Privacy Policy

01Controller

GE - THE DESIGN AGENCY ΔΙΑΦΗΜΙΣΤΙΚΕΣ ΥΠΗΡΕΣΙΕΣ, trading as GE - THE DESIGN AGENCY, is the controller. Registered office: Distomou 1, 18532 Piraeus, Greece. GEMI number: 000149391201000. Greek tax identification number (AFM): 801112490. Competent tax office: KEFODE. Contact: info@designagency.gr.

No data protection officer has been appointed because the current processing activities do not, on the information presently available, require one. Privacy requests may be sent directly to the address above.

02Data we process

• —Identity and contact data, including name, email address, telephone number, company and role.
• —Enquiry and project data, including brief, budget, requested services, attachments, correspondence and meeting notes.
• —Account and administration data if you use a protected area of the website.
• —Nova AI chat content, conversation identifiers, timestamps and related lead metadata.
• —Technical and security data, including IP address, device, browser, logs and consent preferences.
• —Analytics data only after you expressly enable Analytics in Cookie Settings.

03Purposes and legal bases

• —Answering enquiries, preparing proposals and taking pre-contractual steps requested by you: Article 6(1)(b) GDPR.
• —Performing contracts and managing client relationships: Article 6(1)(b) GDPR.
• —Invoices, tax records and compliance with legal obligations: Article 6(1)(c) GDPR.
• —Website security, fraud prevention, service improvement and the establishment or defence of legal claims: Article 6(1)(f) GDPR, after balancing the relevant interests.
• —Optional analytics and non-essential device storage: Article 6(1)(a) GDPR and the applicable Greek electronic communications rules.
• —Electronic marketing where consent is legally required: Article 6(1)(a) GDPR. You can withdraw consent or object at any time.

04Contact and project forms

The contact form on designagencyx.com sends the details you provide directly to the website's access-restricted internal CRM in the Base44 environment. Authorised agency administrators use them to receive, route and answer the enquiry.

Required fields are necessary to handle the request. Do not submit special-category data, identification documents, passwords, health information or confidential third-party material unless we have specifically requested it through an approved secure channel.

05Nova AI assistant

Nova is an AI system. Your messages and conversation metadata are processed through the Base44 application and AI-agent services to generate replies and, where you ask to be contacted, support lead handling.

Nova may produce inaccurate or incomplete answers. It does not make decisions that produce legal or similarly significant effects. Do not use it for legal, medical, financial or other professional advice and do not enter sensitive or confidential data.

06Recipients and processors

We do not sell personal data. Processors receive only the data required for their assigned service and must process it under applicable data protection obligations.

• —Base44 and its authorised infrastructure providers for website hosting, application services, databases, authentication and the Nova assistant.
• —Dropbox when you expressly choose to load the externally hosted company presentation.
• —Google Ireland Limited and its authorised processors for operational email delivery to company-managed mailboxes when a lead is submitted.
• —Google Ireland Limited for Google Analytics, only after analytics consent.
• —Authorised employees, contractors and professional advisers who need the data for the stated purpose and are subject to confidentiality duties.
• —Public authorities, courts or regulators when disclosure is legally required.

07International transfers

Some technology providers or their sub-processors may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision, the European Commission Standard Contractual Clauses or another lawful transfer mechanism, together with supplementary safeguards where appropriate.

08Retention

Data may be kept for a longer period where necessary to comply with law, investigate abuse, resolve a dispute or establish, exercise or defend legal claims.

• —Enquiries and unsuccessful proposals: normally up to 24 months after the last meaningful contact.
• —Client and project records: for the contract period and afterwards for the applicable tax, accounting and limitation periods, generally at least five years and longer where legally required or a claim is pending.
• —Nova conversations not attached to an active client matter: normally up to 24 months.
• —Marketing records: until consent is withdrawn or an objection is made, subject to periodic review.
• —Cookie consent records: for as long as reasonably needed to demonstrate and respect your choice.

09Your rights

We normally respond without undue delay and within one month. We may request information needed to verify identity and protect the data from unauthorised disclosure.

• —Access, rectification and completion of your personal data.
• —Erasure and restriction where the legal conditions are met.
• —Data portability for processing based on consent or contract and carried out by automated means.
• —Objection to processing based on legitimate interests and to direct marketing at any time.
• —Withdrawal of consent at any time without affecting earlier lawful processing.
• —A complaint to the Hellenic Data Protection Authority.

10Security and breaches

We apply proportionate technical and organisational measures, including access restrictions, authentication, role separation and controlled provider access. No online system can be guaranteed completely secure.

Where a personal data breach creates a risk requiring notification, we will follow the GDPR notification and communication requirements.

11Children and automated decisions

The website and agency services are intended for businesses and adults. We do not knowingly solicit personal data from children.

We do not use website data for solely automated decisions that produce legal or similarly significant effects.

12Changes

We may update this policy when processing, providers or legal requirements change. The current version and update date will remain available on this page.