TRANSPARENCY & DATA PROTECTION

Privacy Policy

Here we explain in simple terms what data we process, why we need it, who we may share it with and what rights you have.

Last updated: 27 October 2026

1. Data controller

The data controller is Sevastos Sevastopoulos Insurance & Energy Advisory Office, 2 Eleftheriou Venizelou, Kilkis.

For privacy matters or to exercise your rights, you can contact us at info@sevastos.gr or at 697 618 2204.

2. What data we process

Account: email, authentication details and technical login security information.
Contact and profile: full name, phone number, city, postcode and preferred contact method, when you provide them.
Service requests: information you provide about insurance, electricity or natural gas, notes, renewal dates and appointment details.
Documents: files you choose to upload for analysis, a quote or storage in your personal folder.
Conversations with SEVASTOS AI: messages, files you attach and the technical information needed to generate and display a response.
FAN ZONE competitions: vehicle type, timing and technical information about game attempts, game selections, entry codes, validity status and prize draw audit data.
CROWN+ games: Question identifiers and display times help avoid repeats. Question history is stored in your browser and, when signed in, synced to your account across devices. MILLION+, BILLION+ and TRILLION+ crowns are saved with the stage, winning run identifier and recording time. The 15 question identifiers and answers are sent to validate a crown and are not retained in its milestone record. For signed-in myCROWN+ players, the current game (questions, option order, selection and used lifelines) is also saved for cross-device continuation. Completed results retain the stage, points, correct-answer count, lifelines, time and category totals. On completion, detailed answer choices are replaced by a summary. Data is visible only to its account holder and is deleted with the account. Offline saves sync when connectivity returns. Optional share cards are created on your device and contain only the selected result, without an email address or account details.
CROWN+ group challenges: Your nickname, points, correct-answer count and participation status are visible to anyone with the personal link. MILLION+ invitations can be created and joined without signing in. Guests are identified by a random participation secret in their browser, without IP-based identification or device fingerprinting. Only the creator can delete an invitation and its results; guest creators manage it in the same browser and lose access if they clear browser data. Signing in is optional and saves new invitations to the account. We do not access your contacts. Before sending the invitation, the creator chooses from 1 to 10 rounds and may choose one or more categories; the selected categories are shown to the group and apply to later rounds in the same series. In a series of two or more rounds, each player progresses at their own pace and new players may join later, the same participation identifiers are carried into later rounds and the original link opens the player’s next round. Overall standings rank wins first, followed on tied wins by placement points, correct answers, total score and shortest total time. The same nickname in a different browser does not merge entries. Invitations expire after 7 days and challenge data is automatically deleted after 30 days. For timed challenges, answer selections, lifelines and timings are retained to resume the game and validate its result, with the same maximum retention of 30 days. Active invitations are stored in the browser per user. Signed-in members can retrieve their own invitations and joined challenges through their account. The creator can delete an invitation and its results for the whole group; other participants can only remove it from their own list.
Referral programme: personal link code, category of interest and details entered by the interested person themselves. From 30 September 2026, users may not enter another person's details directly.
Technical data: basic device data, security events and operational information necessary to protect the service and ensure its reliability.

We do not ask you to provide more data than is necessary for the specific request. Avoid sending irrelevant or excessive information in free-text fields and files.

3. Purposes and legal bases

Account and services

Account creation, secure login, request management and provision of MySEVASTOS features.

Performance of a contract or steps taken before entering into a contract.

Handling requests

Communication, quote preparation, appointments, reminders and sharing with a partner only when required for the service you requested.

Your request, performance of a contract and, where applicable, a legal obligation.

Security and reliability

Preventing fraud or misuse, investigating technical issues and protecting accounts.

Legitimate interests in secure operation and the protection of rights.

Running competitions

Validating tickets, applying entry limits, conducting a transparent draw, checking eligibility and awarding the prize.

Performance of the entry terms and our legitimate interest in maintaining the integrity of the process.

Customer referrals

Linking the interested person's independently submitted request to the personal link of the customer who invited them, and managing any reward.

A request from the individual concerned and fulfilment of the programme terms.

Optional communications

Marketing communications are sent only if you have given separate consent, which you can withdraw at any time.

Consent.

Optional analytics data

Measuring visits and actions to improve the service, only after you opt in through the privacy panel.

Consent, which may be withdrawn at any time.

4. Required and optional fields

Fields marked as required are needed to complete the relevant action. If you do not fill them in, we may be unable to create an account or handle your request. All other fields are optional.

5. Recipients and data processing partners

Access is restricted to authorised persons and technical providers needed for authentication, hosting, storage, messaging, technical support and security. The account and data infrastructure operates through Supabase. When you use SEVASTOS AI, the text and files you select may be sent to an AI model provider solely to generate the response. When your request concerns a specific quote or contract, data may be shared with the relevant insurance or energy partner to the extent necessary.

We do not sell personal data. If a transfer outside the European Economic Area is required, the safeguards specified by the GDPR are used.

6. Retention period

We retain account data while the account is active. Request, conversation and document data are retained until the service is completed, and then only for as long as required by applicable legal, tax, insurance or evidentiary obligations, or until you request deletion, where permitted. Analytics events are automatically deleted after 12 months. Competition records are retained to complete, verify and document the draw, then deleted or anonymised when the relevant lawful or evidentiary purpose no longer applies. Anonymous entry IDs and cryptographic evidence of the draw may remain public for transparency.

Account question history and CROWN+ conquests are deleted with your account. Local history and your game remain until you clear this site’s data from your browser.

In insurance and energy forms, a temporary draft in your current tab keeps your entries as you move between pages. The draft itself is not sent to the server and does not include attached files.

7. Analytics data and privacy choices

We do not activate analytics, create an analytics session identifier or send a usage event before you select ‘Accept analytics’. If you select ‘Essential only’, only the functions required for security, log in, saving your choice and the service you requested will operate. We also respect an active Global Privacy Control or Do Not Track signal.

You can change or withdraw your choice at any time using the “Privacy settings” button on the home page or directly here. Withdrawal stops future measurement without affecting the lawfulness of earlier processing.

8. Your rights

You may request access, rectification, erasure, restriction, portability or object to processing, depending on the legal basis and the conditions under the GDPR. Where processing is based on consent, you may withdraw it without affecting the lawfulness of processing carried out before withdrawal.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority.

9. Artificial intelligence, automated decisions and security

SEVASTOS AI is an artificial intelligence system, not a person. It may make mistakes or fail to capture all the terms of a document. Do not upload unrelated identity, health, bank account or third-party information. Final confirmation of a quote, cover, price or contract is provided by a person and the relevant provider's official documents.

We do not make decisions with legal or similarly significant effects solely through automated processing. The electronic competition draw is an automated selection based on published rules and public randomness, but a person confirms the winner after checking eligibility. CHALLENGE 60″ answers do not assess driving ability and are not used for insurance pricing or acceptance. We apply organisational and technical measures proportionate to the risk, although no online service can guarantee absolute security.