Legal

Privacy policy

Last updated: 18 October 2026 Version: 1.1 Ελληνικά

We respect your privacy. Below we explain in plain terms which personal data we collect, why, for how long, and which rights you have under the General Data Protection Regulation (EU) 2016/679 (GDPR) and Greek Law 4624/2019.

This Privacy Policy describes how CACTUS DIGITAL S.A. (CACTUS DIGITAL Α.Ε.) collects, uses and protects the personal data that concerns you, whether as a visitor to the website cactuscrm.gr, as a user of the CactusCRM platform or as a customer of our company. For the connection of social media accounts (Facebook, Instagram, etc.) the Privacy Policy for connected social media accounts also applies. If this English version and the Greek version differ, the Greek version prevails.

1. Data controller

The controller of your data is the company:

  • Company: CACTUS DIGITAL S.A. (CACTUS DIGITAL Α.Ε.)
  • Registered office: 1 Morichovou Square, 546 25 Thessaloniki, Greece
  • VAT number: EL801949381 · Tax office: FAE Thessaloniki
  • General Commercial Registry (G.E.MI.): 166867206000
  • Phone: +30 2311 822997, +30 2312 314861
  • Email: info@cactusweb.gr
  • Data protection: dpo@cactusweb.gr

For any data protection matter you can contact us at dpo@cactusweb.gr.

2. Data we collect

2.1 Data you provide to us

  • Contact details: full name, email, phone number, company, job title.
  • Account details: username, encrypted password, role, profile picture.
  • Billing details: company name, VAT number, tax office, registered address.
  • Content of communications: messages you send through the forms, to the support email or through the platform.

2.2 Data collected automatically

  • Technical data: IP address, device type, browser, operating system, language.
  • Usage data: pages you visit, time spent, actions within the application (logs).
  • Cookies & similar technologies: see section 9.

2.3 Data our customers enter into the platform

When you use CactusCRM as an employee or user of one of our customers, your company is the controller of the data it enters into the platform (customers, leads, invoices and other documents, files, etc.). CACTUS DIGITAL S.A. acts as processor. A separate Data Processing Agreement (DPA) applies to this relationship - see the GDPR page.

3. Purposes & legal bases

Purpose Legal basis
Provision of the CactusCRM service, creation/management of accounts, customer support. Performance of a contract (Article 6(1)(b) GDPR).
Invoicing, accounting & tax obligations. Compliance with a legal obligation (Article 6(1)(c)).
Communication via form or email - responding to your requests. Legitimate interest / pre-contractual measures (Article 6(1)(b) & (f)).
System security, fraud prevention, audit logs. Legitimate interest (Article 6(1)(f)).
Marketing - newsletters, product updates. Consent (Article 6(1)(a)). It can be withdrawn at any time.
Statistics & improvement of the platform (anonymised). Legitimate interest (Article 6(1)(f)).

4. Retention periods

We keep your data only for as long as is strictly necessary for the purposes for which we collected it:

  • CactusCRM account data: for the duration of the contract and up to 90 days after its termination.
  • Accounting and tax documents: 10 years (tax legislation).
  • Communications - support tickets: up to 5 years after resolution.
  • Audit logs & security logs: up to 18 months.
  • Marketing data based on consent: until consent is withdrawn.
  • Cookies: see section 9.

5. Recipients & subcontractors

We do not sell personal data. We share data only with carefully selected providers that are necessary for the provision of the service, under binding processing agreements:

  • Hosting & infrastructure: DigitalOcean (EU data centers).
  • Email - notifications: Postmark / SendGrid / Mailgun (as applicable).
  • Payments: VivaWallet, Stripe.
  • AI / language processing: Anthropic, OpenAI, Voyage AI - only for the AI features you have enabled.
  • Accountant - legal advisor: to meet our obligations.
  • Public authorities: where required by law.

An up-to-date list of subprocessors is available on request.

6. International transfers

Data is primarily stored within the European Union. Where providers outside the EEA are used (e.g. AI services), transfers take place under the Standard Contractual Clauses (SCCs) of the European Commission (Decision 2021/914) and with supplementary technical measures.

7. Data security

We apply technical and organisational measures appropriate to the risk, such as:

  • Encryption of communications with TLS 1.2+.
  • Encrypted backups, kept separate from production.
  • Role-based access control (RBAC) and the principle of least privilege.
  • Audit logs for critical actions.
  • Regular vulnerability testing & security updates.
  • Confidentiality commitments from our staff.
Data breach In the event of an incident that may affect your data, we notify the Hellenic Data Protection Authority (HDPA) within 72 hours and the affected individuals without undue delay, in accordance with Articles 33-34 GDPR.

8. Your rights

Under Articles 15-22 GDPR, you have the following rights:

  • Access to the data we hold about you.
  • Rectification of inaccurate or incomplete data.
  • Erasure ("right to be forgotten") where permitted.
  • Restriction of processing.
  • Portability of your data in a structured, machine-readable format.
  • Objection to processing based on legitimate interest.
  • Withdrawal of consent at any time, without affecting the lawfulness of prior processing.
  • Complaint to the Hellenic Data Protection Authority (HDPA) (1-3 Kifisias Avenue, 115 23 Athens, Greece).

To exercise your rights, email dpo@cactusweb.gr. We respond within 30 days.

9. Cookies

On our public website we use the following cookies:

Cookie Provider Category Purpose Duration
cactus_consent CactusCRM (first party) Functional (essential) Stores the cookie consent choice you have made. 180 days
cactus_attr CactusCRM (first party) Marketing Stores ad click identifiers (e.g. gclid, fbclid) and UTM parameters, so that we know which campaign a contact request came from. It is written only after you give marketing consent and is deleted if you withdraw it. 90 days
_ga, _ga_* Google (Google Tag Manager / Google Analytics 4) Statistics Anonymised measurement of website traffic. They are loaded through Google Consent Mode v2, with all storage categories set to "denied" by default until you give your consent. Up to 2 years (set by Google)

You can give, change or withdraw your consent at any time using the "Cookie settings" button in the website footer.

10. Minors

The service is intended for businesses and professionals. We do not knowingly collect data of minors under the age of 16. If you become aware of such a case, please contact us immediately so that the data can be deleted.

11. Changes to this policy

We reserve the right to update this Policy. In the event of significant changes we will inform you by email or by a prominent notice within the platform at least 30 days before they take effect.

12. Contact

For any matter concerning this Policy or the processing of your data:

Legal Social media privacy policy Legal Data deletion instructions Legal Terms of service Legal GDPR & compliance