Legal
Privacy Policy
1. Overview
This Privacy Policy explains how CafePilot (“we“, “us“, “our“) collects, uses, stores, and protects information about you when you visit cafepilot.eu or contact us through any channel. CafePilot is operated by a team based in Thessaloniki, Greece, and all processing of personal data is governed by the General Data Protection Regulation (GDPR) (EU Regulation 2016/679) and applicable Greek data protection law.
We take your privacy seriously. We collect only what we need, we do not sell or rent your data to anyone, and we do not use advertising networks or tracking pixels on this website.
2. Who We Are (Data Controller)
The data controller responsible for your personal data is:
- Business name: CafePilot
- Address: 16 Vasilissis Olgas Ave, 54640 Thessaloniki, Greece
- Email: info@cafepilot.eu
- Phone: (+30) 231-231-8022
- Website: cafepilot.eu
For any data protection enquiry, you may contact us directly at the email address above.
3. What Personal Data We Collect and Why
3.1 Contact Form Submissions
When you submit the contact form on our website, we collect:
- First name and last name
- Email address
- Phone number (optional)
- Enquiry type and package interest
- Whether you currently own or operate a gaming venue, and if so, how many terminals and the venue type
- Your message
Why: To respond to your enquiry, assess your infrastructure requirements, and provide you with a relevant service proposal. The legal basis for this processing is Article 6(1)(b) GDPR β processing necessary to take steps at your request prior to entering into a contract β and Article 6(1)(f) GDPR β our legitimate interest in responding to business enquiries.
Retention: Enquiry records are retained for a maximum of 24 months. If an enquiry leads to a client relationship, the relevant data is retained for the duration of the contract and for 5 years thereafter in accordance with Greek accounting and commercial law obligations.
3.2 Client Service Data
When you become a CafePilot client, we process additional data necessary to deliver our services, including venue technical specifications, network configurations, and billing software settings. This data is processed under a separate Data Processing Agreement provided at the time of onboarding.
3.3 Server Log Data
Our web hosting provider automatically records standard server access logs when you visit the website. These logs may include your IP address, browser type, operating system, referring URL, and the date and time of your visit. This data is used solely for security and operational monitoring purposes and is not linked to any personal identity. Logs are retained for a maximum of 30 days.
Legal basis: Article 6(1)(f) GDPR β our legitimate interest in maintaining the security and integrity of the website.
3.4 Cookies
We use two categories of cookies:
- Strictly necessary cookies β required for the website to work and to remember your cookie choice. These do not require consent.
- Analytics cookies (Google Analytics 4) β help us understand how the website is used (e.g. which pages are read, from what type of device). They are only activated if you click βAcceptβ in the cookie banner. Before you consent, the Google Analytics code is not loaded and no data is sent to Google.
| Cookie | Provider / Purpose | Duration |
|---|---|---|
cp_consent |
CafePilot β stores your choice (accept or reject) for analytics cookies. Strictly necessary. | 6 months |
_ga |
Google Analytics β distinguishes unique visitors using a pseudonymous identifier. Only with consent. | 2 years |
_ga_<ID> |
Google Analytics β maintains session state. Only with consent. | 2 years |
Legal basis: For analytics cookies, Article 6(1)(a) GDPR β your consent (and Article 5(3) of the ePrivacy Directive 2002/58/EC). For strictly necessary cookies, Article 6(1)(f) GDPR β our legitimate interest in operating the website.
Withdrawing consent: You can change or withdraw your choice at any time via the βCookie settingsβ link at the bottom of every page. When you withdraw consent, the Google Analytics cookies are deleted from your browser and no further data is collected. Withdrawal does not affect the lawfulness of processing before it. Rejecting analytics cookies does not restrict your use of the website in any way.
4. How We Use Your Data
We use the personal data we collect for the following purposes only:
- Responding to your contact form enquiry
- Assessing your venue’s technical requirements and preparing a service proposal
- Communicating with you about our services if you have requested this
- Delivering contracted services to existing clients
- Maintaining the security and operation of our website
- Complying with legal obligations
We do not use your data for automated decision-making or profiling. We do not send unsolicited marketing emails. We do not sell, rent, or trade your personal data to any third party.
5. Data Sharing and Third Parties
We do not share your personal data with third parties except in the following limited circumstances:
5.1 Service Providers
We use the following categories of service providers who may process your data on our behalf, under contractual data processing agreements:
| Provider Type | Purpose | Data Shared |
|---|---|---|
| Web hosting provider | Hosting the cafepilot.eu website and storing form submission emails | Server logs, form submission emails |
| Email delivery (SMTP) | Delivering contact form notifications to our inbox | Contact form data (name, email, message) |
| Google Ireland Limited (Google Analytics 4) β only with consent | Website traffic statistics | Pseudonymous cookie identifier, pages visited, device and browser type, approximate location (country/city). GA4 does not store IP addresses. |
All service providers are contractually bound to process your data only on our instructions, maintain appropriate security measures, and not use your data for any other purpose.
5.2 Gizmo (Billing Software)
For clients who use Gizmo billing software as part of their CafePilot package, certain configuration data is processed in connection with Gizmo’s platform. Gizmo is operated by a separate entity. Please refer to gizmopowered.com for Gizmo’s own privacy terms.
5.3 Legal Obligations
We may disclose your personal data if required to do so by law, court order, or a competent regulatory authority.
6. International Data Transfers
CafePilot operates from Greece, which is a member state of the European Union. Your personal data is processed within the EU/EEA. If any service provider we use processes data outside the EEA, we ensure that appropriate safeguards are in place (such as Standard Contractual Clauses) in accordance with GDPR Chapter V requirements.
Specifically for Google Analytics (only if you have given consent): Google may process data on servers in the United States. Google LLC is certified under the EUβU.S. Data Privacy Framework and additionally applies Standard Contractual Clauses.
7. How We Protect Your Data
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, destruction, or disclosure. These measures include:
- Encrypted transmission of all website traffic via HTTPS/TLS
- Form submissions protected by WordPress nonce tokens to prevent cross-site request forgery
- Honeypot anti-spam protection on the contact form
- Access to personal data limited to CafePilot team members who need it to respond to your enquiry
- Regular review of data retention practices
No method of electronic transmission or storage is 100% secure. If you believe your data has been compromised, please contact us immediately at info@cafepilot.eu.
8. Data Retention
| Data Type | Retention Period | Reason |
|---|---|---|
| Contact form enquiries (non-client) | 24 months | Reasonable period to follow up on business enquiries |
| Client service data | Duration of contract + 5 years | Legal and accounting obligations under Greek law |
| Google Analytics data (only with consent) | Up to 14 months | Maximum GA4 event-data retention limit; cookies expire as listed in section 3.4 |
| Server access logs | 30 days | Security monitoring only |
| Auto-reply confirmation emails | Until deleted by recipient | Sent to your inbox β we retain no copy beyond our standard email retention |
9. Your Rights Under GDPR
Under the GDPR, you have the following rights regarding your personal data:
- Right of access β You may request a copy of the personal data we hold about you.
- Right to rectification β You may ask us to correct inaccurate or incomplete data.
- Right to erasure β You may request that we delete your personal data, subject to our legal retention obligations.
- Right to restriction of processing β You may ask us to restrict how we use your data in certain circumstances.
- Right to data portability β You may request your data in a structured, machine-readable format.
- Right to object β You may object to processing based on our legitimate interests.
- Right to withdraw consent β Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at info@cafepilot.eu. We will respond within 30 days. We may need to verify your identity before processing your request.
If you believe we have not handled your data correctly, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) β the supervisory authority for Greece:
- Website: www.dpa.gr
- Address: Kifisias 1-3, 115 23 Athens, Greece
- Phone: +30 210 6475600
10. Children’s Privacy
Our website and services are directed exclusively at businesses and business professionals. We do not knowingly collect personal data from individuals under the age of 16. If you believe a minor has submitted personal data through our website, please contact us and we will delete it promptly.
11. Third-Party Links
Our website contains a link to gizmopowered.com. We are not responsible for the privacy practices of third-party websites. We encourage you to read their privacy policies when visiting external sites.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The “Last updated” date at the top of this page indicates when it was last revised. Continued use of the website following any update constitutes your acceptance of the revised policy. For significant changes, we will make a visible notice on the website.
13. Contact Us
For any questions, requests, or concerns regarding this Privacy Policy or our handling of your personal data, please contact us:
- Email: info@cafepilot.eu
- Phone: (+30) 231-231-8022
- Address: 16 Vasilissis Olgas Ave, 54640 Thessaloniki, Greece
- Contact form: cafepilot.eu/contact/