Privacy Policy — how we handle your data

Version: 2 July 2026 (preview) · Controller: University of Thessaly — CeprLab · Contact: ceprlab@uth.gr. This policy describes the website as built; it is pending the University's formal data-protection review before the production launch.

1. Who we are

The Clinical Exercise Physiology and Rehabilitation Laboratory (CeprLab) is a research laboratory of the Department of Physiotherapy, School of Health Sciences, University of Thessaly (UTH), Greece. UTH is the data controller for personal data processed through this website. Contact for data-protection matters: ceprlab@uth.gr. UTH's designated Data Protection Officer can be reached through the University's central administration.

2. What data we collect and why

This website collects no cookies, no tracking pixels, no analytics, and no user-submitted data. There is no contact form, no login, and no newsletter on this site — enquiries are made by email. The only personal data processed is standard server access-log data, generated automatically when any web server receives a request:

• IP address of the requesting device
• Date and time of the request
• URL requested and HTTP status code returned
• Referring URL (if any) and user-agent string

Legal basis: Legitimate interest (Article 6(1)(f) GDPR). We have a legitimate interest in maintaining the security, availability, and integrity of our systems. Server access logs are the minimal data required for this purpose, and this interest is not overridden by data subjects' interests given the limited nature of the data and the absence of any profiling or tracking.

3. How data is stored and who processes it

This website is served through statichost.eu, an EU-based static-hosting provider, which acts as a data processor on our behalf. Any server access logs it keeps are retained according to the provider's data-processing terms.

No web fonts are loaded from Google Fonts, Adobe Fonts, or any third-party CDN — the site’s fonts are self-hosted on the same domain — and no third-party resources are requested during normal page loading. Everything the page needs — styles, fonts (with a system-font fallback), images and icons — is served from this same domain.

4. Who we share data with

We do not sell, rent, or otherwise share personal data with third parties, except our hosting provider statichost.eu (data processor, as described above) and Greek or EU authorities where required by law or court order.

5. External links

This website links to external resources — the University of Thessaly and other institutions, journal publishers (via DOI links), public study registries (e.g. ClinicalTrials.gov), OpenStreetMap, and social-media share links (Facebook, Instagram, LinkedIn). We are not responsible for the privacy practices of those sites; following an external link subjects you to that site's own privacy policy.

6. Your rights under GDPR

As a data subject under EU 2016/679 you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), and the right to object (Art. 21). You also have the right to lodge a complaint with the supervisory authority in Greece — the Hellenic Data Protection Authority (HDPA / Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα) at www.dpa.gr.

To exercise any right, contact us at ceprlab@uth.gr. We will respond within one month, as required by GDPR Article 12(3).

7. Cookies and tracking

This website uses zero cookies, zero tracking pixels, zero analytics scripts, and zero fingerprinting. No consent banner is shown because there is nothing that requires consent. The “ZERO COOKIES · ZERO TRACKING · EU HOSTED” declaration in the footer is accurate.

8. Changes to this policy

If we change how we process personal data, we will update this policy and revise the version date above. Please check this page if you have concerns.

9. Contact

ceprlab@uth.gr · CeprLab, Department of Physiotherapy, University of Thessaly, 3rd km Old National Road Lamia–Athens, University Campus, 35100 Lamia, Greece.