Privacy Policy

This Personal Data Protection Policy aims to inform you about the information collected from you when you visit this website, the way in which it may be used, the way in which you can control the use and disclosure of information concerning you, and the measures taken to protect such information. This Policy forms an integral part of the Terms of Use, which are incorporated herein by reference.

The Company “AXIA ENERGY O.E.”, having its registered office in Thessaloniki, at 83 Vasilissis Olgas Street (hereinafter referred to as the “Company”), as the controller of your personal data, informs the person to whom the respective personal data relate (hereinafter the “Data Subject” or the “User”) and who visits/uses the website https://www.axiaenergy.gr/ (hereinafter the “Website”) that the processing of personal data is governed by the applicable national and EU legislation on the collection, use and disclosure of your personal data by us (hereinafter the “Applicable Data Protection Law”), including Law 4624/2019 (hereinafter the “Law”) and Regulation (EU) 2016/679 of the European Parliament and of the Council, adopted on 27 April 2016 and applicable since 25 May 2018 (hereinafter the “Regulation”), as well as the relevant decisions, guidelines and regulatory acts of the Hellenic Data Protection Authority.

The Company ensures the fair and lawful collection and processing of personal data. Personal data is information that directly or indirectly identifies the Data Subject, in particular by reference to an identifier such as first name, surname, telephone number, e-mail address, etc. The above personal data collected are strictly those necessary to carry out the action requested by the Data Subject.

The Data Subject warrants that the personal data provided are correct and accurate and undertakes to notify the Company of any change or amendment thereto. Any loss or damage caused to the Company or to any third party through the submission of incorrect, inaccurate or incomplete information in the contact form shall be the sole responsibility of the Data Subject.

In accordance with Article 8(1)(a) of the Regulation in conjunction with Article 21 of the Law, minors under the age of fifteen (15) are prohibited from disclosing their personal data to us through the Website without the prior consent of their guardian. We ask such persons not to submit any information to us.

Our Company collects only the personal data that are strictly necessary in order to respond to your request or to provide you with the requested service. The categories of personal data we collect are the following:

• Website forms (analysis request, contact, partnership interest): full name, e-mail, telephone number, whether the Data Subject is an individual or a business, business name (for businesses), company/activity (for partners), indicative range of monthly energy cost, subject and message, as well as the Data Subject’s consents and their dates.
• Comments/Reviews form: if the User submits a comment, we collect the rating, the comment text, the display name they choose and whether they are an individual or a business, as well as their full name and e-mail address to verify that the review is genuine. To prevent fake (spam) reviews we also record a pseudonymised fingerprint (hash) of the IP address, not the address itself. Only the rating, the comment, the display name, the individual/business status and the month of submission are published, and only after the Company approves it.
• Origin of the request: the page from which the Data Subject submitted the form, campaign parameters (utm) and the referring website, so that we know how the Data Subject found our Company.
• Data for the analysis: if the User of the Website proceeds with a bill analysis, they provide us with recent energy bills — by uploading them to the form (PDF or photo, up to 3 files of 10 MB each) or by sending them by e-mail. These yield data on consumption, supply, current tariff and charges.
• Communication: the entire content of the communication between the Company and the Data Subject, whether the communication takes place by telephone or by e-mail.
• Technical data: the IP address and basic details of the Data Subject’s browser are temporarily logged by the hosting provider for security purposes and protection against malicious use (e.g. rate limiting of submissions). We do not link them to the Data Subject as a person.
• Statistics cookies: only if the Data Subject accepts them — see the Cookies Policy.

We do not collect special categories of data (e.g. health data) or payment card details through the Website.

The Company and/or the processors acting on its instructions and on its behalf collect, process and use the personal data of Data Subjects in accordance with the applicable legal provisions and this personal data notice. The purposes of the processing of your personal data, as well as the legal bases on which the processing takes place, are the following:

The Company collects and processes personal data solely and exclusively for the above purposes and only to the extent strictly necessary to serve those purposes effectively. Such data are at all times relevant, adequate and not excessive in view of the above purposes, and are accurate and, where necessary, kept up to date.

• Requests that do not lead to a partnership: up to 24 months from the Company’s last communication with the Data Subject, after which they are irreversibly deleted or anonymised.
• Bill files the Data Subject uploads to the form: up to 6 months from submission, after which they are automatically deleted from the server. A file uploaded without the submission being completed is deleted within 7 days. Data already recorded in the analysis follow the retention periods of the request or the partnership.
• Customers: for as long as the partnership lasts and, after it ends, for as long as required by tax and commercial legislation or by the limitation period of any claims (as a rule up to 5 years).
• Consent to receive updates: until the Data Subject withdraws it. We keep the dates of consent and withdrawal as proof.
• Comments / reviews: published ones, for as long as they remain published; they are removed as soon as the Data Subject requests it. Comments that are not published are deleted within 24 months of submission.
• Technical security data (IP): for a short period in accordance with the hosting provider’s settings.
• The Data Subject’s cookie choice: 12 months.

Such data are retained only for the period required to fulfil the purposes of their collection and processing, and are securely deleted upon completion thereof, unless their continued retention is required by applicable law.

The processing of personal data by the Company is carried out in a manner that ensures its confidentiality. The Company takes all appropriate organisational and technical measures to secure the data and protect them against accidental or unlawful destruction, accidental loss, alteration, prohibited dissemination or access, and any other form of unlawful processing.

We undertake that, in the event of a breach of the database of this Website or of the database of any third-party data processor, we will notify the Data Subjects as well as the Hellenic Data Protection Authority within 72 hours of the breach. Where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, the Company is obliged to communicate the personal data breach without undue delay.

The recipient of the personal data is the Company itself and the processors acting on its behalf.

The Company guarantees that it will not transfer, disclose, make available, etc. the personal data of the Data Subject to third parties for any purpose or use. However, it reserves the right to disclose information concerning the Data Subject if the law imposes a relevant obligation or if such disclosure is required by a court decision, a public prosecutor’s order or instruction, or a decision of another person or administrative body with statutory authority to compel the disclosure of such information.

The Company uses third-party service providers (e.g. web hosting providers and data management providers) to manage one or more aspects of its activities, including the processing of personal information. When we use an external company or partner, we use contractual commitments and other appropriate means to ensure that your personal data are used in a manner consistent with applicable law and this Policy.

The processors (service providers) that are contractually bound to act only on behalf of the Company are the following:

• Vercel Inc. (website hosting — form data are processed on servers in Frankfurt, EU)
• Supabase Inc. (database within the EU)
• Resend Inc. (sending notification e-mails to us for each request or comment)
• Google Ireland Ltd. (Google Analytics, only if you accept it)

Our database and servers are located within the EU. Some of our providers (Vercel, Resend, Google) are based in the USA and may process limited data there (e.g. the notification e-mail, technical data). These transfers are covered by the EU–US Data Privacy Framework and/or the Standard Contractual Clauses of the European Commission. A copy of the relevant safeguards is available on request.

The Company uses cookies in order to analyse visitor behaviour, administer the Website, track user preferences and collect information about the user. This is done in order to personalise your experience with us. We use cookies on our Website to manage login sessions and to provide personalised web pages that reflect your particular needs and interests. In this way, the Website remembers your actions and preferences (such as display preferences, language, etc.) for a period of time, so that you do not have to re-enter these preferences every time you visit the website or browse its pages.

For more detailed information about the cookies we collect, please see our Cookies Policy.

Any linking of the Website through special hyperlinks (links, hyperlinks, banners) to any other third-party website does not entail the assumption by the Company of any responsibility for the policy followed by that website regarding the protection and management of personal data. Data Subjects should themselves ensure that they are informed about the protection and management of their data by the above websites.

The User always retains the following rights regarding their personal data:

Right of access

The User has the right to be informed about the personal data the Company stores about them and how these are processed.

Right to rectification

The User has the right to request the rectification of their personal data if they have been recorded incorrectly.

Right to erasure

The User has the right to request from the Company, at any time, the erasure of their personal data. In this case, the Company is obliged to erase the User’s data.

Right to restriction of processing

The User has the right to request from the Company the restriction of the processing of their personal data. In this case, the User’s personal data will be archived and re-integrated into the Company’s operational systems only if the User so wishes.

However, during this period the User will not be able to use the Company’s services. If our services are used, we will process your data again.

Right to data portability

The User has the right to request from the Company that their stored personal data be sent to them or to another controller in a machine-readable format.

Right to object to the processing of your data

The User has the right to withdraw their consent at any time or to object to the further processing of their data. The User may also object to receiving informational communications in the future at any time.

If the User does not agree with one of the processing purposes based on the Company’s legitimate interest, or wishes to object to it, they may raise objections to the processing at any time by sending a message to the e-mail address info@axiaenergy.gr.

In this case, the processing will be reviewed and the Company will either stop processing the User’s data for that purpose or explain to the User the reasons why the disputed processing is necessary.

Automated decision-making

The Company also processes Users’ personal data in the context of algorithms in order to simplify its processes. Of course, the User has the right not to be subject to decisions based solely on automated processing. If the User believes that the Company has unjustifiably refused them access, they may always contact the Company at info@axiaenergy.gr. In this case, the Company will examine the User’s request and decide on a case-by-case basis.

Right to lodge a complaint

The User has the right to lodge a complaint with the Competent Supervisory Authority at any time if they believe that the Company has made an error regarding their personal data or their rights.

The supervisory authority responsible for the Company is:

• Hellenic Data Protection Authority
• 1-3 Kifisias Avenue, Postal Code 115 23, Athens
• Switchboard: +30-210 6475600
• Fax: +30-210 6475628
• E-mail: contact@dpa.gr

Exercising your rights

To exercise the above rights, the User may contact the Company at any time at the following e-mail address: info@axiaenergy.gr. Alternatively, they may contact the Company at its premises at 83 Vasilissis Olgas Street, Postal Code 54642, Thessaloniki, or by telephone at 6948121014. During this process, the Company may ask the User to verify their identity before it can satisfy the request. The User may also correct any of their data that are not valid and object to receiving informational e-mails through the “Personal Data” page of the Company’s Website.

Requests to exercise the above rights are completed within 30 days and are free of charge.

As this notice and the personal data protection terms contained herein may be amended, Data Subjects should regularly review the content of this notice and check for any changes.