1. Controller
SkipCode acts as controller for account, billing and commercial data and as processor where customer website content is processed only on the customer’s instructions.
2. Data we collect
- Identity, contact, account and authentication data.
- Billing address, document type, company and tax/VAT information, including VIES validation results.
- Orders, payments, subscriptions, invoices and provider references. We do not store complete card details.
- Project, website, domain registrant, DNS and operational data.
- Security logs such as IP address, user agent, login attempts and audit events.
3. Purposes and legal bases
We process data to create and secure accounts, provide contracted services, take payments, register domains, issue accounting records, provide support, prevent abuse and comply with tax, accounting and legal duties. The legal bases may include contract performance, legal obligation, legitimate interests and consent where specifically requested.
4. Recipients and providers
Data is shared only as needed with infrastructure and hosting providers, Stripe for payments, Hostinger and relevant registries for domain services, email providers, professional advisers and public authorities when legally required. Each provider receives only the data required for its function.
5. International transfers
Where a provider processes data outside the EEA, we rely on an applicable adequacy decision, standard contractual clauses or another lawful transfer mechanism, together with appropriate safeguards where required.
6. Retention
Account and project data is kept while the service is active and for a limited operational period afterward. Financial, invoice and tax records are retained for the period required by Greek and EU law (configured operationally as 10 years unless a different legal period applies). Security and audit logs are retained according to documented operational schedules. Backups expire through normal rotation.
7. Your rights
Subject to applicable conditions, you may request access, correction, deletion, restriction, portability or objection and may withdraw consent where processing relies on consent. You may also complain to the Hellenic Data Protection Authority or another competent supervisory authority.
8. Security and cookies
We use access controls, encrypted transport, hashed credentials and tokens, audit logging and restricted storage. Essential session and security cookies are used to operate the portal. Any non-essential analytics or marketing cookies should be enabled only through a separate consent mechanism.