This policy explains how mamaXO ("we") processes personal data when you use mamaxo.com, our rental platform and our property-management services. Data controller: mamaXO ΜΟΝΟΠΡΟΣΩΠΗ Α.Ε. (mamaXO Single Member S.A.), ΓΕΜΗ 178428301000, ΑΦΜ 802549101, Maizonos 37, 104 38 Athens — hello.greece@mamaxo.com.
1. What data we collect
Owner enquiries (lead form): name, phone, optional email, property details (area, size, bedrooms, status) and your preferred contact channel.
Accounts: name, email, password (hashed), role (tenant / landlord), and the content you add — listings, photos, applications, messages, lease documents.
Technical data: IP address, device and browser information, pages visited — via cookies and similar technologies only with your consent (see Cookie Policy).
Bills and notices about the properties we manage that reach us by email (utilities, building charges): supplier, account and meter numbers, supply address, amounts and periods.
2. Why we process it (legal bases)
To respond to your enquiry and provide our services — performance of a contract or steps before entering one (Art. 6(1)(b) GDPR).
To operate, secure and improve the platform — legitimate interest (Art. 6(1)(f)).
Analytics and advertising measurement — only with your consent (Art. 6(1)(a)).
Compliance with Greek tax and rental law (e.g. lease registration) — legal obligation (Art. 6(1)(c)).
To process bills for the properties we manage — performance of the management agreement and legitimate interest (Art. 6(1)(b) and (f)). An AI model reads the document and our staff check every result before anyone is charged; no decision about you is taken by automated means alone.
3. Who receives your data
Service providers acting under our instructions: hosting (Hetzner Online GmbH, Germany), file storage (Cloudflare R2), email delivery (Resend), analytics (Google Analytics, Microsoft Clarity — consent-based where the law requires prior consent), maps (Google Maps).
Our operations team receives new enquiries through an internal notification channel.
Reading of bills received by email: Anthropic Claude through Amazon Web Services (Amazon Bedrock, Amazon Web Services EMEA SARL), processed only in EU regions. The documents are not stored by AWS and are not used to train models.
We never sell personal data. Landlords and tenants only see each other’s data as needed to arrange a tenancy.
4. International transfers
Our servers are in the EU (Germany). Where a provider processes data outside the EEA (e.g. Google, Microsoft, Cloudflare, Resend), transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
5. How long we keep it
Enquiries: up to 24 months after last contact. Accounts: while active and up to 12 months after deletion request, unless law requires longer. Lease-related records: as required by Greek tax law (typically 5 years). Emails about bills: deleted within 90 days unless they became a bill on our records; bills are kept as accounting records.
6. Your rights
You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interest. Consent can be withdrawn at any time (for cookies — via "Cookie settings" in the footer).
Write to hello.greece@mamaxo.com. You may also lodge a complaint with the Hellenic Data Protection Authority (dpa.gr).
7. Security & changes
Data is encrypted in transit; access is restricted to staff who need it. We will post any material changes to this policy on this page with a new "last updated" date.