Personal Data Protection Policy

1. Introduction

This Privacy Policy aims at the full and transparent information of users regarding the terms under which the company CULIZEN SOFTWARE ΙΔΙΩΤΙΚΗ ΚΕΦΑΛΑΙΟΥΧΙΚΗ ΕΤΑΙΡΕΙΑ (CULIZEN SOFTWARE Private Company), with registered seat in the Municipality of Athens, Attica, VAT No. 803230894, GEMI No. 192608303000, electronic contact address info@culizen.gr (hereinafter the "Company" or "Culizen"), collects, uses, stores, and generally processes personal data of users who browse its website www.culizen.gr or make use of the Culizen web application/platform (hereinafter the "Service or Culizen") or through other means connected to Culizen.

The Policy applies to every form of use of Culizen services, whether through the website or through the web application or mobile device applications, regardless of the technical means of access. The collection of your personal data takes place almost as a rule for the performance of a contract between us, in your capacity as a user of our services and/or a visitor of our website.

The processing of personal data is carried out in accordance with Regulation (EU) 2016/679 (GDPR), Directive 2002/58/EC, as well as the relevant national legislation (Law 4624/2019, Law 3471/2006). When we therefore refer to processing, this is to be understood in accordance with the definition attributed to it in the GDPR, i.e., any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

2. Roles in our relationship under the GDPR

The Company acts as Data Controller for the personal data related to the creation and management of the user account, the operation of Culizen, the management of the subscription relationship, and communication with users. The data controller is the one who determines the means and purposes of processing personal data. The purposes and manner of processing may also be determined by law.

The user (registered and/or not) is the Data Subject, i.e., a natural person every piece of information about whom can identify them directly or indirectly. When the user enters their own data into the platform, they are the Data Subject of this data concerning them. When they enter data of third parties, such as supplier details or other operational and/or non-operational data that may include information of natural persons, then the user, by selecting the specific functions, determines the purposes of the processing and consequently bears the corresponding liability for compliance with the applicable data protection law as Data Controller.

Recipient is the natural or legal person, public authority, service, or other body to which the personal data are disclosed, whether or not a third party. However, public authorities which may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of this data by these public authorities is carried out in accordance with the applicable data protection rules depending on the purposes of the processing.

Third Party is any natural or legal person, public authority, service, or body other than the data subject, the controller, the processor, and the persons who, under the direct authority of the controller or the processor, are authorized to process personal data.

3. Categories of data and sources of collection

The Company processes personal data which are provided either directly by the user or which arise from the use of the platform. If you connect through a third-party service (e.g., Google), the third-party service may send us information, such as your registration and profile information from that service. This information varies and is controlled by that service or by you, through your privacy settings on that service. In any case, collection and processing are strictly limited to the data necessary for the provision of the Service and for ensuring its safe and smooth operation. In particular, as regards the categories of data collected by our Company, the following apply:

• (a) Within the framework of creating and managing an account, identification and contact data are collected, such as full name and email address and any additional details that the user chooses to declare in their profile. In parallel, authentication and security data are recorded, such as login credentials, encrypted passwords, information regarding the identity of the device or session, as well as data related to the account verification process (e.g., email confirmation or login via third-party providers such as Google).
• (b) During the use of the Service, the Company collects and processes technical and operational data, which are necessary to support the platform and the security of information systems. This data includes, among others, the IP address, information regarding the device and operating system, browser type, session data, login and logout timestamps, as well as activity logs, which reflect the user's activity within the application (such as actions of creation, modification, or deletion of data).
• (c) Within the framework of our transactional relationship, payment information, requests, or any questions you may submit during the use of our services are collected.
• (d) A particular category is the data entered, uploaded, or created by the user themselves during the use of the platform. This data includes indicatively recipes, ingredient and raw material details, costing data, stock information, supplier catalogues, billing details, financial data, commercial information, as well as any attached files or images. To the extent that this data concerns natural persons (such as contact details of suppliers, partners, or customers), it constitutes personal data, for which the user bears liability as regards the legality of processing and the existence of an appropriate legal basis.
• (e) In addition, through the use of optical character recognition (OCR) functions, it is possible that data contained in documents, such as invoices, receipts, including details such as business name, VAT No., amounts, and product descriptions, may be processed. This processing is carried out exclusively following action and initiative of the user and is limited to the purpose of providing the relevant functions of the application.
• (f) Within the framework of use of the application via mobile devices, access may be requested to individual device functions, such as the camera (for document scanning), storage space (for file uploading), or other related functions. This access is activated only following relevant permission of the user and is used exclusively for the execution of the functions they select.
• (g) Finally, in case of communication of the user with the Company, the data contained in the content of the communication are collected and processed, such as identity details, contact details, information related to the request or matter raised, as well as metadata of the communication.

The Company does not collect or process special categories of personal data (sensitive data). Users must avoid entering such data into the platform, unless they have an appropriate legal basis under the GDPR and applicable law.

In general, for the performance of its activities, the Company does not collect or process personal data of minors, nor does it provide services to persons under 18 years of age.

In any case, the Company applies the principle of data minimization and does not collect data beyond what is strictly necessary for the provision and improvement of the Service.

4. Purposes of processing – legal bases – retention periods

The processing of personal data is carried out for specific, clear, and lawful purposes, in accordance with the principles of Article 5 of the GDPR (EU 2016/679), and is limited to the data strictly necessary to achieve these purposes. The Company does not carry out further processing incompatible with the initial purposes of collection, unless this is permitted by the applicable legal framework and following the required information or consent. In particular, for the following processing purposes:

(a) For the provision of the Service and the management of the contractual relationship with the user

For the creation and management of the user account and the provision of access to the platform, the Company processes identification and contact data (full name, email address, login credentials, and related technical identifiers, e.g., IP at the time of registration or login). This processing is necessary for the performance of the contract between the user and the Company, in accordance with Article 6(1)(b) GDPR. The data is retained for as long as the account remains active.

(b) For purposes of financial obligations within the framework of managing the contractual relationship

The management of payments and subscriptions entails the processing of billing and transaction data, such as billing details, payment identifiers, and basic financial data of the user. This processing is necessary for the performance of the contract between us (Article 6(1)(b) GDPR) and for the Company's compliance with its tax obligations (Article 6(1)(c) GDPR). Payments are processed through external providers, which act as independent controllers. The relevant data is retained in accordance with the requirements of applicable legislation for at least ten (10) years with the possibility of extension for tax or legal reasons in the context of defending the legitimate interests of the Company.

(c) For the provision of the functions of the platform

The provision of the functions of the platform, including the management of recipes, costing, stock, financial data, and the analysis of operational information, entails the processing of data entered by the user themselves (see Section 2). The processing is carried out within the framework of the performance of the contract between us. This data is retained for as long as the user chooses to retain it in the system and their account remains active.

The processing of data through optical character recognition (OCR) functions concerns data contained in documents uploaded on the user's own responsibility and initiative, such as invoices and receipts. The processing is carried out exclusively following action of the user and is based on the performance of the contract between us. The user is responsible as regards the legality of the collection and processing of the information of third parties appearing in the receipts and informing them regarding the use of the platform. The data is retained until its deletion by the user and for as long as their account is active.

(d) For purposes of communication, responding to support requests, and handling complaints

Communication with users and the provision of support services entails the processing of communication data, such as the email address and the content of messages. This processing is necessary for the performance of the contract and the service of users' requests (Article 6(1)(b) GDPR). The data is retained for as long as is required for the completion of the request and for a reasonable period of documentation. In particular, data related to support requests or complaints is retained for a period of up to five (5) years for purposes of documentation and complaint management.

The Company may use the user's contact details for sending updates related to the operation of the service, the management of the account, payment reminders, or other related notifications that do not have a purely promotional character. This processing is based on the performance of the contract (Article 6(1)(b) GDPR) or, as appropriate, on the legitimate interest of the Company (Article 6(1)(f) GDPR) for the smooth operation of the service.

(e) For purposes of promotional activities (newsletter)

The sending of commercial communications and the sending of newsletters that include promotional or advertising content is carried out exclusively following prior consent of the user, in accordance with Article 6(1)(a) GDPR and the applicable law for electronic communications (Law 3471/2006). Consent may be withdrawn at any time, without affecting the legality of the prior processing, and the data is retained until its withdrawal.

The Company may also, under the conditions of applicable legislation, use the user's contact details for purposes of direct commercial promotion of similar services, provided they have been collected within the framework of a prior transactional relationship and the user has not objected. In any case, a clear and easy possibility of objection is provided in every communication.

(f) For purposes of security, fraud prevention, detection of malicious activity, and ensuring the integrity of systems

The processing of technical data and logs, such as the IP address, activity data, and system information, is carried out for purposes of security, prevention of malicious use, and ensuring the integrity of the platform and the Company's information infrastructure. This processing is based on the legitimate interest of the Company (Article 6(1)(f) GDPR), which has been balanced against the rights and freedoms of the data subjects. This data is retained for a limited period, which as a rule does not exceed twelve (12) months, unless otherwise required for reasons of security or regulatory compliance.

(g) For purposes of improving the functionality of the platform, addressing technical problems, performance control, and adapting the service to users' needs

This processing is based on the legitimate interest of the Company (Article 6(1)(f) GDPR) for the continuous improvement of its services, provided that the rights of users are not prejudiced.

In any case, the Company ensures that every processing is based on an appropriate legal basis, is limited to the pursued purpose, and is carried out in a manner that respects the rights and freedoms of the data subjects, in accordance with the principles of proportionality, transparency, and minimization. The Company, with regard to the data retention periods, adopts a specific policy with specific criteria (see Section 5).

5. Retention policy for user data

The Company applies a personal data retention policy in accordance with the principle of storage limitation (Article 5(1)(e) GDPR), ensuring that data is retained in a form which permits identification of data subjects for no longer than is strictly necessary for the purposes of processing.

The determination of the retention period is based in particular on the following criteria: (a) the duration of the contractual relationship between the user and the Company and the need to provide the service, (b) the nature and purpose of the processing, (c) the legal and regulatory obligations in force from time to time (in particular tax, accounting, commercial), (d) the need to establish, exercise, or defend legal claims (Article 17(3)(e) GDPR), (e) the existence of consent and the time of its withdrawal (Article 7 GDPR), as well as the need to ensure the integrity and security of information systems.

After the expiry of the contractual relationship or the achievement of the purpose of processing, the data is deleted or anonymized, unless its further retention is necessary on the basis of law or for the above legitimate purposes. In particular, data related to financial transactions may be retained for the period provided for by tax legislation (indicatively at a minimum of 10 years), while data documenting consent or compliance with the GDPR may be retained for the demonstration of the legality of processing.

In cases of inactive accounts, the Company may, following prior information of the user, proceed to the deletion or anonymization of inactive accounts after the lapse of 24 months of inactivity.

The Company periodically reviews the data it retains and applies deletion or anonymization procedures, in order to ensure compliance with the GDPR and to avoid the retention of data beyond the necessary period.

6. Cookies and tracking technologies

At the time of drafting this Policy, the Company does not use cookies or other tracking technologies for purposes of advertising targeting, behavior analysis, or user profiling.

The operation of the platform relies exclusively on technically necessary cookies and related technologies connected to user authentication and session management, which do not require consent in accordance with applicable law.

7. Use of artificial intelligence and processing

Culizen integrates artificial intelligence functions, which constitute an essential element of the platform's functionality and are used for data analysis, drawing conclusions, producing suggestions, and providing support to the user via a digital assistant (chatbot). The user is informed that the responses and suggestions are provided by an artificial intelligence system.

In particular, the platform's chatbot functions as an interactive support tool, which processes the inputs entered by the user in order to provide responses, guidance regarding the use of the application, and information related to its functions. The use of the chatbot presupposes the entry of data by the user, which may include information related to their activity, recipes, financial data, or other operational data. The user bears liability for the content of the information they choose to share through the chatbot and must avoid entering unnecessary or sensitive data.

The processing of data within the framework of artificial intelligence functions is limited exclusively to the data entered by the user themselves and is carried out only to the extent necessary for the provision of the relevant services. This processing takes place, as a rule, in real time or for a limited period of time and is not used for independent or secondary purposes by the Company.

Artificial intelligence systems rely on algorithmic models and may produce results that are not entirely accurate, complete, or up to date. The user acknowledges that the results arising, including those provided through the chatbot, have an exclusively supportive and advisory character and do not constitute professional, financial, legal, or nutritional advice. The final evaluation of the results and the making of any decision is based exclusively on their own judgment and responsibility.

The Service does not proceed to automated decision-making that produces legal effects or significantly affects the user, within the meaning of Article 22 GDPR.

For the provision of artificial intelligence functions, the Company may cooperate with third-party technology providers, which provide infrastructure or artificial intelligence models. These providers may act either as processors or as independent controllers, in accordance with their own legal and regulatory frameworks.

The user must take note of the respective privacy policies of these providers, as the processing may also be governed by their own terms.

The Company does not use the data entered by users for the training of its own artificial intelligence models or for the improvement of artificial intelligence models, nor for purposes beyond the provision of the Service, unless this is expressly stated and prior consent of the user is requested.

The use of artificial intelligence functions is carried out in accordance with the principles of transparency, minimization, and security of the GDPR, as well as with the relevant requirements of the applicable European framework for artificial intelligence. The Company does not guarantee the accuracy, completeness, or suitability of the results produced by the artificial intelligence systems and recommends the human supervision and diligence of verification by the user.

8. Recipients of data and transfers to third parties

The Company transfers personal data to third-party recipients only when this is necessary for the provision of the Service, the performance of the contract with the user, or compliance with legal obligations, in accordance with Articles 6 and 28 of the GDPR.

The recipients of the data include in particular the following categories:

• (a) The Company cooperates with providers of technology infrastructures (such as hosting services, data storage, security, and technical support services), which act as processors within the meaning of Article 4(8) GDPR. Data Processing Agreements (DPAs) have been concluded with these providers, in accordance with Article 28 GDPR, which ensure that data is processed exclusively on the Company's instructions and with appropriate security measures.
• (b) For the provision of artificial intelligence functions, data entered by the user is transferred to providers of relevant technologies such as indicatively Google or other corresponding suppliers. These providers act either as processors or as independent controllers, depending on the way the service is provided and their own processing terms.
• (c) For the processing of payments, the Company uses the provider Stripe, which acts as an independent controller for payment data. The transfer is limited to the data strictly necessary for the execution of the transaction and the management of the subscription.
• (d) The Company may also transfer data to professional advisors, such as legal advisors, accountants, to the extent that this is necessary for compliance with legal obligations or for the establishment, exercise, or defense of legal claims.
• (e) Data is disclosed to public authorities, supervisory bodies, or judicial authorities, when this is required by applicable law or following a lawful request.
• (f) For the support of communication with users, the Company uses tools and providers of communication services, to which the strictly necessary communication data is transferred.

In any case, the Company applies the principle of data minimization and ensures that recipients are bound by confidentiality obligations, and certain specialties are covered by professional secrecy and apply appropriate technical and organizational protection measures, in accordance with the GDPR.

9. Data transfer and third-party providers

As a rule, the Company does not transfer personal data outside the European Economic Area (EEA). In case transfer becomes necessary (indicatively due to the use of international technology providers), this is carried out in accordance with Articles 44 et seq. of the GDPR and subject to the existence of appropriate safeguards.

For the provision of the Service, the Company cooperates with third-party providers of technology services, including providers of infrastructure, artificial intelligence services, and payment services. These providers process data either as processors or as independent controllers, in accordance with their own privacy policies (see Section 7). In case the above recipients are located outside the European Economic Area (EEA), the transfer is carried out only if an adequate level of protection is ensured, in accordance with Articles 44 et seq. GDPR. In these cases, the Company applies appropriate safeguards or relies on adequacy decisions of the European Commission, where such exist.

10. Payments and transaction security

Payments for the use of the Company's services are processed through an external payment service provider, specifically through Stripe Payments Europe Ltd. and/or affiliated companies of the Stripe group (hereinafter "Stripe"), which acts as an independent controller for payment data.

The Company does not collect, store, or process full details of payment means, such as credit or debit card numbers. This data is entered directly by the user into Stripe's secure environment and is processed in accordance with its own security standards and applicable regulatory requirements (indicatively PCI-DSS).

The Company receives only limited data that is strictly necessary for the management of the subscription, billing, and accounting tracking, such as indicatively and not restrictively: payment status (successful/failed), transaction identifiers, basic billing and subscription details. This data is processed exclusively for purposes of performance of the contract (Article 6(1)(b) GDPR) and compliance with the Company's legal obligations (Article 6(1)(c) GDPR), in particular tax and accounting obligations.

The processing of payment data by Stripe is governed by its own privacy policy and terms of service, which the user must consult: https://stripe.com/privacy.

The Company is not liable for the manner of operation, availability, or security of Stripe's systems, to the extent that they are beyond its control, nor for any errors, delays, or transaction failures attributable to the payment provider.

In case of refund requests, cancellations, or payment disputes, management is carried out in accordance with these terms and, as appropriate, Stripe's terms. The user acknowledges that additional terms and procedures of the payment provider may apply.

11. Data security

The Company applies appropriate technical and organizational measures for the protection of personal data, in accordance with the requirements of Article 32 of the GDPR, taking into account the nature, scope, context, and purposes of processing, as well as the risks to the rights and freedoms of natural persons.

Within this framework, policies and procedures have been adopted aimed at preventing unauthorized access, disclosure, alteration, or loss of data. Data is stored in secure information environments, with the use of controlled access mechanisms and restriction of access exclusively to persons who are authorized and required to have access within the framework of their duties. These persons are bound by confidentiality obligations and are subject to appropriate control and supervision procedures.

The Company applies, as appropriate, measures such as data encryption in transit (indicatively through SSL/TLS protocols), authentication and identity verification mechanisms, logging and monitoring of actions, as well as role-based access control. In addition, reliable hosting infrastructures and cloud services that meet high security standards are used.

Cooperating third-party providers and processors are contractually bound to maintain a corresponding level of data protection and to apply appropriate technical and organizational measures, in accordance with the requirements of the GDPR. Processing by third parties is carried out exclusively on the basis of documented instructions of the Company or within the framework of their own independent obligations, where this is required.

The Company also applies security incident management procedures, which include mechanisms for the detection, assessment, and response to potential personal data breaches, as well as notification procedures to the competent authorities and data subjects, where required by legislation (Articles 33 and 34 GDPR).

Despite the above measures, it is noted that no system of data transmission or storage can be considered absolutely secure. Consequently, the Company cannot guarantee the complete security of data in every case, particularly where processing is affected by factors beyond its reasonable control, such as actions of third parties or malicious attacks.

The user must also actively contribute to the protection of their data, by maintaining the confidentiality of the access credentials and taking appropriate security measures during the use of the Service.

12. Rights of data subjects

The Company ensures that every natural person whose personal data is processed fully enjoys the rights recognized to them by the General Data Protection Regulation (EU) 2016/679.

In particular, users have the right to request confirmation as to whether the Company processes personal data concerning them and, if so, to obtain access to this data, as well as to information regarding the purposes of processing, the categories of data, the recipients, the retention period, and their relevant rights, in accordance with Article 15 GDPR.

Users also have the right to request the rectification of inaccurate or the completion of incomplete personal data concerning them (Article 16 GDPR), so that the data retained is accurate and up to date.

Under the conditions of Article 17 GDPR, users may request the deletion of their data ("right to erasure"), in particular where the data is no longer necessary for the purposes of processing, where they withdraw their consent, or where they consider that the processing is carried out in violation of legislation. This right is exercised subject to any legal obligations of the Company or the need to retain the data for the establishment, exercise, or defense of legal claims.

Users have the right to request the restriction of processing (Article 18 GDPR), in particular where the accuracy of the data is disputed or where the processing is unlawful but they do not wish its deletion.

In addition, they have the right to object to the processing of their data when it is based on the legitimate interest of the Company (Article 21 GDPR). In this case, the Company ceases processing, unless it demonstrates compelling and lawful grounds that override the user's rights and freedoms.

When processing is based on consent or is carried out by automated means within the framework of a contract, users have the right to data portability (Article 20 GDPR), i.e., to receive their data in a structured, commonly used, and machine-readable format or to request its transfer to another controller, where this is technically feasible.

Where processing is based on consent, the user has the right to withdraw it at any time, without affecting the legality of the processing carried out before the withdrawal.

To exercise the above rights, the user may submit a relevant request via the Company's email address support@culizen.gr. The Company may request the necessary information to verify the identity of the applicant, in order to ensure the protection of the data from unauthorized access.

The Company responds to requests without undue delay and, in any case, within one (1) month of their receipt, in accordance with Article 12 GDPR. In case of complexity or a large number of requests, the deadline may be extended by up to two (2) additional months, with relevant information to the user.

Finally, users retain the right to lodge a complaint with the competent supervisory authority for the protection of personal data, in particular in the Member State of their habitual residence, place of work, or the place of the alleged infringement of the GDPR. In Greece, the competent authority is the Hellenic Data Protection Authority (www.dpa.gr), to which users may address themselves if they consider that the processing of their data violates applicable legislation.

13. Policy update

This Policy may be modified at any time. Users must review it periodically.

14. Contact

For any matter relating to this Policy, you may contact the Company at: support@culizen.gr or through our contact form.

info@culizen.gr