Privacy policy

1. Controller

The controller is Packio P.C., Thessalonikis 75, 183 46 Moschato, Greece, General Commercial Registry (G.E.MI.) no. 183071501000, email info@getpackio.com, tel. +30 210 4446 487.

This policy explains how we process personal data in the Packio Comply application and website, under Regulation (EU) 2016/679 (GDPR) and Greek Law 4624/2019. For any personal data matter write to info@getpackio.com.

2. What data

• Account: name, email and sign-in data.
• Company: name, VAT number, address, registry number, tax office, legal representative, billing email, markets.
• Packaging and orders: from order files we keep only order number, date, shipping country, SKU and quantity. We do not keep the names, addresses or emails of your own customers.
• Files you upload (e.g. registration certificates) and invoices.
• Payments: card details are processed by Stripe; we only receive the status of the payment and subscription.
• Communication: messages, requests from the website forms (email, markets) and representative requests.
• Technical: IP address, browser, logs, errors, and an action history (who changed what and when) for security.

3. Purposes and legal bases

• Providing the service and support: performance of a contract (GDPR Art. 6(1)(b)).
• Replying to form requests: steps at your request before entering a contract (Art. 6(1)(b)).
• Deadline reminders you asked for without an account: consent (Art. 6(1)(a)), which you can withdraw at any time.
• Invoicing and tax duties: legal obligation (Art. 6(1)(c)).
• Visit and usage statistics, and advertising measurement: only with your consent from the cookie banner (Art. 6(1)(a)), which you can change at any time in “Cookie settings”.
• Security, action history, error tracking, abuse prevention: legitimate interest (Art. 6(1)(f)).

We do not take decisions based solely on automated processing that produce legal effects for you (GDPR Art. 22). The obligation check is an information tool.

4. Who receives data

We do not sell data. We use the following providers, which process data on our behalf under contract (GDPR Art. 28):

• Amazon Web Services: hosting, database and files.
• Clerk: sign-in and account management.
• Stripe: payments. For some processing, such as fraud prevention, Stripe acts as an independent controller under its own policy.
• Resend: sending email.
• Sentry: tracking technical errors.
• Cookiebot (Usercentrics): managing your cookie consent.
• Only if you allow it in the banner: Google (Tag Manager, Analytics), Microsoft Clarity, Mixpanel and HubSpot for statistics, and Meta and LinkedIn for advertising measurement.

Also: (a) the partner (agency or accountant) you signed up through, who can view your company's data in the application; (b) an independent representative, only if you ask us and authorise us; (c) the European Commission, through VIES, when we check your VAT number; (d) public authorities, when the law requires; (e) our accountant, for invoicing.

5. Transfers outside the EEA

Some providers (Amazon Web Services, Clerk, Resend, Sentry, Stripe, and the statistics and advertising tools if you allow them) may process data in the US. These transfers rely on a European Commission adequacy decision (GDPR Art. 45) for certified providers or on standard contractual clauses (GDPR Art. 46). You can ask for more information at info@getpackio.com.

6. How long we keep data

For as long as you keep an account. After it ends we delete or anonymise the data, except what we must keep for as long as tax and accounting law requires (e.g. invoices), or as needed to establish, exercise or defend legal claims. Form requests without an account are kept as long as needed to reply and continue the contact you asked for.

7. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection (GDPR Arts. 15 to 21), and the right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal. Write to us at info@getpackio.com. We reply within one month.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

8. Security

We use encrypted connections, per-company access control, an action history and a SHA-256 fingerprint of the files you upload. No system is completely secure; if a breach affects you, we inform you as the GDPR requires.

9. Cookies and storage on your device

Strictly necessary cookies work without consent (Greek Law 3471/2006, Art. 4(5)). Statistics and advertising cookies load only after you allow them in the banner; until then none of those tools load. You can change or withdraw your choice at any time in “Cookie settings” at the bottom of the page. The same window lists every cookie and how long it lasts.

• Clerk sign-in cookies: keep you securely signed in.
• comply-lang (cookie, 1 year): the language you chose.
• comply:lens (browser storage): the map view you chose.
• CookieConsent (Cookiebot, 1 year): your choice in the banner.
• With consent: statistics cookies (Google Analytics, Clarity, Mixpanel, HubSpot) and advertising cookies (Meta, LinkedIn).

The payment page belongs to Stripe, which uses its own cookies under its own policy.

10. Changes

If this policy changes, we update the date at the top of the page and, for material changes, we inform you by email.