GDPR compliance

TWENTYONE WEST COAST TRVL STORIES SINGLE MEMBER P.C. processes personal data in two distinct capacities, and the Regulation treats them very differently.

Controller — this website and our own business

Enquiries, supplier and client contact records, server logs. We decide why and how these are processed, so the obligations of Articles 12 to 22 fall on us directly. The privacy policy is the notice required by Articles 13 and 14 for that processing.

Processor — the stores on the platform

Every order, customer account, address and payment record in a store running on Nextcommerce belongs to the merchant, not to us. The merchant is the controller; we act only on its documented instructions under a written data processing agreement meeting Article 28(3). We do not use merchant data for our own purposes, we do not mine it, we do not market to a merchant's customers, and we never carry a customer list from one store into another.

Article 5 sets six of them, and on a commerce platform they are engineering constraints rather than a statement of intent:

• Lawfulness, fairness and transparency — every collection point says what it is for at the point it asks.
• Purpose limitation — an address given at checkout is not repurposed into something unrelated.
• Data minimisation — a customer field nobody uses is a liability, not a feature, and we say so when a spec asks for one.
• Accuracy — corrections are made on request and propagate through the store.
• Storage limitation — every record has a stated retention period, enforced rather than aspirational.
• Integrity and confidentiality — TLS everywhere, least-privilege access, two-factor authentication on every account that touches personal data.

Article 5(2) adds accountability: being able to demonstrate the above. We keep the record of processing activities required by Article 30.

What a merchant's counsel usually needs to know, in the order they usually ask it:

• We sign a data processing agreement on Article 28(3) terms before any customer data is touched — ours or yours, whichever your counsel prefers.
• We process only on documented instructions, and we say so if an instruction looks to us like it breaches the Regulation.
• Everyone with access is under a written duty of confidentiality that outlives the engagement.
• Sub-processors — hosting, mail delivery, payment providers, error reporting — are named before they are used, and you may object to a new one.
• Data stays in the EEA by default. Where a specific tool requires otherwise, we say so before it is chosen, and it is covered by standard contractual clauses or an adequacy decision.
• We assist with data subject requests from your customers, with breach notification, and with any DPIA the processing requires under Article 35.
• At the end of the subscription your data is exported to you or deleted, at your choice, and backups age out on a stated schedule.

Articles 15 to 22 give you the right to access the data we hold about you, to have it corrected, to have it erased, to restrict how it is used, to receive it in a portable machine-readable form, and to object to processing based on legitimate interests.

Send the request to hello@twenty-one.co. There is no form to fill in and no fee. We answer within one month, as Article 12(3) requires.

If the data sits inside a merchant's store rather than ours — you bought something, you opened an account, you left a review — we are the processor, not the controller: we will pass the request to that merchant, which is the party that must answer it, and we will help it do so as Article 28(3)(e) obliges us to.

You may also complain to the Hellenic Data Protection Authority, Kifissias 1–3, 115 23 Athens, +30 210 6475600, www.dpa.gr — or to the supervisory authority of the EU country you live or work in.

Article 32 asks for measures appropriate to the risk: TLS on every connection, two-factor authentication on every account, least-privilege and role-based access, rate limiting and input sanitisation on public endpoints, dependency and security updates as routine work rather than as a project, and backups that are restored from time to time to prove they work.

If a breach occurs on our own systems we notify the Hellenic DPA within 72 hours where Article 33 requires it, and the people affected without undue delay where Article 34 does. If it occurs inside a store we run, we notify that merchant without undue delay so it can meet the same deadlines — the clock is theirs, and our job is not to burn it.

• No automated decision-making or profiling with legal or similarly significant effects.
• No sale of personal data, ever, in any form, to anyone.
• No analytics, advertising tag or third-party script on this website.
• No dark patterns in the collection points: nothing pre-selected, nothing buried, no cost to saying no.

Questions about any of this go to hello@twenty-one.co, or 210 3000 463, or Plataion 55, 104 35 Athens. A named person reads that inbox — it is not a ticket queue.