Legal

Privacy Policy

Last updated: 1 October 2026

This page is a starting template describing what the Nautiplex Network platform actually collects and does today — it has not been reviewed by a lawyer. Confirm the content with legal counsel before relying on it for a real launch.

Who we are

The controller of the personal data described here is Nautiplex, trading as Nautiplex Network. Contact us about anything on this page at info@nautiplex.com. We have not appointed a Data Protection Officer, as the law doesn't require one for our processing.

What we collect, why, and for how long

Booking requests (listing pages)

Data: Name, email or phone, preferred date, party size, message, and the package you selected.
Purpose: Passing your request to the operator you contacted so they can reply.
Legal basis: Steps you ask us to take before a possible contract with the operator (GDPR Art. 6(1)(b)).
Who sees it: The operator you contacted, and Nautiplex staff.
Kept for: Deleted automatically 24 months after you send it, or sooner on request.

Reservation requests (hotel, restaurant and other partner pages)

Data: Name, email, date and time, party size, occasion and message.
Purpose: Passing your request to the venue you contacted so they can reply.
Legal basis: Steps you ask us to take before a possible contract with the venue (GDPR Art. 6(1)(b)).
Who sees it: The venue you contacted, and Nautiplex staff.
Kept for: Deleted automatically 24 months after you send it, or sooner on request.

Contact form (/contact)

Data: Your name, email address, optionally your phone or WhatsApp number and business name, the topic you picked and your message.
Purpose: Answering your question, or following up on a request to list your business or become a partner.
Legal basis: Steps you ask us to take, including before a possible contract (GDPR Art. 6(1)(b)), and our legitimate interest in answering enquiries (Art. 6(1)(f)).
Who sees it: Nautiplex staff. The message is delivered to our inbox by email; it isn't stored in the site's database.
Kept for: Kept in our inbox only as long as needed to handle your message, and no longer than 24 months.

Business sign-up forms (forms.nautiplex.com)

Data: For businesses applying to be listed: trading and legal name, VAT number (ΑΦΜ) and tax office (ΔΟΥ), address, contact person, phone, email and invoicing email, licence details, opening hours, prices, descriptions, and links to photos or social profiles.
Purpose: Creating and updating the business's pages and QR codes, contacting the business about its listing, and invoicing.
Legal basis: Performing the listing agreement the business asks for (GDPR Art. 6(1)(b)), and our legal obligation to keep invoicing records (Art. 6(1)(c)).
Who sees it: Nautiplex staff. The form is delivered to our inbox by email through FormSubmit (formsubmit.co); card payments, when requested, are handled by Stripe.
Kept for: For as long as the business is listed, then up to 24 months; invoicing records for as long as Greek tax law requires.

Problem reports (/report)

Data: The page or QR code concerned, your description, and optionally your name and contact details.
Purpose: Investigating safety concerns, misleading listings, tampered QR codes and illegal content, and telling you the outcome.
Legal basis: Our legal obligation to handle notices of illegal content (EU Digital Services Act Art. 16; GDPR Art. 6(1)(c)) and our legitimate interest in keeping listings safe and accurate (Art. 6(1)(f)).
Who sees it: Nautiplex staff. Where needed to resolve a report, the operator concerned (without your contact details unless you agree) or the competent authorities.
Kept for: Open reports are kept until resolved; resolved reports are deleted 24 months after resolution.

QR code scans

Data: Device type, browser, language and approximate country (from our hosting provider's network, not GPS). No cookie and no identifier that links one scan to another.
Purpose: Counting scans per sticker and spotting broken or abused QR codes.
Legal basis: Our legitimate interest in running and securing the QR service (GDPR Art. 6(1)(f)). You can object at any time.
Who sees it: Nautiplex staff only, in aggregated form.
Kept for: Deleted automatically after 400 days.

Admin sign-in (Nautiplex staff only)

Data: Email address and sign-in records, handled by Supabase Auth. We never see or store passwords.
Purpose: Restricting the dashboard to authorised staff and recording who changed what.
Legal basis: Our legitimate interest in securing the platform (GDPR Art. 6(1)(f)).
Who sees it: Nautiplex staff.
Kept for: For as long as the staff account exists; audit records are kept for accountability.

Security log (sign-in attempts)

Data: For each attempt to sign in to the staff dashboard or reset its password: the email address entered, IP address, browser user agent, whether it succeeded, and the time.
Purpose: Detecting and stopping password-guessing and other attacks on staff accounts.
Legal basis: Our legitimate interest in securing the platform (GDPR Art. 6(1)(f)).
Who sees it: Nautiplex staff.
Kept for: Deleted automatically after 90 days.

Website analytics (Google Analytics) — only if you accept

Data: Pages viewed, how you arrived (e.g. a search or a link), device and browser type, approximate location (country/city), and a random cookie ID. Google signals and advertising features are off; we send no names, emails or phone numbers.
Purpose: Understanding which pages and listings are used so we can improve the site and know what brings visitors.
Legal basis: Your consent (GDPR Art. 6(1)(a); Law 3471/2006 Art. 4(5)). Withdraw it any time via “Cookie settings” in the footer.
Who sees it: Google Ireland Ltd as our processor; Nautiplex staff see aggregated reports.
Kept for: Analytics data is kept for 14 months; the cookies last up to 2 years unless you clear them.

We never process payments or store card details, and don't sell data. Analytics and advertising cookies run only if you accept them in the cookie banner. We don't make automated decisions about you. See the Cookie Policy for what is stored on your device and the optional cookies you can accept or reject.

Service providers and international transfers

Data is stored with Supabase (database and authentication) and served through Vercel (hosting). Contact-form messages and notices about new requests and reports are delivered by email through Resend, and business sign-up forms through FormSubmit; card payments for listings, when requested, go through Stripe. If you accept analytics cookies, Google Ireland processes the analytics data. Each processor acts under a data processing agreement and may only use the data to provide their service to us. Where any of them processes data outside the European Economic Area, the transfer is covered by the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or send it to you in a portable format. You can object at any time to processing based on our legitimate interests. Email info@nautiplex.com and we'll reply within one month. Giving us your details is voluntary, but without contact details an operator can't reply to your request.

You also have the right to complain to the Hellenic Data Protection Authority, Kifisias 1-3, 115 23 Athens, Greece — complaints@dpa.gr, www.dpa.gr — or to the data protection authority where you live.

Children's privacy

Nautiplex Network is a general-audience directory for boat charter businesses, not a service directed at children. Our forms are meant for adults: anyone under 15 — the age of digital consent in Greece (Law 4624/2019, Art. 21) — should ask a parent or guardian to send the request. We don't knowingly collect personal information from children under 15; if we learn that we have, we'll delete it promptly — contact us at info@nautiplex.com. Details about children that a parent includes in a request (ages, swimming ability, needs) are used only to pass the request on and are deleted with it. See also Child safety and protection.