Privacy policy

1. Who we are

nexus-hub is an e-services platform operated by AGILE ΜΟΝΟΠΡΟΣΩΠΗ ΑΝΩΝΥΜΗ ΕΤΑΙΡΕΙΑ ΠΛΗΡΟΦΟΡΙΚΗΣ ΚΑΙ ΤΕΧΝΟΛΟΓΙΑΣ Α.Ε. (“AGILE”, “we”), registered at 19 Ierou Lochou Street, Metamorfosi, Attica 144 52, Greece.

This policy explains what personal data we process, for which purposes, on which legal basis, for how long, and what rights you have under the General Data Protection Regulation (EU) 2016/679 (GDPR) and Greek Law 4624/2019.

• Controller: AGILE Single-Member S.A. of Informatics and Technology
• Address: 19 Ierou Lochou Street, Metamorfosi, Attica 144 52, Greece
• Contact: [email protected]

2. Where this policy applies

This policy covers nexus-hub.gr, the myNexus account platform (accounts.nexus-hub.gr) and the nexus-hub edocs, delivery, move and stream applications, together with our communication with customers, prospective customers and partners.

It does not cover third-party websites we link to, nor the processing the AADE carries out under its own statutory mandate.

3. Our role: controller or processor

The distinction matters for your rights, because nexus-hub operates on two levels.

• As a controller we act for website data, contact requests, account administration, billing for our own services, and support.
• As a processor we act for the document content and data a customer uploads or creates inside the applications. There the customer business is the controller, and we act on its instructions under a data processing agreement (DPA).

4. What data we collect

• Contact details: name, company, role, email and telephone — when you complete the contact form or request a demo.
• Account and usage data: username, roles and permissions, legal entities, actions taken inside the application, logs and audit trail.
• Technical data: IP address, device and browser type, language, pages visited, timestamps.
• Subscription and billing data: invoicing details, VAT number, payment history.
• Support data: your correspondence with our support team and the content of your requests.
• Newsletter data: email address and subscription status, where you have signed up.

We do not ask for and do not want special categories of data (Article 9 GDPR). Please do not send such data through our forms or to support.

5. Why we process it, and on what legal basis

• Providing the service — performance of a contract (Art. 6(1)(b) GDPR).
• Answering contact and demo requests — legitimate interest, or steps preparatory to a contract.
• Meeting tax and accounting obligations, including transmission to myDATA — legal obligation (Art. 6(1)(c)).
• Security, abuse prevention and the audit trail — legitimate interest and legal obligation.
• Improving the platform through usage statistics — consent, via your cookie choices.
• Newsletter and product updates — consent, withdrawable at any time.

6. Cookies and similar technologies

We use cookies and equivalent local-storage technologies. Necessary cookies are always on, because without them the site and platform sign-in do not work. No optional cookie is set before you give consent.

• Necessary: session and sign-in, security and CSRF protection, language choice, and recording your cookie decision. Legal basis: legitimate interest / technical necessity.
• Analytics: anonymous or aggregated usage data, so we can see which pages and features actually help. Legal basis: consent.
• Marketing: measuring campaign performance on external platforms. Legal basis: consent.

Your choice is stored locally in your browser and kept for twelve months, after which we ask again. You can change it at any time from the cookie settings, or by clearing cookies in your browser.

7. Who we share data with

• AADE / myDATA: the document data the law requires, when we transmit as a certified provider.
• Infrastructure and service providers: hosting, storage, email, support and system monitoring — always under an Article 28 GDPR processing agreement.
• Professional advisers and auditors: where needed for legal, accounting or audit purposes.
• Authorities: where we are under a legal obligation or receive a lawful request.

We do not sell personal data, and we do not make it available to third parties for their own marketing.

8. Location and international transfers

Data is hosted on infrastructure inside the European Union. Where a transfer outside the EEA is unavoidable — for example by a support provider — it takes place only under an adequacy decision or the European Commission's Standard Contractual Clauses, with supplementary safeguards.

9. How long we keep it

• Documents and related tax data: for the statutory retention period.
• Account data: for the duration of the subscription and a reasonable period afterwards, for evidence and settlement.
• Contact requests: up to twenty-four months from the last exchange.
• Logs and audit trail: typically twelve months, unless a longer period is needed for security or audit.
• Newsletter subscription: until you withdraw consent.

10. Security

AGILE operates a certified Information Security Management System to ΕΛΟΤ EN ISO/IEC 27001:2023. Measures include encryption in transit, role-based access control, environment separation, action logging, backups, incident management and regular staff training.

In the event of a data breach likely to risk rights and freedoms, we notify the Hellenic Data Protection Authority within 72 hours and, where required, the data subjects themselves.

11. Your rights

• Access your data and receive a copy of it.
• Rectification of inaccurate or incomplete data.
• Erasure, where no retention obligation overrides it.
• Restriction of processing, and objection to processing based on legitimate interest.
• Portability of the data you provided, in a structured format.
• Withdrawal of consent for cookies and the newsletter, without retroactive effect.

We answer requests sent to [email protected] within one month. You also have the right to lodge a complaint with the Hellenic Data Protection Authority, 1-3 Kifissias Avenue, 115 23 Athens, www.dpa.gr.

12. Automated decision-making

We do not take decisions about you based solely on automated processing with legal effects for you. Automatic document reading and matching propose results, which remain under the control and approval of the customer's own users.

13. Children

Our services are aimed at businesses and professionals. We do not knowingly collect data relating to children. If we find that we have, we delete it.

14. Changes to this policy

We may update this policy for legal, technical or operational reasons. The last-updated date and version number appear at the top of this page. For material changes we notify customers by email or inside the platform.

15. Contact

For any question about this policy, to exercise your rights, or to request our data processing agreement, write to [email protected].