Personal data

Data controller

This is an English translation provided for convenience; in case of any discrepancy, the Greek version prevails. The controller responsible for processing the data is the business that provides Topognosia; its details are at the end of this page, under "Provider details". For any matter concerning your personal data you can contact us via the "Contact" page, with the topic "Account and alerts".

No Data Protection Officer has been appointed, as our activity does not fall under the cases of Article 37 GDPR: it does not involve systematic monitoring of individuals or processing of special categories of data.

Categories of data

Topognosia publishes statistics about businesses. Data about companies (legal entities) is, as a rule, not personal data. It is personal data when it reveals a natural person: for sole proprietorships, other forms without legal personality, and general and limited partnerships, whose legal name by law contains a partner's name.

We do not collect businesses' contact details (telephone, email, fax, PO box) or their tax ID (AFM). Only companies (S.A., Ltd, P.C., cooperatives and equivalent forms) are shown by name. Sole proprietorships and general and limited partnerships appear exclusively in aggregate figures, without name, address or map location, and never in a list.

Small numbers are protected, so that an individual unnamed business cannot be identified, either from a single publication or by comparing successive publications. Where a municipality's data does not meet our quality criteria, limited information or none is published.

Origin of the data

The main source is the Open Data Service of GEMI (the General Commercial Registry). This data has not been collected from you.

Sources that contain no personal data are also used: the ELSTAT census, OpenStreetMap, municipal boundaries, official property value zones and the street data of the Hellenic Cadastre. All sources and their licences are listed on the "Sources" page.

Purpose and legal basis

The purpose of the processing is to provide a reliable picture of local business activity, from data the state already publishes. The processing is based on our legitimate interest (Article 6(1)(f) GDPR).

We have weighed this interest against the rights of natural persons and consider the processing proportionate: we do not keep contact details or tax IDs, we do not publish the names of sole proprietorships or general and limited partnerships, and we protect small numbers. The balancing test is documented and reviewed whenever the content we publish changes.

User account

If you create an account, we process your email address, the areas and comparisons you save, the area alerts you set (spot and radius or a whole municipality, and sector, so we can send you the monthly message) and your active sessions (device type and sign-in time), solely to provide the account (Article 6(1)(b) GDPR).

If you set a password, it is kept only in irreversible cryptographic form. If you choose to sign in with Google, we receive from Google only your email address and an identifier for your account.

To protect accounts from abuse, failed sign-in attempts are kept for a short period.

When you create an account, we record where you came to the website from on the same day: the campaign name of the link (utm) or only the domain of the website that referred you, never the full address. This is done without cookies, so we know which channels bring users (legitimate interest, Article 6(1)(f) GDPR), and it is included in your data export.

If you request a change of email address, the new address is kept together with the confirmation link for a short period, like other sign-in links, and the previous address receives a notice of the change.

Newsletter

If you subscribe to the monthly newsletter "What opened and what closed", we process your email address, the dates of subscription and confirmation and which issues were sent to you, only to send you the newsletter. The basis is your consent (Article 6(1)(a) GDPR), which you give by confirming the subscription with the link we send you or, if you have an account, with the subscribe button on your account page, where your address is already confirmed. You can withdraw it at any time, with one click from any issue or from your account page.

A subscription that is not confirmed is deleted within 7 days. After you withdraw, we erase your address from the list within 30 days, and the record of the issues you received within 60 days of their sending. If you delete the account with the same email address, your newsletter subscription is also deleted immediately.

Recipients and hosting

To run the website we use Cloudflare (hosting, a database within the European Union, email sending and the info@topognosia.gr mailbox) and, as a backup for email sending, Resend. If you choose to sign in with Google, Google receives the sign-in request as an independent controller.

These companies are based in the USA. Where data is transferred there, the transfer takes place under the European Commission's standard contractual clauses or the EU-U.S. Data Privacy Framework.

We do not use advertising networks or third-party tracking tools, and we do not set tracking cookies; for this reason no cookie notice is shown. Only strictly necessary cookies are used, for signing in to the account and for form security.

Visitor statistics are collected without cookies and without storing the IP address.

The registry's addresses are placed on the map without being sent to third-party services.

Retention period

Registry data is kept for as long as needed to record how business activity develops over time.

Files from public sources are kept for as long as necessary so that the published figures can be verified against their source. They are not published or transferred to third parties.

Messages you send us through the forms, together with the reply address, are kept for up to 12 months and then deleted.

Your account data is kept until it is deleted, which you can do at any time from your account page.

Deleting the account does not delete your purchases (amount, date, receipt details) or withdrawal declarations: we keep them for as long as tax legislation requires, as a rule five years from the end of the year of purchase, and we do not use them for any other purpose (Article 6(1)(c) GDPR). They are included in your data export.

For the request limit on forms and sign-in links we keep, for up to 24 hours, a cryptographic fingerprint of the IP address, from which the address itself cannot be derived.

Your rights

You have the right of access, rectification, erasure, restriction of processing and portability of your data, to the extent each applies to our processing. You can exercise your rights via the "Contact" page: with the topic "Correct a detail" for a published figure, "Remove my business" to object, or "Account and alerts" for the account, alerts and the newsletter.

We reply to every request within one month at the latest.

Right to object

Since the processing is based on legitimate interest, you have the right to object to it at any time (Article 21 GDPR). The objection is submitted via the "Contact" page, with the topic "Remove my business".

If your business is a sole proprietorship or a general or limited partnership and you maintain your objection, we exclude your business from every published figure, including the aggregate figures. Data naming it is removed immediately and the figures with the next monthly or extraordinary publication. We keep only the GEMI number, so that it does not return with the next data update.

Right to lodge a complaint

If you consider that the processing infringes the GDPR, you have the right to lodge a complaint with the Hellenic Data Protection Authority.

Automated decision-making

No automated decisions, including profiling, are made concerning natural persons.

How you are informed

The data comes from a public registry with hundreds of thousands of entries, and we do not keep contact details of the natural persons concerned — deliberately, so that we do not process them.

As informing each person individually would require disproportionate effort, information is provided through this page, in accordance with Article 14(5)(b) GDPR.