Privacy policy
This is a translation. If the Greek and English versions differ, the Greek version prevails.
1. Data controller
The data controller is the business Ioannis Aslanis ("JT SERVICES"), Servion 10, 104 41 Athens, Greece, tax ID (ΑΦΜ) 064846123 (more in the Terms of use). For personal data matters: privacy@jtmonitor.gr. No Data Protection Officer (DPO) has been appointed, because our activity does not require one.
2. What data we process
a) Platform users
| Category | Examples |
|---|---|
| Account details | full name, email, mobile number, language, password (encrypted) |
| Business details | country, tax ID, business name, legal form, tax office, address, NACE codes (from ΑΑΔΕ for Greek businesses) |
| Subscription and payments | plan, invoice history. Card details are handled only by Stripe |
| Usage | NACE codes you follow, saved lists, requests and replies, notification preferences |
| Technical | IP address, device/browser type, security logs |
| Partner programme | referral code, referrals, commissions, IBAN and payee details |
b) Visitors and the contact form
Name, business, email, phone, message, and technical data from the security check (Cloudflare Turnstile).
c) People who appear in public sources
The Platform contains mainly business information. Where it includes information about individuals (for example names of legal representatives from ΓΕΜΗ, signatories of public decisions, business contact details that a company publishes itself), we process it only to the extent necessary.
3. Purposes and legal bases
| Purpose | Legal basis (article 6 GDPR) |
|---|---|
| Creating your account, providing the service, notifications for your plan | performance of a contract (6.1.b) |
| Tax ID check through ΑΑΔΕ, email/mobile confirmation, preventing fraud and abuse | legitimate interest (6.1.f) and performance of a contract |
| Invoicing, tax obligations, myDATA | legal obligation (6.1.c) |
| Newsletters | consent (6.1.a), which you can withdraw at any time |
| Security, logs, protection from bots | legitimate interest (6.1.f) |
| Partner programme (calculating and paying commissions) | performance of a contract and legal obligation |
| Public information about businesses and their representatives | legitimate interest (6.1.f) in informing the market |
We do not take decisions about you based solely on automated processing within the meaning of article 22 GDPR. We use artificial intelligence to classify and summarise public information, not to assess people.
4. Recipients — processors
We do not sell personal data. We use the following providers, under data processing agreements (DPA):
| Provider | Use | Data location |
|---|---|---|
| Supabase | database, accounts | EU (Frankfurt) |
| Cloudflare | hosting, network, security, Turnstile, email forwarding | global network; USA |
| Hetzner | server that collects public data | EU (Germany) |
| Brevo | sending email | EU |
| Twilio | SMS for mobile confirmation | USA / EU |
| Stripe | payments | EU (Ireland) / USA |
| E-invoicing provider | issuing invoices, transmission to myDATA | Greece |
| Anthropic | processing public content with artificial intelligence | USA |
| Google (Google Fonts) | website fonts | USA / EU |
We also pass data to public authorities where the law requires it (for example ΑΑΔΕ). For requests, your contact details become visible to another user only if you approve it.
5. Transfers outside the EEA
Where a provider processes data outside the EEA (mainly the USA), the transfer relies on the EU–US Data Privacy Framework (for certified providers) or on the European Commission's Standard Contractual Clauses, with additional safeguards. We send Anthropic only public source content, never user account data.
6. Retention
| Data | Period |
|---|---|
| Account and usage | as long as the account exists; deleted within 30 days after the account is deleted |
| Invoices and accounting records | as long as tax law requires (usually 5 years, up to 20 in special cases) |
| Security logs | up to 12 months |
| Contact form | up to 24 months, unless a business relationship follows |
| Newsletters | until you withdraw consent |
| Partner programme | for as long as you take part, plus what tax law requires |
7. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and you can withdraw consent at any time. Write to us at privacy@jtmonitor.gr; we reply within one month. You can also lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).
If your details appear on the Platform from a public source and you want to object, write to us; we review every request and remove the details unless there are overriding legitimate grounds.
8. Security
Encryption in transit (HTTPS) and at rest, role-based and row-level access control in the database, security checks against bots, minimal staff access, backups.
9. Cookies
- We use only strictly necessary cookies and storage technologies, for operation and security:
- signing in to your account (session);
- protection from bots (Cloudflare Turnstile and Cloudflare's security mechanisms);
- storing your language and theme choice (dark/light) locally on your device.
- We do not use advertising cookies or third-party marketing cookies, nor tools that track you across other websites.
- Strictly necessary cookies do not need consent (article 4(5) of Greek Law 3471/2006). If we ever add cookies that need consent, we will ask for it before turning them on.
10. Changes
We publish every change here, and for material changes we notify you by email.