Privacy Policy

Last updated: 14/04/2025

At Controllables, we are committed to protecting your personal data and being transparent about how we collect, use, and share it.

This Privacy Policy explains what data we collect, why we collect it, and how you can exercise your rights under the General Data Protection Regulation (EU 2016/679) (“GDPR”).

1. Who We Are

This website, and all services provided under the “Controllables” branding, are operated by Fotis J. Panagiotopoulos, an individual based in Athens / Greece, who determines the purposes and means of processing personal data collected through the services.

If you have any questions or concerns about this Privacy Policy or how your data is handled, please contact:

Name: Fotis J. Panagiotopoulos
Email: info@controllables.gr
Location: Athens, Greece

2. What Personal Data We Collect

We collect the following categories of personal data:

Identity and Contact Data - Name, email address, phone number, physical/mailing address.
Professional Data - Company name, job title, role, industry.
Billing Data - Payment and billing information for customers in a business relationship.
Usage Data - IP address, browser type, device type, operating system, referral URLs, usage of our website and services.
Content Data - Information you upload, submit, or generate when using our products (e.g. Controllables IoT).
Support Data - Information you provide to our support team, including contact details and issue descriptions.
Social and Survey Data - Feedback or data submitted via surveys or social channels.
IoT Device Data – Data collected from IoT devices you purchase and install, such as temperature readings, environmental metrics, energy usage, and device states. This data is associated with your account and used to provide monitoring and automation services.

We do not collect any special categories of personal data (e.g., health data, religious beliefs) unless explicitly provided and consented to.

3. How and Why We Use Your Data (Legal Basis)

Under the GDPR, we must have a lawful basis for processing your data. We rely on the following:

Purpose	Legal Basis
To provide and operate our services.	Performance of a contract
To personalize your experience and content.	Legitimate interest
To improve our website and offerings.	Legitimate interest
To provide support and respond to requests.	Performance of a contract
To process payments and transactions.	Performance of a contract
To send updates and promotional communications.	Consent / Legitimate interest (for B2B)
To comply with legal obligations.	Legal obligation
To protect our rights and security.	Legitimate interest
To collect and process data from IoT devices you own and install.	Performance of a contract / Legitimate interest

We process data collected from your IoT devices solely to deliver the services you have requested, such as monitoring, automation, and alerts. This data is linked to your account, and may include sensitive information about your building’s environment and equipment.

You retain full ownership and control of your device data, and we do not access, share, or use it for any other purpose without your explicit consent.

You can withdraw your consent at any time where we rely on it (e.g. for marketing emails).

We do not sell your personal data. We may share it with:

Trusted third parties that help us operate the website, provide services, or process payments, under confidentiality agreements.
Public authorities when legally required.
Analytics and advertising partners (only with your consent, where required).

All third parties are required to process your data securely and in accordance with GDPR.

Some IoT devices may contact external services directly (e.g. for IP-based geolocation or weather forecasts). These requests may include the device’s public IP address and are processed solely to enable features such as time-based automation, timezone configuration, or environmental adjustments.

These services do not receive any personally identifiable information (PII) (such as account details or user IDs) from our platform and cannot associate requests with individual users or devices. We ensure that any third-party services used respect data minimization principles and do not retain or reuse this data for profiling or advertising.

5. International Data Transfers

Your data may be transferred and processed outside the European Economic Area (EEA), including to countries that may not provide the same level of data protection. Where such transfers occur, we ensure appropriate safeguards, such as:

Standard Contractual Clauses (SCCs) approved by the European Commission.
Transfers to countries deemed to provide adequate protection under GDPR.

6. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes outlined in this policy, unless a longer retention period is required by law. Backup copies may persist for a limited time after deletion for system integrity and legal reasons.

As a data subject, you have the following rights:

Access: You can request a copy of the personal data we hold about you.
Rectification: You can ask us to correct inaccurate or incomplete data.
Erasure (“Right to be Forgotten”): You can request deletion of your data under certain circumstances.
Restriction of Processing: You can ask us to limit processing in specific cases.
Data Portability: You can request your data in a structured, machine-readable format.
Objection: You can object to processing based on legitimate interests or direct marketing.
Withdraw Consent: If we process your data based on consent, you can withdraw it at any time.

To exercise your rights, email us at info@controllables.gr.

You also have the right to lodge a complaint with a supervisory authority in your country.

8. Cookies and Tracking Technologies

We use essential cookies on our website. These cookies are necessary for the proper functioning of the site and enable core features such as security, network management, and accessibility.

We do not use cookies to analyze user behavior, track users across websites, or serve targeted advertising.

As these cookies are strictly necessary, they are set without requiring your prior consent. You can control or disable cookies through your browser settings; however, please note that doing so may affect the functionality of certain parts of the site.

9. Data Security

We implement robust technical and organizational measures to protect your data, including:

SSL encryption for data in transit.
Secure data storage with restricted access.
No storage of sensitive payment information on our servers after processing.

10. Children’s Privacy

Our services are not intended for individuals under the age of 16.

We do not knowingly collect data from children. If you become aware of such data, please contact us and we will delete it promptly.

11. How to Delete Your Information

If you would like to delete your personal data or request the removal of your account information, please contact us directly at info@controllables.gr.

We will review and respond to your request within one month, in accordance with applicable data protection laws. Please note that certain data may be retained for legal, regulatory, or security purposes, or as necessary to complete any transactions or fulfill contractual obligations.

12. Changes to This Policy

We may update this policy from time to time. When we do, we will post the revised version on this page with an updated date. For material changes, we may notify you via email or service alerts.

13. Contact Us

If you have any questions, or would like to exercise your rights, you can contact us at:

Email: info@controllables.gr

This Privacy Policy is governed by the laws of the European Union and the laws of Greece, as applicable.