Privacy policy

This policy describes what happens to personal data when you use lightspeed-solutions.gr. It is written to be read, not to be survived. If anything here is unclear, ask us and we will answer plainly.

Who is responsible

Lightspeed Solutions is the controller of the personal data described below.

• Address: Athens, Greece
• Email: [email protected]

We have not appointed a Data Protection Officer, and are not required to: we do not process personal data on a large scale, and we process no special categories of data. Any question, request or complaint under this policy goes to the email address above.

What this site does not do

It is easier to start with what is absent, because most of it is absent by design:

• No third-party fonts. Typefaces are served from our own domain. Visiting a page does not tell Google or any font host that you were here.
• No tracking before consent. Nothing that identifies you is loaded, requested or stored until you say so, and refusing is one click.
• No cookie wall. Refusing costs you nothing. Every page works identically either way.
• No advertising profile built from this site alone. We do not buy, enrich, or sell visitor data, and we run no data broker integrations.
• No automated decisions. Nothing here profiles you or decides anything about you automatically.

Visiting a page

Pages are served by Cloudflare, which operates the network this site runs on. To deliver a page and to defend against attack, Cloudflare processes your IP address, the requested address, your browser’s user agent, and the time of the request.

• Purpose: delivering the site, and keeping it available and secure.
• Legal basis: Article 6(1)(f) GDPR — our legitimate interest in a site that works and is not trivially knocked over. We cannot serve a page without handling the IP address it must be sent to.
• Recipient: Cloudflare, Inc., acting as our processor.
• Retention: short-lived operational and security logs held by Cloudflare under their own retention schedule. We do not build our own log archive from them, and we do not use them to identify individual visitors.

The contact form

If you send the form on the contact page, we receive what you typed, plus a small amount of context that helps us answer.

What	Where it comes from
Name	You
Email address	You
Company	You, optional
Your message	You
The page you wrote from	The form
Your language	The form
The country your request came from	Cloudflare’s network

• Purpose: reading your message and replying to it. Nothing else. It does not go on a mailing list, because we do not have one.
• Legal basis: Article 6(1)(a) GDPR — your consent, which is the tick box on the form. Where the exchange turns into work we do for you, Article 6(1)(b) also applies, because the data is then needed for the contract.
• Recipients: Resend, which delivers the message as email, and the provider hosting our mailbox. Both act as our processors.
• Retention: up to 24 months from our last exchange, so we can pick up a conversation you resume. If it becomes a client relationship, the file is kept for as long as that relationship and any legal or tax obligation requires. You can ask us to delete it sooner and we will.

Submitting the form is the only way this site sends us anything about you. It never sends silently.

Booking a call

The booking page shows a still image until you click it. Only then is Cal.com loaded, and only then does anything reach them. If you never click, Cal.com never learns you visited.

Once you do book, Cal.com processes the name, email address and time you give it, in order to place the meeting in both calendars.

• Purpose: arranging a meeting you asked for.
• Legal basis: Article 6(1)(b) GDPR — steps taken at your request before a contract.
• Recipient: Cal.com, acting as our processor. Their own privacy notice governs what happens inside their booking page.

The client area

The client area at lightspeed-solutions.gr/client is for people we already work with. There is no public sign-up: we create the account, and you sign in with a link we email you instead of a password.

What	Where it comes from
Your email address	Us, when we set the account up
Your name	Optional, and only if you or we add it
Your projects, their phase and delivery date	Our work with you
What has been invoiced and what has been paid	Our accounts
Links to previews and to your receipts	Our work with you

• Purpose: showing you the state of the work you commissioned, and letting you sign in to see it.
• Legal basis: Article 6(1)(b) GDPR — performance of our contract with you.
• Recipients: Supabase, which hosts the database and issues the sign-in links, and Resend, which delivers them as email. Both act as our processors. The database itself is hosted inside the EU, in Ireland.
• Kept on your device: a sign-in token, in your browser’s local storage, so that you are not asked to sign in again on every visit. Signing out deletes it. It is strictly necessary for a service you asked for, which is why it needs no consent, and it is not a tracker: it is sent to our own database and nowhere else.
• Retention: for as long as we work together, plus whatever a legal or tax obligation requires of the underlying records. Ask us to close the account and we will.

Which rows you can read is enforced by the database, not by the page. The query your browser sends does not say who you are or ask for a particular client; Postgres resolves that from your sign-in token and returns your own projects or nothing at all.

Where data goes outside Europe

Cloudflare, Resend, Cal.com and Supabase are established in, or transfer data to, the United States. Supabase keeps our database in Ireland, but the company behind it is American, so the same safeguards are named here. Those transfers rely on the European Commission’s Standard Contractual Clauses, and where the provider is certified, on the EU–US Data Privacy Framework. If you consent to analytics or advertising, the same applies to Google and Meta.

You can avoid every one of these transfers except the first: refuse cookies and use email instead of the form, and only the request that delivered this page leaves the country.

Your rights

Under the GDPR you can ask us to:

• Access the personal data we hold about you, and get a copy of it.
• Correct anything inaccurate or incomplete.
• Erase it — the “right to be forgotten” — where we no longer need it.
• Restrict processing while a dispute about it is resolved.
• Port it: receive it in a machine-readable form, or have us send it on.
• Object to processing we base on legitimate interest.
• Withdraw consent at any time, which does not undo processing that was lawful before you withdrew it.

Email [email protected] and say which one you want. We answer within one month. If a request is genuinely complicated we may take up to two months more, and we will tell you inside the first month if that happens. Exercising these rights is free.

For cookies specifically, you do not need to write to us at all: the Cookie preferences link in the footer of every page reopens the dialog, and changing your mind there takes effect immediately.

Complaining

If you think we have handled your data unlawfully, please tell us first — it is usually a misunderstanding we can fix quickly. You are entitled to go straight to the supervisory authority regardless:

Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα) Λεωφ. Κηφισίας 1-3, 11523 Athens, Greece Telephone: +30 210 6475 600 Email: [email protected] Web: www.dpa.gr

Security

The site is served over HTTPS only, with HSTS. The contact form posts to our own domain rather than a third-party webhook, so the message does not pass through anyone we have not named here, and no API key sits in the page source. A Content-Security-Policy restricts what a page is permitted to load at all.

No system is perfect. If you find a security problem with this site, email us and we will treat it seriously.

Changes

If we change what we collect or why, we update this page and change the date at the top. Material changes that need your consent will ask for it again rather than assume it.

The legal framework

This policy is given under Regulation (EU) 2016/679 (GDPR), Greek Law 4624/2019, and — for cookies and similar technologies — Article 4(5) of Greek Law 3471/2006.

Cookies and similar technologies

No analytics or advertising tag is configured on this site, so the only entries are the two that make it work. Nothing profiles you, and no consent banner appears, because there is nothing to consent to.

Strictly necessary — set without consent