Privacy Policy

1. Who is responsible for your data

The controller of your personal data is ABOVE DIGITAL P.C., trading as "ABOVE Digital" (Tax ID EL801875977, Tax Office A' Athens), referred to below as "ABOVE Digital", "we" or "us".

• Registered office: 265 Kifisias Ave, 14561, Kifisia, Attica, Greece
• Email: info@abovedigital.io
• Phone: +30 210 2205610

Requests and questions about personal data are handled by our privacy contact, Otar Peradze. Write to info@abovedigital.io with the subject "Personal data".

2. What data we collect and why

Quote request form (Contact page)

When you request a quote we collect your name, company, email address, your domain (industry), the description of your project, an optional attachment (an image, PDF, DOC, DOCX or TXT file of up to 5 MB), whether you would like us to sign an NDA, and your consent to this policy. We use them to answer your request, assess your project, prepare a proposal and, if you ask for one, an NDA.

Book a 30-minute call form

When you book a call we collect your name, email address, phone number, company (optional), the preferred weekday and 30-minute time slot, the topic you would like to discuss (optional) and your consent to this policy. We use them to confirm the call with you by email or phone, and to hold it.

Please do not include special categories of data (for example health data) or other people's personal data in a message or attachment unless it is necessary for your request.

Technical data sent with a form

With each form submission we store your IP address, browser identification (user agent), the page and language you sent it from, and the date and time. We use them to protect the forms against spam and abuse: a hidden trap field, a minimum time on the form, a limit of five submissions per hour from one IP address and Google reCAPTCHA Enterprise, which scores each submission invisibly (see section 4).

Like any website, our hosting provider's web server also records standard access logs (IP address, requested page, date and time, browser) to operate the site and keep it secure.

Email and phone

If you write to us or call us, we process the data you give us (such as your name, contact details and the content of your message) to reply and to handle your request.

Clients, partners, suppliers and job applicants

If you or your company work with us, we process the contact and professional details, contract, invoicing and payment data needed to prepare and perform the contract and to meet our tax, accounting and social-security obligations. If you send us your CV, we use it to assess your application. Photos and videos may be recorded at events we organise or as part of the services we provide.

Website analytics

Only if you accept analytics cookies do we measure how the site is used with Google Analytics; see section 4.

We do not sell personal data, and we do not make decisions about you based solely on automated processing or profiling.

3. Legal bases

• Answering a quote request or a call booking: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR), together with the consent you give with the form's checkbox (Art. 6(1)(a) GDPR).
• Contracts with clients, partners and suppliers: performance of a contract (Art. 6(1)(b) GDPR).
• Tax, accounting and social-security records: compliance with a legal obligation (Art. 6(1)(c) GDPR).
• Protecting the forms against spam and abuse (including Google reCAPTCHA), server logs, IT security and establishing or defending legal claims: our legitimate interests (Art. 6(1)(f) GDPR).
• Analytics cookies: your consent (Art. 6(1)(a) GDPR and Art. 4(5) of Law 3471/2006).
• Storing your cookie choice: strictly necessary to provide the site as you asked, so no consent is needed (Art. 4(5) of Law 3471/2006).

You can withdraw your consent at any time, as easily as you gave it. This does not affect the lawfulness of processing before the withdrawal.

4. Cookies and similar technologies

On your first visit a banner lets you accept all, reject all or customise your choice; both "Accept all" and "Reject all" are equally easy. Until you choose, nothing is stored except your language (see ad_lang below) and, once you choose, the choice itself; the site makes no requests to Google or any other analytics or advertising service (the one exception is the reCAPTCHA security service, which loads only on the Contact and Book a call pages: see below). Our fonts and images are served from our own server.

Strictly necessary (always on)

• ad_consent (your browser's local storage, set by abovedigital.io): your choice per category (necessary, analytics, marketing), with its version and the time you made it. It is kept until you change your choice or clear your browser's storage, and is never sent to anyone. If the list of tools we use changes, we ask you again.
• ad_lang (cookie set by abovedigital.io, 1 year): the language you view the site in (en, el, fr or ka). It is saved when you open a page or switch language, and is read only by our own server. On your first visit to an English page, if your browser's preferred language is Greek, French or Georgian, we show you that version instead; once ad_lang exists we never switch your language automatically again. We use your browser's language setting for this, never your location or IP address.
• Google reCAPTCHA Enterprise (a Google Cloud service of Google Ireland Limited and Google LLC), loaded only on the Contact and Book a call pages, to tell people from bots and protect the forms from spam and abuse. It works in the background, with no checkbox or puzzle. When you submit a form, Google receives your IP address and information about your browser and device and how you interact with the page (such as mouse movement and time spent), may set or read cookies, and returns a score; Google's Privacy Policy and Terms of Service apply. We rely on our legitimate interest in keeping the forms secure, so it runs without a consent choice. Our server also sends Google (Google Cloud) the token and your IP address to check the score.

Analytics (only if you accept)

• Google Analytics 4 (property G-XZ9CCFNTB8), loaded through the Google tag GT-P85W5Z5 and provided by Google Ireland Limited and Google LLC. It measures visits, the pages viewed, how you reached the site, the approximate location (country/city), device and browser.
• Cookies: _ga (2 years) and _ga_XZ9CCFNTB8 (2 years), which tell visits and visitors apart.
• We use Google Consent Mode v2: all consent signals are set to "denied" by default, and the Google tag is not loaded at all until you accept analytics. The advertising signals (ad_storage, ad_user_data, ad_personalization) are granted only if you also accept marketing.

Marketing

We currently use no marketing or advertising cookies or pixels. If we add any, we will update this policy and ask for your consent first.

Changing your choice

You can change or withdraw your consent at any time through the Cookie settings link at the bottom of every page. When you withdraw analytics consent, measurement stops and the Google Analytics cookies on our domain are deleted. You can also delete cookies and site data in your browser settings.

The links to our profiles on LinkedIn, YouTube, Facebook and Clutch are plain links: nothing is loaded from those services until you click one, and then their own privacy policies apply.

5. How long we keep your data

• Quote requests and call bookings, including attachments and the technical data stored with them: up to 24 months after our last contact, unless a contract follows; then the rule for contract records below applies. Submissions identified as spam are deleted within 60 days.
• Emails: for as long as needed to handle the correspondence, and no longer than the period above unless a contract follows.
• Contract, invoicing and accounting records: for as long as required by Greek tax, accounting, social-security and general law, and then deleted or anonymised.
• Employee data: at least five (5) years from the end of the year in which the employment ended, and then destroyed, deleted or anonymised where the law permits.
• Photos, video and audio recorded in the course of our services: three (3) months from receipt, unless they are needed to document or develop a project or for training.
• Your cookie choice: in your browser until you change it or clear your browser's storage.
• Google Analytics: the cookies last up to 2 years; event data is kept by Google for the retention period set in our Google Analytics account (at most 14 months).

We may keep data longer where we are legally required to, or for as long as needed to establish, exercise or defend legal claims.

6. Who receives your data

Your data is accessed only by the members of our team who need it, and they are bound by confidentiality. We share it only with:

• Hetzner Online GmbH (Germany): hosting of the website, its database and form attachments (processor).
• Google (Google Ireland Limited, Ireland, and Google LLC, USA): our business email (Google Workspace), through which form submissions and their attachments reach us, the reCAPTCHA security service on the two forms, and — only with your consent — Google Analytics (processor).
• Kommo Inc. (amoCRM, USA): our CRM, which may receive the enquiries sent with the quote and book-a-call forms so that we can follow them up (processor).
• Video-call providers (such as Google Meet, Zoom or Microsoft Teams), if a call is held online.
• Accountants, legal advisers and IT contractors who work with us under confidentiality obligations, where needed.
• Our clients, where needed for a project you take part in, for example as a partner or subcontractor.
• Public authorities (such as the tax authority, EFKA, courts, prosecutors or the Hellenic Data Protection Authority) where the law requires it.

Our processors act only on our instructions under written agreements that require confidentiality, appropriate security, notification of any data breach, and the deletion or return of the data when the service ends. We do not share personal data with third parties for their own advertising.

7. International transfers

Our website and its data are hosted in the European Union (Germany). Google may process data in the United States and other countries outside the European Economic Area. Google LLC is certified under the EU-US Data Privacy Framework, covered by the European Commission's adequacy decision of 10 July 2023, and Google also relies on the Commission's Standard Contractual Clauses. Kommo Inc. may process enquiry data in the United States; such transfers take place on the basis of appropriate safeguards, such as the European Commission's Standard Contractual Clauses. Any other transfer outside the EEA would be made only with appropriate safeguards under Chapter V GDPR.

8. Security

We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), access to form submissions only for authorised staff through a password-protected admin area, and storage of attachments outside the public part of the website under random file names, so they can never be opened from the web. If a personal data breach occurs, we will notify the Hellenic Data Protection Authority and, where required, you.

9. Your rights

Under the GDPR you have the right to:

• Access your data and receive a copy of it;
• Rectification of inaccurate or incomplete data;
• Erasure ("right to be forgotten"), unless we must keep the data by law;
• Restriction of processing;
• Data portability: to receive the data you gave us in a structured, machine-readable format or have it sent to another controller;
• Object to processing based on our legitimate interests;
• Withdraw your consent at any time, without affecting earlier processing;
• Not be subject to a decision based solely on automated processing (we make no such decisions).

To exercise a right, email info@abovedigital.io with the subject "Personal data". We may ask you to confirm your identity. We will reply within one (1) month of receiving your request; for complex or numerous requests this can be extended by two (2) further months, and we will tell you if it is. Exercising your rights is free of charge.

10. Right to complain

If you believe that the processing of your data breaks the law, you can lodge a complaint with the Hellenic Data Protection Authority (HDPA): 1-3 Kifisias Ave, 115 23 Athens, Greece, tel. +30 210 6475600, email contact@dpa.gr, www.dpa.gr. You can also complain to the authority in the EU country where you live or work. We would appreciate the chance to address your concern first, at info@abovedigital.io.

11. Links to other websites

Our website links to websites of third parties that we do not operate or control, and we are not responsible for their content or their privacy practices. Please read their privacy policies.

12. Applicable law

This policy is governed by Greek law, the GDPR and Law 4624/2019. The courts of Athens, Greece have jurisdiction over any dispute, without prejudice to your right to lodge a complaint with a supervisory authority or to bring proceedings in the courts of your country under the GDPR.

13. Changes to this policy

We review this policy regularly and may update it; the date at the top shows the current version. If a change concerns the cookies or tools we use, the cookie banner will ask for your choice again. The previous version was published on 9 March 2023.