Privacy Policy

1. Introduction & Data Controller

Evolan Technology Group ("Evolan," "we," "us," or "our") is the data controller responsible for personal data processed through evolan.gr and in connection with our services in Greece. This Privacy Policy explains what personal data we collect, why, on what legal basis, and what rights you have under the EU General Data Protection Regulation (GDPR) and Greek Law 4624/2019.

By using our website or services, you acknowledge that you have read and understood this Privacy Policy.

2. What Personal Data We Collect

We collect personal data you provide directly (e.g. through our contact form), and data collected automatically when you visit our website:

• Contact and business information you submit (name, email, phone number, business type, message content)
• Technical data (IP address, browser type, device information) collected automatically while browsing
• Service-related information if you become a client (support tickets, system logs from devices we manage, access credentials stored securely and encrypted)

3. Legal Basis for Processing

Under GDPR Article 6, we only process your personal data where we have a valid legal basis:

• Contract (Art. 6(1)(b)): to respond to your enquiry or provide services you've requested
• Legitimate interests (Art. 6(1)(f)): to operate and secure our website, and to communicate with prospective clients about our services
• Consent (Art. 6(1)(a)): for optional marketing communications, which you can withdraw at any time
• Legal obligation (Art. 6(1)(c)): where processing is required to comply with applicable law

4. How We Use Your Data

• Respond to enquiries submitted through our contact form
• Provide, maintain, and support the IT services you engage us for
• Send service-related communications (with your consent for marketing)
• Maintain the security and proper functioning of our website
• Comply with our legal and regulatory obligations

5. Who We Share Data With

We do not sell your personal data. We share it only with service providers (processors) who help us operate our website and services, under contractual data-processing terms, including:

• Vercel (website hosting and infrastructure)
• Brevo (contact-form email delivery)

We may also disclose data where required by law, or to protect our legal rights.

6. International Data Transfers

Some of our service providers (see Section 5) may process data on servers located outside the European Economic Area, including in the United States. Where this occurs, we rely on the provider's Standard Contractual Clauses (SCCs) approved by the European Commission, or another valid GDPR transfer mechanism, to ensure your data continues to receive an adequate level of protection.

7. Data Retention

We retain personal data only for as long as necessary for the purposes it was collected for — typically, contact-form enquiries that don't lead to a client relationship are retained for a limited period and then deleted; client and service-related records are retained for the duration of the relationship plus any period required by applicable legal, tax, or accounting obligations.

8. Cookies

We use essential cookies necessary for the website to function, and may use analytics cookies to understand site usage. Most browsers let you control or block cookies through their settings; disabling non-essential cookies won't affect core site functionality.

9. Data Security

We apply appropriate technical and organizational measures to protect your data, including encryption in transit (TLS), access controls, and secure credential storage. No method of transmission or storage is completely secure, but we work to protect your data to current industry standards.

10. Your Rights Under GDPR

Under GDPR Articles 15–22, you have the right to:

• Access the personal data we hold about you
• Rectification of inaccurate or incomplete data
• Erasure of your data ("right to be forgotten"), subject to legal exceptions
• Restrict processing in certain circumstances
• Data portability — receive your data in a structured, machine-readable format
• Object to processing based on legitimate interests or for direct marketing
• Withdraw consent at any time, where processing is based on consent
• Not be subject to decisions based solely on automated processing that produce legal effects concerning you

To exercise any of these rights, contact us using the details in Section 12. We will respond within one month, as required by GDPR Article 12(3).

11. Right to Lodge a Complaint

If you believe our processing of your personal data infringes GDPR, you have the right to lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα): www.dpa.gr, Kifisias 1-3, 115 23 Athens, Greece — or with the supervisory authority of your own EU member state.

12. Contact Us

For any question about this Privacy Policy or to exercise your rights, contact us:

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last Updated" date above.