can opt out at any time, in every message. |
| Sending newsletters and marketing messages to non-customers (prospective clients) by email/SMS | Your consent — Art. 6(1)(a) GDPR and Art. 11(1) of Law 3471/2006. You can withdraw it at any time. |
| Analytics and advertising cookies (traffic measurement, remarketing, conversion measurement) | Your consent — Art. 4(5) of Law 3471/2006 and Art. 6(1)(a) GDPR, given through the cookie banner |
| Keeping the website secure and defending our legal rights | Our legitimate interests — Art. 6(1)(f) GDPR |
We do not use your data for automated decision-making that produces legal or similarly significant effects on you (Art. 22 GDPR).
Newsletter sign-ups: how consent works
When you subscribe, we confirm your address with a verification email (double opt-in). Every newsletter and marketing message we send contains an unsubscribe link; unsubscribing takes effect immediately for future messages and does not affect the lawfulness of what was sent before.
04 Cookies and tracking tools
Cookies are small files that a website stores on your device so that it can recognise your browser and remember information — for example your preferences or how you arrived at the site. First-party cookies are set by our own website; third-party cookies are set by other providers (such as Google or Meta) through our website.
Categories we use
- Strictly necessary — required for the website and its forms to function (session handling, security, form submission). These do not require consent.
- Analytics — Google Analytics 4 helps us understand how visitors use the site so we can improve it. Google Analytics 4 does not log or store your full IP address, and user- and event-level data is kept for up to 14 months. Set only with your consent.
- Advertising — the Meta (Facebook/Instagram) Pixel and the Google Ads tag measure ad performance and let us show relevant ads (remarketing) to people who visited the site. Set only with your consent.
The cookies
| Cookie | Category | Purpose | Duration | Provider |
|---|---|---|---|---|
| Website platform cookies (LeadConnector) | Strictly necessary | Page delivery, session handling, form submission | Session | First party |
| __cf_bm | Strictly necessary | Security / bot protection | 30 minutes | Cloudflare (third party) |
| _ga | Analytics | Distinguishes visitors for traffic statistics | 2 years | Google (third party) |
| _ga_* | Analytics | Maintains session state for Google Analytics 4 | 2 years | Google (third party) |
| _gcl_au | Advertising | Google Ads conversion measurement | 3 months | Google (third party) |
| _fbp | Advertising | Meta Pixel — identifies browsers for ad measurement and remarketing | 3 months | Meta (third party) |
| _fbc | Advertising | Meta Pixel — stores the ad click that brought you to the site | 3 months | Meta (third party) |
The list above is indicative of the tools we use; the exact, current list is always shown in the cookie banner's settings panel.
Your choices
On your first visit, a cookie banner lets you accept or reject each optional category separately — nothing optional is pre-ticked, and you can reject all optional cookies with one click. You can change your choices at any time via the “Cookie Settings” link on the website. You can also manage or delete cookies in your browser: Chrome, Firefox, Edge, Safari, Opera.
05 Who receives your data
We do not sell your personal data. Recipients only receive the data strictly necessary for the service they provide to us:
- Processors acting on our behalf, bound by data-processing agreements and confidentiality:
- HighLevel Inc. (GoHighLevel / LeadConnector) — our website, CRM, forms, and email/SMS sending platform. Form submissions and contact records are stored there.
- Google — analytics (Google Analytics 4) and advertising (Google Ads), where you have consented to the relevant cookies.
- Meta Platforms — advertising measurement and remarketing (Meta Pixel), where you have consented to advertising cookies.
- Financial institutions, to the extent required to execute payments.
- Tax authorities, as required by Greek tax legislation.
- Lawyers, where necessary to exercise our rights and defend our legitimate interests.
- Bailiffs, notaries, judicial, prosecutorial, police, and supervisory authorities, where required by law, court decision, or a lawful request made in the exercise of their duties.
On our social-media pages (e.g. Instagram), the platform provider and we act as joint controllers for page-statistics processing. The terms of this joint controllership are set out in Meta's Page Insights Controller Addendum. You can contact us about your rights for anything relating to our pages, without prejudice to your right to also contact the platform.
06 Transfers outside the EU
Some of the providers above (HighLevel Inc., Google, Meta) may process personal data in the United States. Where that happens, the transfer is protected by an adequacy decision of the European Commission — the EU–US Data Privacy Framework, for providers certified under it — and/or by the European Commission's Standard Contractual Clauses with supplementary measures (Arts. 45–46 GDPR). You can ask us for more information about these safeguards using the contact details in section 01.
07 How long we keep your data
- Enquiries that don't become bookings: kept for up to 24 months from our last contact, then deleted. This period reflects the planning cycle of the events we serve — particularly weddings and corporate events, which are often planned 12 to 24 months ahead — so we can respond if you come back to us about the same event. It rests on our legitimate interest (Art. 6(1)(f) GDPR), and you can ask us to delete this data earlier at any time.
- Customers and bookings: kept for the duration of our business relationship and afterwards for as long as Greek tax and accounting legislation requires, and until the limitation period for any related legal claims has expired.
- Marketing subscriptions: kept for as long as your consent remains in force — that is, until you unsubscribe or object. Records proving consent and its withdrawal are kept for up to six months after our marketing to you stops.
- Cookie data: for the durations listed in the cookie table in section 04.
If legal proceedings involving us and directly or indirectly concerning you are ongoing when a period above expires, we keep the relevant data until a final, irrevocable decision is issued. After the applicable period, your data is deleted or destroyed in line with our data-destruction policy.
08 Your rights
Under Articles 15–21 of the GDPR you have the right to:
- Access — ask for a copy of the personal data we hold about you (Art. 15).
- Rectification — ask us to correct inaccurate or incomplete data (Art. 16).
- Erasure — ask us to delete your data, where the legal conditions are met (Art. 17).
- Restriction — ask us to limit how we use your data (Art. 18).
- Portability — receive the data you gave us in a structured, machine-readable format (Art. 20).
- Objection — object to processing based on our legitimate interests; for direct marketing, your objection is always honoured, no justification needed (Art. 21).
- Withdraw consent — where processing is based on consent, withdraw it at any time with effect for the future, without affecting the lawfulness of prior processing (Art. 7(3)).
How to exercise them: email [email protected] or write to Yposminagou Parousi 96, 176 76, Athens, Greece. Exercising your rights is free of charge (unless a request is manifestly unfounded or excessive, particularly through repetition). If we have reasonable doubts about your identity, we may ask for additional information to confirm it.
We will respond within one month of receiving your request. Where a request is complex or requests are numerous, this may be extended by two further months — in that case we will tell you within the first month, with the reasons for the delay. Note that we may lawfully decline, in whole or in part, a request for erasure or restriction where keeping the data is necessary for compliance with our legal obligations or for establishing, exercising, or defending legal claims.
09 Complaints
If you believe your rights have been infringed, you can lodge a complaint with the Greek supervisory authority:
- Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα)
- Kifisias Avenue 1-3, 115 23 Athens, Greece
- Website: www.dpa.gr · Tel: +30 210 6475600
We would appreciate the chance to address your concern first — you are welcome to contact us at any time. This is not a precondition: you keep the right to lodge a complaint with the Authority directly at any time.
10 How we protect your data
We apply appropriate technical and organisational measures to protect your personal data against loss, misuse, and unauthorised access — including encrypted connections (TLS) across the website, access controls and strong authentication on the systems that hold your data, and contractual confidentiality and security obligations on every processor we work with. No system is perfectly secure, but we limit access to your data to those who genuinely need it.
11 Children
Our website and marketing are directed at adults (18+). We do not knowingly collect personal data from children through the website. Where the data of a minor is involved in an event booking, the rights described in section 08 are exercised by the person with parental responsibility.
12 Changes to this policy
We may update this policy from time to time — for example if we change providers or tools. When we do, we will revise the “Last updated” date at the top of this page, and communicate significant changes where appropriate.
13 Contact us
Questions about this policy or your personal data? Email [email protected] and a real person at Fun Up will reply.