⚠ DRAFT — to be reviewed by a lawyer before publication.
This text is a working draft. Company details in [BRACKETS] and items marked DECISION are placeholders. In case of discrepancy, the Greek text prevails.
LEGAL
Privacy Policy — dizzygrowth.com and the myCogni licensing service
Last updated: [DATE] · Ελληνικό κείμενο →
This policy explains what personal data we process when you visit dizzygrowth.com, buy a Subscription for the myCogni Chat / myCogni Search plugins, and when those plugins communicate with our license and update server ([licenses.dizzyagency.gr] and [mycogni.gr] — DECISION: domains to be finalised).
Important: This policy does not cover visitors’ conversations in the stores that use myCogni Chat. Those take place on each store’s server and are sent directly to the AI provider chosen by the store. Dizzy does not receive them. Each store is the controller for them, so for related questions please contact the store where you chatted.
1. Controller
[COMPANY NAME] (trading as “Dizzy Agency”)
VAT no. [VAT], Tax office [TAX OFFICE] — [ADDRESS]
Email for personal data matters: [PRIVACY EMAIL, e.g. privacy@…]
(We have not appointed a Data Protection Officer (DPO), because, given the nature and scale of the processing, one is not required under Article 37 GDPR. — to be confirmed.)
2. What data we process, why, and on what legal basis
| Category | What it includes | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Account & order | Full name, email, phone, company name, VAT no./tax office, billing address, country, product/plan, amounts, order and subscription history, password (encrypted) | Carrying out the purchase, managing the subscription and renewals, access to the account | Performance of a contract — Article 6(1)(b) |
| Invoicing | Invoice/receipt details, VAT no., VIES check | Issuing invoices/receipts, tax and accounting obligations | Legal obligation — Article 6(1)(c) |
| Payment | The payment provider sends us only the payment status, the card type and last 4 digits, and its expiry date. We do not see or store the full card number. | Charging and automatic renewal, refunds, fraud prevention | Performance of a contract; legitimate interest in fraud prevention — Article 6(1)(b), (f) |
| License (at purchase) | License Key, purchaser’s email, order number | Linking the Key to your Subscription | Performance of a contract |
| License (activations) | For each activation: License Key, the website’s address (URL/host), a random installation identifier, the version of the plugin, WordPress, PHP and WooCommerce, the date of the first and last check | Activation, validity check (roughly once a day from each website), delivering updates, showing active websites in your account, enforcing the website limit, version compatibility | Performance of a contract; legitimate interest in preventing Key abuse |
| Technical connection data | The IP address of the server or device connecting. On the license server it is not stored in the database; it is used only temporarily (about 1 minute) to limit excessive requests. It may be recorded in the hosting provider’s usual access logs, as on any website. | Security, protection against attacks and abuse, troubleshooting | Legitimate interest — Article 6(1)(f) |
| Support | The content of your messages, attachments, contact details and, if you give them to us, access details for your website | Answering and resolving requests | Performance of a contract; legitimate interest for pre-contractual questions |
| Newsletter emails | Email, name, open/click history | News, guides and offers | Consent — Article 6(1)(a). For existing customers and similar products: Article 11(3) of Greek Law 3471/2006, with an unsubscribe option in every email |
| Service emails | Order confirmations, renewal reminders, notices of expiry or changes to the terms, important security notices | Performance of a contract / legal obligation | |
| Traffic & cookies | Cookie identifiers, pages you visited, device/browser | Operation of the website (cart, login); statistics; advertising | Necessary cookies: legitimate interest / Article 4(5) of Law 3471/2006; all others: only with consent (see section 8) |
We do not take decisions based solely on automated processing that produce legal effects for you (Article 22 GDPR). The automatic Key check simply confirms whether the Subscription is active.
What we DO NOT receive: the content of chat conversations, data about the stores’ visitors or orders, your AI provider’s API key, or access details for your website (unless you give them to us for support).
3. How long we keep data
| Data | Period (proposal — DECISION) |
|---|---|
| Customer account | For as long as the account exists. After a deletion request it is deleted, except for what must be kept for tax reasons |
| Orders & invoices | As required by tax law (as a rule 5 years from the end of the financial year, or longer if the limitation period is extended — Greek Laws 4308/2014, 4174/2013) |
| Keys and activations | For as long as the Subscription is active and up to [12] months after it expires (in case of renewal or dispute); then deleted or anonymised. An activation you remove from your account is deleted [immediately / within 30 days] |
| Temporary use of IP on the license server | About 1 minute (in memory, not written to the database) |
| Hosting log files | According to the hosting provider’s policy, up to [30–90] days |
| Support requests | [24] months from closing the request; website access details are deleted as soon as the request is closed |
| Newsletter | Until you withdraw consent / unsubscribe |
| Cookies | As stated in the cookie table in the consent tool |
4. Who data is shared with (processors)
We do not sell personal data. We share it only with partners that help us provide the service, under a data processing agreement (Article 28 GDPR):
| Partner | Role | Location |
|---|---|---|
| [HOSTING PROVIDER] | Hosting of dizzygrowth.com and the license server | [EU / country] |
| [PAYMENT PROVIDER, e.g. Stripe / Viva] | Processing payments and subscriptions (for certain processing, such as fraud prevention, it may act as an independent controller) | [EU / USA] |
| [EMAIL PROVIDER, e.g. Klaviyo / SMTP] | Sending service emails and newsletters | [EU / USA] |
| [E-INVOICING PROVIDER / myDATA] | Issuing and transmitting invoices | Greece |
| [Accountant] | Accounting and tax support | Greece |
| [Support tool / helpdesk, if any] | Managing requests | […] |
| [Analytics / advertising tools, only with consent] | Statistics / marketing | […] |
We may also disclose data to public authorities where required by law (e.g. tax authorities).
5. Transfers outside the EEA
If a partner processes data outside the European Economic Area (e.g. in the USA), the transfer takes place only with appropriate safeguards: an adequacy decision (e.g. the EU-U.S. Data Privacy Framework for certified companies) or the European Commission’s Standard Contractual Clauses (Articles 45–46 GDPR). You can request information about these safeguards at [PRIVACY EMAIL].
6. Security
We apply appropriate technical and organisational measures: encrypted connections (HTTPS), passwords stored as hashes, access restricted to staff who need it, request rate limiting, security updates and backups. In the event of a data breach that poses a risk to you, we will notify the Authority and, where required, you (Articles 33–34 GDPR).
7. Your rights
You have the right:
- of access to your data (Article 15),
- to rectification (Article 16): you can correct most details yourself in “My Account”,
- to erasure (Article 17), except for what we must keep by law,
- to restriction of processing (Article 18),
- to data portability (Article 20),
- to object to processing based on legitimate interest (Article 21) and, unconditionally, to direct marketing,
- to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
In “My Account” on dizzygrowth.com you can see your Keys and the websites where they are active, and you can remove any website you like.
To exercise your rights, write to [PRIVACY EMAIL]. We reply within one month (extendable by two months for complex requests, in which case we will inform you). We may ask you to confirm your identity.
Complaint: If you believe the processing infringes the GDPR, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA), 1-3 Kifisias Ave., 115 23 Athens, tel. +30 210 6475600, www.dpa.gr. We would appreciate it, however, if you contacted us first so that we can try to resolve it.
8. Cookies
dizzygrowth.com uses:
- Necessary cookies (e.g. cart, account login, security, storing your cookie choices), without which the website does not work. They do not require consent.
- Statistics and marketing cookies ([e.g. Google Analytics, Meta Pixel]), only if you accept them in the consent banner.
You can change your choices at any time from the “Cookie settings” link at the bottom of every page. The full list of cookies and their duration is shown in the consent tool.
9. Minors
Our services are aimed at businesses and adults. We do not knowingly collect data from minors.
10. Changes
If we materially change this policy, we will update the date at the top of the page and, for material changes, inform customers by email.
Questions about this page?