Privacy Policy

1. Who is responsible for your data

This public marketing website is operated by Voulgaridis Athanasios (ΒΟΥΛΓΑΡΙΔΗΣ ΑΘΑΝΑΣΙΟΣ), a sole proprietorship (Ατομική Επιχείρηση) established in Greece, trading under the registered distinctive title (διακριτικός τίτλος) Atomic Solution.

• Registered address: ΠΟΛΥΚΡΑΤΟΥΣ ΑΝΩΝΥΜΟΣ 13, ΕΥΟΣΜΟΣ ΘΕΣΣΑΛΟΝΙΚΗΣ, ΚΟΡΔΕΛΙΟΥ-ΕΥΟΣΜΟΥ / ΘΕΣΣΑΛΟΝΙΚΗΣ, 56224
• VAT number (ΑΦΜ): 166815237
• Business registry (ΓΕΜΗ) number: 187113806000

References to "Atomic Solution", "we", and "us" in this policy mean that business, which is the controller of personal data processed through this website.

For privacy questions or to exercise your rights, email [email protected]. We have not appointed a data protection officer. Privacy matters are handled directly through that address.

2. Scope

This policy covers only the public marketing website at atomic-solution.com, including its contact form and chat assistant. The website is intended for people acting for business or professional purposes, not for personal or household use.

Any password-protected area we operate for existing clients is outside this policy. Processing there is governed by the separate agreement covering that relationship.

3. Data we collect

• Contact form: your name, email address, company name if supplied, project information, budget range, and anything else you include in your message.
• Chat assistant: your messages and recent conversation context. If you ask for human follow-up, we also store the contact details and relevant message or summary you submit.
• Technical and security information: IP address and limited request information used for site security, abuse prevention, and rate limiting.
• Consent and attribution information: your consent choices and, only after marketing consent, landing page, referrer, campaign parameters, Google advertising identifiers, LinkedIn advertising identifiers, and capture time.

We collect this information from you directly and from your device as you use the website. We do not buy contact lists and we do not assemble profiles from outside data sources.

Only the fields marked required on the contact form are needed for us to reply. You are not obliged to provide them, but without them we cannot respond to your enquiry.

Please do not submit sensitive personal data, confidential information, or information you do not have the right to share.

4. Why we use data and our legal bases

• To respond to an enquiry and take steps you request before a possible business agreement — Article 6(1)(b) GDPR, steps taken at your request before a contract.
• To operate and secure the website, prevent abuse, and understand basic service performance — Article 6(1)(f) GDPR, our legitimate interests, where those interests are not overridden by your rights.
• To run optional analytics or advertising measurement — Article 6(1)(a) GDPR, the consent you give per category.
• To comply with duties imposed by law — Article 6(1)(c) GDPR, legal obligation.

Where we rely on legitimate interests, you may object at any time as described in section 10. We will stop unless we can demonstrate compelling legitimate grounds that override your rights.

You may withdraw consent at any time through Cookie settings. Withdrawal does not affect processing that was lawful before it.

5. Cookies, local storage, and measurement

The site stores the necessary `atomic_consent` cookie for up to one year so it can remember your analytics and marketing choices. Optional tools remain off until you select the corresponding category.

Consent-aware delivery — Google Tag Manager. Google Tag Manager may load after you accept Analytics or Marketing, but it is only a delivery mechanism: each tag it delivers must be independently permitted by your current choice. It may not bypass or combine the categories below.

Analytics — Google Analytics 4. When you accept Analytics, Google Analytics 4 may receive device, browser, page, and interaction information to help us understand aggregate site use.

Marketing — Google Ads. When you accept Marketing, Google Ads conversion tracking may receive limited visit and conversion information to measure whether advertising led to an enquiry. We do not send the contents of your enquiry.

Marketing — LinkedIn. When you accept Marketing, the LinkedIn Insight Tag and LinkedIn conversion tracking may receive limited device, visit, and conversion information to measure advertising performance. We do not send the contents of your enquiry.

After marketing consent, limited attribution information may be kept in your browser's local storage. Withdrawing Marketing consent instructs the browser to delete the `atomic_marketing_attribution` record immediately, stops marketing tags from loading, and prevents any older attribution record from being reused if consent is granted again. Provider cookies already placed on your device can also be removed through your browser controls.

6. The chat assistant

The assistant uses either OpenAI or Google, depending on the active configuration. One provider receives your current message and recent conversation context to generate each response; the same request is not sent to both. If you request human follow-up, the information you submit is also saved as an enquiry record.

Assistant replies may be incomplete or incorrect. Do not use the chat for confidential, sensitive, urgent, or high-risk information.

The assistant answers questions. It does not take decisions about you that produce legal effects or similarly significant effects, it does not score, rank, or reject enquiries without a person involved, and we do not use it to profile you. Every enquiry that leads to follow-up is read by a person.

7. Who receives data

We use service providers only as needed to operate this website:

• Hostinger: hosting on a VPS located in Germany.
• ChatGPT or Gemini: whichever provider is active for the chat request.
• Google: Tag Manager, Analytics 4, and Ads, according to the separate consent choices described above.
• LinkedIn: Insight Tag and conversion tracking, only after Marketing consent.
• Resend and operational notification providers: to deliver an enquiry to us by email or operational alert when configured.

These providers process data under their own service terms and our applicable arrangements with them. We do not sell or rent personal data, and we do not give enquiry details to unrelated businesses for their own marketing. Sending an enquiry does not subscribe you to marketing email.

8. Location and international transfers

Website and enquiry data is hosted on our Hostinger VPS in Germany. Some providers named above may process data outside Greece or the European Economic Area. Where required, transfers rely on a lawful safeguard such as an adequacy decision or approved contractual clauses. Provider locations and safeguards may change with the active service configuration.

9. Retention and deletion

If a website enquiry does not become a separate business relationship, we delete the enquiry record and its metadata 12 months after the last meaningful interaction about that enquiry. We retain only a cumulative anonymous count of deleted enquiries. That count contains no contact details, message text, campaign identifier, or link back to an individual enquiry.

We may pause deletion for a documented legal obligation, legal claim, or separate active business relationship. Each exception must have a recorded reason and review date. When it ends, the original last-interaction retention clock continues rather than restarting, so an already-expired enquiry is eligible for the next deletion run.

Ordinary website access logs are retained for 30 days. Short-lived security and rate-limit records may expire sooner. If an enquiry becomes a separate business relationship, records needed for that relationship follow the retention periods required by the separate agreement and applicable law.

Copies held by email, notification, analytics, or chat providers are governed by the corresponding operational deletion controls and provider arrangements. Backup copies are isolated from normal use and must age out under the backup-retention process before being overwritten or deleted.

10. Your rights

Subject to applicable law, you may request access, correction, deletion, restriction, or portability of your personal data, or object to processing based on legitimate interests. You may withdraw consent at any time.

Send a request to [email protected]. We may need enough information to verify your identity. You may also complain to the Hellenic Data Protection Authority.

We will respond without undue delay and normally within one month after receiving your request. Where the law permits an extension because a request is complex or numerous, we will tell you within the first month and explain the delay.

11. Security

We use proportionate safeguards including transport encryption, access controls, input validation, rate limiting, and restricted access to stored enquiries. No internet service can guarantee absolute security.

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Hellenic Data Protection Authority without undue delay, and we will tell you directly where the law requires it.

12. Children

This B2B website is not directed at children. Do not submit information about a child through its form or chat.

13. Changes

We may update this policy when the public website, its providers, or applicable requirements change. The publication date shown on the page identifies the current version. Where a change materially affects how we use your personal data, we will show a notice on the website rather than relying on the date alone.

Your use of this website is also subject to our Website Terms of Use.