Privacy policy

TWENTYONE WEST COAST TRVL STORIES SINGLE MEMBER P.C., trading as Nextcommerce, is the data controller for the personal data described here. Registration details are at the foot of this page; write to hello@twenty-one.co for anything on this subject and it reaches the person who can act on it.

We have not appointed a Data Protection Officer — the scale of the processing described below does not require one under Article 37 GDPR.

It covers nextcommerce.gr: the enquiry form, and the server logs behind it. That is the whole of it — there is no account on this site, no newsletter, no analytics and no advertising tag.

It does not cover the stores we run on the platform. There the merchant is the controller of its own customers' data and we act as a processor on its documented instructions under a data processing agreement; that merchant's own privacy notice governs, not this one. The GDPR page sets out how that split works.

Enquiry form

Your first and last name, email address and — if you fill them in — a telephone number, the plan you are looking at, whether you already run a store and its address, and the message itself. Purpose: to read your enquiry and answer it. Legal basis: Article 6(1)(b) GDPR, steps taken at your request before entering into a contract; and, where you are writing on behalf of a company rather than as an individual, our legitimate interest in responding to business enquiries under Article 6(1)(f).

Server logs

Your IP address and ordinary request metadata — time, page, browser, referring page — recorded by the web server. Purpose: keeping the site up, secure and abuse-free. Legal basis: our legitimate interest in the security and availability of the service, Article 6(1)(f).

We do not ask for special-category data, we do not buy lists, we do not build profiles of visitors, and there is no automated decision-making of any kind on this site.

Only the suppliers that make the site work, each under a contract that binds them to process on our instructions:

The mailbox provider

An enquiry is delivered by email to welcome@nextcommerce.gr over authenticated SMTP, so your message is stored in that mailbox. Data held in the EU.

The hosting provider

Serves the site and holds its logs on a server in the EU. Where a transfer outside the EEA is unavoidable, it is covered by the European Commission's standard contractual clauses.

Beyond those, we disclose personal data only where the law obliges us to, or where it is necessary to establish or defend a legal claim — to our accountants, auditors or lawyers, under professional confidentiality. We never sell it.

• An enquiry that does not become a project: kept for up to 24 months, so we can pick up the thread if you come back, then deleted.
• An enquiry that becomes a subscription: kept for the life of the engagement and then for as long as Greek tax and commercial law requires the records of it, currently five years from the end of the financial year.
• Server logs: days, not months.

Under the GDPR you can ask us for a copy of the personal data we hold about you, ask us to correct it or erase it, ask us to restrict how we use it, ask for it in a portable form, and object to processing we base on legitimate interests.

Write to hello@twenty-one.co. We answer within one month, free of charge, and we will ask for enough information to be sure it is really you before we act.

If you think we have handled your data wrongly, please tell us first — but you also have the right to complain to the Hellenic Data Protection Authority, Kifissias 1–3, 115 23 Athens, +30 210 6475600, www.dpa.gr.

The site is served only over TLS. Access to the mailbox is limited to the people here who need it and protected by two-factor authentication. The form's inputs are sanitised and its delivery is authenticated. No system is perfectly secure; if a breach ever puts your rights at risk we will notify the Hellenic DPA and you, as Articles 33 and 34 require.

Questions about any of this go to hello@twenty-one.co, or 210 3000 463, or Plataion 55, 104 35 Athens. A named person reads that inbox — it is not a ticket queue.