Privacy Policy

Last updated: 18 October 2026 (v2.3) · Supersedes version v2.2 (18 October 2026)

1. Data Controller

The data controller is FINANCIAL SERVICES Ο.Ε. (General Partnership), 10 I. Plessa St., 29100 Zakynthos, Greece, VAT No. 802029709 (Zakynthos Tax Office), General Commercial Registry (Γ.Ε.ΜΗ.) No. 168484324000, email financialserviceszth@gmail.com. For any matter relating to this policy: financialserviceszth@gmail.com.

For any personal data matter you may contact financialserviceszth@gmail.com. If a Data Protection Officer (DPO) is appointed, their details will be published on this page.

2. Data We Collect

Depending on how you use the website, the following may be collected:

• Contact form: first name, last name, telephone, email address, subject and message.

  User account: email address and encrypted password, name or company name, country and, for businesses, VAT number.

  Orders: products, amounts, VAT rate and amount, date, order status, invoice details.

  Payments: card details are not collected or stored by the Company; payment takes place in the payment provider's secure environment, which returns only a transaction identifier and status.

  Product access: download and login logs, with date and time, for security and abuse-prevention purposes.

  Cookies and statistics: see the Cookie Policy.

  3. Purposes of Processing

  • Responding to contact requests.

    Creating and managing user accounts and sending account messages (sign-up confirmation, password reset, order notifications).

    Performing the sales contract: delivering the digital product and providing access.

    Issuing, transmitting and archiving tax documents, keeping accounting records and complying with tax legislation.

    Fraud and abuse prevention, systems security.

    Improving content and user experience through statistics.

    4. Legal Basis

    • Consent (Art. 6(1)(a) GDPR): contact form, analytics cookies.

      Performance of a contract (Art. 6(1)(b) GDPR): user account, orders, product delivery, support.

      Legal obligation (Art. 6(1)(c) GDPR): issuing invoices, keeping tax and accounting records.

      Legitimate interest (Art. 6(1)(f) GDPR): systems security, fraud prevention, establishment or exercise of legal claims.

      5. Retention Periods

      • Contact form data: three (3) months from submission, if no engagement follows.

        User account: for as long as it remains active and for twelve (12) months after the last login or a deletion request.

        Orders, invoices and accounting records: five (5) years from the end of the relevant tax year, as required by tax legislation. The same period applies to copies held in the Company's document storage environment.

        Download and login logs: twelve (12) months.

        Cookies: as stated in the Cookie Policy.

        6. Recipients — Processors

        Data is not disclosed to third parties other than the following processors, acting solely on the Company's instructions under an Article 28 GDPR agreement:

        • Netlify, Inc. — website hosting and operation of the contact form. Data: form submissions, technical logs.

          Google Ireland Limited — (a) website analytics through Google Analytics 4, (b) email and collaboration services through Google Workspace. The two services are governed by separate data processing terms.

          Supabase — database, user authentication and private storage of product files. Data: account, orders, logs. Hosting region: Ireland (within the EU).

          Stripe — card payment processing. Data: transaction details, buyer email. The provider acts as an independent controller for payment data it processes for its own compliance and fraud-prevention purposes.

          The Company’s bank — for payments by businesses by bank transfer. Data: name of the payer, amount, date and reference of the transfer, which the Company uses to activate the account and for tax documentation. The credit institution acts as an independent controller for the data it processes for its own lawful purposes.

          Resend — delivery of automated account and order messages. Data: recipient email address, message content, delivery status.

          ELORUS ΙΚΕ (13 Theofilopoulou St., 11743 Athens) — issuing tax documents for card payments (service receipts and credit notes) and transmitting them electronically to the Greek tax authority (myDATA). Data: buyer invoicing details, transaction breakdown.

          Epsilon Net — issuing tax documents for payments by businesses by bank transfer and transmitting them electronically to the Greek tax authority (myDATA). Data: buyer invoicing details, transaction breakdown.

          Microsoft Ireland Operations Limited — storage and archiving of invoices, receipts and related files in the Microsoft 365 environment. Data: issued tax documents and the invoicing details they contain.

          Make.com — automated handling of replies to public reviews. Data: content and display name of the public review.

          Competent authorities, where a legal obligation exists.

          The Company maintains an internal Register of Processors recording the purpose, data categories, place of processing and applicable agreement for each provider. The register is updated on every change and is available to supervisory authorities.

          7. Place of Processing and Transfers Outside the EEA

          Processing takes place primarily within the European Economic Area. In particular, database and product file data are hosted on infrastructure in Ireland, while email, collaboration and file storage services are provided by entities established in the European Union.

          Certain providers, in particular those established in the United States, may process data on servers outside the EEA or have support staff outside the EEA. In such cases, transfers are made on the basis of the European Commission's Standard Contractual Clauses or an adequacy decision, with appropriate supplementary technical and organisational measures.

          8. Data Security

          The Company applies appropriate technical and organisational measures: encrypted transmission (HTTPS), password hashing, authentication using secure keys, role-based access restriction, private storage of product files with temporary download links, request rate limiting and regular review of access rights.

          9. Data Subject Rights

          You have the right of access (Art. 15), rectification (16), erasure (17), restriction (18), portability (20) and objection (21), as well as the right to withdraw consent at any time, without affecting the lawfulness of prior processing.

          Requests may be submitted to financialserviceszth@gmail.com and are answered within one (1) month, extendable by a further two months for complex requests, with prior notice to you.

          10. Right to Lodge a Complaint

          You have the right to lodge a complaint with the Hellenic Data Protection Authority, 1-3 Kifissias Ave., 11523 Athens, www.dpa.gr.

          11. Automated Decision-Making

          No automated decision-making or profiling producing legal effects or similarly significantly affecting you is carried out.

          12. Amendments

          The Company reserves the right to amend this policy. Changes take effect upon publication on the website. For material changes, registered users are notified by email.

          Last updated: 18 October 2026 (v2.3) · Supersedes version v2.2 (18 October 2026)