Privacy & GDPR

1. Introduction and Controller Identity

1.1 About This Policy

This Privacy Policy describes how Partnely collects, uses, stores, processes, and protects your personal data when you use our website partnely.com and related services.

1.2 Data Controller

The data controller for your personal data is PARTNELY DIGITAL L.P.:

• Legal Name: PARTNELY DIGITAL L.P.
• Trade Name: PARTNELY
• Tax ID (AFM): 803126280
• GEMI No: 190176909000
• Email: info@partnely.com

1.3 Legal Framework

This Policy complies with:

• The General Data Protection Regulation (GDPR) - Regulation (EU) 2016/679
• The Greek Law 4624/2019 on personal data protection
• The ePrivacy Directive 2002/58/EC (as amended)
• The Law 3471/2006 on data protection in electronic communications
• Guidelines from the Hellenic Data Protection Authority (HDPA)

2. Categories of Personal Data We Collect

2.1 Data You Provide Directly

Registration and Account Data

• Email address (required)
• Password (stored encrypted with bcrypt)
• User role (Client/Professional)
• Email verification status

Profile Data (for Professionals)

• Full name or business name
• Business type (agency/freelancer)
• Professional description
• Services offered
• Location and contact details
• Photos and portfolio

Payment Data

• We do not store full card details
• Stripe Customer ID and Subscription ID
• Subscription type and billing period

2.2 Automatically Collected Data

• Technical Data: IP address, browser type, operating system
• Usage Data: Pages visited, time spent, actions
• Cookies: Session cookies, analytics cookies (with consent)

3. Purposes and Legal Basis for Processing

Contract Performance (Article 6(1)(b) GDPR)

• Account creation and management
• Platform services provision
• Payment and subscription processing
• User messaging exchange

Legitimate Interest (Article 6(1)(f) GDPR)

• System security and fraud prevention
• Publication of reviews for professionals and stores, so that users can choose based on the experience of others

Where we rely on legitimate interest, we have balanced that interest against your rights, and you have the right to object at any time (Article 21 GDPR) at gdpr@partnely.com.

Consent (Article 6(1)(a) GDPR & Article 5(3) ePrivacy)

• Marketing emails (revocable anytime)
• Analytics cookies and usage statistics, including server-side processing (via cookie banner)

4. Recipients and Data Transfers

Other Platform Users

When you post a Quote Request, your contact details (name, phone number and email address) become visible only to the professionals who submit a quote on that specific request — never publicly and never to professionals who have not submitted a quote. Legal basis: performance of the matching service you requested (performance of a contract).

Public Publication of Reviews

When you submit a review for a professional or a store, it is published publicly on that party's page and is visible to any visitor, with no account required. It may also appear in search engines. Legal basis: legitimate interest (Article 6(1)(f) GDPR).

What is published:

• The display name you enter yourself — you may use initials or a pseudonym
• Your company name, if you fill it in
• The ratings, title, text and any photo you upload
• The date and any reply from the party being reviewed

What is never published:

• Your email address
• Your contact phone number
• The order number, in store reviews

We ask for these details only so that we can verify the authenticity of the review and contact you if needed. In store reviews, the store owner cannot see your email or phone number. We do not record your IP address when you submit a review.

Anonymous submission: when submitting, you can choose not to display your name. The review is then published as "Anonymous" and is not publicly linked to your account.

Review before publication: every review is checked by a member of our team before it is published. We do not use automated filtering or artificial intelligence to decide whether it is published.

Removal: you may at any time request the withdrawal or anonymisation of your review at gdpr@partnely.com. If you submitted a store review without holding an account on the platform, that same address is how you exercise your rights.

Third-Party Service Providers

• Stripe Payments Europe, Ltd. / Stripe, LLC: Payment processing (USA - EU-US DPF, SCCs)
• Cloudinary Ltd.: Image hosting (EU/US - GDPR DPA, SCCs)
• Resend Inc.: Email sending (USA - SCCs). Our notification/transactional emails do not include open-tracking pixels or click tracking.
• Neon Tech, Inc.: Database hosting (EU Frankfurt)
• Render Services, Inc.: Backend, search engine and cache hosting (EU Frankfurt - EU-US DPF)
• Elorus: Invoice / tax record issuance (Greece/EU)
• Google LLC: Analytics - Google Analytics (USA - EU-US DPF) (consent only)
• Microsoft Corporation: User behavior analytics - Microsoft Clarity (USA - EU-US DPF; Microsoft acts as an independent controller) (consent only)
• PostHog, Inc.: Product analytics - PostHog EU Cloud (data hosted in the EU, Frankfurt, Germany) (consent only)
• Meta Platforms Ireland Ltd. / Meta Platforms, Inc.: Marketing & advertising - Meta Pixel & Conversions API (EEA/USA - EU-US DPF) (consent only)
• Klaviyo, Inc.: Email/SMS marketing automation (USA - EU-US DPF, SCCs) (consent only)
• Functional Software, Inc. (Sentry): Error & performance monitoring (USA - EU-US DPF)
• Vercel Inc.: Frontend hosting (server-side execution in EU Frankfurt; global CDN for static assets - EU-US DPF)

The list above is the complete list of data recipients. The list in the Cookie Policy §4 covers only providers related to cookies/tracking.

Transfers Outside the EU

For transfers to third countries (mainly USA), we ensure adequate protection level through Standard Contractual Clauses (SCCs) and supplementary measures (encryption, pseudonymization).

5. Data Retention Period

• User account: Immediate permanent deletion from active systems upon request. Any residual copies in backups are retained for up to 7 days (database provider's backup policy).
• Messages: 3 years from last message
• Invoices & tax records: 5 years (Greek Law 4308/2014; up to 10 years in special cases provided by law)
• Stripe Customer ID & subscription metadata: Duration of the subscription relationship + 30 days
• Security & account activity logs: 12 months (these include IP address and user agent)
• Administrator action log: IP address and user agent are erased at 12 months. The record itself (which action, by whom, when) is kept for 5 years as accountability evidence under GDPR Article 5(2) and for the defence of legal claims.
• Reviews: They remain published for as long as the reviewed party's profile exists, so that they continue to inform consumers. Reviews of professionals are deleted automatically if either the author's or the reviewed party's account is deleted. In any case you may request the withdrawal or anonymisation of your own review at gdpr@partnely.com.
• Store review invitations: The invitation link stops working after 90 days
• Featured listing impression statistics: The visitor identifier (a cryptographic fingerprint of the IP address, used only to avoid counting the same view twice) is erased at 90 days. After that only anonymous impression counts per day and service remain; these are not personal data and are kept without a time limit for the professional's statistics.
• Backups: 7 days

6. Your Rights (GDPR)

Under the GDPR you have the rights of access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw your consent at any time. A detailed description of each right (Articles 15-22) and how to exercise them is provided in Part B, §4 below.

Right to Complain

You can submit a complaint to the Hellenic Data Protection Authority (HDPA):

• Address: Kifisias 1-3, 115 23 Athens
• Phone: +30 210 6475600
• Email: contact@dpa.gr
• Website: www.dpa.gr

7. Data Security

Technical Measures

• TLS 1.3 encryption (HTTPS)
• Password encryption with bcrypt
• JWT Tokens with short lifespan
• HttpOnly Cookies for refresh tokens
• Rate Limiting and CORS Protection
• Security Headers (Helmet.js)

Breach Management

In case of data breach, we notify HDPA within 72 hours (if there is risk) and subjects without undue delay (if there is high risk).

8. Cookies

For detailed information about cookies we use, see the Cookie Policy.

9. Minors

Our Services are not directed to persons under 18 years old. We do not knowingly collect data from minors. If we become aware we have collected minor's data, we will delete it immediately.

10. Policy Changes

We may periodically update this Policy. In case of substantial changes, we will notify you via email and publish a notice on the website.

11. Contact

For any questions about the Privacy Policy:

• General Questions: info@partnely.com
• Data Protection Contact: gdpr@partnely.com
• Rights Requests: gdpr@partnely.com
• Security Incidents: security@partnely.com

1. Compliance Statement

Partnely is committed to full compliance with the General Data Protection Regulation (GDPR) - Regulation (EU) 2016/679, as well as Greek personal data protection legislation (Law 4624/2019).

2. Partnely's Role

2.1 Data Controller

Partnely acts as Data Controller for:

• User account data (email, password, profile)
• Transaction data (subscriptions, payments)
• Communication data (messages between users)
• Analytics and cookies data

2.2 Data Processor

For certain functions, Partnely works with third-party providers. Providers acting as Data Processors are bound by Data Processing Agreements (DPA) under Article 28 GDPR, which apply through each provider's standard terms (e.g. Stripe, Google, Klaviyo, Meta). Some providers (e.g. Microsoft Clarity) act as independent controllers under their own terms. The complete list of providers, with their role and transfer mechanism, is set out in the "Data Recipients and Transfers" section (§4).

3. Legal Bases for Processing

We process data only when there is a valid legal basis:

4. Your Rights - Detailed (Articles 15-22 GDPR)

Exercising Rights

• Email: gdpr@partnely.com
• Via platform: Settings → Privacy → My Rights
• Response time: Within 30 days, extendable by up to 60 days (Article 12(3) GDPR)
• Cost: Free (except excessive/unfounded requests)

5. Data Transfers to Third Countries

When we transfer data outside the European Economic Area (EEA), we ensure adequate protection level:

SCCs: Standard Contractual Clauses approved by the European Commission
EU-US DPF: EU-US Data Privacy Framework (Adequacy Decision July 2023)

We verified the active EU-US DPF certifications of the providers above on the official dataprivacyframework.gov registry (last checked: July 2026).

6. Technical and Organizational Measures (Article 32)

6.1 Technical Measures

• Encryption: TLS 1.3 for data in transit
• Password encryption: bcrypt with salt
• JWT Tokens: 15-minute access tokens, 7-day refresh tokens
• HttpOnly Cookies: For refresh tokens
• Security Headers: Helmet.js, CSP, HSTS
• Rate Limiting: Brute force protection
• Monitoring: Anomaly tracking

6.2 Organizational Measures

• Security policies and procedures
• Staff training
• Access restriction (need-to-know basis)
• Action logging (audit log)
• Periodic security audits

7. Data Breaches (Articles 33-34)

Response Procedure

1. Detection: Immediate incident recognition
2. Assessment: Risk and impact evaluation
3. HDPA Notification: Within 72 hours (if risk exists)
4. User Notification: Without delay (if high risk exists)
5. Corrective measures: Damage limitation, restoration
6. Documentation: Incident and action recording

Security Incident Contact

Email: security@partnely.com
Availability: Best-effort monitoring during business hours. Outside business hours, notifications are received and answered within 48 hours.

8. Data Protection Contact

We have designated a contact point for questions and requests regarding your personal data:

• Email: gdpr@partnely.com
• Responsibilities: Handling data protection questions and requests, liaison with the HDPA
• Response time: Within 30 days, extendable by up to 60 days (Article 12(3) GDPR)

9. Right to Complain

If you believe your data processing violates GDPR, you have the right to submit a complaint:

10. Contact for GDPR

For data protection and GDPR matters:

• General Questions: info@partnely.com
• Data Protection Contact: gdpr@partnely.com
• Rights Requests: gdpr@partnely.com
• Security Incidents: security@partnely.com