Privacy Policy

1. Purpose and scope

This Privacy Policy explains how Afterwards Technologies ("Afterwards Technologies", "we", "us" or "our") processes personal data when an individual visits a website on which this Policy is published, contacts us, requests information or a proposal, communicates with our team, participates in our training activities, or otherwise engages with our own business operations. It describes the relevant categories of data, purposes and legal grounds, recipients, retention criteria, international transfers, safeguards and rights under Regulation (EU) 2016/679 (the General Data Protection Regulation, or "GDPR") and applicable Greek data-protection law.

This Policy applies where we determine the purposes and essential means of the processing and therefore act as a controller. Where we process personal data solely on a business client's documented instructions when delivering a software, automation or AI project, the client will normally be the controller and we may act as its processor under a separate data-processing agreement. This Policy does not replace the client's own privacy notice or any agreement required by Article 28 GDPR. The descriptions of optional website features below apply only when the relevant feature is offered. A description of a possible processing activity is not a representation that a particular analytics service, AI chatbot, online checkout, recruitment portal or tracking technology is currently deployed.

2. Controller and privacy contact

For processing undertaken in connection with its own business communications, website and service relationships, the relevant business operates under the name Afterwards Technologies. Questions, privacy requests, concerns about this Policy and notices relating to personal data may be addressed to legal@afterwardstechnologies.com.

Where a specific engagement identifies a different legally responsible controller, or where we act as a processor for a client, the legally applicable contractual and privacy documentation determines the parties' respective responsibilities. A service-provider name alone does not alter the allocation of controller and processor roles required by the GDPR.

3. Data-protection principles

We seek to process personal data lawfully, fairly and transparently; collect it for specified, explicit and legitimate purposes; limit collection to information necessary for those purposes; maintain appropriate accuracy; retain information no longer than justified; and protect it through riskappropriate technical and organisational measures. Processing must be supported by a valid legal basis, documented and reviewed when its purposes, risks, recipients or underlying technology change.

4. Categories of personal data

Depending on the interaction and service concerned, the categories of information that may be processed include:

• Identity and contact details: names, business email addresses, telephone numbers and correspondence details supplied in an enquiry, registration or business relationship.
• Professional and organisational information: employer, position, sector, business requirements, meeting preferences and information reasonably required to prepare or discuss a proposal.
• Communications and project information: enquiry contents, business correspondence, meeting records, support requests, statements of work, instructions, deliverables and feedback.
• Training information: registration, attendance, learning objectives, exercise submissions, assessment or participation information and information needed to provide a certificate of completion, where relevant.
• Transaction and administrative information: contractual and billing records, invoices, payment references and records necessary for tax, accounting or legal compliance. Where an independent payment service processes card payments, its own notice governs the information it collects; we should not be assumed to receive or store full card credentials.
• Technical and security information: IP addresses, browser and device information, request timestamps, access or error logs, network identifiers and security events generated through use of a website or connected service.
• Preferences and consent records: communication preferences and information needed to demonstrate choices concerning marketing or optional tracking.
• Content voluntarily supplied: documents, messages, prompts, feedback, application materials or other information a person chooses to provide, insofar as that content is relevant to the service or communication.

We do not ask people to send health information, payment-card security codes, passwords, government identifiers, biometric data or other special or highly sensitive information in an ordinary website enquiry. Such data should not be submitted unless a dedicated lawful, secure and appropriately documented process has been established.

5. Sources of information

Personal data may be obtained directly from the individual, from an authorised representative of an organisation, from information generated during a service relationship, or from technically necessary interactions with a website or connected business system. In appropriate B2B circumstances, publicly available professional information or a professional referral may be used to identify a relevant business contact, subject to a documented lawful basis, proportionality, the information duties in Article 14 GDPR and applicable rules on electronic marketing.

We do not treat the mere public availability of personal data as unrestricted permission to collect it, enrich profiles, or contact individuals commercially.

6. Purposes and legal bases for processing

Different processing operations may rely on different grounds under Article 6 GDPR. Where appropriate, more than one ground may apply to distinct parts of a relationship; the basis used for one purpose is not automatically applied to an unrelated purpose.

6.1 Enquiries and business communications

We use information supplied in enquiries and correspondence to understand requests, answer questions, arrange discussions and maintain necessary communications. Depending on whether the individual is acting personally or for an organisation, the basis may be steps taken at the individual's request before entering a contract (Article 6(1)(b)) or our legitimate interest in handling genuine business communications (Article 6(1)(f)).

6.2 Proposals, contracts and project delivery

Information may be processed to scope services, prepare offers, carry out contractual commitments, coordinate projects, manage deliverables, obtain approvals and provide agreed support. The basis may be Article 6(1)(b) where the individual is party to a contract, or Article 6(1)(f) where information relates to representatives and personnel of corporate clients. Processing carried out on a client's behalf may instead be governed by the client's instructions and an Article 28 GDPR agreement.

6.3 Accounting, tax and regulatory obligations

Relevant records may be processed and retained to issue invoices, keep accounting records, comply with legally binding obligations, respond to lawful authority requests and fulfil applicable corporate or tax requirements (Article 6(1)(c)).

6.4 Security, incident handling and misuse prevention

Limited technical data and logs may be processed to maintain operational integrity, identify attempted intrusions, investigate failures, protect systems and prevent fraud or abuse, based as appropriate on legitimate interests (Article 6(1)(f)) and legal obligations (Article 6(1)(c)). Such processing is subject to necessity, proportionality and appropriate retention limits.

6.5 Newsletters and direct marketing

If an individual subscribes to a newsletter or otherwise requests marketing communications, personal data may be used for that specified purpose on the applicable lawful basis, including consent where required. Any narrow exception permitting communications to existing customers will be assessed against the conditions of Greek Law 3471/2006 and other applicable rules. Each marketing email must offer a practical opt-out. Submitting a contact request does not, by itself, create newsletter consent.

6.6 Training, workshops and education

Where training is provided, information may be used to organise sessions, register attendees, adapt exercises to stated learning objectives, communicate logistical details and issue completion documentation. The basis depends on the contractual relationship and may include Article 6(1)(b) or 6(1)(f), with Article 6(1)(c) for mandatory records. Recording a session, publishing identifiable participant testimonials or using photographs for promotion requires its own appropriate assessment and information, and consent where legally necessary.

6.7 Recruitment and professional collaboration

If an individual submits a job application or collaboration proposal, relevant information may be assessed for recruitment or engagement purposes, generally in connection with pre-contractual steps or legitimate interests, as applicable. Information will not automatically be retained for an unlimited future talent database merely because an application was received.

6.8 Analytics and optional advertising technologies

Where optional analytics, personalisation, advertising pixels or comparable trackers are used, the applicable device-access consent requirements and the GDPR basis must both be satisfied. Technologies requiring prior consent must remain inactive until that consent is obtained. Rejecting optional tracking must not prevent access to ordinary content merely because tracking is commercially desirable.

6.9 Legal claims and business protection

Information that is relevant to an actual or reasonably anticipated dispute may be processed where necessary to establish, exercise or defend legal claims, comply with binding obligations, or protect legitimate interests. Any related retention must be limited to what is justified by the dispute and applicable law.

7. Necessity of providing information

Certain information is necessary to respond meaningfully to an enquiry, identify the contracting party, deliver requested services or comply with a legal obligation. Failure to provide it may prevent us from responding or entering into or performing an agreement. Consent for non-essential cookies, unrelated marketing or optional profiling is not a prerequisite for ordinary website access or a condition automatically attached to a request for a business proposal.

8. Cookies, local storage and similar technologies

Websites may rely on strictly necessary technologies for core operation, cybersecurity, load balancing, session continuity and recording a visitor's privacy preferences. Where the statutory conditions for the strictly necessary exception are met, prior consent is not required for those operations. Cookies or comparable techniques used for optional analytics, behavioural advertising, profiling or other non-essential purposes require consent before being placed or accessed, unless a specific legal exemption genuinely applies.

If consent-based technologies are deployed, the consent mechanism must explain their purposes, permit a genuine choice to accept or reject at the same level and with comparable ease, avoid preselected consent and allow withdrawal as easily as consent was given. The precise identifiers, providers, purposes and expiry periods must be disclosed through a current cookie inventory or consent interface reflecting the technologies actually used. This general explanation does not substitute for a feature-specific cookie notice where one is required.

9. AI-enabled interactions and submitted prompts

If we offer an AI-enabled interaction through our own website or services, the interaction will be identified as involving artificial intelligence when applicable transparency law requires it. Depending on the specific function, information processed may include the user's prompt, relevant conversation context, technical metadata, generated response and records necessary for security, troubleshooting or quality assurance.

An AI feature may use external model or infrastructure providers. Whether submitted content is logged, retained, transferred outside the EEA, reviewed or used to improve a model depends on the actual system design and the applicable provider terms; no universal statement that prompts are never stored or used for training should be inferred from this Policy. Appropriate information and contractual controls must be established before such processing takes place.

Users should not enter third-party personal data, confidential business records, credentials, paymentcard information or sensitive information into general-purpose prompts unless a secure, authorised workflow expressly supports that use. AI outputs may be incomplete or incorrect and should be independently reviewed where decisions matter.

10. Automated decisions and profiling

This Policy does not authorise decisions based solely on automated processing that produce legal effects or similarly significant effects on an individual. If such processing is introduced, it must be evaluated separately under Article 22 GDPR and other applicable legislation, including requirements for a lawful exception, meaningful information, safeguards and the ability to obtain human intervention where required.

11. Client projects: controller and processor responsibilities

In technology, AI, software, data and automation engagements, our access to personal data may be determined by the client's systems and instructions. If the client is controller and we are processor, processing must be limited to documented instructions and governed by an Article 28 GDPR agreement that addresses confidentiality, sub-processors, technical and organisational safeguards, breach notification, assistance with data-subject rights, transfers, audits and return or deletion at the end of the engagement.

The client's compliance responsibilities are not transferred to us by publishing this website Policy, and this Policy is not a substitute for project-specific risk assessments, security terms or data-processing documentation.

12. Data recipients and service-provider categories

Subject to necessity, confidentiality and lawful arrangements, relevant information may be accessible to authorised personnel and professional contractors, hosting and infrastructure providers, businessemail and communications services, scheduling and video-meeting services, project-management and CRM providers, training delivery providers, payment service providers, accountants, professional advisers, cybersecurity providers and AI API providers, insofar as they are actually engaged for a specific operation.

We may also disclose information where required by applicable law, a valid legal process or a competent authority, or where necessary to assert or defend legal rights. A third-party provider's independent processing, where applicable, is governed by its own legal responsibilities and the relevant disclosures to affected individuals.

13. International transfers

When personal data is transferred to, or made remotely accessible from, a country outside the European Economic Area, the relevant transfer must be supported by an appropriate mechanism under Chapter V GDPR. Depending on the destination and recipient, this may involve an adequacy decision, European Commission standard contractual clauses and any supplementary safeguards required by a transfer-risk assessment.

Where reliance is placed on a specific EU–US Data Privacy Framework certification, the recipient's current participation and scope must be verified. Individuals may request information about safeguards relevant to their data at legal@afterwardstechnologies.com. This Policy does not assert that any particular international transfer is currently occurring.

14. Retention and deletion

Personal data is retained only for a period justified by the relevant purpose, the service relationship, mandatory recordkeeping, security requirements or the establishment, exercise or defence of claims. The criteria used to determine retention include the nature of the interaction, whether a contract is active, the applicable statutory retention period, the age and relevance of the information, security needs and whether a legal hold is necessary.

Routine unanswered enquiries should not remain indefinitely in active systems; transactional records may need to be kept for longer where accounting or tax law requires it; marketing information should cease to be used upon a valid opt-out; and security logs should be subject to limited, purpose-specific schedules. Where an exact operational retention schedule is legally required, it must reflect the actual systems and be communicated in the relevant notice. Backup deletion may take place within controlled technical cycles, subject to restricted access until removal.

15. Security safeguards

Protection measures should be proportionate to the nature and risks of processing and may encompass identity and access management, strong authentication, encrypted data transfer, rolebased restrictions, secure software development, patching, vulnerability management, logging, backups, confidentiality commitments, supplier due diligence, staff awareness and secure deletion practices. The actual safeguards are determined by the relevant system and risk assessment; publishing this Policy is not a guarantee that every possible measure is deployed in every environment. No method of online transmission or storage can be guaranteed entirely risk-free.

16. Personal-data breaches

Where a personal-data breach occurs, the incident must be assessed, documented, contained and handled according to the roles and obligations that apply. A controller must notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a notifiable breach unless the legal conditions for an exception are met; affected individuals must be informed when Article 34 GDPR requires it. Where we act as a processor, the relevant controller must be informed without undue delay in accordance with law and the applicable processing agreement.

17. Your GDPR rights

Subject to the GDPR's conditions and exceptions, individuals may request access to their personal data, correction of inaccuracies, erasure, restriction of processing and portability where applicable; may object to processing based on legitimate interests; and may invoke rights relating to certain solely automated decisions. Where processing is based on consent, that consent may be withdrawn at any time without affecting the lawfulness of processing carried out before withdrawal. Objection to processing for direct marketing may be exercised at any time.

To submit a request, contact legal@afterwardstechnologies.com. We may require proportionate identity verification where reasonably necessary. Requests must be handled without undue delay, normally within one month of receipt, subject to the extensions and other provisions permitted by Article 12 GDPR. Rights are not absolute and may be subject to lawfully applicable restrictions.

18. Complaints to a supervisory authority

An individual has the right to lodge a complaint with a competent supervisory authority, in particular in the EU Member State of habitual residence, place of work or alleged infringement. For matters within its competence, the Greek authority is the Hellenic Data Protection Authority (HDPA), whose official website is https://www.dpa.gr/en. We encourage individuals to contact legal@afterwardstechnologies.com first if they wish us to review a concern, but doing so is not a prerequisite for exercising the statutory right to complain.

19. Children and minors

Our corporate services and professional-facing content are intended principally for adults and business users. We do not intentionally request children's data through ordinary business enquiries. Any educational activity expressly intended for minors must have age-appropriate information, a valid lawful basis, suitable safeguarding and any parental authorisations required by applicable law. Where we learn that data was collected without a lawful basis, we will assess and take appropriate corrective action.

20. External websites, social media and embedded services

Links to social networks, third-party websites, learning platforms, payment processors or externally hosted media may lead to services whose operators act as separate controllers or otherwise determine their own processing. Their privacy information should be reviewed before disclosure of personal information. Embedding an external service may also involve cookies or transfers; such embedding must be evaluated and configured consistently with applicable consent and information obligations.

21. Changes to this Policy

This Policy may be updated where services, legal requirements, processing purposes or technical arrangements change. The version made available on the relevant website will state its update date. Where the law requires individual notice or renewed consent for a material change, the appropriate steps must be taken before the new processing begins. Changes to this text do not retrospectively make earlier unlawful processing lawful.

22. Contact

For questions concerning this Privacy Policy, the handling of personal data, or the exercise of dataprotection rights, please contact legal@afterwardstechnologies.com.