Privacy Policy

This policy explains what personal data the website collects. shell-it.com, for what purpose, on what legal basis, to whom they are transmitted and for how long they are kept. It concerns exclusively the website and those who communicate with us through it.

Last updated: August 27, 2026

Data controller

The data controller is the sole proprietorship with a distinctive title Shell-iT:

• Headquarters: Themistokleous 3, 10677 Athens, Greece
• VAT number: 149017961
• GEMI Number: 167791403000
• E-mail: info@shell-it.com
• Phone: +30 210 440 7283

We have not appointed a Data Protection Officer (DPO), as the conditions of article 37 of the GDPR do not apply. For any questions regarding your data, please contact the email address above.

What data do we collect and why?

1. Contact form

When you fill out the form on the page Contact, we collect:

• Full name and email address — mandatory, so that we can respond
• Phone — optional
• Your message
• The page from which it was sent the form, so we can understand the context of the question

Purpose: to answer your question and, if cooperation arises, to proceed with an offer.

Legal basis: your consent (Article 6, paragraph 1, letter a) GDPR), which you give with the relevant selection field of the form, and taking measures prior to concluding a contract at your request (Article 6, paragraph 1, letter b).

The form messages are not stored in the website's database· are sent directly to our email and remain in our mailbox.

2. Book an appointment

On the page Make an appointment There is an electronic booking system in operation. To book an appointment, please enter the full name and the e-mail yours, the time which you choose and the time zone your, as well as any comments which you will add.

Purpose: to schedule and hold the meeting and send you confirmation and reminders.

Legal basis: taking measures prior to entering into a contract at your request (Article 6(1)(b) GDPR).

When the meeting is held via Google Meet, the appointment is registered in the business's Google calendar and your name and email are known to Google as the service provider.

3. Traffic statistics

We use two traffic measurement services, which operate in different ways and have different legal bases. Both show us aggregate data — which pages are being read, from which device, from which country, from which website the visitor came — and not who you are.

Purpose in both cases: to understand how the website is used and to improve it.

Google Analytics. It operates with your consent (Article 6(1)(a) GDPR). For visitors from the EEA and the United Kingdom, the website implements Google Consent Mode with all storage categories initially in "denied" status: until you consent. no cookies and no identifiers are stored on your device. You can withdraw your consent at any time from the page. Cookie Policy.

Ahrefs Web Analytics. It works without cookies and without identifiers: it does not store or read anything on your device, so it does not fall under the consent requirement for cookies and is activated regardless of your choice in the banner. Your IP address is used momentarily during processing, converted into an irreversible form together with your browser characteristics and not saved.

Legal basis for Ahrefs: our legitimate interest in measuring the traffic to our website in a way that does not track visitors (Article 6(1)(f) GDPR). You have the right to object to this processing; see below.

4. Cookies

The website uses cookies. Strictly necessary cookies — those that store your language selection and cookie decision — operate without consent, because without them the website does not function. All others are activated only with your consent.

The full list, with the category and duration of each cookie, can be found on the page Cookie Policy, where you can also change or revoke your choices.

5. Protection from automated submission

The contact form is protected by the service Cloudflare Turnstile, which checks that the submission is made by a human and not by an automated program. For this check, Cloudflare processes your IP address and technical characteristics of your browser.

Legal basis: our legitimate interest in protecting the website from malicious use and spam (Article 6(1)(f) GDPR).

6. Server logs

The hosting provider automatically keeps technical logs of each request to the website, which include the IP address, time and page requested. This is a standard feature of every server.

Legal basis: legitimate interest in the security and proper functioning of the website (article 6 par. 1 letter f GDPR).

What we don't do

• We do not sell personal data and we do not make it available to third parties for their own purposes.
• We do not send newsletters. and we do not maintain a list of recipients; the website does not have a registration form.
• We do not create profiles. and we do not make decisions that concern you in an automated manner.
• We do not accept comments. visitors to blog articles.
• We do not address minors. and we do not knowingly collect data from persons under the age of 16.

Who has access to your data?

In addition to us, your data is made known to the following providers, each of which acts for a specific purpose:

• Hosting provider — website storage and technical logs
• Email provider — sending and receiving form messages and appointment confirmations
• Google — traffic statistics and, for appointments made via Google Meet, the calendar and video conference
• Ahrefs — traffic statistics
• Cloudflare — automated submission control in the contact form
• CookieYes — recording and managing your consent for cookies

Transfers outside the European Economic Area

Google, Cloudflare and Ahrefs are companies based or have infrastructure outside the EEA, so some data may be transferred to third countries, notably the United States. These transfers are made based on the mechanisms provided for in Chapter V of the GDPR — the adequacy decision on the EU-US Data Protection Framework, where applicable, or the European Commission's standard contractual clauses.

How long do we keep your data?

• Communication messages: up to 24 months from the last communication, unless they develop into a collaboration.
• Appointment details: up to 24 months after the meeting.
• Customer data and documents: for as long as the collaboration lasts and then for as long as required by tax and commercial legislation.
• Traffic statistics: according to the retention times of the respective services.
• Cookie consent recording: for as long as is required as proof of consent.

Your rights

As a data subject, you have, in accordance with Articles 15 to 22 of the GDPR, the right to:

• access — find out what data we process about you and receive a copy
• correction — request the correction of inaccurate information
• deletion — request their deletion, provided there is no legitimate reason for retention
• restriction of processing
• portability — receive your data in a structured, commonly used format
• opposition to processing based on our legitimate interest
• withdrawal of consent at any time, without affecting the lawfulness of the processing carried out before the revocation

To exercise any of these, email us at info@shell-it.com. We will respond within one month from receipt of the request. Exercising your rights is free of charge.

Right to complain

If you believe that the processing of your data violates the GDPR, you have the right to file a complaint with the supervisory authority:

Personal Data Protection Authority
Kifisias 1–3, 11523 Athens
Telephone: +30 210 6475600
www.dpa.gr

We would appreciate it if you would contact us first so we can try to resolve the issue immediately.

Security

The website operates exclusively via an encrypted connection (HTTPS). Access to the administration is limited to strictly necessary persons and is protected by strong credentials. We take appropriate technical and organizational security measures, but no method of transmitting or storing data on the Internet can be considered completely secure.

Changes to this policy

We may update this policy when our services or obligations change. The date of the last update is indicated at the top of the page. In the event of a material change, we will prominently display it on the website.

Contact

For any questions regarding this policy or your data: info@shell-it.com or +30 210 440 7283.