Privacy Policy

1. Data Controller and Scope

The controller within the meaning of the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the applicable national data protection legislation is:

• KONET
• Stefanou Veldemiri 5, Sykies, 56625 Thessaloniki, Greece
• Commercial Registry (GEMI) No: 134646304000
• VAT No: 153133759
• Phone: +30 2310 501800
• Email: isend @ isend.gr
• Websites: isend.gr, sms.isend.gr

This Privacy Policy applies to the iSend platform, accessible at sms.isend.gr, and to the website isend.gr (jointly the "platform"). Please read this Privacy Policy regularly, as changes in legislation or in our internal procedures may alter its content.

2. Data Protection Officer

You may contact the Data Protection Officer of KONET at any time using the phone number or the email address listed above.

3. Principles of Data Processing

The term "personal data" refers to all information relating to an identified or identifiable natural person, such as name, address, phone number, date of birth, email address, IP address and user behaviour. Anonymous information which does not allow us to identify you is not classified as personal data. The processing of personal data (for example collection, retrieval, use, storage or transfer) always requires a legal basis or your consent. Processed personal data are deleted as soon as the purpose for which they were collected has been fulfilled and no statutory retention periods apply.

Below we inform you about the individual processing activities, their scope and purpose, the legal basis on which they rely and the respective storage period.

4. Visiting the Platform (Log Files)

When you visit the platform, our server automatically collects data which your browser transmits and stores them temporarily in log files. This information is required for technical reasons in order to display the platform and to guarantee its security and stability:

• IP address of the requesting computer or device
• Date and time of access
• Name and URL of the requested file
• The URL of the referring website (referrer)
• Browser, operating system and the name of your internet service provider

The legal basis is Article 6(1)(f) GDPR: the processing serves our legitimate interest in operating the platform securely and reliably. The data are deleted as soon as they are no longer required for this purpose, unless a longer retention is required by law, for example for the investigation of a security incident.

5. Registration and User Account

To use the iSend services you create a user account. Registration is required for the conclusion and performance of a contract with us. During registration and account management we process the data you provide:

• Full name
• Email address
• Password (stored in encrypted/hashed form)
• Phone number
• Company name
• Address, city and country
• Billing and payment details
• IP address

The legal basis is Article 6(1)(b) GDPR (performance of a contract or pre-contractual steps). We also process your email address and phone number to send you essential service messages, for example password reset messages and account notifications. The data are deleted when they are no longer required for the performance of the contract, unless statutory retention obligations (for example tax legislation) require further storage. You may request the correction of your details at any time through the platform or by contacting us, and you may request the closure of your account at any time.

6. Use of the Platform — Recipient Data

When you use the platform to send SMS, Viber or one-time password (OTP) messages, you upload or enter personal data of your recipients (such as mobile numbers, names and custom fields) as well as the content of your messages. For these data you act as the data controller and iSend acts as the data processor within the meaning of Article 28 GDPR: we process them exclusively on your documented instructions, for the sole purpose of delivering your messages, and never for our own purposes.

• Messages are delivered through licensed messaging providers operating lawfully in Greece (their details are available on request) and through our hosting infrastructure within the EEA (Leaseweb). The data are stored and processed within the EEA.
• Uploaded contact import files are automatically deleted within 48 hours of the completion of the import.
• In the sending reports, the message content is deleted after 30 days and the sender and recipient numbers are anonymised after 12 months; anonymised delivery statistics are archived for up to 5 years. Tax and invoicing records are retained for 10 years.
• Unsubscribe requests (STOP replies, unsubscribe links, blocked-numbers list) are honoured automatically on every sending and contact import, and the related records are retained permanently — even after the deletion of the customer account — so that the objection of the recipients is respected at all times.

The details of this processing are set out in the Terms of Use, which include our data processing commitments towards you as customer.

7. Security Messages (OTP and Notifications)

For the protection of your account we may send you security-related messages, such as one-time passwords (OTP), two-factor authentication codes and login notifications, using your phone number or email address. The legal basis is Article 6(1)(b) and (f) GDPR — the secure performance of the contract and our legitimate interest in preventing unauthorised access.

8. Contact and Abuse Report Forms

You can contact us through the contact options published on the platform, as well as through the abuse report form. In that case we process the data you submit (name, email address, the content of your message and any attachments) in order to classify, investigate and answer your request. The legal basis is Article 6(1)(f) GDPR — our legitimate interest in responding to requests and in keeping the service safe — and, where a report leads to enforcement measures, compliance with our legal obligations. The data are deleted once the request has been dealt with, unless a longer retention is required by law.

9. Disclosure of Data

We will disclose your data to third parties only if:

• You have given your explicit consent in accordance with Article 6(1)(a) GDPR
• The disclosure is lawful and necessary for the performance of our contractual obligations towards you in accordance with Article 6(1)(b) GDPR
• We are legally obliged to do so in accordance with Article 6(1)(c) GDPR
• The disclosure is necessary to protect our legitimate interests or to establish, exercise or defend legal claims in accordance with Article 6(1)(f) GDPR

Categories of recipients: licensed messaging and telecommunications providers (for the delivery of your messages; their details are available on request), hosting providers within the EEA (Leaseweb), payment service providers (banking institutions, Stripe, PayPal) which process your payment data under their own responsibility, and public authorities where the law so requires.

KONET does not sell personal data to third parties.

10. Cookies

The platform uses only technically necessary cookies: the session cookie, the CSRF security token, the optional "remember me" cookie and the cookie which stores your cookie preferences. We do not use advertising or tracking cookies. The legal basis is Article 6(1)(f) GDPR. Most browsers allow you to restrict or delete cookies through their settings; note, however, that without the necessary cookies the platform cannot function properly.

We use cookies to improve the performance of our website. You can manage your cookie settings here.

11. Third-Party Services

To protect public forms and the login page from automated abuse we use Cloudflare Turnstile, a verification service of Cloudflare Inc.; for this purpose your IP address and technical browser data are transmitted to Cloudflare. The opt-in forms (popups) which our customers embed on their own websites use Google reCAPTCHA, a verification service of Google, for the same purpose; when those forms are used, the visitor's IP address and technical browser data are transmitted to Google. When you pay by card or PayPal you are redirected to the environment of the respective payment provider, which processes your payment data as an independent controller. The legal basis is Article 6(1)(f) GDPR (security of the platform) and Article 6(1)(b) GDPR (execution of payments).

12. Hyperlinks

The platform may contain hyperlinks to websites operated by other providers. We accept no responsibility for the handling of your data on those websites; please consult the privacy information of the respective operator.

13. Your Rights

As a data subject you have the following rights:

• In accordance with Article 15 GDPR, to request information on the personal data we process, the purposes of the processing, the categories of recipients and the envisaged storage period.
• In accordance with Article 16 GDPR, to request the immediate rectification of inaccurate or incomplete personal data stored by us.
• In accordance with Article 17 GDPR, to request the erasure of your personal data, insofar as the processing is not required for compliance with a legal obligation or for the establishment, exercise or defence of legal claims.
• In accordance with Article 18 GDPR, to request the restriction of the processing of your personal data.
• In accordance with Article 20 GDPR, to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and to transmit them to another controller.
• In accordance with Article 7(3) GDPR, to withdraw a previously given consent at any time, with effect for the future.
• In accordance with Article 77 GDPR, to lodge a complaint with a supervisory authority — in Greece, the Hellenic Data Protection Authority (www.dpa.gr).

14. Right to Object

Insofar as we process your personal data on the basis of legitimate interests in accordance with Article 6(1)(f) GDPR, you have the right under Article 21 GDPR to object to the processing for reasons arising from your particular situation. As far as direct marketing is concerned, you have a general right to object without stating any reason, and we will take the appropriate measures.

15. Minors

The platform and our services are not intended for persons under 18 years of age and we do not knowingly collect personal data of minors. If you are under 18, please do not provide us with personal data.

16. Security Measures

We have implemented extensive technical and organisational measures to protect your personal data against manipulation, loss and misuse, including recognised encryption methods (SSL/TLS) for data in transit, individual accounts with role-based permissions, optional two-factor authentication (2FA) and logging of critical actions. These measures are reviewed regularly and adapted to technological developments. Please note that data transmitted unencrypted — for example by plain email — may be readable by third parties.

17. Changes to this Privacy Policy

If we decide to change this Privacy Policy, we will publish the changes on this page and update the revision date shown at the top of the page. Please check this page regularly.

18. Contact

For any question regarding this Privacy Policy or the processing of your personal data, contact us at isend @ isend.gr or by phone at +30 2310 501800.