1. Data controller
For the website, enquiries, and customer administration, the data controller is Ioannis Arvanitis, a sole proprietor trading as ArvaSafe, registered at Sofroniskou 16, 122 44 Egaleo, Greece, Greek Tax ID 152124704, VAT number EL152124704, and GEMI number 195035403000. General contact: contact@arvasafe.com. Data-protection contact: privacy@arvasafe.com. No Data Protection Officer (DPO) has been appointed. For backup content, the customer remains the controller and ArvaSafe acts as processor under the service agreement and DPA.
2. Data we collect
For enquiries we collect your name, business details, business type, workstation range, stated needs, email, optional phone number, and message. For appointments, Google Calendar processes the details and time selections you enter. For customers we process contact, contract, billing, support-request, and technical service metadata. Backup content is limited to the data the customer chooses to protect.
3. Purposes and legal bases
We respond to enquiries and prepare quotations as pre-contractual steps (GDPR Art. 6(1)(b)), provide and support the service under contract (b), meet tax and accounting obligations (c), and protect the website and service against abuse on the basis of our legitimate interests (f). We do not rely on blanket consent for all of these activities.
4. Recipients and providers
We use Cloudflare for hosting, CDN, and technical logs; Formspree to receive enquiries; and Google Workspace and Google Calendar for email and appointments. Fonts are self-hosted by arvasafe.com. For the backup service, the selected storage region and relevant sub-processors are recorded in the Order Form and DPA. We do not sell personal data.
5. Transfers outside the EEA
Cloudflare, Formspree, Google, and the disclosed backup-service sub-processors may process certain website, enquiry, appointment, or technical metadata outside the EEA, including in the United States. Where required, providers publish transfer mechanisms such as Standard Contractual Clauses (SCCs) or data-processing terms. The backup-content storage region and relevant terms are recorded in the service contract documents.
6. Backup security and access
Backup files are encrypted client-side with AES-256 before upload. ArvaSafe securely manages and safeguards the keys so that restores can be performed. Access to decrypted content is limited to named authorised personnel, only for a customer-requested restore or support case, and is logged. Storage and platform sub-processors do not hold the keys required to decrypt file content.
7. Retention
Enquiries and appointments that do not lead to an engagement are retained for up to 12 months and then deleted. Customer, contract, and billing records are retained for the engagement and for the periods required by applicable tax, accounting, or legal obligations. Backup content follows the agreed retention schedule and the contract-end export and deletion process. Technical logs are retained only as needed for security and operation, also subject to the relevant provider policies.
8. Your rights
You may request access, rectification, erasure, restriction, portability, or object to processing where applicable (GDPR Art. 15–22) by writing to privacy@arvasafe.com. You may also lodge a complaint with the Hellenic Data Protection Authority.
9. Cookies and external content
The site only uses technically necessary cookies or local storage for functions such as language or theme preference. Font files are self-hosted and do not make requests to Google Fonts servers. Google Calendar loads only after you choose to open the booking interface and may then use its own cookies. We do not use advertising or analytics cookies.
10. Automated decisions
We do not use personal data for profiling or automated decision-making that produces legal or similarly significant effects.
11. Changes
We may update this policy when our services or legal obligations change. The revision date appears above, and material changes will be announced on the website.
