1. Data Controller
The data controller is ArvaSafe, based in Athens, Greece. For general enquiries, write to contact@arvasafe.com. For data-protection and GDPR matters, write to privacy@arvasafe.com.
Legal
Privacy Policy
How we collect, use, and protect your personal data.
Last updated: 1 May 2026
2. Data we collect
We only collect what we need to provide the service: name, email, phone, business name, profession, and number of workstations, when you contact us or book a call.
3. Purpose of processing
Your data is used solely to respond to enquiries, deliver the backup and compliance service, and meet legal obligations (tax law and GDPR).
4. Legal basis
Processing is based on your consent (GDPR Art. 6(1)(a)), performance of a contract (b), and compliance with legal obligations (c).
5. Storage & security
Data is hosted on Impossible Cloud's certified European servers in the EU (Germany, Finland, Poland), with ISO 27001 certification and encryption in transit and at rest, in line with GDPR Article 32.
6. Retention
We keep your data for the duration of our engagement plus 10 years, a safety margin supporting the tax and professional record-keeping obligations of Greek Law 5104/2024, depending on your sector. Afterwards it is deleted on schedule, with documentation.
7. Your rights
You have the right of access, rectification, erasure, restriction, portability, and objection (GDPR Art. 15–22). To exercise: privacy@arvasafe.com. You may also lodge a complaint with the Hellenic DPA (www.dpa.gr).
8. Cookies
The site uses only strictly necessary cookies (e.g. language and theme preference). No tracking or advertising cookies.
9. Third parties
We do not sell or share your data. We work only with EU-based sub-processors (infrastructure provider) bound by a DPA.
10. Changes
We may update this policy. Material changes will be announced on the website.