Legal & transparency
Privacy policy
Version 1.0 · In force from 13 October 2026
Contents
- In 30 seconds
- Who decides what happens to your data.
- Who did this page talk to?
- Every piece of data has a reason and an expiry date.
- Four stops. No fifth.
- We stop bots without asking you to find traffic lights.
- Every demo tells you where its data goes.
- Few, named, under contract.
- We prefer the EU. Where that isn’t possible, we say so.
- A person decides, not an algorithm.
- One email will do. No paperwork.
- You can complain to the authority.
- Children
- There, the client is the controller.
- Changes
What we keep, for how long, and how you delete it.
Written to be read, not scrolled past. Some of what we promise here you can check for yourself, in ‘Who did this page talk to?’.
In 30 seconds
- We run no advertising trackers, social-media pixels or tracking cookies. We sell data to no one.
- Whatever you type into a form is stored as a private record on our server and reaches info@netex.gr as an email. You join a mailing list only if you explicitly ask to, for a PDF for instance.
- To stop spam, your IP address becomes a cryptographic fingerprint that deletes itself within the hour. It’s never stored with your message.
- On your device we keep only what you asked for: ‘Less motion’, ‘Sound’, any codes you’ve won and answers that pre-fill the form.
- In the demos, the camera and microphone switch on only when you tap, and images and sound are processed on your device; they never reach us. Where a demo needs an outside provider, as the voice demo does, it tells you before it starts.
- A copy, a correction or deletion: one email to info@netex.gr is enough. A person replies.
The full text follows. If anything differs, the full text applies.
Data controller
Who decides what happens to your data.
The controller for netex.gr, and for everything you send us through it, is Netex. Its details follow.
Company detailsnetex.gr
- Trading name
- Netex
- Heraklion office
- 56 Karterou Street, Heraklion, Crete
- Almyros office
- Almyros Industrial Area, Chorostasi, Magnesia
- info@netex.gr
We haven’t appointed a Data Protection Officer: our work doesn’t involve large-scale systematic monitoring of people, so the General Data Protection Regulation (GDPR) doesn’t require one (Article 37). Netex answers every privacy question directly at info@netex.gr.
This policy covers netex.gr and the conversations that start from it. When we process data on a client’s behalf in a project, the data processing agreement with that client applies instead (see ‘When we work for clients’).
Check it yourself
Who did this page talk to?
Fonts, scripts, images and video are hosted on our own server. Nothing loads from Google Fonts, ad networks or social platforms, so no third party learns that you’re reading this page.
You don’t have to take our word for it. Your browser keeps a list of every file it loaded for this page. We read it and show it to you, grouped by server.
What this page loadednetex.gr
With JavaScript on, you’d see the list of files this page loaded here. Without it, the page loads only HTML, CSS, images and fonts from netex.gr.
The check runs only in your browser (the Resource Timing API) and sends nothing anywhere.
What our server tells your browser, on every page
- Images, fonts, video and data connections: from netex.gr only (Content Security Policy).
- Camera, microphone, location and payments: off. Camera and microphone open only on the few demo pages that need them, and only after you tap (Permissions Policy).
- Chrome’s Topics API, which guesses your interests for advertisers: off.
- When you follow a link to another site, it learns only that you came from netex.gr, not from which page (Referrer Policy).
- Every connection is encrypted (HTTPS), and your browser remembers not to accept anything less.
The exceptions, only when you ask for them
Links to LinkedIn, Instagram and Viber are plain links. Until you click one, those platforms don’t know you’re here.
The data, one by one
Every piece of data has a reason and an expiry date.
We collect nothing ‘just in case’. The table shows every situation in which any of your data reaches us: what we keep, why, on what legal basis and for how long.
| When | What we keep | Why | Legal basis | How long |
|---|---|---|---|---|
| When you open a page | IP address, time, page, browser and device, referring page, in the server’s logs | To serve the page, find faults and fend off attacks | Legitimate interest (GDPR Art. 6(1)(f)): running and securing the site | Up to 30 days, then deleted automatically |
| When a request looks like an attack | IP address, time, path, browser and the rule it triggered, in the Wordfence firewall | To block attacks and automated attempts | Legitimate interest: security | Blocks expire automatically; records are kept for up to 30 days |
| When you send a form (X-Ray, plant visit, contact, brief) | Name, email, company, phone if you give it, sector, size, region, systems, whatever you write, the page you sent it from, the language and the time of your consent | To reply, arrange the Scan call and, if you ask, prepare a proposal | Consent (Art. 6(1)(a)) and steps before a contract (Art. 6(1)(b)) | 24 months from our last contact if we don’t work together. If we do, for the contract and then as long as tax law requires |
| When you email or phone us | Your address or number, the message and any attachments | To reply to you | Legitimate interest or steps before a contract | As for forms: 24 months from our last contact |
| When you request a PDF (Sector Playbook, mini X-Ray) | Email, sector, and your meter results if you send them | To send the PDF and the few emails the form states | Consent, with email confirmation where the form says so | Until you unsubscribe, or 12 months after the last email in the series |
| When you unsubscribe | Only the email address and the date | So we never email you again | Legitimate interest: honouring your choice | For as long as the mailing list exists |
| When you win a code (Frame Hunt) | The code, when it was issued and a cryptographic fingerprint of the connection; name and email only when you redeem it | To enforce ‘one code per person’ and check redemption | Performing the game terms (Art. 6(1)(b)) | 90 days after the code expires; only anonymous totals remain |
| On every form submission and code request | A cryptographic fingerprint (HMAC-SHA256) of your IP address, keyed with a server secret, and a counter | To stop mass submissions and bots without a CAPTCHA | Legitimate interest: security | Up to one hour, then deleted automatically |
| When you send us your CV | Whatever your CV and message contain | To consider your application | Steps before a contract; for future roles, only with your consent | 6 months after the role closes, or 24 months if you ask us to keep it |
| When you change a setting or answer one of the site’s questions | Preferences and pre-fills on your own device (localStorage, sessionStorage) | So the site remembers what you asked for | Your explicit request (Greek Law 3471/2006, Art. 4(5)) | See the Cookie policy; this never reaches us |
| Camera and microphone in demos | Nothing. Images and sound are processed on your device | — | — | Stored nowhere |
The legal bases, in plain words
- Consent: you give it by ticking a box that isn’t pre-ticked, and you can withdraw it any time without affecting what happened before.
- Steps before a contract: when you ask for something that leads to working together, such as an X-Ray or a proposal.
- Legitimate interest: reasons such as keeping the site secure. You can object, and then we stop, unless an overriding security reason applies.
From form to person
Four stops. No fifth.
Your request is stored in the site’s database as a private record. It appears nowhere on the site, and only the people at Netex who handle requests can see it, each with a personal account and two-step sign-in.
At the same time, the server sends a notification email to info@netex.gr through our email provider. It sends you no automatic reply: the first answer comes from a person. That also means nobody can use our forms to send email to someone else.
We add you to a mailing list only if you ask for it on a form that says so plainly. We don’t pass your details to partners or sell them. Every tool that touches them is in the ‘Who else sees it’ list. If a job needs a partner, for equipment at a plant, say, we ask you first.
The form doesn’t store your IP address. While you fill it in, your answers stay in your browser only; they leave your device only when you send the form.
When we delete a record, it goes from the database and from the mailbox. It leaves the backups when they rotate, within 30 days at most.
If we work together, billing records are kept for as long as Greek tax and accounting law requires, usually five years from the end of the financial year.
Security
We stop bots without asking you to find traffic lights.
We don’t use a CAPTCHA, so none of the Google cookies that come with one either. Forms are protected by three things you never see: an invisible trap field for bots, a signed timestamp that rejects submissions sent too fast or too late, and a limit on submissions per connection.
To apply the limit, we need to recognise the same connection for a short while. We don’t keep the IP address: we keep a fingerprint of it, made with HMAC-SHA256 and a server secret, which can’t be turned back into the address without that key. The fingerprint deletes itself within an hour and is never linked to your form.
Under GDPR, a fingerprint like this is still pseudonymised personal data. That’s why we give it such a short life.
The site is also protected by the Wordfence firewall, which runs on our own server and checks every request before it reaches WordPress. When a request looks like an attack, it logs the IP address and may block it for a while. We take part in the Wordfence security network: IP addresses that hammer our admin sign-in are shared with Defiant Inc. (USA), the company behind Wordfence, so that other sites can block them too.
The site’s admins sign in with personal accounts and a second step, and backups are kept off the server. We don’t publish configuration details, for obvious reasons.
If a breach affects you, we notify the Hellenic Data Protection Authority within 72 hours, and you without delay where the risk is high, as GDPR Articles 33 and 34 require.
The demos
Every demo tells you where its data goes.
Most demos run entirely in your browser. The ones that need more tell you before they start.
- on your device
Meters, scenarios and games
The Hidden Cost Meter, the Process X-Ray, the scenarios and the games calculate in your browser. Nothing you type into them is sent, unless you choose to send it through a form. Prize games ask our server only whether you’ve hit the target, with no identifying details.
- on your device
Camera and microphone
They switch on only after you press the button and your browser asks permission. Images and sound are analysed by a model running inside the page; nothing is uploaded and nothing is stored. Every such demo also has a ready-made example, for anyone who’d rather keep the camera off.
Recipients
Few, named, under contract.
We don’t sell or swap data. It’s seen only by the providers the site needs in order to run, acting as processors on our behalf, under contracts that forbid them to use it for their own purposes.
| Role | What they see | Safeguard |
|---|---|---|
| Website and database hosting | Everything the server stores: forms, logs | Data processing agreement (GDPR Art. 28) |
| Email (info@netex.gr) and notification sending | The emails we exchange and form notifications | Data processing agreement |
| Off-site backups | An encrypted copy of the database and files | Data processing agreement |
| Firewall and security scansDefiant Inc. (Wordfence) · USA | IP addresses that look like attacks; scans send file fingerprints, not personal data | EU-US Data Privacy Framework or standard contractual clauses |
List last updated: 13 October 2026
If we work together, billing details are seen by our accountant and sent to the Greek tax authority (AADE, myDATA), as the law requires.
We give data to public authorities only when the law requires it, for example on a prosecutor’s order, and only what is asked for.
Transfers
We prefer the EU. Where that isn’t possible, we say so.
We choose providers that keep data in the European Union. When a provider sits outside the European Economic Area, such as Defiant (Wordfence) in the US, the transfer happens only on a lawful basis: an adequacy decision, such as the EU-US Data Privacy Framework for certified companies, or the European Commission’s standard contractual clauses. The ‘Where’ column in the recipients table shows each provider’s country.
We’ll send you a copy of the safeguards on request.
Automation
A person decides, not an algorithm.
We make no decisions about you by purely automated means (GDPR Article 22). Requests are sorted by simple rules, such as sector and region, so they reach the right office; a person reads and answers them.
There is one automatic filter: it turns away messages with more than two links, because that’s what spam usually looks like. If it happens to you, the screen says so, and you can write to info@netex.gr directly.
We don’t run form data through third-party AI tools to score or profile you.
The site’s AI assistants say they’re AI in their first sentence, as Article 50 of the AI Act requires, and every realistic image made with AI carries the ‘AI-generated image’ label.
Your rights
One email will do. No paperwork.
You can exercise any of these rights free of charge by writing to info@netex.gr from the address you gave us. We reply within one month; if the request is complex it may take up to two more months, and we’ll tell you so within the first.
If you write from a different address, we may ask you to confirm it’s you. We won’t ask for ID when something simpler will do.
Access
Find out whether we hold data about you and get a copy (Article 15).
Request a copyRectification
Have anything wrong or incomplete corrected (Article 16).
Ask for a correctionErasure
Have your data deleted, except what the law obliges us to keep (Article 17).
Ask for deletionRestriction
Have your data frozen while an objection or a correction is being looked at (Article 18).
Ask for restrictionPortability
Receive what you gave us in a machine-readable format, CSV or JSON (Article 20).
Ask for your dataObjection
Object to processing based on our legitimate interest. We stop, unless an overriding security reason applies (Article 21).
Raise an objectionWithdrawing consent
Any time, as easily as you gave it. What happened before stays lawful (Article 7(3)).
Withdraw consent
These buttons open your email app with the subject filled in. You write the message.
Complaints
You can complain to the authority.
If you believe we’ve breached your rights, you’re entitled to lodge a complaint with the Hellenic Data Protection Authority. We’d rather you told us first so we can put it right, but you don’t have to.
- Hellenic Data Protection Authority (HDPA)
- 1-3 Kifisias Avenue, 115 23 Athens, Greece
+30 210 6475600 · contact@dpa.gr · www.dpa.gr
If you live or work in another EU country, you can also go to that country’s authority.
Children
This site is for businesses. We don’t knowingly collect data from children under 15, the threshold in Greek law (Law 4624/2019, Article 21). The games need no personal details; if you’re under 15, play away, but please don’t fill in a form or join a leaderboard.
In client projects
There, the client is the controller.
In a project, such as an AI Front Desk or invoice reading, the client is the controller and we process the data on their behalf. The data processing agreement (DPA) we sign with them applies, with its sub-processor list and where the data lives. Our commitments are written down in the AI Trust Standard.
If you’re a customer of one of our clients and want to exercise a right, contact them. If you write to us, we’ll forward your request to them straight away.
Changes
When something material changes, we raise the version number and note here what changed. If the change affects data we already hold, we tell you by email before it applies.
Change log
- 1.0 · 13 October 2026 · First version, with the new netex.gr.
Questions about this policy: info@netex.gr.