Privacy Policy
DRAFT — NO LEGAL APPROVAL
This binding legal text sets out the framework under which Standee, a directory of Greek tools and SaaS (the "Service"), processes your personal data, in compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Greek Law 4624/2019.
Courtesy translation: This English text is an informative translation. The Greek version is the only legally binding version; if the two differ or are unclear, the Greek text prevails.
Notice on Measurement: The Service uses no analytics tools, advertising networks, social plugins or third-party CAPTCHA and sets no tracking cookies. Traffic is measured solely on our own server, using a pseudonymised identifier that is renewed every day (Section 3.1).
1. Subject Matter, Scope and Amendments
This Policy applies to the website standee.gr and its features: browsing the directory, submitting a recommendation request ("Ask for a recommendation"), the account with sign-in by email link (magic link), saving tools and searches, claiming and listing projects by makers ("List your project") and reporting problems. Browsing, submitting a request or report, creating an account and signing in mean that you have taken note of this Policy.
This Policy may be amended, e.g. when features, providers or legislation change. Each new version is published on this page with a new version number and effective date; for material changes we give advance notice on the website and, where we hold your email address, by email.
2. Identity of the Data Controller
Legal status: natural person, independent developer
Jurisdiction: Hellenic Republic
Seat:
Email: vasilispapg@outlook.com
Website: vspapg.gr
The Controller determines the purposes and means of the processing described here. No Data Protection Officer (DPO) has been appointed; for any personal data matter, please write to the email above.
3. Categories and Nature of the Data Collected
3.1 Visitors: Technical Data and Measurement
Your IP address is not stored. For aggregate statistics and abuse protection, the server computes a hash identifier from the IP, the browser and a secret salt that changes every day, so that visitors are not tracked from one day to the next and the identifier is not reversible. We record events such as page view, listing view, outbound click to a tool (the number of clicks via the `/go` path) and request submission, together with the path, the referring domain and UTM parameters. The parameter `utm_source` is added to the destination address of outbound links. Declared bots and prefetch requests are not counted.
In addition, to know which pages are used, the page you visit sends our server a message with its path, the language and, if present, only the domain name of the website that referred you (not the full address), and the server increments a daily counter. The counter does not store an IP address, browser details, cookies, a visitor identifier or a hash; we cannot link two visits to each other. The same applies to the terms you search for in the directory: only the term (normalised; terms that look like an email address or a phone number are not recorded) and the number of searches per day are stored, with no link to you. Declared bots are not counted.
3.2 Recommendation Request ("Ask for a recommendation")
Email, the text describing your need (private; never published) and, optionally, the tool you use today, category, a reference to a similar tool, a monthly budget range and a deadline, as well as the date and version of the notice that was shown. The email confirmation link is stored only as a hash and expires after seven (7) days. The email in the sending queue is cleared as soon as the message is sent; if sending finally fails, it is kept for up to seven (7) days so that sending can be retried, and is then deleted.
3.3 Account (Buyer or Maker)
Sign-in is passwordless, with a one-time link sent to your email. We process your email, the sign-in link (stored only as a hash, valid for fifteen (15) minutes and for a single use), the random session identifier (Cookie Policy) and, for buyer accounts, the list of tools and searches you save. These lists are not published, are not provided to makers and are not used for profiling or advertising. We do not store the list on your device before you sign in.
3.4 Makers: Claiming and Listing a Project
Email, the listing data you declare (description, prices, images, logo, certifications with number, issuing body and date, company details; VAT number and company registry number remain private), proof that you manage the tool's domain (value, method, date), the listing's change history and, only if you choose to provide it, a CV (private by default).
3.5 Reports and Communication
When you submit a report ("Something is not right?") or contact us, we process your email, optionally your name, the description and the evidence you provide.
3.6 Abuse Prevention Measures (Anti-spam)
Forms are protected by a hidden field (honeypot), a minimum completion time (signed form timestamp) and request limits per IP identifier (hash) and per recipient. For these limits, short-lived hashes that expire automatically are kept; the raw IP is used in server memory only to compute them.
3.7 Server Logs
Server logs contain no email, IP, request path or request text; they contain only technical operating data and short hashes for error diagnosis.
3.8 Data You Did Not Provide Yourself
Listings marked "Recorded" are created from publicly available information (the tool's page, public repositories, public registers) and always show source and date. If they contain data of a natural person (e.g. the trade name of a sole proprietorship), that data comes from those sources. You may request correction or removal through the "Something is not right?" form or at vasilispapg@outlook.com. If a third party enters your email in a request, you will receive at most one message with a confirmation or deletion link.
4. Legal Bases for Processing (Article 6 GDPR)
| Purpose of Processing | Legal Basis |
|---|---|
| Processing and sending a reply to your request, and related messages | Article 6(1)(b) — pre-contractual steps at your request |
| Account: email-link sign-in, session, saving tools and searches | Article 6(1)(b) — performance of the service you request |
| Claiming, operating a maker account and publishing a listing | Article 6(1)(b) — performance of a contract (Terms of Use) |
| Optional uses beyond the reply (e.g. anonymous demand topic, saved-search notification, disclosure of details to a named recipient, CV) | Article 6(1)(a) — separate, optional consent per purpose, revocable at any time |
| Aggregate statistics, network security, abuse prevention (honeypot, request limits) | Article 6(1)(f) — legitimate interest of the Controller; right to object (Section 7) |
| Examining reports, exercising rights, meeting legal obligations, establishing or defending legal claims | Article 6(1)(c) and 6(1)(f) |
The strictly necessary session cookie falls under the exemption of Article 4(5) of Law 3471/2006 (see the Cookie Policy).
5. Recipients and Processors
The data is processed by the following processors:
- Hetzner Online GmbH — hosting of the server and database in a data centre within the EU (Finland).
- Resend, Inc. (USA) — sending email messages (request confirmation, sign-in link). It receives the email address, subject and body of the message; it does not receive the text of your request. Open and click tracking of emails remains disabled. The transfer to the USA relies on the adequacy decision (EU–US Data Privacy Framework), provided the provider remains certified, and/or on the European Commission's Standard Contractual Clauses. A copy of the clauses is available on request at vasilispapg@outlook.com.
No analytics tools, advertising networks or third-party CAPTCHA are used; before any such change, this Policy will be updated.
We do not provide your email or the text of your request to tool makers without your separate, named consent. Data is disclosed to public authorities only where required by law.
6. Data Retention Periods
| Data Category | Retention Period |
|---|---|
| Request without email confirmation | 7 days |
| Requests (and requester's email) | 12 months from submission |
| Traffic and abuse hash identifiers | 90 days; aggregate counts remain without hashes |
| Daily traffic counters (no IP, no identifier) | 400 days |
| Daily search counters (no identifier) | 90 days |
| Email that failed to send (recipient and text) | 7 days |
| Resolved reports | 24 months from resolution |
| Sign-in link (hash) | 15 minutes, single use |
| Sign-in session | 14 days |
| Buyer account (email, list, searches) | Until the account is deleted; an account without sign-in for 24 months is anonymised, with prior email notice 30 days before |
| Maker account and listing data | For as long as the account exists |
| Proof of consent or notice | Kept without personal data |
| Backups (encrypted) | Up to 14 daily copies, rotated cyclically |
Account deletion takes effect after a grace period of 14 days, during which a new sign-in cancels the deletion; permanent and irreversible deletion follows. For a maker, the listings they created themselves are deleted; listings taken over by claiming remain as directory entries, without the maker's personal data. Data in backups is overwritten in the normal cycle and is not restored except in a system recovery.
7. Rights of Data Subjects
You retain in full the rights of Access, Rectification, Erasure, Restriction, Portability and Objection (Articles 15–21 GDPR) by writing to vasilispapg@outlook.com. In addition, from your account you can export your data to a file and request deletion of the account. Requests are handled within the time limits set by Article 12 GDPR.
Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal. Where it is based on legitimate interest, you have the right to object on grounds relating to your particular situation. The Service does not take decisions based solely on automated processing that produce legal effects concerning you and does not carry out profiling (Article 22 GDPR).
If you consider that your rights are infringed, you have the right to lodge a complaint with the Hellenic Data Protection Authority (1-3 Kifisias Ave., 115 23 Athens, www.dpa.gr) or with the supervisory authority of the EU Member State where you reside.
8. Minors
The Service is intended for professionals and businesses and not for minors. We do not knowingly collect data of minors. If you find that a minor has provided us with data, please contact vasilispapg@outlook.com so that it can be deleted.
9. Governing Law and Jurisdiction
This Policy is governed by Greek law and by European Union data protection law. The courts of Athens have jurisdiction, without prejudice to mandatory provisions that establish jurisdiction of the courts of your place of residence or of the supervisory authority.