Privacy Policy

Last updated: [1 October 2025]
Who we are: Flip Digital Agency (“Flip”, “we”, “us”) is a boutique digital agency based in Athens with operations in the Netherlands.
Contact: contact@flipdigital.gr
EU presence: We serve clients in Greece, the Netherlands and other EEA countries.

Scope

This policy explains what personal data we collect on flipdigital.gr and connected pages, why we collect it, how we use and share it, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR).

What we collect

We collect the minimum data needed to provide our services:

Contact & inquiry data: name, email, phone, company, role, project details, messages.
Contract & billing data: business address, VAT/Tax ID, invoicing records.
Website & device data: pages viewed, referrers, approximate geo, browser/OS, device identifiers, IP addresses, cookies or similar technologies (only where consented, except strictly necessary).
Support & hosting data: website URLs we manage, server logs, change logs, incident details.
Marketing preferences: newsletter opt-ins/opt-outs, campaign interactions.

Why we use your data (purposes & legal bases)

We process data only when a lawful basis applies (GDPR Art. 6). The main ones for an agency like ours are:

To respond to inquiries and deliver proposals — perform pre-contract steps or a contract with you.
To provide and support projects (web design, hosting, maintenance, marketing) — perform a contract.
To invoice, keep accounts, and meet tax/record-keeping duties — legal obligation.
To secure our sites and services (logs, fraud/abuse prevention), improve UX, and run basic analytics — our legitimate interests, balanced with your rights.
To run marketing communications or place non-essential cookies/trackers — your consent, which you can withdraw at any time.

Cookies and similar technologies

We use strictly necessary cookies to make the site work. For analytics, performance, or advertising cookies, we ask for your consent before setting anything and provide an equal “Reject” option. You can change or withdraw consent at any time via the Cookie Settings link in the footer. Requirements for cookie consent come from the ePrivacy Directive (Art. 5(3)) and GDPR consent rules (freely given, specific, informed, unambiguous; no pre-ticked boxes or consent by scrolling).

If you use GA4/other tools, add:
We use [Google Analytics 4/Matomo/etc.] to understand aggregated site usage. We configure it to respect IP anonymisation (where supported) and data retention limits. Only after you consent do we load this tool.

5) Where data comes from

Directly from you via forms, email, phone, or meetings.
Automatically from your device when you visit our site (see Cookies).
In B2B contexts, basic business contact data may also come from public sources or referrals.

6) How we share data

We don’t sell your personal data. We share it only with:

Processors that help us operate: secure hosting/backup providers, email and CRM tools, error monitoring, analytics/advertising vendors (loaded only after consent), payment and accounting tools.
Professional partners we appoint for a project (e.g., developers, copywriters, media buyers) under NDA and DPAs.
Authorities if required by law or to protect rights and security.

For each processor we sign a Data Processing Agreement and ensure suitable security. Where a vendor is outside the EEA, we rely on an adequacy decision or EU Standard Contractual Clauses and apply additional safeguards as needed.

How long we keep data

Inquiry records: up to 12 months if no project starts.
Project/contract and invoicing records: as required by law (typically 6–10 years, depending on jurisdiction).
Analytics/marketing data: per your consent and the retention settings we configure in the tools.
We delete or irreversibly anonymise data when it’s no longer needed.

Your GDPR rights

You can exercise these rights at any time (subject to narrow exceptions):

Access — obtain a copy of your data we hold.
Rectification — correct inaccurate or incomplete data.
Erasure — request deletion (“right to be forgotten”).
Restriction — limit processing in certain cases.
Portability — receive data in a structured, machine-readable format.
Object — object to processing based on legitimate interests or direct marketing; we will stop unless we have compelling legitimate grounds.
Consent withdrawal — where processing relies on consent, you can withdraw it at any time without affecting past lawful processing.

To make a request, contact contact@flipdigital.gr. To protect your data, we may ask you to verify your identity. We will respond within one month where feasible.

Children

Our services are B2B and not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has provided us data, contact us and we will delete it.

11) Security

We use appropriate technical and organisational measures to protect personal data, including encrypted transport (TLS), access controls, role-based permissions, backups, and vendor due diligence. No method is 100% secure, but we continually improve our safeguards.

Links to other sites

Our website may link to third-party websites. Their privacy practices are their own; please review their policies.

Changes to this policy

We may update this policy from time to time. We’ll post the latest version here and change the “Last updated” date.

Contact

For privacy questions or requests, email contact@flipdigital.gr.