Skip to content

Privacy Policy

DONATION POS Ε.Ε. — Last updated: 28 August 2026

This Policy describes how DONATION POS Ε.Ε. collects, uses, stores and protects personal data, in accordance with the General Data Protection Regulation (EU 2016/679 – 'GDPR') and Greek Law 4624/2019.

1. Data Controller

The data controller is DONATION POS Ε.Ε.:

  • Registered office: 218 Thiseos Ave., Kallithea 17675
  • VAT: 802572430 — Tax Office KEFODE Attica
  • For data protection matters, use the secure contact form.

2. Categories of Data We Collect

a) Organisations / cooperation applicants:

  • Organisation details: name, legal form, VAT, tax office, address, phone, email, website, number of members, activity.
  • Legal representatives' details: full name, father's name, VAT, phone, mobile, email.
  • Banking details: IBAN for donation settlement via the licensed PSP.
  • For incomplete onboarding: verified email, language, latest application stage and last-activity time. We do not store draft field values or documents in this follow-up record.

b) Donors:

  • Email address and payment details, collected and processed directly by the payment provider (Stripe). We do not store or have access to full card details.
  • Donation amount and date.

c) Platform administrators: session data (authentication cookie).

3. Purposes & Legal Bases of Processing

  • Management of cooperation applications and contract performance — Article 6(1)(b) GDPR (contract performance).
  • Operational assistance with completing an application initiated by the applicant — Article 6(1)(b) GDPR (pre-contractual steps). This communication does not subscribe the applicant to a newsletter or marketing.
  • Processing and settlement of donations — Article 6(1)(b) GDPR.
  • Compliance with anti-money-laundering obligations (Greek Law 4557/2018) and tax/accounting obligations — Article 6(1)(c) GDPR (legal obligation).
  • Email verification via OTP code — Article 6(1)(b)/(f) GDPR (legitimate security interest).
  • Platform security and fraud prevention — Article 6(1)(f) GDPR (legitimate interest).

4. Recipients & Processors

We use reliable third-party providers as processors:

  • Viva Payment Services S.A. (Viva Wallet) — licensed payment processing/settlement provider (PSD2, supervised by the Bank of Greece, PCI-DSS).
  • Stripe Payments Europe, Ltd. — online (card-not-present) payment processing/settlement via Stripe Connect (PSD2, supervised by the Central Bank of Ireland, PCI-DSS Level 1).
  • Neon — database hosting (servers within the EU — Frankfurt).
  • Vercel — application hosting.
  • Resend — sending notification emails.

Where a provider is based in or processes data outside the EEA, the transfer is safeguarded by the European Commission's Standard Contractual Clauses (SCCs). Data is also transferred to competent authorities where required by law.

5. Retention Period

  • Contractual relationship data & documents: for the duration of the cooperation and up to 5 years after its end, or as required by tax/accounting law.
  • Donation/transaction data: in accordance with tax law deadlines.
  • Email verification codes (OTP): deleted after use or expiry (15 minutes).
  • Incomplete-onboarding follow-up records: automatically anonymised after 90 days where no application has been submitted.
  • Rejected applications: kept for a reasonable period and then deleted.

6. Data Subject Rights

You have the following rights regarding your data:

  • Right of access and information.
  • Right to rectification of inaccurate data.
  • Right to erasure ('right to be forgotten'), where no legal retention obligation exists.
  • Right to restriction of processing.
  • Right to data portability.
  • Right to object to processing.

To exercise your rights, use the secure contact form. We respond within one (1) month. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

7. Cookies

We use strictly necessary, time-limited session cookies for secure sign-in, the application workspace and payment-provider verification (including admin_session, org_session and provider_kyc_stripe_session). The provider-verification cookie does not grant Zeus access. Optional analytics cookies are enabled only after explicit consent; we do not use advertising cookies.

8. Security

We implement appropriate technical and organisational measures: encrypted transmission (HTTPS/TLS), email verification with a one-time code, abuse protection (rate limiting), secure administrator authentication, and data access restriction based on the principle of least necessity.

9. Amendments

This Policy may be updated. The applicable version is published on this page with the date of last update.

← Terms of Service