Looking for our terms? Read the Terms and Conditions.
Last updated: 20 June 2026
Depending on the service, the Controller of your data is: for education products (apollonpapas.com), VASILEIOS APOLLON PAPAS, VAT 113532010; for B2B services and the SaaS tool (gya-media.com), GYA Media SP PC, VAT 803027683, GEMI 187728303000; for UK clients, GYA Media Group Ltd. Data-protection contact: [email protected].
Processor role: When we provide outreach/automation services for business clients, we process data on their behalf as Processor; the client is the Controller and their policy applies. This policy covers our own processing as Controller.
| Purpose | Legal basis |
|---|---|
| Providing products/services, account management | Performance of contract (6(1)(b)) |
| Payments, invoicing, tax/accounting duties | Legal obligation (6(1)(c)) |
| Customer support, security, fraud prevention | Legitimate interests (6(1)(f)) |
| Email marketing to existing customers for similar products | Legitimate interests / Art. 11(3) Law 3471/2006 (soft opt-in) |
| Newsletter/marketing to non-customers, non-essential cookies | Consent (6(1)(a)) |
| Service improvement/analytics | Legitimate interests / Consent as applicable |
You may withdraw consent at any time without affecting prior lawful processing.
We do not sell your data. We share it only with categories of processors/recipients under data-processing agreements: payment service provider (Stripe) for billing; hosting & infrastructure providers for sites, dashboards and content; email & CRM platforms for communications, lists and relationship management; analytics & advertising providers for measurement and (only with consent) advertising; professional advisers/collaborators (e.g. accountants, lawyers, contractors) where needed to deliver services; authorities/courts where required by law. For security reasons we do not publish the full list of individual vendors; it is available on request to the supervisory authority or to a data subject exercising their rights, to the extent required.
Some recipients or collaborators may be outside the EEA. Where so, we apply appropriate safeguards: adequacy decision (e.g. Serbia, 2023), EU Standard Contractual Clauses (SCCs) and/or the DPF framework, and a transfer impact assessment where required (e.g. UAE).
We keep data as long as needed for the above purposes: account data for the relationship and, after it ends, for the period required by applicable law; tax/accounting records for the statutory period (typically up to 5-6 years); marketing data until withdrawal/objection. Thereafter we delete or anonymise.
You have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. Exercise them at [email protected] (we may verify identity). We respond within 1 month (extendable by 2 months for complex requests). You may complain to the Hellenic Data Protection Authority (www.dpa.gr) or, for the UK, the ICO.
We do not knowingly target children below the digital-consent age (15 in Greece - Law 4624/2019) without parental consent. See Terms of Use §9.
We apply reasonable technical and organisational measures. No transmission/storage is fully secure; in a breach we act under GDPR Art. 33-34.
We update the date and, for material changes, give appropriate notice.