Privacy Policy

1. Introduction

Ysona ("we", "our", or "us") is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our website, services, or automated legal document generation platform.

Ysona operates in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and, where applicable, Greek national data protection law as implemented under Law 4624/2019. Our services are currently focused on the automated generation of Greek residential rental agreements.

By using our services, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

The data controller responsible for your personal data is:

If you have any questions about this policy or how we handle your personal data, please contact us using the details above.

3. Personal Data We Collect

We collect the following categories of personal data when you use our services:

3.1 Information You Provide Directly

When you complete our intake form, we collect the information required to generate your legal document. This may include:

• •Full names of the contracting parties
• •Addresses, TIN numbers, ID numbers
• •Email address(es) for document delivery
• •Contract terms such as amount, duration, and guarantees
• •Identity document references (where applicable)
• •Any other information required to populate your document

3.2 Information Collected Automatically

When you interact with our platform, we may automatically collect certain technical data, including:

• •IP address and browser type
• •Pages visited and time spent on our platform
• •Device type and operating system
• •Referral source

3.3 Business Information (B2B Users)

If you are a business or legal professional using Ysona on behalf of your clients, we may also collect your company name, VAT number, business email address, and billing information.

4. How We Use Your Personal Data

We process your personal data for the following purposes and on the corresponding legal bases:

• •Service delivery: Generating your legal document using the information you provide. Legal basis: Performance of a contract (Article 6(1)(b) GDPR).
• •Document delivery: Sending your completed document to your provided email address. Legal basis: Performance of a contract (Article 6(1)(b) GDPR).
• •Execution logging: Recording execution metadata for operational monitoring and quality assurance. Legal basis: Legitimate interests (Article 6(1)(f) GDPR).
• •Error handling and support: In the event of a processing error, we log and review failure information to resolve issues and maintain service reliability. Legal basis: Legitimate interests (Article 6(1)(f) GDPR).
• •Legal compliance: Retaining records as required by applicable Greek and EU law. Legal basis: Legal obligation (Article 6(1)(c) GDPR).

We do not use your personal data for automated decision-making or profiling in ways that produce legal or similarly significant effects on you.

5. Data Sharing and Third-Party Processors

We do not sell your personal data. We share your data only with trusted third-party service providers who act as data processors on our behalf, strictly for the purpose of delivering our services.

All third-party processors are bound by data processing agreements and are required to process your data only in accordance with our instructions and applicable data protection law.

Some of these processors may transfer data outside the European Economic Area (EEA). Where such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law.

When data is no longer required, it is securely deleted or anonymised.

7. Your Rights Under GDPR

Under the GDPR, you have the following rights in relation to your personal data:

• •Right of access: You may request a copy of the personal data we hold about you (Article 15 GDPR).
• •Right to rectification: You may request correction of inaccurate or incomplete data (Article 16 GDPR).
• •Right to erasure: You may request deletion of your data, subject to legal retention obligations (Article 17 GDPR).
• •Right to restriction of processing: You may ask us to restrict how we use your data in certain circumstances (Article 18 GDPR).
• •Right to data portability: You may request your data in a structured, machine-readable format (Article 20 GDPR).
• •Right to object: You may object to processing based on our legitimate interests (Article 21 GDPR).
• •Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at services.ysona@outlook.com. We will respond to your request within 30 days. We may need to verify your identity before processing your request.

If you believe we have not handled your data in accordance with applicable law, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA): www.dpa.gr.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• •Access controls and authentication on all systems processing personal data
• •Encrypted data transmission (HTTPS/TLS)
• •Restricted access to personal data on a need-to-know basis
• •Real-time error monitoring and alerting to detect and respond to anomalies

While we take data security seriously, no system is entirely immune to risk. In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify the HDPA within 72 hours and inform affected individuals where required by law.

9. Cookies and Tracking Technologies

Our platform may use cookies and similar technologies to improve your experience and to collect analytical data. Essential cookies are required for the proper functioning of our service. Analytics cookies are used only with your consent.

You can manage your cookie preferences through your browser settings. Please note that disabling certain cookies may affect the functionality of our platform.

10. Children's Privacy

Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it without delay.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by posting the updated policy on our website.

The "Effective Date" at the top of this document indicates when this policy was last updated. We encourage you to review this policy periodically.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

This policy was last reviewed on 17 February 2026.