Privacy Policy

01 / Controller and contact

Deseo Radio (deseoradio.com) is operated by ILUMA DIGITAL ΟΕ, trading as ILUMA DIGITAL AGENCY, Greek tax number 802967384, General Commercial Registry (GEMI) number 186406203000, registered address 1 Moschonision Street, Egaleo, 12242 Attica, Greece. The company is the data controller for processing it determines. General contact: radio@iluma.gr, +30 210 300 0825; privacy requests: gdpr@iluma.gr. This mailbox is a privacy contact point and does not imply the appointment of a statutory Data Protection Officer.

02 / Scope

This notice covers the public website, communications, guest DJ applications, MyLive accounts, DJ sets, track promotions, scheduling, associated notifications and electronic messages. Linked services such as Spotify, HearThis, Mixcloud and Apple Podcasts have separate privacy terms. DJ Participation Terms apply additionally to contributors.

03 / Personal data processed

• Visitors: IP addresses, browser/device and access logs, security data, language and cookie preferences, and interactions where enabled.
• Contacts: name, email, message, professional details and correspondence.
• DJs: legal and artist names, email, optional contact/social details, photo, biography, work samples, preferred slots, show details, terms version and acceptance timestamp.
• MyLive/CMS: account and permission information, authentication logs, episode statuses, scheduling, submitted MP3 DJ sets, track promos, review comments and related metadata.
• Notifications: email preferences and delivery status, device/push subscription identifiers where enabled.
• Measurement: audience, usage, traffic and performance metrics, which may involve identifiers before aggregation.

Information is obtained from you, your device or the services you choose. Please do not submit special-category data or third-party data without a lawful reason.

04 / Purposes and legal grounds

Depending on context, Article 6 GDPR grounds include: contract or requested pre-contractual steps (6(1)(b)) for services and DJ participation; legitimate interests (6(1)(f)) for communication, website security, fraud prevention, service administration and legal defence, subject to balancing; legal obligations (6(1)(c)) for mandatory records; and specific consent (6(1)(a)) for optional tracking or marketing where required. Publication of agreed artist profiles and show details relies on the participation relationship or a carefully assessed legitimate interest. Consent can be withdrawn without affecting earlier lawful processing. Agreeing to usage terms does not constitute marketing consent.

05 / Public profiles and content

Selected artist names, photos, biographies, programme slots, public links and show information may appear on official websites, channels and promotional materials under participation arrangements. Private email addresses, passwords and internal review notes are not intended for publication. Uploads for internal review are not published automatically. Contributors must have the necessary rights in their content.

06 / Email and push

Essential transactional messages relate to accounts, programme changes, submissions and security. Newsletters and promotional messages require an appropriate legal ground and applicable opt-out options. Push notifications require user/device permission, which may be withdrawn in device or service settings; device permission alone does not replace any other required consent.

07 / Cookies and providers

The website uses necessary storage for operation, sessions, language and privacy preferences. Depending on configuration, optional services include consent-controlled Google Analytics 4, cookieless Cloudflare Web Analytics, Webpushr for opted-in notifications, Cloudflare Turnstile and ILUMA Radio Signal measurements. Provider processing may occur even without traditional cookies. See the Cookie Policy and privacy settings.

08 / Recipients

Authorized personnel and necessary service providers may access data for hosting, mail, IT security, analytics, notifications, broadcast/podcast distribution, professional advice and support. Relevant providers may include Cloudflare, Google, Webpushr, HearThis and hosting/email vendors, subject to actual configuration. External platforms may act as independent controllers. We do not sell visitors' personal-data lists.

09 / Transfers outside the EEA

Some vendors may process information outside the EEA. Such transfers require an applicable GDPR Chapter V mechanism, such as adequacy decisions or Standard Contractual Clauses with supplementary measures when necessary. Request specific safeguards through gdpr@iluma.gr.

10 / Retention

We retain data only for the applicable purpose, active relationship, legal obligations or claims, then delete or anonymize it. Season 6 applications and acceptance records are generally scheduled for up to 24 months after the season, with lawful exceptions. Promo audio may be deleted sooner after completion of its approval workflow. Active MyLive accounts and related security records follow operational needs; logs, backups and tax records follow applicable retention periods. Public archival material can remain longer where lawful and necessary. Specific retention details can be requested from the privacy contact.

11 / Security

Risk-appropriate organizational and technical controls include access restrictions, HTTPS, form validation and automated-abuse protection. Absolute security cannot be guaranteed. Personal data incidents are assessed and reported where GDPR Articles 33–34 require.

12 / Your rights

Subject to legal conditions, rights include access, rectification, erasure, restriction, portability, objection, and consent withdrawal (GDPR Articles 7, 15–18, 20–21). You may request information regarding Article 22 automated individual decisions; ordinary operations do not rely on solely automated decisions producing legal or similarly significant effects. Contact gdpr@iluma.gr. We normally respond within one month; an additional two months may be available in legally permitted cases with notice. Requests are generally free; proportionate identity verification may be necessary.

13 / Supervisory authority

You may lodge a complaint with the Hellenic Data Protection Authority at www.dpa.gr without losing other remedies. You may contact us first, but are not required to do so.

14 / Children and changes

The service is intended for the general public, not for intentional collection of children's data without suitable safeguards. DJ participation has separate eligibility terms. External websites apply their own policies. We update this notice when actual processing or the law changes and communicate material changes where required.