This Privacy Policy explains how the Android and iOS mobile apps and the
web service at www.ethelontes.eu (together, the “Service”) collect,
use, and protect your personal data. The Service is intended for members of civil-protection volunteer
teams and for visitors exploring the public demo.
1. Data Controller and Platform Provider
The data controller of your personal data is the association/organisation (the volunteer
team) you belong to. Its details (name, email, phone, address) are shown in the in-app “Terms of Use &
Privacy Policy” after you sign in.
For Warehouse, Cash Box and Group Orders data, your team is the data controller; the platform provider
does not sell, does not act as an intermediary and does not handle money in group orders
(see the Terms of Use, section 10).
For subscription data (see the Terms of Use,
section 11) — billing mode, coverage, individual purchases, the subscription event log, grants of free access —
the data controller is the platform provider, which provides and charges for the
subscription. Your team learns from this data only whether you are covered and until when (section 5).
The platform provider/operator develops, hosts and maintains the Service on behalf of the
teams and, for the teams’ data, acts as a data processor (Article 28 GDPR); for subscription
data it is the data controller, as stated above. It is also the point of contact for platform matters:
Christos Themelis
Email: themelisx@gmail.com
Website: www.ethelontes.eu
2. Data We Collect
| Category | Data | When / Why |
|---|
| Account (sign-in) |
Google (Android, iOS, web): Google account identifier, email address, name,
profile photo URL.
Apple (iOS, web): Apple account identifier, email address (or the “Hide My Email”
relay address, if you choose it) and name, if you share it. |
When you sign in with Google or Apple, to identify you and link you to your team. A member can link
both Google and Apple to the same Service account, either from the Profile or automatically when
both providers confirm the same email address. |
| Profile |
Full name, phone number, alternative notification email, role, team, skills/certifications (e.g.
licences, specialities, expiry dates) |
For team coordination. The phone number is optional. |
| Operational data |
Availability, shifts, activities, trainings, incidents, vehicle/boat assignments, shift-swap
requests and similar records you create or view |
The core purpose of the Service; visible within your team according to each member’s role and
permissions. |
| Precise location (GPS) |
Latitude/longitude, speed, heading, timestamp |
Only while you enable a GPS Tracker in the mobile app, or when you send an SOS — see
section 3. |
| Push notifications |
Push token: Firebase Cloud Messaging (Android) or Apple Push Notification service (iOS) |
To deliver operational notifications (incident alarms, SOS, shift reminders, announcements).
Operational notifications are not sent to honorary members, municipality representatives and accounts
that do not belong to a natural person, nor to members who have no access because of the subscription
rules (Terms of Use, section 11). |
| Device & session |
Platform (Android/iOS) and device label (manufacturer and model on Android; “iPhone” and the iOS
version on iOS), sign-in tokens |
Stored with your session to keep you signed in and so that devices can be revoked. |
| Equipment, cash box and group orders |
Warehouse: team equipment issued to you (issue number, item, quantity, dates,
acceptance/return).
Cash box: receipts, refunds, credits and settlements concerning you (amount, date,
internal receipt number, treasurer).
Group orders: pre-orders (items, sizes, quantities, estimated/final price), payments
and balances, collections, distributions, size exchanges.
Member sizes (e.g. uniform, footwear) — optional.
Notes/reasons written by you or by the people in charge. |
Only if your team uses these features: to manage the team’s equipment, to keep the treasurer’s
internal cash box and for the group equipment orders you place. You enter your sizes only if you wish,
so that size selection is pre-filled, and you can delete them at any time. |
| Subscription |
Your team’s billing mode, whether you are covered and until when, a pseudonymous subscription
identifier, any free access granted to you (by whom, when, note).
Individual subscription: store (Google Play or App Store), product (monthly or yearly),
purchase identifiers, purchase and expiry dates, trial period, auto-renewal, cancellation or refund,
environment (production or sandbox).
Log of purchase/subscription events and of platform-administrator actions. |
To check your coverage and apply your team’s access rules, verify purchases and prevent abuse (e.g.
one purchase shared across several accounts). Never includes card or bank-account details. |
Cash-box receipts are internal and are not tax or accounting documents. The Service does
not process card or bank-account details; payments are made outside the Service (e.g. in
cash to the treasurer) and are only recorded. The individual subscription is paid through Google Play or the
App Store, which process your payment details and do not share them with us.
The Service does not contain advertising and does not use third-party
analytics or tracking tools. We do not sell your personal data.
Device calendar (Android only): the Profile screen of the Android app offers two optional
settings, off by default and set separately on each device: “Add my participations to the
phone calendar” writes your own shifts (assignments and availability declarations), trainings and activities
as plain events, without reminders, into a device calendar that you choose; “Show work shifts (my Work
Shifts)” only reads from the calendar the work shifts that the “my Work Shifts” app has entered there, so
that they appear in the day view. The calendar permission is requested only if you turn on one of these
settings and is used only locally on the device: nothing read from or
written to the calendar is sent to our server. If you choose a calendar that is synced with an account (e.g.
Google), the syncing is done by the calendar provider according to your own account. Turning the setting off
(or signing out) removes only the events that the app wrote.
3. Location (GPS), GPS Tracker and SOS
The mobile app offers two GPS Tracker modes, which you switch on and off yourself:
- Vehicle tracker: reports the location of the vehicle you are on, only during your shift
on it or while the vehicle is deployed to an active incident (or at any time, for members whom the team
has granted the special “GPS tracker without a shift” permission).
- Member tracker: reports your own location so your team can coordinate you on the live
map. It runs continuously while you keep it enabled and is not limited to your shift.
While a tracker is enabled, location keeps being reported when the app is in the background or the screen
is off. When tracking is off, no location is collected.
- Android: the tracker runs as a “location”-typed foreground service with a persistent
notification. The app does not request the Android background-location permission.
- iOS: the app requests location access only “While Using the App” (not “Always”) and, if
you allowed only approximate location, asks for temporary precise location for the tracker. While a
tracker is enabled, iOS shows its location-in-use indicator in the status bar.
SOS: when you press SOS from an active tracker, your current location and your name (or,
for a vehicle, the vehicle’s name and the names of its shift crew) are sent to all members of your team, as a
push notification and to the team’s Telegram channel (if the team uses one). Your phone number is included
only if you saved it in your profile and turned on the “show my phone to the other
team members” option yourself. This option is off by default.
4. Why We Process It and Legal Basis
- Team coordination (shifts, availability, activities, incidents, maps, SOS): legitimate
interest / performance of a task carried out in the public interest, for the purpose of civil
protection.
- Location: collected only when you enable a tracker yourself or send an SOS.
- Showing your phone number to other members and push notifications:
consent (profile option / the device’s notification permission), which you can withdraw at any time.
- Equipment, cash box and group orders: the team’s legitimate interest in managing its
equipment and the money handled on behalf of its members, and performance of the pre-order you submit.
Member sizes: consent (you enter and delete them yourself).
- Subscription (coverage checks, purchase verification, applying the access rules):
performance of a contract — your individual subscription or your team’s agreement (Article 6(1)(b) GDPR).
Keeping the records required by tax law: compliance with a legal obligation (Article 6(1)(c)). Abuse
prevention and the record of platform-administrator actions: the provider’s legitimate interest (Article
6(1)(f)).
- Security and integrity of the Service: legitimate interest.
5. Who Sees Your Data & Third Parties
- Your team: your name, role, availability and operational data are visible to team
members and team managers according to their permissions. Team managers/administrators always see your
phone number; other members only if you allow it.
- Live map: while a tracker is enabled, the vehicle’s or your location is visible on the
map to the members of your team and, if they choose to show them, to members of other teams in the same
municipality.
- Warehouse, cash box, group orders: each member sees only their own
records (equipment, cash-box statement, orders). Within your team they are also visible to those with
the corresponding permission: warehouse managers, treasurers and those allowed to view the cash box
(e.g. the board/audit committee), and group-order managers. Other team administrators see only counts of
pending items (not amounts) when they change your status in the team. Municipality representatives see
only what their permissions allow.
- Subscription: your team’s managers/administrators see only whether you are covered and
until when — no amounts. Full subscription details are visible only to the platform provider.
- Suppliers: an order the team sends to a supplier (by email, only on an explicit action
by the person in charge) contains only items, sizes and quantities — no member names or
details.
- Google: Google Sign-In and push delivery on Android (Firebase Cloud Messaging).
- Apple: Sign in with Apple and push delivery on iOS (Apple Push Notification
service).
- Google Play / App Store (individual subscription only): the sale, charging, renewal,
cancellation and refunds are handled by Google or Apple, which process your payment details as
independent data controllers under their own terms and privacy policies.
- RevenueCat (RevenueCat, Inc., USA — for the individual subscription): a data
processor acting on behalf of the platform provider, which verifies purchases with Google Play and
the App Store and informs our server of the subscription status. When you sign in to the mobile app, the
RevenueCat software (SDK) included in the app processes: a pseudonymous subscription
identifier; the details of your store purchases (purchase identifiers and receipts, product, price
and currency, dates); and technical data needed to provide its service (platform, app version, device
model and OS version, IP address). It never receives your name, email address or account
identifier and is not used for advertising or tracking. Transfers to the USA are made under a data
processing agreement (DPA) with appropriate safeguards under Article 46 GDPR (e.g. the European
Commission’s standard contractual clauses) or, where the recipient is certified, under the EU–US Data
Privacy Framework (Article 45 GDPR). When your account is deleted, your customer record at RevenueCat is
deleted too (section 9).
- Telegram: if your team uses Telegram, announcements, reminders, shift/activity rosters
(with member names), alarms and SOS messages (with the location and, only with your consent, your phone
number) are posted to your team’s Telegram channel/group.
- Email (Brevo): the Service’s emails (e.g. shift reminders, emergency-call notifications,
notifying team managers of a new member, cash-box receipts, pre-order payment reminders, notifying the
people in charge when a member with pending items leaves) are sent to your email address through the
email delivery
provider Brevo.
- Maps: map tiles (OpenStreetMap, Esri) and address search (OpenStreetMap Nominatim, with
the text you type) are loaded directly by your device; these providers see your IP address but not your
GPS location. Weather forecasts are computed for the location of the team’s base, not yours.
- Hosting provider: the server that hosts
www.ethelontes.eu and its
database.
These providers process data under their own terms; some (e.g. Google, Apple, Telegram, RevenueCat) may process it
outside the European Economic Area. We do not share your data with advertisers or data brokers.
6. Data Sources
Weather and the possible fire-risk index (forecast) are computed from data provided by the public sources
below. The Service’s server sends them only the coordinates of the team’s base station; no
personal data, and not your location, is sent.
- MET Norway (Norwegian Meteorological Institute), Locationforecast service: weather
forecasts. License CC
BY 4.0.
- NASA POWER (power.larc.nasa.gov): historical
meteorological data used to compute the index. License CC BY 4.0.
- Open-Meteo (open-meteo.com): weather forecasts and
historical data, until the full transition to the sources above. License CC BY 4.0.
7. Data Retention
- Account and operational data are kept while you are a member of the team.
- GPS locations: the map shows only the last 24 hours. Every new location that is
reported automatically deletes those older than 24 hours; so after a tracker is switched off, its last
24 hours of locations remain stored until it is next enabled.
- Equipment issues, cash-box transactions, pre-orders and payments are kept as a
ledger that is not deleted (corrections are made with reversing entries), for
transparency in managing the team’s equipment and money. When your account is deleted these records are
anonymised (“Former member”). Free-text fields (notes, reasons,
comments) are not cleaned automatically — do not write personal data of other people in them.
- Member sizes: until you delete them or your account is deleted (they are then
deleted).
- Technical duplicate-submission data (the server’s response to a payment/order action,
so that it is not executed twice): up to 24 hours; also deleted when your account is deleted.
- Subscription data: while your account exists. The log of purchase and subscription
events (purchases, renewals, cancellations, refunds) for up to 24 months, except: records
of platform-administrator actions (e.g. granting or revoking free access, changing a team’s billing mode),
which are kept for as long as necessary for the provider’s accountability; and whatever tax law requires,
for as long as it requires. When your account is deleted, the customer record at RevenueCat is deleted, but
the purchase records of an in-app subscription (store, plan, purchase and expiry dates, the
store’s transaction identifier — not your name or email) are kept for 5 years after the
subscription expires and then deleted, for tax/accounting purposes and to prevent fraud (so that the same purchase cannot be claimed by another account); they and whatever else is retained
remain linked only to the anonymised account. The store’s transaction identifier is pseudonymous (Google or
Apple can link it to your store account), so these records are not anonymous.
- A device’s sign-in and push tokens are deleted when you sign out on it.
- When your account is deleted, section 9 applies.
8. Security
- All network traffic uses HTTPS/TLS; cleartext traffic is disabled.
- Sign-in tokens are stored encrypted on the device (encrypted storage on Android, Keychain on iOS).
- Access to data is restricted by team, role and permissions.
9. Your Rights, Data Export & Account Deletion
You have the right to access, correct, delete (“right to be forgotten”), restrict, port and object to the
processing of your data, and to withdraw your consent at any time.
- Data export: from the Profile (“Εξαγωγή δεδομένων μου” in the app,
“Λήψη των δεδομένων μου” on the web) you get all your personal data as a JSON
file. It also includes the Warehouse, Cash Box and Group Orders data concerning you (and your actions as
a person in charge, without other members’ details), as well as your subscription data.
- Account deletion: in the app, Profile → “Αποχώρηση από την ομάδα”
→ confirm in the “Αποχώρηση και διαγραφή” dialog; on the web, Profile →
“Αποχώρηση από την ομάδα” → confirm. Your account is
irreversibly anonymised immediately: your name, email, phone number and photo are
removed, your Google/Apple sign-in links are removed (the app’s access to your Apple account is
revoked) and every device is signed out. Participation history (shifts, activities, incidents,
trainings) is kept anonymously, without identifying you. Your GPS locations (Member Tracker) from the
last 24 hours before deletion remain stored, linked to the anonymised account (not to your name), and
are no longer shown on the live map. If you have pending items (team equipment, a cash-box balance, open
pre-orders), deletion is not blocked; the responsible people in your team are notified
by email (with your name and only totals of the pending items) so they can settle them.
Cash-box and order records are kept anonymously (section 7). This cannot be undone. A team manager can
delete your account from user administration, with the same result (anonymisation). More: Account & Data
Deletion.
- Subscription: when your account is deleted, the customer record at RevenueCat that
corresponds to your pseudonymous subscription identifier is deleted; the subscription data we retain
(section 7) remains linked only to the anonymised account. Deletion does not cancel your
individual subscription on Google Play or the App Store; cancel it yourself in the store
before deleting your account, so that you are not charged again.
- To exercise your rights, contact your team’s manager (section 1) or the platform provider at
themelisx@gmail.com from your account’s email address. If you
can no longer sign in, you can request deletion by email; it is completed within 30 days.
- You also have the right to lodge a complaint with the Hellenic Data Protection Authority
(www.dpa.gr).
10. Demo Mode
The Service offers a demo without an account, using a shared account and sample team data. Anything you
enter there is visible to other visitors; do not enter real personal data.
11. Children
The Service is intended for adult volunteers and team managers. It is not directed at children.
12. Changes
We may update this policy. Material changes will be reflected by updating the “Last updated” date above
and, when the Terms of Use change, you are asked to accept them again the next time you sign in to the
app.
13. Contact
Questions about this policy or your data: your team’s manager or
themelisx@gmail.com.