Privacy policy

Here we explain what personal data we collect when you use Sitadiko, why we need it, who we share it with and what rights you have, in line with the EU General Data Protection Regulation 2016/679 (GDPR) and Greek Law 4624/2019.

1. Controller

• Business name: Αναστάσιος Γκόρτζας του Σεραφείμ (ατομική επιχείρηση)
• VAT no. (ΑΦΜ): 154468940 · Tax office: Amarousiou (Marousi)
• Address: Dimitras 14, 151 24 Marousi, Greece
• Email: [email protected] · Phone: 698 381 1159

For anything to do with your data, write to us at [email protected].

2. What data we collect

• Your business details that you enter in the guide and the editor: business name, line of work, phone, email, address, text, photos and logos.
• Account details, if you sign in with Google: your name, email address and your Google account ID. We never get your password or access to any other Google data.
• Payment details: email, amounts, what you bought and when. Card details are processed only by Stripe; we never see them.
• Help requests: name, email, phone and your message to our expert.
• Technical data: IP address, browser type and time of access in the server logs, and the essential cookies (see our Cookie policy).

We don't use advertising or tracking tools (e.g. Google Analytics, Facebook Pixel) and we don't sell data to anyone.

3. Why we use it and on what legal basis

• To build, host and publish your website and give you access to it: performance of a contract (Article 6(1)(b) GDPR).
• For payments, receipts/invoices and accounting: performance of a contract and legal obligation (Article 6(1)(b) and (c)).
• To send you emails about the service (e.g. a new message on your website, payment confirmation, a failed payment): performance of a contract. We don't send marketing emails without your consent.
• For the security of the platform and to prevent abuse: legitimate interest (Article 6(1)(f)).

4. Messages from website visitors

When a visitor sends a message through the contact form of a website built on Sitadiko, the controller is the business that owns the website. We act as the processor: we store the message and pass it on to the business, without using it for any other purpose. To exercise your rights as a visitor, contact the business; if you can't reach them, write to us and we'll help.

5. Who we share data with

Only with providers we need to run the service, under contracts that require them to protect it:

• Hosting provider (Hetzner Online GmbH, Germany): where the platform runs and the data is stored.
• Stripe (Ireland/USA): card payments.
• Google (Ireland/USA): only if you choose “Sign in with Google”.
• Resend (USA): sending the service's emails.
• Telegram: internal notifications to our team about new orders and requests (name, email, phone), and off-server storage of encrypted backups, which cannot be read without our own key.
• Unsplash / Pexels: the ready-made photos load from their servers, so they see the visitor's IP address.
• Our accountant and the tax authorities: the details required by law for receipts and invoices.

When data is transferred outside the European Economic Area (e.g. to the USA), the transfer is based on the European Commission's adequacy decision for the EU-US Data Privacy Framework or on standard contractual clauses.

6. How long we keep it

• Your websites and account: for as long as you use the service or until you ask for deletion.
• Visitor messages: until the business deletes them or the website is closed.
• Payment and receipt/invoice records: for as long as tax law requires (usually 5 years).
• Server logs: up to 90 days.
• Backups: up to 30 days on the server, where they are deleted automatically. We delete the encrypted off-server copies every month.

7. Your rights

You have the right to:

• find out what data we hold about you and get a copy;
• correct anything that is wrong;
• ask for it to be deleted, except for whatever we must keep by law;
• restrict or object to its processing;
• get your data in a machine-readable format (portability).

Write to us at [email protected] and we'll reply within one month. If you believe we haven't respected your rights, you can file a complaint with the Hellenic Data Protection Authority (Kifisias 1-3, 115 23 Athens).

8. Security

All communication is encrypted (https). Access to data is limited to those who need it to serve you. We keep backups. If a breach affecting you occurs, we will inform you as required by law.

9. Minors

The service is aimed at professionals over 18. We do not knowingly collect data from minors.

10. Changes

If this policy changes, we will update the date at the top of this page and, for significant changes, we will let you know by email.