Privacy Policy

01

Who controls your data

EchoByte is the data controller for the personal data described in this policy. Write to [email protected] or call (+30) 693-688-9577 for anything to do with your data, including rights requests.

We have not appointed a Data Protection Officer: our processing does not meet the Article 37 GDPR thresholds that require one. Requests go to the address above and are handled by the team that runs the systems.

02

What this policy covers

This policy covers personal data we handle in our own right: visitors to this website, people who contact us, prospects, partners, applicants and the staff of our customers who deal with us.

It does not cover the data inside our Platforms. Berths, shipments, orders and the people behind them belong to the customer operating that Platform: they are the controller, we are the processor acting on their instructions under an Article 28 GDPR agreement. If a marina or courier holds data about you, ask them, and we will support them in answering you.

03

What we collect

You contact us

Name, company, email address, phone number and whatever you choose to put in the message, plus our replies.

You become a customer

Business contact details of your named contacts, billing details, contract and invoicing records, support tickets and the correspondence around them.

You visit this site

Server logs written by our hosting: IP address, date and time, requested URL, HTTP status, referrer and user agent. No analytics or advertising trackers run on this site.

You apply for a job

Your CV and the information you send with it, kept separately from customer records.

We do not knowingly collect special categories of data under Article 9 GDPR, and we ask you not to send them to us. This site is aimed at businesses and is not directed at children.

04

Why we use it, and on what legal basis

We do not sell personal data, we do not share it with advertising networks, and we do not make automated decisions producing legal or similarly significant effects about you.

05

How long we keep it

06

Who else sees it

We keep the list of processors short and we vet them. Each one is bound by a written contract under Article 28 GDPR and processes data only on our instructions.

• Our hosting and infrastructure provider, operating data centres inside the EU.
• Our email and productivity provider, for correspondence.
• Our accountant and, where legally required, the Greek tax authority (AADE) via myDATA.
• Professional advisers, and public authorities where the law obliges us to disclose.

We publish the current sub-processor list to customers on request, and we give notice before adding a new one that processes customer data.

07

International transfers

Our default is that personal data stays inside the European Economic Area. Where a provider processes data outside the EEA, we rely on an adequacy decision of the European Commission, or on Standard Contractual Clauses together with a transfer impact assessment and technical measures such as encryption. Ask us and we will tell you which applies to a given provider.

08

How we protect it

• TLS in transit and encryption at rest for databases and backups.
• Role-based access, least privilege, and multi-factor authentication on administrative accounts.
• Patching and dependency updates as part of the hosting service, with monitoring and alerting.
• Separate environments for development, staging and production; production data is not used for testing.

If a breach is likely to result in a risk to your rights, we notify the Hellenic Data Protection Authority within 72 hours and inform affected people without undue delay where the risk is high.

09

Your rights

Under Articles 15 to 22 GDPR you can ask us for access to your data, correction, erasure, restriction of processing, or a copy in a portable format. You can object to processing based on legitimate interests, and you can withdraw consent at any time without affecting processing already carried out.

Write to [email protected]. We answer within one month, and tell you if we need to extend that by up to two further months because the request is complex. There is no charge unless a request is manifestly unfounded or excessive.

You also have the right to complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifissias 1-3, 115 23 Athens, +30 210 6475600, [email protected], www.dpa.gr. We would rather you came to us first, but the choice is yours.

10

Changes to this policy

We update this policy when our processing changes. The current version is dated 29 July 2026. Material changes are announced by email to customers before they take effect.