Privacy Policy
Personal Data Protection Policy GDPR
Last updated: 16/7/2025
- Introduction
The company under the name “xPantia” (hereinafter referred to as “the Company,” “we,” “us”), with headquarters at Veletsiou and Tripoleos 0, 41336, Larissa, recognizes the importance of protecting your personal data and is committed to protecting it. This Data Protection Policy describes how we collect, use, store, and protect your personal data when you visit and interact with our website, www.xpantia.gr (hereinafter referred to as “the Website”), in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Greek legislation on the protection of personal data (Law 4624/2019).
Data Controller: For the purposes of the GDPR, the data controller for your data is “xPantia”. Email contact for data issues: [e.g., privacy@xpantia.com]
Data Protection Officer (DPO): Our Company has appointed a Data Protection Officer, whom you can contact directly for issues relating to the processing of your personal data at the following email address: [dpo@xpantia.com]
2. What Data We Collect and Why
We only collect data that is necessary for the proper functioning of the website and the provision of our services. This data may include:
Data you provide to us:
Contact Form & Email: When you contact us via the contact form or directly via email, we collect your name, email address, and any other information you provide in your message in order to respond to your request.
Newsletter Subscription: When you subscribe to our newsletter, we collect your email address in order to send you informational and promotional material, for which you have given your consent.
Data collected automatically (with your consent):
Browsing Data (Cookies): As described in detail in our Cookies Policy, we collect information through cookies, such as your IP address, browser type, pages you visit, and time spent on the site, for the purpose of analyzing traffic and improving your experience.
Device Data: We may collect information about the device you use to access our website, including the device type, operating system, and version, in order to optimize the user experience.
Location Data: We may collect information about your location, such as the country or city from which you are connecting, in order to provide content tailored to your region and improve our services.
3. Legal Basis for Data Processing
The processing of your personal data is based on the following legal bases:
Your consent (Article 6(1)(a) GDPR): For actions such as subscribing to the newsletter or accepting non-essential cookies. You have the right to withdraw your consent at any time.
Performance of a contract or taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR): When you contact us about a possible collaboration or for information about our products.
Our legitimate interest (Article 6(1)(f) GDPR): To ensure the security of our network, respond to your inquiries, and improve our services.
Compliance with a legal obligation (Article 6(1)(c) GDPR): When we are required by law to process your personal data, such as for tax purposes or to comply with court orders.
Protection of vital interests (Article 6(1)(d) GDPR): In exceptional cases, when processing is necessary to protect the vital interests of the data subject or another natural person.
4. Who We Share Your Data With
We do not sell, rent, or share your personal data with third parties for their own commercial purposes. We may share your data with:
Service Providers: Companies that provide services to us and act as processors on our behalf (e.g., web hosting companies, email delivery platforms). These providers are contractually obligated to protect your data and use it only for the purposes we have assigned to them.
Public Authorities: If required by law or court order, we may disclose your data to the relevant public and judicial authorities.
Partners: In the event of a merger, acquisition, or sale of the Company’s assets, your personal data may be transferred to the new owner or successor. In such a case, we will notify you of the transfer of your data to a third party.
Business Partners: We may share certain data with business partners who provide complementary services or products, but only if you have given your consent to do so.
Transfers outside the EEA: If your data is transferred outside the European Economic Area (EEA), we ensure that appropriate safeguards are in place to protect it, such as standard contractual clauses approved by the European Commission in accordance with Article 46 of the GDPR or other appropriate data transfer mechanisms.
5. Data Retention Period
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law.
For inquiries via the contact form, the data is retained for as long as necessary to fully respond to and serve your request.
For newsletter subscriptions, data is retained until you withdraw your consent (unsubscribe).
For data related to contractual obligations, the data is retained for as long as required by tax law (usually 5-10 years, according to the Tax Procedure Code Law 4174/2013).
After the above periods have elapsed, your personal data will be securely deleted or anonymized so that you can no longer be identified.
6. Your Rights
Under the GDPR, you have the following rights regarding your personal data:
Right of Access: To request a copy of the data we hold about you.
Right to Rectification: To request the correction of inaccurate or incomplete data.
Right to Erasure (“Right to be Forgotten”): Request the erasure of your data, under certain conditions.
Right to Restriction of Processing: Request that the processing of your data be restricted.
Right to Data Portability: To receive your data in a structured, commonly used, and machine-readable format.
Right to Object: To object to the processing of your data for direct marketing purposes.
Right to Withdraw Consent: Withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Right not to be subject to automated decision-making: Not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR).
To exercise any of your rights, you can contact us at: [e.g., privacy@xpantia.com].
If you believe that the processing of your data violates the GDPR, you have the right to lodge a complaint with the competent supervisory authority, the Personal Data Protection Authority (APDPCH) (www.dpa.gr).
The exercise of your rights is free of charge, unless your requests are manifestly unfounded or excessive, in particular due to their repetitive nature. In this case, we may charge a reasonable fee or refuse to respond to your request.
We will respond to your request within one (1) month of receiving it. This deadline may be extended by two (2) additional months, if necessary, taking into account the complexity and number of requests.
7. Data Security
We take all necessary technical and organizational security measures to protect your personal data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.
These measures include, among others:
• Encryption of data during transfer and storage
• Regular checks and evaluations of security measures
• Restricted access to personal data only to authorized individuals
• Procedures for dealing with data breaches
• Training our staff on data protection issues
• Use of a firewall and anti-malware software
• Regular backups of data
• Application of the principle of least privilege
8. Changes to this Policy
We may update this policy from time to time. The latest version will always be available on our website. We encourage you to check it regularly to stay informed about how we protect your data.
In the event of material changes to this policy, we will notify you via a notice on our website or by email, if we have your email address, at least 30 days prior to the changes taking effect.
Legal Notice: This text is a template and does not constitute legal advice. To ensure full compliance with the GDPR and applicable law, we strongly recommend that you consult a legal advisor specializing in data protection issues.