Privacy policy.

01Who we are

The data controller is the sole proprietorship Syntilas Th. Konstantinos, trading as web.lab, Tax ID 135992720, Corfu Tax Office, General Commercial Registry (GEMI) No. 125169633000, based in Kompitsi, Corfu 49100, Greece.

For any matter concerning your personal data, you can write to us at [email protected].

02What data we collect

We only collect what we need for the purpose you give it to us for:

• Contact and quote forms: name, email, phone, company name and whatever you tell us about your project.
• my.lab account: login details, billing details (company name, tax ID, tax office, address), invoice history, support requests and messages.
• Payments: amount, date and transaction result. Your card details are processed directly by the payment provider; we never see or store them.
• Messenger conversations: the content of the conversation and your Facebook profile name, when you write to us via Messenger.
• Usage data: IP address, device and browser type, pages you visited and where your visit came from, through cookies and only if you allow it.
• Security check: when you submit a form or log in to the site, the Cloudflare Turnstile service checks technical details of your connection and browser (e.g. IP address, browser and device type) to tell people apart from automated programs (bots).
• Cookie choice: your choice, with the date, a consent ID and your IP address without its last part, so that we can prove your consent.

03Why we use it and on what legal basis

• Replying to a request or quote: to take steps at your request before entering into a contract (Article 6(1)(b) GDPR).
• Providing services, invoicing and support: to perform our contract with you (Article 6(1)(b)).
• Accounting and tax obligations: because the law requires it (Article 6(1)(c)).
• Proof of cookie consent: because the GDPR requires it (Article 7(1) and Article 6(1)(c)).
• Site security and abuse prevention: for our legitimate interest (Article 6(1)(f)). This includes the bot check on forms and login.
• Statistics, behavior analysis and advertising: only with your consent, which you can withdraw at any time (Article 6(1)(a)).

04Who we share it with

We don't sell personal data. We only share it with partners who help us operate, and only as much as needed:

• Cloudways, hosting for the site and its data, in a data center in Frankfurt, Germany.
• Cloudflare, for DNS, CDN and the security check against bots (Turnstile) on forms and login.
• Wordfence (Defiant), for protecting the site against attacks (firewall).
• Viva Wallet, for paying invoices.
• Google (Workspace, Analytics 4 and Maps), for our email, traffic statistics and displaying the map.
• Elastic Email, as a backup email sending service.
• Meta (Meta Pixel and Messenger), for measuring and targeting ads and for Messenger conversations.
• Microsoft (Clarity), for anonymous analysis of how pages are used.
• Our accountant and the competent authorities, when required by law.

Our forms run on Gravity Forms and my.lab on WooCommerce, on our own servers. Their data is not sent to third parties beyond those listed above.

05Transfers outside the EEA

Some providers (Google, Meta, Microsoft, Cloudflare, Wordfence, Elastic Email) may process data in the United States or Canada. These transfers take place under the EU-U.S. Data Privacy Framework, the adequacy decision for Canada or the European Commission's standard contractual clauses.

06How long we keep it

• Contact requests and quotes that didn't lead to a project: up to 24 months.
• Client details and invoices: for as long as we work together and then for as long as tax law requires (usually 5 to 10 years).
• Messenger conversations and support requests: up to 24 months after they close.
• Record of cookie consents: 24 months.
• Cookie data: as set out in our Cookie policy.

07Your rights

You have the right of access, rectification, erasure, restriction of processing, portability and objection, as well as the right to withdraw your consent at any time.

To exercise any of them, write to us at [email protected]. We will reply within one month.

If you believe we have not handled your data correctly, you can file a complaint with the Hellenic Data Protection Authority (Kifisias 1-3, 115 23 Athens, www.dpa.gr).

08Security

We use an encrypted connection (HTTPS), regular backups, up-to-date software and access limited to those who need it.

09Changes to this policy

If anything important changes, we will update this page and the date at the top. If the change affects clients with a my.lab account, we will also let them know by email.

Questions? Write to us at [email protected].