Privacy Policy

The data controller responsible for your personal data is:

We collect the following categories of personal data:

• Account data: name, email address, password (hashed), company name, and billing address provided during registration.
• Payment data: billing details processed by our payment provider. We do not store full card numbers on our servers.
• Usage data: IP address, browser type, device information, pages visited, actions performed within the platform, and timestamps.
• QR code scan analytics: aggregate and anonymised scan counts, device types, and geographic region (country/city level). We do not track individual end-users who scan your QR codes beyond what is needed for aggregate statistics.
• Communications: content of support requests and emails you send to us.
• Cookies and similar technologies: see Section 6.

We process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR): to create and manage your account, provide the Service, and process payments.
• Legitimate interests (Art. 6(1)(f) GDPR): to improve the platform, prevent fraud, ensure security, and send service-related communications.
• Consent (Art. 6(1)(a) GDPR): to send marketing emails or newsletters when you have opted in. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c) GDPR): to comply with applicable tax, accounting, and regulatory requirements.

We retain your personal data for as long as your account is active or as required to provide the Service. Specifically:

• Account data is kept until you delete your account, plus a 30-day grace period.
• Billing records are retained for 10 years to satisfy Greek tax legislation.
• Support correspondence is retained for up to 3 years.
• Anonymised analytics data may be retained indefinitely.

Following the relevant retention period, data is securely deleted or irreversibly anonymised.

We do not sell your personal data. We share it only with trusted third-party processors under contractual data-processing agreements (DPAs), including:

• Cloud infrastructure providers for hosting and data storage.
• Payment processors (e.g., Stripe) for subscription billing.
• Email service providers for transactional and marketing emails.
• Analytics tools used to improve platform performance.

We may also disclose data if required by law, court order, or to protect the rights, property, or safety of Codeehut, our users, or others.

We use cookies and similar tracking technologies to operate and improve the Service. Cookies we use fall into the following categories:

• Strictly necessary: required for authentication and session management. Cannot be disabled.
• Functional: remember your preferences and settings.
• Analytics: help us understand how users interact with the platform (e.g., page views, feature usage).
• Marketing: used only with your explicit consent to deliver relevant communications.

You can manage or withdraw cookie consent at any time via your browser settings or our cookie preference centre.

Under the GDPR you have the following rights regarding your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: request correction of inaccurate or incomplete data.
• Erasure ("right to be forgotten"): request deletion of your data, subject to legal retention obligations.
• Restriction: request that we limit how we process your data in certain circumstances.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interests or for direct marketing purposes.
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted data transmission (TLS), hashed passwords, access controls, and regular security assessments.

Despite these measures, no method of transmission over the internet or electronic storage is 100% secure. In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by the GDPR.

Your data is primarily stored and processed within the European Economic Area (EEA). Where we transfer data outside the EEA (for example, to third-party services based in the United States), we ensure adequate safeguards are in place through Standard Contractual Clauses (SCCs) approved by the European Commission or other recognised transfer mechanisms.

Suite CodeeHut is intended for users who are at least 18 years old. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a person under 18, please contact us and we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. For material changes, we will notify you by email or via an in-app notification at least 14 days before the changes take effect. Your continued use of the Service after that date constitutes acceptance of the updated Policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or the way we handle your personal data, please contact us: