Privacy

Who we are

Echofair is a service of AVGEROS G. CHRISTOS, trading as Dot.360, of Piraeus, Greece (ΓΕΜΗ 173622609000, ΑΦΜ 157126620) — a sole trader, not a company. For anything on this page, write to hi@echofair.app.

The important distinction

There are two sets of personal data here, and we have a different role for each. Getting this the wrong way round is the mistake that makes a lead capture tool a liability, so it is stated first.

• Your account data — your name, work email, company, what you bought. We decide what to do with this, so for it we are the controller.
• Your visitors' data — everyone your team captures at a stand. You decide what to ask them and why. You are the controller; we are your processor and act on your instructions.

In plain terms: the leads in your account are yours. We do not sell them, mine them, market to them, use them to train anything, or look at them except when you ask us to help with a support problem.

What we hold as controller — your account

• Name, work email address, company name, and a hashed password. We cannot read your password.
• Which events you created and what you bought. Payment is handled by Stripe; we store the amount, the invoice reference and the credit, never a card number.
• Ordinary server logs — IP address, browser, which pages were requested — kept for up to 30 days for security and debugging.

The legal basis is performance of our contract with you, and our legitimate interest in keeping the service secure and working.

What we hold as processor — your visitors

Whatever your form asks for. By default that is a name, an email address, a company and a note, and you can add or remove fields yourself. Alongside each lead we store the consent record, because that is the product:

• When the lead was captured, and by which device and team member.
• The exact consent wording shown, and its version — so a record from day one of a show is still reconstructible on day four after you have edited the form.
• Whether and when the visitor confirmed by email, and the IP address the confirmation came from.
• Optionally a photograph of a business card or a short voice note, if your team takes one. These are stored privately and are only ever reachable through a link that expires in five minutes.

We do not decide what any of this is for. If a visitor asks us to delete their data we will point them to you, and tell you, because you are the one who has to answer.

Who else sees it

Only the services that make the product work. All of them are under a data processing agreement.

We do not sell personal data, and we do not share it with advertisers. The analytics on this marketing site are separate and are covered on the cookies page; nothing measured there ever touches a customer's lead data.

How long it is kept

• An event stays open for 30 days from activation. Leads and their consent records remain in your account after that, so you can still export them.
• Delete a lead and it goes, along with any photo or voice note. Its consent record is kept only where we are required to be able to show consent was obtained, and never for longer than needed.
• Close your account and we delete everything within 30 days, except records we must keep for tax and accounting — invoices, which Greek law requires us to hold for several years.
• Server logs: up to 30 days.

Where it is

The database and the file storage are in Frankfurt, inside the EU. Email delivery (Resend) and payments (Stripe) involve transfers to the United States, made under the European Commission's Standard Contractual Clauses. If you connect a CRM or a mailing list yourself, that data goes wherever that provider operates, and that transfer is yours rather than ours.

Security

• Everything is served over HTTPS. Passwords are hashed with bcrypt; device and API tokens are stored only as hashes, so a copy of our database does not let anyone capture leads as you.
• Every account is separated at the database layer, and a query that does not name a tenant is refused rather than silently returning everything.
• Business card photographs and voice notes are stored with no public URL and served only through short-lived signed links.
• If personal data is ever breached we will tell the Hellenic Data Protection Authority within 72 hours, and tell you without undue delay.

Your rights

Under the GDPR you can ask for a copy of your data, ask us to correct or delete it, object to processing, or ask for it in a portable format. Write to hi@echofair.app and we will answer within one month.

If you are a visitor whose details were captured at a stand: the company at that stand holds your data, not us. Ask them, or ask us and we will pass it on and tell you who they are. Every confirmation email we send names them.

You can also complain to the Hellenic Data Protection Authority (dpa.gr), or to the authority where you live.

Changes

If we change anything material we will say so by email before it takes effect. The date at the top of this page is when it last changed.