Privacy policy

The controller is PHOENIX VERUS SINGLE MEMBER P.C., 3 Kanari St., Mytilene 81100, Lesvos, Greece, company registry (Γ.Ε.ΜΗ.) no. 195034542000.

For anything concerning your personal data, write to info@phoenixverus.com. We have not appointed a data protection officer, because the size and nature of what we do does not require one; the same address reaches the person who answers.

Data you give us. When you download a guide, request a demo or use the contact form, you give us a name, a business email and, optionally, a company, the area you are interested in and a message. For the PhoenixBooking demo we also ask for a mobile number, the business name and its type; we use them to send you the access details and to contact you about the demo. Product updates are sent only if you opt in.

Data your visit produces. For every page you open, our own server records the page, language, country, device type, the page you came from and any campaign parameters on the link. The visitor identifier is a fingerprint (hash) of the IP address and browser with a random salt that changes every day: the next day you are a different visitor to us, and nobody can reverse the fingerprint. Nothing is stored on your device for this and the IP address itself is never stored. This measurement uses no cookies and no third party, on the basis of our legitimate interest in knowing how the site is used; you may object by email.

If you consent to analytics or advertising, a persistent identifier (pv_uid) is created on your device that links your visits to each other and to Google Analytics. It is deleted when you withdraw consent or when it expires.

Advertising attribution. If you arrived from an advertisement or campaign, we record the parameters carried on the link: UTMs and click identifiers such as gclid, fbclid and msclkid. That is how we know which campaign brought whom, without asking.

Data from cookies and similar technologies. Only with your consent — see the Cookie policy.

• To answer a request of yours — contact, demo, guide. Legal basis: steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR).
• To know which channel brings clients, so advertising spend is not wasted. Legal basis: our legitimate interest in measuring our own communications (Article 6(1)(f)). You may object at any time.
• For security and abuse prevention — rate limiting, detection of automated submissions. Legal basis: legitimate interest (Article 6(1)(f)).
• For traffic statistics and advertising measurement using cookies. Legal basis: your consent (Article 6(1)(a) GDPR and Article 4(5) of Greek law 3471/2006), which you may withdraw at any time.

Form data is stored in a database operated by Supabase Inc., in data centres within the European Union. Supabase acts as a processor under its Data Processing Addendum (supabase.com/legal/dpa). Its security information is at supabase.com/security.

The website is hosted by Railway Corp. (USA) in a data centre in the United States. The server sees your IP address in order to deliver the page, as every server does; our own code keeps it in memory only, for a few minutes, while Railway’s platform may retain it in its request logs for security purposes, for a limited period. The transfer rests on the Commission’s standard contractual clauses, included in Railway’s Data Processing Addendum (railway.com/legal/dpa).

For statistics and advertising, and only with your consent, data reaches Google Ireland Ltd. (Google Analytics 4, Google Ads) and Meta Platforms Ireland Ltd. (Meta Pixel). Both transfer data to the United States; the transfer rests on the EU–US Data Privacy Framework, under which both are certified, and on the Commission’s standard contractual clauses.

If you book a call, the booking is made through Google Calendar. What you enter there is processed by Google under its own terms.

If you request demo access, your email is passed to the demo application, which also runs on Supabase within the EU, to open a 48-hour passwordless session. After 48 hours the session expires.

When you send a message, a notification is queued in the same database and delivered to our mailbox. It does not pass through a third-party newsletter service.

If you have consented to advertising and submit a form, we also notify Meta from our server (Conversions API) that a contact took place, with your email in hashed form, so the advertisement that preceded it can be measured. Without that consent nothing is sent to Meta.

We do not sell data. We do not pass it to third parties for their own purposes. We do not use it to train artificial-intelligence models.

• Contact details from forms: 24 months from our last contact with you. If you become a client, for the duration of the engagement and as long as tax law requires afterwards.
• Advertising attribution: alongside the contact record it belongs to, for the same period.
• Anonymous visit measurement (daily fingerprint): 13 months, the same as Google Analytics.
• Demo sessions: 48 hours.
• Google Analytics: 14 months, the setting we have chosen at Google.
• Your cookie choice: 6 months on your device. Then we ask again.
• Server security records: in memory only, for a few minutes, for rate limiting. Never written to disk.

You have the right of access to your data, to rectification, erasure, restriction of processing, portability, and to object to processing based on legitimate interest. Where processing rests on consent, you may withdraw it freely, without affecting what was done before.

To exercise any of these, write to info@phoenixverus.com. We answer within a month. We do not ask for a copy of an identity document unless we have reasonable doubt about who is asking.

If you believe we are breaking the law, you have the right to lodge a complaint with the Hellenic Data Protection Authority, 1–3 Kifisias Ave., 115 23 Athens, Greece, dpa.gr. We would rather you told us first, but it is not a condition.

This website is addressed to businesses and professionals. We do not knowingly collect data about minors. If we learn that we have, we delete it.

When something material changes — a new processor, a new purpose, a new retention period — we update this page and the date at the top. We do not send an email for every change of wording.