Privacy Policy

1.Who is responsible for your data

The data controller is Κ. ΜΠΟΥΡΔΑΚΟΣ & ΣΙΑ Ε.Ε., trading as KKAA Solutions, registered in Greece (VAT EL801985029, GEMI No. 167601003000, official registry record), based in Athens, Greece. For anything in this policy, contact info@kbourdakos.gr.

2.What data we process

Website visitors

• Technical logs — our web server and our content delivery provider record standard request data (IP address, URL, time, user agent) for security and troubleshooting.
• Measurement cookies — only if you accept them in the cookie banner (see section 4). If you decline, no advertising or analytics cookies are set.

Prospective and current clients

• Contact details — name, email, phone, company details you send us through the request form, email or other channels.
• Client Portal accounts — login identifier and the engagement information shown in your portal account.
• Secure Vault contents — secrets shared for an engagement, such as credentials or configuration snippets. They are encrypted in your browser before they reach us: our server stores only the ciphertext and never sees the plaintext or the decryption key.
• Engagement data — during a cleanup or incident response we access your websites, servers and databases; the material we handle there (including logs and database contents) can contain personal data of your own users. We process it only as needed for the engagement, acting on your instructions.
• Billing data — details required by Greek tax law for invoicing.

3.Why we process it (legal bases)

• Providing the service you requested — responding to requests, running engagements, operating the Client Portal and Secure Vault (performance of a contract, GDPR Art. 6(1)(b)).
• Security and operation of this website — server logs, abuse prevention (legitimate interest, Art. 6(1)(f)).
• Invoicing and accounting — legal obligation (Art. 6(1)(c)).
• Ads and analytics measurement — only with your consent via the cookie banner (Art. 6(1)(a)); you can withdraw it at any time (section 4).

4.Cookies and measurement

This site does not set advertising or analytics cookies by default. When you first visit, a banner asks for your choice:

• Accept — Google tags are loaded for ads conversion measurement (Google Ads) and anonymous usage statistics (Google Analytics 4). See how Google uses this data.
• Decline — no Google tags are loaded. The site works exactly the same.

Your choice is stored in your browser (local storage key kkaa_consent) so we don't ask again. To change it, use the "Cookie settings" link in the footer of any page — it clears your stored choice and shows the banner again.

5.Who we share data with

We do not sell personal data. We share it only with providers that help us operate, under appropriate data-processing terms:

• Hosting infrastructure — the servers this website and the Vault run on.
• Cloudflare — content delivery and security in front of this website (processes visitor IPs and request data).
• Google — ads/analytics measurement, only if you consented (section 4).
• Accounting services — invoicing data, as required by Greek tax law.

We disclose data to authorities only where the law requires it.

6.International transfers

Some providers above (for example Cloudflare and Google) may process data outside the European Economic Area. Where that happens, transfers rely on safeguards recognized by the GDPR, such as adequacy decisions and Standard Contractual Clauses.

7.How long we keep data

• Enquiries that don't become engagements — kept briefly, then deleted.
• Engagement records and reports — kept for as long as needed to support the engagement and defend legal claims.
• Secure Vault contents — destroyed automatically on first retrieval or when the link expires (at most 7 days after upload), whichever comes first; the Vault stores nothing beyond that.
• Invoicing records — kept for the period required by Greek tax law.
• Server logs — kept for a short rolling window for security purposes.

8.How we protect data

Security is our trade and we apply it to our own systems: encrypted connections (HTTPS) everywhere, the Secure Vault for sensitive exchanges instead of email, access restricted to those who need it, hardened and monitored infrastructure, and confidential handling of all client material (see also our Terms of Service). No system is perfectly secure, but if we ever detect a breach affecting your data we will inform you and the competent authority as the GDPR requires.

9.Your rights

Under the GDPR you can ask us for access to your data, correction, deletion, restriction of processing, portability, and you can object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time without affecting past processing. To exercise any right, email info@kbourdakos.gr.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (dpa.gr) or your local supervisory authority.

10.Changes to this policy

We may update this policy from time to time; the current version, with its "Last updated" date, is always published on this page. Material changes affecting active clients will also be communicated directly.

11.Contact

Privacy questions and requests: info@kbourdakos.gr — Κ. ΜΠΟΥΡΔΑΚΟΣ & ΣΙΑ Ε.Ε. (KKAA Solutions), Athens, Greece.