How we use the personal data of the people who run a business on CarFast and their staff. For your customers' data, we are your processor — section 8 explains, and the DPA governs. A privacy notice is read, not accepted: there is no box to tick for this document.
Georgios Pamfilis of Stefanos, trading as pamfili.co, sole proprietorship, ΑΦΜ 300145978, of [REGISTERED ADDRESS], Greece, operates CarFast and the other applications of the Network (RentFast, BoatFast, TourFast, GuestFast, TaxiFast, ServeFast, Services). For the data in this notice we are the controller.
Data protection contact: [email protected]. [We have / have not appointed a data protection officer — DECIDE and record the reason.]
If you are a sole trader, your business contact details are your personal data and this notice applies to them.
| data | where it comes from | |---|---| | name, email, phone, business name, business address, ΑΦΜ, ΔΟΥ | you, at signup and in your account settings | | billing details, invoices, payment status, payment-provider references | you, and the payment provider | | staff name, phone, role, permissions, login credentials | the business owner, when adding staff | | usage of the Service — features used, actions taken, timestamps, IP address, device and browser information | generated as you use CarFast | | metered usage of booking integrations, translation and document signing — counts and cost | generated by the Service | | support correspondence | you, when you contact us |
We do not collect payment-card numbers; the payment provider handles them.
| purpose | lawful basis | |---|---| | providing your account and the Service, and performing our contract with you | contract (Art. 6(1)(b)) | | invoicing, payment, accounting and tax records | legal obligation (Art. 6(1)(c)) — Greek accounting and tax law | | authenticating you and your staff; securing the Service; preventing fraud and abuse | legitimate interest (Art. 6(1)(f)) in a secure service | | support, and service communications about your account | contract | | improving the Service, using aggregated usage statistics | legitimate interest — we do not identify individual business owners in doing so | | telling you about new features or Network services relevant to your business | legitimate interest in informing existing customers about our own similar services; you may opt out at any time |
We do not sell your personal data, and we do not share it with other business owners.
We process your data in the European Economic Area. Where a provider processes it outside the EEA [CONFIRM REGIONS — DigitalOcean, Stripe, mail provider], we rely on an adequacy decision or the Standard Contractual Clauses. You may ask us for a copy of the mechanism used.
| data | retained | |---|---| | account and profile | for the life of the account, then [30] days | | invoices and accounting records | 5 years from the end of the financial year, as Greek law requires — longer if a tax assessment is open [CONFIRM with counsel] | | staff accounts | until the business owner removes them, then [30] days | | usage and security logs | [12] months [CONFIRM] | | support correspondence | [2] years [CONFIRM] |
The personal data you hold about your customers in CarFast — bookings, contracts, documents, correspondence — is yours. You decide why and how it is processed. We process it only to provide the Service and only on your instructions, under the Data Processing Agreement that forms part of your Terms. That agreement lists our sub-processors — including the AI provider that parses booking-channel emails where you connect an integration, and translates emails and chat messages where you use translation — and the security measures we apply.
Your customers' rights requests about that data are for you to answer. If one reaches us, we forward it to you.
The RentFast account that a customer of yours may hold is separate: we operate it as an independent controller under the RentFast privacy notice. It is not part of your data.
You have the right to access the personal data we hold about you, to have it rectified, to have it erased where we no longer need it, to restrict or object to its processing, and to portability of data you gave us under contract. You may object to service marketing at any time, and we will stop.
To exercise a right, email [email protected]. We will respond within one month. [Self-service export and deletion are not yet available in the application; a request by email is honoured within the statutory period.]
Note that invoices and accounting records are kept for the period Greek law requires even if you ask us to erase your account; we will tell you what we have retained and why.
You have the right to lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifissias 1–3, 115 23 Athens, www.dpa.gr.
We make no decision about you based solely on automated processing that produces legal or similarly significant effects.
We will notify material changes to this notice by email to your account address at least 15 days before they take effect. The current version is always at https://carfa.st/en/privacy; earlier versions are available on request.
Version 0.1 — [DATE].
© 2024 pamfili.co