This policy explains the data we process when you visit the website, use the PCI DSS certification type tool or send a contact or quote request, why we use it and how you can exercise your rights.
1. Controller and DPO
This website is provided by INNOTECH – INNOVATIVE TECHNOLOGIES SINGLE MEMBER LTD (Greek registered name: INNOTECH ΚΑΙΝΟΤΟΜΕΣ ΤΕΧΝΟΛΟΓΙΕΣ ΜΟΝΟΠΡΟΣΩΠΗ Ε.Π.Ε.; “Innotech”), registered at 15 Neratziotissis & 4 Thiseos, Marousi, 15124, Greece, VAT number 800525642, General Commercial Registry (GEMI) number 127434301000. Contact: [email protected], telephone +30 210 600 66 66. Innotech acts as controller for the activities of this website.
The Data Protection Officer (DPO) is Giorgos Tarlas. For personal data matters, withdrawal of consent or rights requests, contact [email protected] marked “For the attention of the DPO”, or write to the postal address above.
2. PCI DSS certification type tool data
From your first answer, we record your progress and selections: business role, payment channels and methods, statements about handling or storing card data, transaction range, any declared breach and answers relating to SAQ eligibility. We also store the resulting SAQ type or level, language and technical progress information such as request identifier, tool version and update sequence.
Progress is saved in your browser and sent to our systems. The request includes the IP address and, where valid information is supplied by the infrastructure, a two-letter country code. This initial recording takes place before the quote stage and does not require you to have entered a name or email. A progress identifier does not make the data anonymous, especially when linked with an IP address or later contact details.
3. Contact and quote details
Forms collect the fields shown for the relevant route: full name, email, optional telephone and message. The general contact form sends its details when submitted. Required and optional fields are identified in the form.
Where full scoping is needed, additional company and payment environment details are collected: company name, tax identifier, address, employee and payment-related staff counts, locations, banks or payment providers, card brands, request purpose and timeframe. Depending on your answers, the form may request previous compliance information, hosting and integration details, descriptions of data processing, storage or transmission, payment countries, counts of servers, computers, externally accessible systems and remote devices, and information on network segmentation, antivirus and IT staff.
Information already established by your SAQ answers is used in scoping to avoid unnecessary repeated questions. We do not request actual transaction records or card numbers. Free text you choose to enter is also part of the request; limit it to necessary information and avoid card details, passwords and unnecessary third-party data.
4. Consent and automatic quote saving
Before personal quote fields appear, we request an affirmative consent choice for automatically saving your details and unfinished answers in your browser and our systems, and for contact about that specific quote. After acceptance, changes are saved even without final submission so you can resume and we can handle the interest you expressed.
You may choose not to continue with the form and contact us directly instead. You may withdraw consent at [email protected] without affecting the lawfulness of earlier processing. Processing for which no other lawful basis exists is stopped. Consent relating to your request does not cover unrelated promotions.
5. Technical data and its source
For tool and quote requests, the IP address is obtained from technical connection information forwarded by our infrastructure. Country is recorded as a two-letter code where valid information is supplied by the infrastructure. We do not request GPS access or your device’s precise location.
Technical identifiers, receipt times and status information are also used to link successive updates, confirm saving and prevent duplicate requests. Visiting the website involves the technical connection processing needed to deliver the page. We do not use the tool as a service to identify an otherwise anonymous visitor.
6. Purposes and lawful bases
We use data to operate and resume the tool, assess declared PCI DSS needs, prepare quotes, respond to requests and provide agreed services. Steps necessary for a quote or contract with the individual concerned rely on pre-contractual measures or contract performance. Communication with a legal entity’s representative and handling the business request may rely on our legitimate interest in responding to requests addressed to the company.
Initial SAQ progress recording and related technical data serve the legitimate interest in operating, resuming and reliably managing the tool. Automatic saving of personal details and contact about an unfinished quote rely on the consent requested at that stage. Any retention required by law relies on the relevant legal obligation, while documenting and defending lawful claims may rely on legitimate interest. Accepting the terms is not treated as blanket consent to all processing.
7. Systems and recipients
SAQ progress and scoping details are recorded in our CRM. Completing a quote request creates a ticket in Innotech’s service system containing contact details, answers, scoping, available IP and country information, and a link to the relevant CRM section. The general contact form creates a ticket containing its own fields. The acceptance declaration at submission and receipt time are also recorded.
Data is intended for the staff responsible for requests and services and for the necessary technical operation of the relevant systems. Hosting, infrastructure or support providers may access data within their role.
Choosing a combined quote with a partner’s services records that interest in the request sent to Innotech. It does not give general permission to distribute your details to other companies. Any additional disclosure for a particular service must relate to its purpose and lawful basis. Data may also be disclosed to competent authorities where legally required.
8. Browser and system storage
The website uses local storage for SAQ progress and, after the relevant consent, for the quote draft. Once successful quote submission is confirmed, the corresponding local draft containing personal details is cleared. It is not cleared before confirmation, so a sending failure does not erase your work.
Request information is retained in company systems for handling the request and related lawful purposes. Retention needs are assessed against the purpose, the progress of the relationship, applicable obligations and any lawful claims. Where there is no longer a lawful reason for processing, data is deleted or anonymised. Storage remains subject to your rights and does not permit use for any future purpose.
9. Cookies, analytics and promotions
When measurement is enabled, Google Analytics loads only after your optional acceptance in Cookie settings, to measure site use and effectiveness. Events include page views, SAQ use, package choices and confirmed enquiry submissions. We do not send contact fields, messages or detailed scoping answers to Analytics. The service receives technical connection information, including the IP address when connecting to its servers. Your preference is stored locally and can be changed in Cookie settings. This choice is separate from processing enquiries. Advertising personalisation, fingerprinting and session replay are not enabled. External services have their own policies.
Sending a request or consenting to quote saving does not subscribe you to marketing updates. The contact described here concerns the request you initiated. Future activation of different purposes or non-essential technologies requires corresponding information and the lawful choice applicable to them.
10. Rights and withdrawal
Subject to GDPR conditions, you may request access, correction, erasure, restriction and portability of your data. You may object to processing based on legitimate interests and withdraw consent for processing relying on it. Rights are considered in context; for example, a legal obligation to retain particular information may limit its erasure.
Send your request to [email protected] for the attention of the DPO, including enough information to locate the relevant request without unnecessary sensitive details. Proportionate identity verification may be needed. You may also complain to the Hellenic Data Protection Authority at www.dpa.gr or the competent supervisory authority where you are located.
11. Security, external services and changes
Protecting data requires appropriate technical and organisational measures, access control and limiting information to its necessary purpose. No online service can guarantee absolute security. If you realise you accidentally submitted card details or credentials, contact us promptly without repeating those details in a new message.
External websites and services reached through links have their own policies. This policy is updated when actual website functionality or data processing changes. For information about a specific request, recipients or processing locations, contact the DPO.