سياسة الخصوصية

1. Who we are

Controller: mamaXO ΜΟΝΟΠΡΟΣΩΠΗ Α.Ε. (mamaXO Single Member S.A.), ΓΕΜΗ 178428301000, ΑΦΜ 802549101, Maizonos 37, 104 38 Athens.

For anything about your data, write to privacy@mamaxo.com.

We have not appointed a Data Protection Officer, as our activities do not require one (Art. 37 GDPR). The address above reaches the people responsible for data protection.

This policy applies to everyone whose data we process, wherever they live.

2. What we collect

Visitors: IP address and browser details in our server logs, and daily visit counts without cookies (section 15). Usage statistics with your consent — or, for Google Analytics outside the EU/EEA, the UK and Switzerland, by default (section 16 and the Cookie Policy).

Owners: name, phone, email, property details and messages; for management also ΑΦΜ, identity details, IBAN, the management agreement and payout records.

Tenants and applicants: name, contact details, application details (income, household, move-in date), identity and residence documents, the lease, payments, condition reports, messages and repair requests.

Co-tenants, guarantors and occupants: what the lease needs — name, ΑΦΜ, identity and contact details.

Golden Visa clients: contact details and the documents the application needs, including those of family members.

Calls and emails with us: your phone number, the keys you press in our phone menu, and what you write to us.

3. Where we get data from, if not from you

Landlords: details of tenants, co-tenants and guarantors, including those typed into our free lease builder. The lease it produces informs the tenant about this policy.

Banks: payer name, reference and amount of transfers to our accounts.

Utility providers and building managers: bills for the homes we manage (supplier, account and meter numbers, address, amounts, periods).

Public property portals: name and phone number of private owners advertising a home, to offer them our services. If you tell us not to contact you, we stop and keep only a note not to call again.

Golden Visa main applicants: details of their family members.

Google: public reviews of mamaXO (reviewer name, rating, text), obtained through DataForSEO and shown on our site.

4. Why we use it and on what legal basis

Our services — accounts, applications, leases, property management, payments, replies to enquiries: contract or steps before one (Art. 6(1)(b) GDPR).

Lease declarations to ΑΑΔΕ, tax and accounting records, anti-money-laundering checks for property sales: legal obligation (Art. 6(1)(c)).

Statistics where we ask first, marketing emails: your consent (Art. 6(1)(a)), which you can withdraw at any time.

Our legitimate interests (Art. 6(1)(f)): security logs, fraud prevention, matching incoming payments to rent, processing bills of the homes we manage, calling owners to offer our services, improving our service, counting visits without cookies and Google Analytics outside the EU/EEA, the UK and Switzerland (section 15), and the tenant’s details in the free lease builder. You can object (section 10).

5. Identity documents

For a lease we ask for: name, father’s name, ID card or passport number and expiry, residence permit where required, ΑΦΜ, and a copy of the document.

For a Greek ID card, please send the digital copy issued through gov.gr instead of a photo (Hellenic DPA Opinion 1/2025; Law 5266/2025, art. 30).

Only you and our staff see the copy — never the landlord. When our staff ask, an AI model (Amazon Bedrock, Frankfurt) reads the fields from the scan; staff check every field before it is saved. We never record the Greek Personal Number (ΠΑ) or the machine-readable zone, and we do not compare your photo with any other image.

We keep the copy as long as the tenancy needs it and up to 24 months after your last lease ends, then remove it; a removed copy leaves our storage after 30 days. The fields taken from it stay with the lease records.

ΑΦΜ, identity numbers and IBAN are stored encrypted.

6. Tenant score and AI

For tenants with a lease we calculate a score from: rent and bills paid on time, condition reports signed, how promptly messages are read, and how repairs are reported. This is profiling.

You and our staff see the score and what it is made of; landlords do not. It is advisory: no decision about you is taken by automated means alone (Art. 22 GDPR). You can ask how it was calculated and object to it (Art. 21).

We use AI models to draft and translate listing texts, polish notes in owner reports, read bills and suggest which payment a transfer belongs to. Our staff check the results; AI takes no decisions about you.

7. Who receives your data

We do not sell personal data. Processors in the table act only on our instructions (Art. 28 GDPR). Landlords and tenants see each other’s details only as far as the tenancy needs, each as an independent controller.

8. Transfers outside the EEA

Our servers are in Germany. Some recipients process data in the USA or the United Kingdom. Transfers rest on the EU–US Data Privacy Framework where the recipient is certified, on Standard Contractual Clauses (Art. 46(2)(c) GDPR), or on the EU adequacy decision for the United Kingdom. Anthropic is not certified under the Framework; we rely on the Standard Contractual Clauses in our agreement with it. You can ask us for a copy of the safeguards.

9. How long we keep it

These are our rules. Where a dispute or the law requires it, we keep data longer, only for that purpose.

10. Your rights

You can ask for access, rectification, erasure, restriction and portability of your data, and object to processing based on legitimate interests (Art. 15–21 GDPR). To object to visit counting, use “Don’t count my visits” in the Cookie Policy or turn on Global Privacy Control.

Direct marketing: you can object at any time, without giving reasons, including to profiling for marketing. We then stop (Art. 21(2)–(3)).

Consent: withdraw it at any time — “Cookie settings” at the bottom of every page, or the unsubscribe link in every email. This does not affect what was done before.

Write to privacy@mamaxo.com. We answer within one month; complex requests may need two more months, and we tell you why within the first month. We may ask you to confirm your identity.

You can complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1-3, 115 23 Athens, +30 210 6475600, contact@dpa.gr, www.dpa.gr — or to the authority where you live or work.

11. Do you have to give us your data?

For a lease and its declaration to ΑΑΔΕ, the law requires the parties’ name, ΑΦΜ and identity details; without them we cannot prepare or declare the lease. Other data is needed only as far as the service you ask for requires it; without it we may not be able to provide that service.

12. Marketing emails and calls

We send marketing emails only with your consent (Art. 11 Law 3471/2006), which you confirm through a link we email you. We record what you agreed to, when, and from which IP address. Every email has a one-click unsubscribe link.

For calls to owners, see section 3. Tell us on the call or by email and we will not call again.

13. Children

Our services are not directed at children. We receive data about minors only from a parent or guardian — for example, family members in a Golden Visa application.

14. Security

Encryption in transit (TLS); field-level encryption of ΑΦΜ, identity numbers and IBAN; documents in private storage, given out only through our application after an access check; access by role; an audit log that cannot be edited. No system is perfectly secure: if a breach puts you at risk, we inform you and the authority as the law requires.

15. Measuring site use

Visit counts without cookies. When you open a page, our server counts the visit: the page, the site that linked to you (domain only), your country (looked up from your IP address, which we then discard), language and device type. Nothing is stored on your device and no record about you is kept; the counter resets daily and only totals are kept, for up to 25 months. Basis: our legitimate interest in knowing how the site is used (Art. 6(1)(f) GDPR). Object any time: “Don’t count my visits” in the Cookie Policy, or turn on Global Privacy Control.

When you send us a form — an enquiry, a lease from the builder, an account — we keep with it the site that linked to you on that visit (domain only) and its campaign labels, to know which channels bring enquiries. Same basis and same objection as above; with statistics consent we keep the fuller record described in the Cookie Policy.

Our web server notes page loads without your IP address or browser string and deletes that file after the nightly count. The page sends a short request without cookies: the page, page view / enquiry sent / document downloaded, the linking domain, campaign labels, language and device type. To count a visit once a day, the server combines your IP address and browser with a random value that exists only in memory and changes at midnight UTC, then discards them. Your country is looked up on our own server in the DB-IP “IP to Country Lite” database; nothing is sent to DB-IP.

Outside the EU/EEA, the UK, Switzerland and countries where local law requires consent, Google Analytics is on by default to measure site use (cookies _ga, _ga_*, 13 months). Basis: legitimate interest (Art. 6(1)(f) GDPR). Google LLC is our processor; the transfer is covered by the EU–US Data Privacy Framework. No advertising, no Google signals. A one-line notice tells you once; switch it off any time under “Cookie settings”. If our server cannot tell your country, we ask you first, as in the EU.

Everywhere, Microsoft Clarity and our detailed statistics run only with your consent (see the Cookie Policy).

Don’t count my visits (Cookie Policy)

IP geolocation by DB-IP (CC BY 4.0)

16. Changes

We publish changes here with a new date. Previous versions are available on request at privacy@mamaxo.com.