Effective from 17 October 2026.
1. Who we are
CACTUS DIGITAL S.A. ("Cactus", "we") is a digital agency. We provide social media and marketing services to our business clients through our platform and client portal (the "Platform").
- Company: CACTUS DIGITAL S.A. (CACTUS DIGITAL Α.Ε.)
- Registered office: 1 Morichovou Square, 546 25 Thessaloniki, Greece
- VAT number: EL801949381 · Tax office: FAE Thessaloniki
- General Commercial Registry (G.E.MI.): 166867206000
- Phone: +30 2311 822997, +30 2312 314861
- Email: info@cactusweb.gr
- Data protection: dpo@cactusweb.gr
This policy explains what data we process when a client connects Facebook, Instagram, TikTok, YouTube or LinkedIn accounts to the Platform, and when they use the client portal.
2. Data we collect
- Portal account data: name, email, phone and company of the client's staff who use the portal.
- Connected account data: ID, name and profile picture of the connected Page, account or channel.
- Access tokens issued by each platform with your consent. We never receive your password.
- Content: captions, images and videos we prepare or you upload, comments and approvals in the portal, and the IDs and links of posts we publish.
- Insights: aggregated performance metrics of posts and Pages (e.g. impressions, reach, engagement, views).
- Technical data: access and error logs (IP address, date, action) for security.
We do not collect private messages, friend or follower lists, or personal data of your followers.
3. How we use it
- To publish and schedule posts that you approved in the portal, on the accounts you connected.
- To show you post performance and improve the planning of future months.
- To suggest captions with AI: the brief and post details are sent to an AI provider (section 6). A person reviews every suggestion and you approve it.
- To notify you by email about approvals, required material and connection problems.
- For security and troubleshooting of the Platform.
We do not sell data and do not use it for advertising to third parties. We never publish anything you have not approved.
4. Legal basis
- Performance of a contract (GDPR Art. 6(1)(b)): the social media service you engaged us for.
- Legitimate interest (GDPR Art. 6(1)(f)): security and logs.
- For data of the Pages we manage on your behalf, we act as your processor under our contract.
5. Platform connections
- Facebook and Instagram (Meta): we request only the permissions needed to list your Pages, publish content and read insights. Use is subject to Meta's Terms and Privacy Policy.
- TikTok: basic profile info (display name, avatar) and video upload. Before each post you see and choose the visibility settings yourself. TikTok's Terms and Privacy Policy apply.
- YouTube (Google): uploading videos to your channel via YouTube API Services. By connecting, you agree to the YouTube Terms of Service. The Google Privacy Policy applies. You can revoke access at any time at Google security settings.
- LinkedIn: listing the Pages you administer, publishing content and reading insights. LinkedIn's Terms and Privacy Policy apply.
- Google API disclosure: Cactus's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Who else sees the data
Only the Cactus team working on your account, and the providers that serve us as processors:
| Provider | Purpose |
|---|---|
| DigitalOcean | Platform hosting (EU data centers) |
| Google Workspace (Drive) | Storage of images and videos |
| Anthropic | AI caption suggestions (API data is not used to train models) |
| Brevo | Email delivery |
| Sentry | Error tracking |
Some providers may process data outside the EEA. In that case Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework apply.
7. Security
Tokens and data are transferred only over HTTPS. Tokens are stored encrypted. Access to the Platform is role-based, so each team member sees only the clients they work on.
8. Retention
| Data | Retention |
|---|---|
| Access tokens | Until you disconnect the account, or up to 30 days after the contract ends |
| Content and insights | Contract duration + 12 months, unless you request earlier deletion |
| Technical logs | Up to 90 days |
| Invoices and contracts | As required by tax law |
Posts already published stay on the platforms, where you manage them.
9. Your rights
You have the right of access, rectification, erasure, restriction, objection and portability. You can revoke access at any time (see the Data Deletion Instructions). For any request, email dpo@cactusweb.gr. We respond within 30 days.
You may also lodge a complaint with the Hellenic Data Protection Authority.
10. Changes
If we materially change this policy, we will notify clients by email and update the date at the top of this page.