Privacy policy

1. Who we are, and who controls the data

Sirvis is an application for heating and air-conditioning technicians, at sirvis.app. This policy covers the application and the sirvis.app website.

Sirvis is provided by Μιχαήλ Μειμάρης, a sole proprietorship trading as «ΒΕΤΦΛΟΟΥ», established at Παπαναστασίου Α΄ 98, 546 44 Θεσσαλονίκη, Ελλάδα.

The most important point on this page is the two roles. For a business’s customers’ data (names, phone numbers, addresses, machines, services) the BUSINESS is the controller and we are the processor: we process it only on its instructions, so that the application works.

For the business’s own account (the people who sign in, the subscription and billing, correspondence with us) and for this website, we are the controller.

We have not appointed a Data Protection Officer, because GDPR Art. 37 does not require one for the size and kind of our processing. Questions are answered at the address in §10.

1a. Did you get an SMS from your technician through Sirvis?

Your technician is responsible for your details: they have you on their list and decide when to send you a reminder. When they book a visit with you, you also get one reminder of it, by SMS or email, at the time they set; when it carries a link (an email always does), on its page you can say «I’ll be there» or «I need another day», and the answer reaches only them. We hold and send them only on their behalf.

To stop further messages, tap «Stop these messages» on the link’s page (in an email, also your email program’s unsubscribe), or tell your technician. For anything else, ask them first; we will help them.

2. What data we hold

What the business enters about its customers:

• Customers: name, phone numbers, email, language, notes, whether they are a business, and whether they asked not to receive messages.
• Addresses: street, postcode, city and access notes.
• Machines: kind, brand, model, serial number, dates, parts, and a photo of their nameplate where one was taken.
• Services and jobs: dates, what was done, price, whether it was paid, notes.
• Requests and appointments: what the customer chose on the link’s page (days, time), the day agreed, and their answer to the visit reminder («I’ll be there» or «I need another day»).
• Messages: the text, the number or email, when they were sent and what the provider answered (for an email, also whether it was delivered or bounced), and the link codes.

From a file you import (Excel, CSV, phone contacts) we do not keep the file; only its cells, as customer and machine rows.

About the business’s account:

• The people who sign in: name, email, role, language, and when they signed in. The password is stored only as a one-way hash.
• The business’s details: legal name, VAT number, address, phone, email, the SMS sender name and the invoice details.
• The subscription: plan, status and the payments (amount, date). The card details stay with Stripe.
• An activity log: who did what, and when, in the application.

We may send one email to a technician who may be interested in Sirvis. We do not keep their address in the application, and every such email says how to receive no more.

3. Why, and on what legal basis

• To provide the application to the business: performance of the contract (GDPR Art. 6(1)(b)). For its customers’ data, on its instructions, under Annex A of the Terms.
• For service and visit reminders to customers: on the business’s instructions; the business is responsible for the lawful basis of its communication with its customers.
• For billing and invoices: performance of the contract and a tax obligation (GDPR Art. 6(1)(b) and 6(1)(c)).
• For security and preventing abuse: legitimate interest (GDPR Art. 6(1)(f)).
• To see whether a business uses the application (when someone from it was last in, how many customers, SMS and jobs it has), so that we can help it if it got stuck: legitimate interest (GDPR Art. 6(1)(f)).

We do not sell data and do not use it for advertising. We take no automated decisions with legal effects on you and do not build profiles.

4. The providers involved (sub-processors)

The application relies on the providers below. Each receives only what its purpose needs:

When you tap an address in the application, Google Maps opens with that address, from your own browser. We send nothing to Google.

If you turn on notifications on a phone (Settings → “Notifications on this phone”), each new customer request reaches your phone through your browser’s push service (Google for Chrome and Android, Apple for iPhone and Safari, Mozilla for Firefox). The notification leaves encrypted end to end: the service sees only the device’s address, not the customer’s name. You turn it off with one tap.

Every subscription invoice is transmitted, as the law requires, to the Greek tax authority (AADE, myDATA), with the business’s legal name, VAT number, address and the amounts. AADE is a public authority, not one of our providers.

Before adding a new provider that receives customers’ data, we announce it inside the application, so that the business can object (Annex A, A4).

5. Transfers outside the EU

The database and the application server are in Germany. Some providers in the list (for email, payments and the network) process data outside the EU as well.

Where that happens, the transfer relies on the European Commission’s Standard Contractual Clauses or on an adequacy decision, as set out in our agreement with each provider.

6. How long we keep it

• Customers’ and account data: for as long as the account exists, with an active subscription or not. Nothing is deleted automatically when the trial or the subscription ends.
• A customer who has been sent nothing and has no history can be deleted by the business in the application at any time.
• A customer with history can be stopped from messages by the business («Don't send them messages»), and the business can ask us to delete them. The same goes for the whole account. We carry out a deletion within 30 days of the request, at [email protected]. The business downloads a copy of the data whenever it likes from Settings → «Your data» (in Excel, or everything in one file), or asks us and we send it within 30 days. When a customer asks what the business keeps about them, their data downloads from their page («Their details in Excel»).
• The link a customer receives stops working at the end of its service season.
• The activity log: for as long as the account exists.
• Payment and invoice records: for as long as tax law requires.
• We keep the invoices ourselves, for as long as tax law requires; they are transmitted to the Greek tax authority (AADE, myDATA).
• The SMS and email providers keep their own records of the messages sent, on their own retention schedules.

7. Security

• All traffic is encrypted (HTTPS, with HSTS).
• Each business’s data is separated from the others’ in the database itself, not only in the application.
• Within a business, each person’s role decides what they see.
• Nameplate photos are kept in private storage, per business.
• Card details never reach our servers.
• A customer’s link page opens only with its code, does not appear in search engines, and limits repeated attempts.

If a breach affects a business’s customers’ data, we notify the business without undue delay, so that it can make its own notifications.

8. Your rights

You have the right of access, rectification, erasure, restriction and objection, and the right to data portability (GDPR Arts. 15–22).

If you are a customer of a business that uses Sirvis, you exercise your rights with that business. If you come to us, we will pass the request on and help it answer you.

You also have the right to complain to the Hellenic Data Protection Authority (dpa.gr) or to the authority of the country where you live.

9. Cookies and storage on your device

The website and the application keep on your device only what is needed to sign you in and to remember your choices. No advertising, no tracking, no visitor statistics; this is why you will not see a consent banner.

The link page a customer opens and the home page set no cookie at all.

When you turn on notifications on a phone, the application installs a small browser program on it (a service worker), only to show the notifications. It stores no pages and no data. It goes when you turn notifications off or clear the site’s data.

10. Changes and contact

If we change this policy materially, we change the date at the top of this page and announce it inside the application.

For any question about your data: [email protected].