Data protection (GDPR)

1. The data controller

The data controller is AQUA VISTA RENTALS ΜΟΝΟΠΡΟΣΩΠΗ Ι.Κ.Ε., Dimitriou Gounari 227, 16674 Glyfada, Greece, G.E.MI. 180317509000. You can write to us at contact@lidz.eu. We have not appointed a data protection officer (DPO); we deal with requests sent to this address directly.

2. Your rights

• The right of access: to find out what data we process about you and to receive a copy of it.
• The right to rectification: to have inaccurate data corrected and incomplete data completed.
• The right to erasure: to have your data deleted when we no longer have a legal basis to keep it.
• The right to restriction of processing: to have your data used only in a limited way until a matter is clarified, for example when you contest its accuracy.
• The right to data portability: to receive the data you have given us in a format that other programs can read too.
• The right to object: to object to the processing of your data based on our legitimate interest. If you ask us not to call you again, we will not call you again.
• The right not to be subject to a decision based solely on automated processing that produces legal effects: we do not take such decisions about you. The Hot, Warm or Cold classification of a call only decides whether contact details reach agencies.

3. How to exercise your rights

• Send us your request at contact@lidz.eu. You do not need an account and it costs nothing.
• We reply within one month at most. If the request is complex, this period may be extended by two further months; in that case, we tell you within the first month.
• So that we do not disclose someone else's data, we may ask you to prove that you are the person concerned, for example that the phone number is yours.
• Agents can delete their own account in Settings › Account.

4. Who processes data for us

Our providers process data only for the services they provide to us, under their data processing agreements:

• Replit: hosting the site, the app and the database; counting visits (Replit Analytics), only with the visitor's consent.
• Vonage: sending sign-in codes by SMS and WhatsApp.
• Elastic Email: sending sign-in codes by email.
• Apple and Google: signing in with an Apple or Google account, and alerts on iPhone and Android.
• Browsers' notification services: alerts in the browser. Alerts do not contain owners' names or phone numbers.
• ElevenLabs: the AI assistant that makes the calls, including their recording and transcription.
• Twilio: the phone line through which the calls are made.
• Stripe: card payments for the plans.
• Zoho: issuing invoices for the plans.

We check businesses' invoicing details with ANAF and in VIES, the European Union's system for validating VAT numbers.

5. Transfers of data outside the European Economic Area

Some providers are located outside the European Economic Area, for example in the USA. In these cases, data is transferred under the EU–US Data Privacy Framework, if the provider is certified, or under the standard contractual clauses adopted by the European Commission.

6. How we protect data

• Owners' numbers, first names and streets, as well as call transcripts, are stored encrypted; agents see them only after “I'll take it”.
• We keep a record of every number opened: which number, from which account and when.
• All connections are encrypted (HTTPS), and the session cookie cannot be read by scripts on the page.
• Agents sign in with a one-time code or with their Apple or Google account, without a password.
• Deleted data may remain for a while in the database's backups, until these are replaced.

7. Security incidents

If a personal data breach occurs, we notify the data protection authority within 72 hours of becoming aware of it. If the incident poses a high risk to you, we also inform you.

8. The right to lodge a complaint

If you believe that we are not respecting your rights, please write to us at contact@lidz.eu. You also have the right to lodge a complaint with a data protection authority:

• in Greece, where we have our registered office: the Hellenic Data Protection Authority (HDPA), www.dpa.gr;
• in Romania: the National Supervisory Authority for Personal Data Processing (ANSPDCP), www.dataprotection.ro;
• in the European Union member state where you live or work.