MarketStarter / Privacy & cookies Plain language
Privacy and cookies.
What we collect, why we collect it, who else sees it, and how to make us stop. We sell data plumbing for a living, so we would rather explain ours than hide it.
Last updated: 24 July 2026
Section 01Who we are
MarketStarter is the trading name of a one-person business (a Greek ατομική επιχείρηση) registered in Greece. We install AI and CRM systems for businesses. This website is marketstarter.gr.
For everything described on this page, the data controller — the person who decides why and how your data is used — is:
- Legal name
- Vasios Georgios tou Anastasiou — sole proprietorship, trading as MarketStarter
- Registered address
- Kochylia, Skyros, 34007 Evia, Greece
- Tax number (ΑΦΜ)
- 145329584
- General Commercial Registry (ΓΕΜΗ)
- 189710822000 · EUID ELGEMI.189710822000
- hello@marketstarter.gr
We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR. For any privacy question, write to hello@marketstarter.gr — it reaches a person, not a ticket queue.
This policy is available in English and Greek. Both versions are intended to have the same meaning; if you spot a discrepancy, please tell us and we will fix it.
Section 02What this policy covers
It covers this website, the contact form on our contact page, the booking page at /book/, and business enquiries you send us by email.
It does not cover other companies' websites we link to. If you follow a link from here to somewhere else, that site's own policy applies.
Section 03What we collect, and how
You give it to us
When you send the contact form: your first and last name, your work email address, your company, which system you are asking about, and — if you write one — your message. Your phone number is optional.
When you book a call: your name, email address, the time you choose, and any notes you add. The calendar itself is served by Cal.com and loads only when you ask for it — by pressing the button on the booking page, or by arriving there through a “Book a call” button elsewhere on this site, in which case that click is your request and the calendar opens ready.
Fields we genuinely need in order to reply are marked as required on the form. Anything marked optional can be left blank, and the only consequence is that our answer will be less specific.
We collect it automatically
- Server logs. Our hosting provider records the IP address, browser user-agent and timestamp of requests to this site, as part of running and securing it.
- Marketing attribution. If you arrive from an ad, a campaign link or another website, your browser keeps a note of where you came from — the
utm_source,utm_medium,utm_campaign,utm_termandutm_contentvalues in the link, the Google and Meta click identifiers (gclid,wbraid,fbclid), the first page you landed on, the page you were on when you sent the form, and the site that referred you. This is stored only in your own browser's session storage, it disappears when you close the tab, and it is sent to us only if you choose to submit the form. See Section 10. - Analytics. Only after you agree to it. See Section 10.
We obtain it from other sources
To answer an enquiry properly we may look up publicly listed information about the company you work for. This is explained in full in Section 05.
Section 04Why we use it, and on what legal basis
Under the GDPR we must have a lawful basis for each thing we do with your data. Here is the complete list.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Replying to your enquiry and scoping the work | Name, work email, phone number if you give one, company, service interest, message | Art. 6(1)(b) where your enquiry is a genuine step towards a contract; Art. 6(1)(f) otherwise — our interest in responding to and keeping a record of business enquiries | 12 months from last contact |
| Keeping a CRM record of the enquiry | The above, plus the status of the enquiry and our own notes | Art. 6(1)(f) — our interest in running a sales pipeline and keeping business records | 24 months from the last meaningful interaction |
| Understanding which channels bring enquiries | utm_* values, gclid, wbraid, fbclid, landing page, the page you submitted from, referring site |
Art. 6(1)(f) — our interest in understanding which campaigns and channels generate enquiries | 24 months, with the CRM record |
| Blocking automated and spam submissions | A hidden field no human sees, and how long the form took to fill in | Art. 6(1)(f) — our interest in preventing automated abuse of our forms | Not stored beyond the submission decision |
| Looking up publicly listed information about the enquiring company | The domain of your email address (for example acme.gr); in return, company name, industry, employee-count band, country and publicly reported technology stack |
Art. 6(1)(f) — our interest in understanding the size, sector and systems of the business enquiring, so we can reply with a relevant scope and price | 12 months from last contact, or immediately on disqualification — whichever is sooner |
| Booking a call | Name, email, chosen time, any notes you add | Art. 6(1)(b) — steps taken at your request before entering a contract | 24 months from last contact |
| Recording your cookie choice | Your choice per category, a consent identifier and timestamp, your country, and a pseudonymised IP address | Art. 6(1)(c) — a legal obligation: where we rely on your consent we must also be able to demonstrate it (Art. 7(1) GDPR, and art. 4(5) of Greek Law 3471/2006) | For the life of the consent, plus 12 months |
| Website analytics (Google Analytics 4, loaded through Google Tag Manager) | A cookie identifier, IP address, pages viewed, and the fact that a form was submitted or a call booked | Your consent — Art. 6(1)(a) GDPR and art. 4(5) of Greek Law 3471/2006 | 14 months (event and user data alike; set in Google Analytics) |
| Advertising measurement (Meta / TikTok) — not currently active | — | Your consent — Art. 6(1)(a) and Law 3471/2006 art. 4(5) | n/a |
| Notifying ourselves internally that a new enquiry has arrived | A reference number, the service interest and a link — never your name, email, phone number or message text | Art. 6(1)(f) — our interest in responding promptly | Not retained beyond the notification |
On legitimate interests
Where we rely on legitimate interests, we have carried out a balancing assessment weighing our interests against your rights and freedoms. You can request a summary of it at hello@marketstarter.gr.
Section 05Information we obtain from other sources
This section exists because of Article 14 GDPR, which applies whenever a company holds information about you that you did not give it directly. We would rather spell it out than bury it.
What we look up
When an enquiry arrives, our system may look up publicly listed information about the company: its name, industry, employee-count band, the country it is based in, and the technology it publicly reports using — for example whether it already runs HubSpot, Salesforce or Shopify. That last point is the one that actually changes what we quote you.
What we send in order to do it
Only the domain of your email address — the part after the @, for example acme.gr. We do not send your name, your email address, your phone number or anything you wrote in the message.
Where it comes from
From ZenLeads Inc., trading as Apollo.io, 440 N Barranca Ave #4750, Covina, CA 91723, USA — a commercial business-contact database. Apollo compiles that database from publicly accessible sources, including company websites and professional networking profiles, and from data contributed by its own users. Apollo's own privacy information is at apollo.io/privacy-policy.
Why, and on what basis
To qualify and route inbound business enquiries so that we can reply with a relevant scope and price. The legal basis is our legitimate interest under Article 6(1)(f) — specifically, our interest in understanding the size, sector and systems of the business enquiring before we answer it.
Who then sees it
The information is stored on the enquiry record in our CRM (Salesforce) and passes through our own automation server. Apollo.io acts as a separate, independent controller of the data held in its own database — it is not acting on our behalf when it operates that database. The lookup involves a transfer to the United States; see Section 07.
How long we keep it
The looked-up fields are deleted 12 months after our last contact with you, or immediately if we conclude there is no fit — whichever comes first. They are stored separately from what you typed, so we can always tell you which is which.
When we tell you
If we obtain information about you from these sources, we will tell you at the latest within one month, or at the time of our first contact with you if that is sooner. In practice, our first reply says so.
Your right to object
You can tell us to stop, and we will. Under Article 21 GDPR you can object to this lookup. Email hello@marketstarter.gr — or just reply "no lookup" to any message from us — and we will delete the looked-up fields and flag your record so it never happens again. You do not have to give a reason, and it will not affect the answer you get from us.
Two things we want to be explicit about: we do not make any decision about you by automated means alone, and we do not sell, licence or pass this information to anyone. If you think we have got any of it wrong, you can also complain to the Hellenic Data Protection Authority — see Section 15.
Section 06Who we share it with
We do not sell your data and we do not share it for anyone else's marketing. We do use a small number of service providers to run the business. Here is every one of them, what it gets, and on what footing.
| Recipient | What it receives | Role | Where | Transfer safeguard |
|---|---|---|---|---|
| Salesforce — SFDC Ireland Limited, and Salesforce, Inc. (USA) | The contents of the contact form, the attribution values, and any company information we look up | Processor | Salesforce's EMEA region (our instance is SWE108); accessible from the United States by Salesforce and its sub-processors | EU-US Data Privacy Framework (Salesforce, Inc. is a certified participant) and/or Standard Contractual Clauses. Data processing addendum · sub-processors |
| Apollo.io — ZenLeads Inc., 440 N Barranca Ave #4750, Covina, CA 91723, USA | The domain of your email address only (e.g. acme.gr), so we can look up publicly listed information about your company |
Separate controller — Apollo runs its business-contact database on its own account, not on our behalf | United States | EU-US Data Privacy Framework and/or Standard Contractual Clauses. DPA · trust centre |
| Google — Google Ireland Limited, Gordon House, Barrow Street, Dublin 4 (and Google LLC, USA) | Analytics, after consent only: a cookie identifier, IP address, pages viewed, and the fact that you submitted a form or booked a call. Email: our mailbox runs on Google Workspace, so every enquiry we reply to is stored there. Fonts and Tag Manager, on every page load and before any consent: your IP address and browser user-agent, because this site's typefaces are served from Google Fonts and its tag container from Google Tag Manager. The container sets no cookies and sends no measurement until you accept. | Processor for Google Analytics and for our Google Workspace mailbox; separate controller of its own request logs for the Google Fonts and Google Tag Manager requests, neither of which any contract of ours covers | United States. Google Analytics offers no EU-only storage option. | EU-US Data Privacy Framework (Google LLC certified) and/or Standard Contractual Clauses |
| jsDelivr — open-source content delivery network | Your IP address and browser user-agent on every page load, because this site's page-animation library is served from that CDN | Separate controller of its own server logs | Global CDN | Standard Contractual Clauses where applicable. We are working to serve this file from our own server instead. |
| Hostinger — Hostinger International Ltd, Vilnius, Lithuania | Server log data for this website, and hosting for the private server our internal automation runs on | Processor | European Union — this site is served from Frankfurt, Germany | Data processing agreement |
| Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA | Your name, email and any details you enter when booking, plus the meeting time. Loading the calendar also sends your IP address and browser details to Cal.com and to its error-logging service (Sentry, USA). If you arrived through a tracked campaign link, the campaign tags on it and the addresses of our own pages you came through accompany the booking as internal notes, so we can tell what brought you to us — they contain no personal details beyond that | Processor for bookings; a separate controller of its own error-telemetry | United States | Art. 49(1)(b) GDPR — the transfer happens only when you ask for the booking calendar (by opening it on the booking page, or by pressing a “Book a call” button elsewhere on this site that takes you there and opens it), and for steps taken at your request before a contract: you initiate the booking. Cal.com is not certified under the EU-US Data Privacy Framework and publishes no standard contractual clauses, so we do not claim either. If you prefer to avoid this US provider entirely, use the contact form or email instead · privacy policy |
| CookieYes Limited, Milton Keynes, United Kingdom (company no. 13074037) | The record of the cookie choice you made, a consent identifier, your country, and a pseudonymised IP address — your IP is also looked up against its geo-location service on every page load, before you have chosen anything | Processor | United Kingdom, with onward processing by its own suppliers | European Commission adequacy decision for the UK, plus Standard Contractual Clauses for its suppliers |
| n8n, self-hosted | New-enquiry records, for routing and the company lookup | Not a third party — our own software, on a private server we rent and control | European Union | Nothing is disclosed to the makers of n8n; Hostinger is the underlying hosting processor |
We receive an internal notification when a new enquiry arrives. That notification contains only a reference number, the service you asked about, and a link to the record — it never contains your name, email address, telephone number or the content of your message.
We may also disclose data where the law requires it, or where it is necessary to establish, exercise or defend a legal claim.
Advertising pixels
As of the date of this policy we do not use advertising pixels on this website. If we add them, we will update this policy and add the corresponding category to the cookie banner before any such tag loads. Those services would be Meta (Meta Platforms Ireland Limited, Dublin), which would act as a joint controller with us under Article 26 GDPR for event data, and TikTok (TikTok Technology Limited, Dublin).
Section 07Sending data outside Europe
Some of our providers are based outside the European Economic Area, principally in the United States. Where that is the case, we rely on an adequacy decision of the European Commission — including the EU-US Data Privacy Framework where the recipient is certified under it — and/or the European Commission's Standard Contractual Clauses, together with any additional measures required. One provider is the exception: Cal.com, our booking calendar, currently offers neither — so that transfer happens only when you yourself ask for the calendar — on its own page, or through a “Book a call” button that takes you there and opens it — and book, and rests on the Art. 49(1)(b) derogation for steps taken at your request, as set out in the recipients table above. You can ask us for a copy of the safeguards we use by emailing hello@marketstarter.gr.
Being straight about it: we cannot tell you that your data never leaves the EU, because it is not true. Our CRM support, the company lookup, our mailbox and — once you consent to it — our analytics all involve US-linked providers.
What does stay put: the automation that processes new enquiries runs on n8n, self-hosted on a private server we rent and control in the European Union. It is not a third-party service, and no data is sent to the makers of n8n.
Section 08How long we keep it
| What | How long |
|---|---|
| Enquiry correspondence that does not lead to work | 12 months from our last contact with you |
| CRM lead or prospect record | 24 months from the last meaningful interaction |
| Company information we looked up | 12 months from last contact, or immediately on disqualification — whichever is sooner |
| Client records with an accounting or tax dimension | For the period required by Greek tax and accounting legislation |
| Records needed to establish or defend legal claims | Until the applicable limitation period expires |
| Cookie-consent records | For the life of the consent, plus 12 months so we can demonstrate it — where your browser allows the record to reach our consent-management provider. Ad and tracker blockers commonly block that request, in which case no record of your choice reaches us at all, and only your own browser holds it |
| Website analytics | 14 months (event and user data alike; set in Google Analytics) |
Where no fixed period is set out above, we decide how long to keep information by reference to: whether the purpose we collected it for is still being pursued; whether we are still in an active commercial dialogue with you; our statutory accounting and tax obligations under Greek law; and the limitation periods for legal claims.
Section 09Your rights
You have the following rights over your personal data. To use any of them, email hello@marketstarter.gr.
- Access (Art. 15) — ask for a copy of what we hold about you.
- Rectification (Art. 16) — have anything inaccurate corrected.
- Erasure (Art. 17) — ask us to delete it.
- Restriction (Art. 18) — ask us to keep it but stop using it while something is disputed.
- Portability (Art. 20) — receive the data you gave us in a machine-readable format.
- Object (Art. 21) — object to processing based on our legitimate interests, including the company lookup in Section 05.
- Withdraw consent (Art. 7(3)) — withdraw your cookie consent at any time, as easily as you gave it. See Section 10.
- Not be subject to solely automated decisions (Art. 22) — see Section 11.
We answer within one month, which can be extended by two further months for complex requests (Art. 12(3)) — we will tell you if that happens. It is free, unless a request is manifestly unfounded or excessive (Art. 12(5)). We may ask you a question first to make sure you are who you say you are.
Direct marketing
You can stop us marketing to you, at any time. You have an absolute right to object to our using your data for direct marketing, including any related profiling. If you object, we stop immediately, and we do not need a reason. Email hello@marketstarter.gr.
Section 11Automated decisions
We do not make decisions about you by automated means alone that produce legal effects or similarly significantly affect you. A person reads every enquiry.
Section 12Children
Our services are aimed at businesses and are not directed at children. Under Greek law (Law 4624/2019, art. 21), a person must be at least 15 to consent to information society services on their own behalf. We do not knowingly collect data from children.
Section 13Security
This site is served over HTTPS. Access to the CRM and to our automation is limited to the operator of the business and protected by authenticated accounts. Our contact form carries a hidden trap field and a timing check that block automated submissions.
No system is perfect. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Hellenic Data Protection Authority and, where the risk is high, you directly, as required by Articles 33 and 34 GDPR.
Section 14Changes to this policy
When we change this policy we update the "Last updated" date at the top. If a change materially affects how we use your data, we will say so with a notice on the site. Previous versions are kept, dated, in our repository.
Section 15Complaints
If something we have done with your data bothers you, tell us first at hello@marketstarter.gr — it is usually faster to fix it directly.
You also have the right to complain to the supervisory authority at any time:
Hellenic Data Protection Authority(Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα)
Kifisias Avenue 1-3, 115 23 Athens, Greece
Tel +30 210 6475600 · Fax +30 210 6475628
contact@dpa.gr · complaints@dpa.gr
www.dpa.gr · how to file a complaint
The Authority's online complaint portal requires Greek TAXISnet credentials. If you cannot use it, you can email complaints@dpa.gr instead.
Still have a question?
Ask a person. No form required for this one.