Last updated: 11 October 2026
1. Introduction and contact
This Policy explains how we process personal data through https://depnos.com, its demo request form and correspondence sent to info@depnos.com. The website currently offers no signup, login, customer accounts, payments or live POS connections.
Depnos is a hospitality technology project operated by Vasileios Mantelos and Nikolaos Toganidis. Incorporation in Greece is planned; the future company’s registered address is undecided. Until responsibility is transferred, the current operators remain responsible for operating the website. Contact: info@depnos.com.
The project is based in Amsterdam, the Netherlands, and Athens, Greece. Postal contact address: Bercylaan 1195, 1031 KP Amsterdam, Netherlands. This is a contact address for the current operators, not a registered company address.
Vasileios Mantelos and Nikolaos Toganidis jointly determine why and how demo enquiry information is processed and act as joint controllers for that processing. Both manage demo enquiries. You can contact them at info@depnos.com about your personal data and exercise your rights against either controller. Under their joint-controller arrangement, both operators share responsibility for handling privacy requests, protecting enquiry information and applying the retention and deletion rules in Section 5, including deletion of unsuccessful enquiries no later than 12 months after the last contact unless a specific legal obligation or identifiable legal claim justifies limited longer retention. Their common contact point is info@depnos.com. This contact point does not limit your right to exercise your rights against either controller. This Policy provides their joint privacy information and summarises these shared responsibilities.
2. Information we collect
The demo form collects your first name, last name, email, venue type, venue name and POS provider. Telephone information is optional; if provided, it includes the selected country code. If you arrive from a plan link, the selected plan is included. A submission identifier links the enquiry to email delivery attempts. Alternatively, email info@depnos.com; we will request only the information needed to respond. We also process messages and related correspondence you send us.
Selecting a POS provider does not connect it or give us access to its records. We do not request passwords, bank credentials or card details. Do not send these or unnecessary sensitive data.
To help limit abusive demo submissions, the application combines the request IP address and email address and hashes them into a rate-limit identifier. This identifier and submission timestamps are held in temporary application memory, not a lead database. The rate limit evaluates a one-hour window; memory records are removed when the server instance ends or application cleanup removes them. Hashing does not make this information anonymous. To reduce duplicate emails when a submission is retried, we also keep limited delivery metadata: a random submission reference, a cryptographic fingerprint of the submitted content, creation, attempt and expiry times, processing/delivery states and Gmail message reference IDs. The tracking record contains no raw contact or venue details, email bodies, IP addresses or email-sending credentials. This metadata is pseudonymous, not anonymous, and is used for reliable delivery and resolving failed or uncertain sends, not visitor analytics or marketing tracking. Cloudflare processes technical request information, including IP addresses, requested URLs, browser/connection information and traffic metadata, to deliver and secure the website. Stored Workers logs and traces are disabled for this website. Cloudflare also processes network/security information for its own service protection and operations; its retention criteria are the purpose, necessity, security risk and applicable legal requirements, as explained at https://www.cloudflare.com/privacypolicy/. We do not keep a separate visitor access-log database.
3. Purposes and legal bases
We use your contact details to respond to your request and arrange a demo, and your venue/POS details to prepare a relevant response. We do not subscribe you to newsletters or use these details for unrelated promotional campaigns.
Where necessary to take steps you request before entering into a contract personally, we rely on Article 6(1)(b) GDPR. For enquiries made on behalf of a business or otherwise outside that basis, we rely on Article 6(1)(f): our legitimate interest in responding to voluntary business enquiries.
Necessary technical processing for website operation and security relies on our legitimate interest in maintaining a reliable website and preventing misuse. Necessary processing for specific legal obligations relies on Article 6(1)(c); processing for legal claims relies on our legitimate interest in protecting our rights. Legitimate interests must be assessed against your rights and freedoms.
4. Access, providers and transfers
Internal access to submitted enquiries is limited to Vasileios Mantelos and Nikolaos Toganidis, solely to contact you about your request. We do not sell this information or disclose it to unrelated businesses for their marketing. Rights requests and legal obligations are handled as described in this Policy.
We use Cloudflare Workers to host the website and process demo form submissions, and Google Gmail/Workspace to send and store enquiry and demo emails. The demo request implementation does not store lead details in a separate application database. Full enquiry records are kept in Gmail only, without an additional spreadsheet or CRM copy. Cloudflare Durable Objects store the limited delivery metadata described in Section 2. Their execution and storage use the EU jurisdiction setting; this does not mean all website or Google processing takes place in the EU. Cloudflare may process object identifiers outside this jurisdiction for service operations.
Fonts and website images are served from depnos.com; visitors do not contact Google Fonts to load the website font. Social links open external websites only when you follow them; their operators apply their own privacy notices. Limited disclosure may also be necessary to comply with law or obtain professional advice concerning a legal claim.
Cloudflare and Google act as processors for the enquiry content and delivery metadata processed on our behalf under their data-processing terms. They and their authorised subprocessors may access data as needed to operate these services. Their independently determined service/security data processing is described in their own notices: https://www.cloudflare.com/privacypolicy/ and https://cloud.google.com/terms/cloud-privacy-notice. Website delivery uses Cloudflare's global network. Our Google Workspace Business Starter service does not provide an EU-only data-region policy. Processing and support access may therefore take place outside the EEA, including in the United States and other countries where these providers and their subprocessors operate. Their data-processing terms provide transfer safeguards, including the European Commission's Standard Contractual Clauses where applicable and recognised adequacy mechanisms such as the EU–US Data Privacy Framework where applicable. Details: https://www.cloudflare.com/cloudflare-customer-dpa/, https://cloud.google.com/terms/data-processing-addendum and https://cloud.google.com/terms/alternative-transfer-solution. Current subprocessor locations: https://www.cloudflare.com/gdpr/subprocessors/ and https://workspace.google.com/terms/subprocessors. You can request further information or copies of applicable safeguards at info@depnos.com.
5. Retention
For enquiries that do not become customer relationships, we keep the information only while necessary to respond and follow up, and for no more than 12 months after our last contact. We delete it sooner when it is no longer needed. If you become a customer, the applicable customer privacy information will explain retention for that relationship. Limited information may be retained longer for a specific legal obligation or identifiable legal claim.
You may request deletion at info@depnos.com without waiting 12 months. Technical information follows the periods identified in Section 2. Active email-delivery tracking records are scheduled for automatic deletion seven days after submission; provider scheduling may delay removal. Cloudflare's SQLite recovery history may contain recoverable delivery metadata for up to 30 days. This short tracking period does not extend the retention period for enquiry emails or create a separate copy of their contents. The enquiry-email retention rule is applied manually, not by the website. Deletion covers relevant received and sent correspondence, including copies in Trash. Gmail normally keeps Trash for up to 30 days unless permanently deleted sooner; Workspace administrators can generally restore permanently deleted mail for a further 25 days. Google's underlying deletion process follows its data-processing terms, which allow up to 180 days after customer data becomes unrecoverable by the customer, subject to legally required storage. Deletion therefore does not promise instant removal from every provider recovery/backup system. We do not use recovery copies for routine follow-up and will reapply a valid deletion if data is restored. Contact us for help applying deletion to provider-held data. These recovery periods do not authorise continued active use after the enquiry retention limit.
6. Security and cookies
Internal access is restricted as described above. The website uses HTTPS. Email-sending credentials are held server-side and are not included in the public browser code. Google authorization is limited to sending emails, not reading the inbox. The form validates submitted information and uses a hidden anti-spam field and best-effort rate limiting. These measures do not guarantee that all misuse will be prevented.
No online system guarantees absolute security. We assess personal data breaches and make legally required notifications.
We do not use advertising pixels, session recordings or website analytics tracking. Necessary cookies or similar technologies are described at https://depnos.com/cookie-policy. If consent-requiring technologies are introduced, we will provide information and obtain consent before using them.
7. Your rights
Subject to GDPR conditions, you may request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests on grounds relating to your situation. If processing relies on consent, you may withdraw it without affecting earlier lawful processing. You can object at any time to direct marketing if introduced.
Contact info@depnos.com. We may proportionately verify your identity. Requests are normally free; we respond without undue delay, generally within one month. Where law permits, complex or numerous requests may require up to two additional months; we explain this within the first month. If we refuse a request, we explain why and the available remedies.
You may complain to a competent supervisory authority, particularly where you habitually reside, work or the alleged infringement occurred. Examples are https://www.dpa.gr and https://www.autoriteitpersoonsgegevens.nl. You need not contact us first.
8. Automated decisions and children
We do not make solely automated decisions about enquiry data producing legal or similarly significant effects. Demo enquiries target adult business representatives. Contact us if you believe a child has supplied personal data.
9. Changes
We update this Policy when relevant practices or requirements change, publish its date and provide additional notice where appropriate. Future incorporation or new services will require updated operator/processing information and lawful arrangements before the relevant change.