Privacy Policy — ToWork Thessaloniki

At ToWork we only collect the data we need to respond to your request, provide the workspace or registered business address you chose, and meet our legal obligations. We do not sell data, and we do not use it for advertising without your consent.

Here you will find what data we process, why, for how long, who we share it with and what rights you have. This policy follows the General Data Protection Regulation (EU) 2016/679 (“GDPR”), Greek Law 4624/2019 and Greek Law 3471/2006.

This is a translation of the Greek original. In case of any discrepancy, the Greek version prevails.

Last updated: 16 October 2026

1. Who we are

The data controller is TOWORK SINGLE MEMBER P.C., a single-member private company (“ToWork” or “we”).

• VAT No: 802992995, Tax Office: ΚΕΦΟΔΕ Thessaloniki
• G.E.MI. No: 186958006000
• Address: 83 Vasilissis Olgas Avenue, 1st floor, 54642 Thessaloniki, Greece
• Contact: info@towork.gr, +30 231 601 7826

2. When this policy applies

This policy applies when you visit towork.gr, contact us or fill in a form, use our services or are on our premises.

For our existing clients, it applies together with the “Personal Data” clause of the private agreement we have signed. It does not cover third-party websites we may link to.

3. What data we collect

Depending on our relationship, we process:

• Contact details: full name, email, phone number and the content of your messages.
• Client details: identity details, home address, tax ID, and business, billing and payment details.
• Use of the premises: bookings, entry logs linked to your personal access code, and footage from the entrance security cameras.
• Browsing data: IP address, device and browser, as described in our Cookie Policy.

We do not ask for special categories of data, such as health information. Payments are made by bank transfer, IRIS or card on our premises. Card details are processed by the bank that provides the payment terminal (POS); we do not store them. We do not make decisions about you based solely on automated means.

4. Why we use it and on what legal basis

Each use relies on one of the legal bases in Article 6 GDPR. Consent is only one of them, and we ask for it only where the law requires it.

• Responding to enquiries, quotes and tours — Steps prior to entering into a contract (Art. 6(1)(b))
• Providing our services — Performance of a contract (Art. 6(1)(b))
• Invoicing, tax obligations, client identification where required by law — Legal obligation (Art. 6(1)(c))
• Security of the premises and website, review requests, defence of legal claims — Legitimate interests (Art. 6(1)(f))
• Analytics and advertising via cookies — Consent (Art. 6(1)(a))

Where we rely on legitimate interests, you may object (section 9). Without the information required by the contract or by law, such as your tax ID for invoicing, we cannot provide the service.

5. On our premises

Each member receives a personal access code, and the system logs when it is used.

Two security cameras operate: one outside the main entrance, built into the doorbell, and one inside, facing the entrance to the space. The cameras do not cover work areas, do not record audio and are marked with signs. We use this data only to protect people and property.

For the registered business address service, we use your details for the service agreement and to receive your mail, which we open only at your request.

6. Who we share data with

We do not sell or rent data. We share it only as needed for the purposes in section 4, with:

• public authorities, such as the Independent Authority for Public Revenue (AADE), where required by law;
• our accountant and banks, for invoicing and payments;
• technology providers, such as website hosting and email;
• legal advisers, where needed to defend our rights.

Providers that process data on our behalf are bound by contract under Article 28 GDPR and do not use it for their own purposes.

Some providers are located outside the European Union, for example in the United States. In that case, transfers take place with the safeguards provided by the GDPR, such as adequacy decisions or standard contractual clauses.

7. How long we keep it

We keep data only as long as needed for its purpose or as required by law, such as tax law for invoices and receipts. Client data is kept for the duration of our relationship and for as long as legal claims may be brought. Camera footage is deleted automatically after 15 days, unless it is needed to investigate an incident.

8. How we protect it

We look after the security of your data with technical and organisational measures suited to our business, and we review them when needed. For example:

• an encrypted connection (HTTPS) across the website;
• personal codes for entering the premises and accessing our systems;
• paper documents kept in a locked area;
• regular software updates and backups;
• working with trusted providers that apply their own security measures.

Only those who need your data to serve you have access to it.

We do not ask for card details by email or phone. If you receive a message that appears to come from us and seems suspicious, please let us know at info@towork.gr.

9. Your rights

You may, free of charge, request access to your data, rectification, erasure, restriction of processing or portability. You may also object to processing based on legitimate interests, object at any time to direct marketing, and withdraw your consent.

Write to us at info@towork.gr. We reply within one month; for complex requests, this period may be extended. Some rights are limited by law; for example, we cannot delete invoices before their mandatory retention period ends.

For any issue, we would appreciate it if you contacted us first, so we can resolve it together. You also have the right to contact the competent supervisory authority.

10. Email, cookies and minors

Review requests. After working with us, we may email you to ask about your experience. If you prefer not to receive such messages, just let us know.

Cookies. Essential cookies are always active; all others are activated only with your consent. Details and settings are available in our Cookie Policy. The embedded map is loaded from Google Maps, which applies its own privacy policy.

Minors. Our services are intended for professionals over 18. We do not knowingly collect data from minors.

11. Changes and contact

If anything material changes in how we handle your data, we will update this page and the date at the top. For significant changes affecting active clients, we will also let you know by email.

For any questions, get in touch:

• Email: info@towork.gr
• Phone: +30 231 601 7826
• Post: TOWORK SINGLE MEMBER P.C., 83 Vasilissis Olgas Avenue, 1st floor, 54642 Thessaloniki, Greece

VAT No: 802992995 · G.E.MI. No: 186958006000