Z28 Privacy Policy

Last updated: November 4, 2026

Who we are

Z28 is a brand of Andreas Papadopoulos (sole proprietorship, registered in Greece: General Commercial Registry (GEMI) no. 165306806000, VAT no. EL150496621), Riga Feraiou - Ellispontou 42, 566 25 Sykies, Thessaloniki, Greece. We decide how and why the personal data described here is used, so we are its "controller". For any privacy question or request, email legal@z28.tech.

What we collect, why, and on what legal basis

1. Our form on Facebook or Instagram. Your name and email address (Meta fills them in from your profile, and you can edit them), your answers to our multiple-choice questions about your business (for example your trade, where your leads come from and the tools you use), and which ad and form you used. We use them to send you a short questionnaire, up to 3 reminders if you don't reply and, if you ask for one, a proposal. Legal basis: steps you asked for before a possible contract (GDPR Art. 6(1)(b)). For the reminders and for keeping a record of what we sent you: our legitimate interest in following up on your own request (Art. 6(1)(f)).
2. Our questionnaire and your replies. Your company name, if you give it, your answers and the messages you send us. Same purposes and legal bases as above.
3. When you email us. If you write to hello@z28.tech or legal@z28.tech, or reply to one of our emails: your email address, your name and what you write. We use it to answer you and, if you ask, to send you a proposal. Legal basis: your request (Art. 6(1)(b)) or our legitimate interest in answering messages sent to us (Art. 6(1)(f)).
4. Booking a call. If you book a call through our booking link, Google (Calendar and Meet) collects your name, email address, the time you choose and anything you write in the booking form, and shares it with us so we can hold the call. Legal basis: your request (Art. 6(1)(b)). We do not record calls. If we ever want to, we will ask you at the start of the call and record only if you agree.
5. When you become a client. Your contact and billing details, the business you represent, the proposal you accepted and the version of our terms, invoices and payment records. Payments are processed by Stripe; we never see your full card number. Legal bases: our contract with you (Art. 6(1)(b)) and our tax and accounting obligations under Greek law (Art. 6(1)(c)).
6. Our demo. The email address you enter and the choices you make in the demo, to send you one demo email and to stop repeated sends to the same address. Legal bases: your request (Art. 6(1)(b)) and our legitimate interest in preventing abuse of the demo (Art. 6(1)(f)). We do not send demo users reminders.
7. Our website. Our hosting provider and our system process standard technical data (such as IP address, browser type, pages requested and time) to deliver the site, keep it secure and fix errors. Our demo uses Cloudflare Turnstile to tell people from bots. Legal basis: our legitimate interest in a working, secure website (Art. 6(1)(f)).

You don't have to give us any of this. Without an email address we can't send you the questionnaire or the demo, and without billing details we can't provide our service.

How we use AI

Our system uses Anthropic's Claude, an AI model, to choose questions for you from a list we wrote and approved, to write 1-2 short opening sentences for your email and, after you answer our questionnaire, to help draft a proposal from your answers. We never send Claude your name, email address, company name or other contact details; we remove them first. A person from our team checks every proposal before it is sent, and emails written with AI say so. A person from our team reads replies. We do not make decisions about you that have legal or similarly significant effects by automated means.

Who receives your data

Service providers that handle data for us: Make (Celonis, Inc.) to receive form entries from Meta, in its EU data region; Cloudflare, Inc. to run our system, store our database in the European Union, route emails sent to our addresses and protect the demo (Turnstile); Resend (Plus Five Five, Inc.) to send and receive our system's emails, in its EU region (Ireland); Anthropic, only as described under "How we use AI"; Google, to host our website (Firebase Hosting) and for our team mailbox (Gmail); Stripe to process payments; Google (Calendar and Meet) for call bookings. Meta provides the form and acts as an independent controller for its own platform; see Meta's Privacy Policy.

Where Greek tax and accounting law requires it, client invoices and payment records go to our accountant and to the tax authorities. We may also disclose data when the law requires it or to protect our legal rights.

We do not sell your personal data, and we do not share it for anyone else's marketing or for cross-context behavioral advertising.

International transfers

Some of our providers are based in the United States, even where they process data in the EU. Where a provider is certified under the EU-U.S. Data Privacy Framework, we rely on that; otherwise we use the European Commission's Standard Contractual Clauses. You can ask us for a copy of the relevant safeguards.

How long we keep it

• Leads who do not become clients: up to 12 months after our last contact, then deleted from our system and our mailbox.
• Demo users: up to 12 months after the demo, then deleted.
• If you unsubscribe, we keep only your email address (or a coded form of it) and the date, so that we can respect your choice.
• Clients: for the length of our agreement and afterwards for as long as Greek tax and accounting law requires.
• Technical logs of our own system: up to 30 days. Our hosting and email providers keep their own security logs for the periods set in their terms.

Your rights

Wherever you live, you can ask us to access, correct or delete your data, to restrict our use of it, to object to our use of it (including any follow-up based on our legitimate interest), and to receive your data in a portable format. If we ever ask for your consent for something, you can withdraw it at any time. Email legal@z28.tech; we answer within one month. You can unsubscribe from any of our emails at any time: use the link at the bottom of the email, the unsubscribe button of your email app, or reply "unsubscribe". You can also complain to the Hellenic Data Protection Authority (www.dpa.gr).

Security

We protect your data with encryption in transit, access limited to named members of our team with two-factor authentication, and separate storage for each client's data.

Cookies

Our website does not use advertising cookies, analytics cookies or tracking pixels. Our demo page uses Cloudflare Turnstile, which may store a small piece of data in your browser only to protect the demo from bots. If this ever changes, we will update this policy and ask for your consent where the law requires it.

Children

Our services are for businesses. We do not knowingly collect data from anyone under 18.

When we work for our clients

When our clients use Z28 to reply to their own customers (for example homeowners who asked them for an estimate), we process that data only on our client's behalf and instructions, as their service provider ("processor"). The client's own privacy policy applies; please contact the client directly.

Changes

We will post any change on this page with a new "Last updated" date.

Contact

Andreas Papadopoulos (sole proprietorship), Z28, Riga Feraiou - Ellispontou 42, 566 25 Sykies, Thessaloniki, Greece · legal@z28.tech