Privacy Policy

1. Operator and responsibility

Sendro is operated by George Georgoulas, 330, 28is Oktovriou Street, Nea Peramos, Attica 190 06, Greece. Privacy contact: georgoulasgeo@gmail.com. General contact: +30 698 476 9993.

A business that uses Sendro ordinarily determines the purposes and lawful basis for communicating with its own customers and acts as the controller of those conversations. Sendro normally processes the messages on that business's instructions as its processor. Sendro separately acts as controller for its website enquiries, administrative and business-contact information, and its own security records where applicable. The exact roles depend on the processing activity and applicable agreements.

2. Data processed

For currently enabled WhatsApp messaging, the information processed may include customer names and telephone numbers, platform account and message identifiers, message content, files or media references, timestamps, send/delivery/read status, conversation assignments, staff replies, and guest or reservation details voluntarily provided by the relevant business or its customers. Bulk-message delivery history may include names, telephone numbers, booking references, tour details and delivery results, even where not linked to an active conversation.

For authorized business users we may process account identifiers, staff names, email addresses, role and access information, authentication and security event records. Our informational website may process basic technical request information through hosting infrastructure and messages sent to our published contact address. The illustrative messages shown on the Sendro website are fictional.

WhatsApp is in operational internal use. Instagram Direct integration is still under controlled development/testing and is not yet a generally enabled channel. Planned Facebook Messenger and TikTok integrations are not represented as live.

3. Purposes and legal basis

As a processor, Sendro receives, transmits, organizes, displays and stores customer communications and delivery status so the relevant business can provide customer support, subject to its documented instructions and applicable law. Each business is responsible for informing its correspondents and identifying its applicable GDPR lawful basis, including where customer messaging or marketing consent is required.

For information handled by Sendro as its own controller, we use contact details to answer enquiries and take requested pre-contract steps; account and service-administration information to provide authorized access and manage agreements; security event information to protect the service against unauthorized access and misuse; and records needed to meet applicable legal obligations. Depending on the particular activity, these may rely on GDPR Article 6(1)(b) (contract/pre-contract steps), Article 6(1)(f) (legitimate interests in secure and reliable operation), or Article 6(1)(c) (legal obligations). If a processing activity requires consent, we will request it; it may be withdrawn where that is the applicable legal basis. Our legitimate interests must be balanced against affected persons' rights as required by law.

4. Providers, access and international processing

Data may be handled by the relevant customer business and its authorized staff, Sendro as the technical service provider, and the messaging and hosting services needed for enabled channels. Current relevant providers include Meta/WhatsApp for messaging and Render for hosting the service and PostgreSQL data storage. Render's active PostgreSQL database is deployed in Frankfurt, Germany; that fact alone does not establish that provider support, logging, media and backups are all restricted to the European Economic Area. Meta and Render may have different roles for different processing activities.

We do not sell customer conversation data to advertisers. If information is transferred outside the EEA, the parties must apply the relevant GDPR cross-border-transfer requirements and suitable safeguards as applicable. For details concerning a particular business's communication with you or the service providers relevant to that business, contact the business or Sendro using the contact above.

5. Retention, deletion and security

Personal data is retained according to the purposes for which it is needed, the controller's documented instructions, applicable legal obligations, and justified exceptions such as unresolved enquiries or disputes. We have adopted a 12-calendar-month ordinary retention target for bulk-message sending/delivery history measured from creation of the relevant record, and are evaluating a similar target for inactive conversation history from last relevant activity. These are operational policy targets, not a GDPR-mandated universal deadline. Automatic 12-month deletion is not yet implemented.

Requests for access, correction or erasure are therefore handled through a manual, case-specific process with the responsible controller. An authorized administrator may delete a visible conversation and its message rows, but related bulk-send history, technical media, logs, backup copies and separately held Meta information are not necessarily deleted by that action. Archiving a conversation is not erasure. We assess relevant records, lawful exceptions and backup/restore requirements before making representations that a request has been completed.

Authorized access is limited according to operational responsibilities, and security controls are subject to review and improvement. The service uses managed hosting and database recovery facilities; the exact periods depend on provider arrangements and any separately retained exports. We cannot promise a risk-free service or instantaneous deletion from every independent system.

6. Your GDPR rights and how to contact us

Depending on the circumstances, you may have rights of access, rectification, erasure, restriction of processing, objection and portability, as well as withdrawal of consent where consent is relied upon. You may lodge a complaint with the Hellenic Data Protection Authority or another competent authority.

If your request concerns a conversation with a business using Sendro, contact that business first because it generally controls the customer relationship. For Sendro website information, service administration, help identifying the responsible business, or an escalation, email georgoulasgeo@gmail.com with the subject “Sendro privacy request”. Identify the relevant business if known, your request and a safe means of reply. Do not email passwords, access tokens, complete private conversations or unnecessary identity documents. Reasonable identification may be sought only where needed.

The controller generally responds without undue delay, ordinarily within one month, subject to lawful extensions or exemptions. See our Data Deletion Instructions for details of the request process.

7. Website cookies and technology

The current static Sendro website does not intentionally embed advertising pixels or custom visitor analytics. Hosting infrastructure may process basic request and security records to operate the site. If additional analytics, forms, or technologies requiring consent are introduced, our disclosures and applicable controls will be updated.

8. Updates to this notice

We may update this Privacy Policy when the service, actual providers, legal requirements or data-handling practices change. The date at the top identifies the latest version. This notice describes the current limited service and does not promise that features still in development are available to external businesses.