Privacy Policy

1. Introduction

This Privacy Policy describes how CORE TECH LOGIC L.P. ("we", "us") collects, uses, and protects your data when using the bizlist.gr service and its API (api.bizlist.gr).

We are committed to protecting your personal data in accordance with the General Data Protection Regulation (GDPR - Regulation EU 2016/679) and Greek legislation (Law 4624/2019).

2. Data We Collect

A. Public Business Data

We collect and process publicly available business data from official commercial registries:

• Company name and trade name
• GEMI (Greek Business Registry) number and Tax ID (VAT)
• Registered address
• Contact information (email, phone, website)
• Activity codes (KAD/NACE)
• Legal form and status
• Date of incorporation
• Management and representation details
• Details of persons named as signatories in the published documents of the business: full name, capacity and professional registration number
• Published financial statements (balance sheets)

Data sources:

• General Commercial Registry (GEMI) - Greece
• Bulgarian Commercial Register - Bulgaria
• Companies Registration Office - Ireland
• Department of Registrar of Companies - Cyprus
• The business's own public website, where it maintains one: contact details it publishes there itself, social media links, logo and activity description
• Sector-specific public registries: Register of Insurance Intermediaries, Regulatory Authority for Waste, Energy & Water (RAAEY), Hellenic Food Authority (EFET), Register of Shipping Companies for Pleasure Craft
• Official publications on debts, insolvency and infringements: the AADE/e-EFKA list of debtors (POL.1158/2017), the Electronic Insolvency Register and, for legal entities, the lists of infringers published by AADE
• Lists of politically exposed persons (Law 4557/2018) and international sanctions lists (EU, UN, OFAC)
• Publicly accessible third-party sources that display business information, such as online business directories and mapping services (Google Maps, through the provider DataForSEO and the browser extension of section 12): contact details, trade name, geographic coordinates, activity category, and aggregate rating with review count. From reviews we show only the rating and the count
• Public ad libraries (Meta, Google, TikTok) and public business pages on social networks (Facebook, Instagram, TikTok, LinkedIn, YouTube): number of active ads, followers and engagement on recent posts. Estimated website traffic from the provider DataForSEO. We show the counts with a link to the source

B. User Account Data

When you register and use the service, we collect:

• Email address
• Name (if provided via Google OAuth)
• IP address at registration
• Timezone (optional)
• Referral source and campaign identifiers

C. Transaction Data

• Premium subscription status
• Credit balance and usage history
• Data export history
• AI analysis history
• Terms acceptance record: when you accept the Terms of Service, the Privacy Policy and the Acceptable Use Policy, we record the document and its version and the date/time of acceptance, linked to your account, as proof of acceptance. (We do not store an IP address or user-agent in this record.)

D. API Access

For API users:

• API keys (stored encrypted)
• API usage logs

E. Technical Data

• IP address
• Browser type and version (user-agent)
• Pages visited
• Search queries

Technical data (IP, user-agent) is also temporarily used (up to 30 days) in hashed form for server-side attribution, i.e. linking your referral source (e.g. advertising campaign) to your account upon registration.

F. Personal Data Within the Public Data

The public data we process also includes data relating to natural persons: names and roles of managers, partners, board members and legal representatives; data of sole proprietorships (self-employed professionals); public procurement and state aid records (Diavgeia); lists of politically exposed persons (Law 4557/2018) and international sanctions lists (EU, UN, OFAC); as well as natural persons included in the AADE/e-EFKA list of debtors (POL.1158/2017) or the Insolvency Register.

We keep these records as the source publishes them. For natural persons and sole proprietorships we show only a neutral indicator that the person is on the list of debtors, with a link to the official publication. The same indicator appears next to the person's name in the list of people of a company. The debt amount and insolvency records of natural persons stay in our database and are used only to check accuracy against the source.

The lists of politically exposed persons and sanctions do not contain tax numbers. We match them to the people in GEMI by name, and the match is shown as "possible" until it is confirmed.

• Source: This data is not collected from the data subject themselves, but is drawn from the public sources and registers referred to above.
• Categories: Full name, capacity/role, relationship or shareholding percentage and, where the source has them, records in the list of debtors or the Insolvency Register, public contracts/aid, inclusion in a directory or map with a rating, and public online presence counts of the business.
• Legal basis: Legitimate interest (Article 6(1)(f) GDPR), in the context of business transparency and the support of AML/KYC compliance, in conjunction with the framework for the re-use of public sector data (Law 4727/2020). For data of legal persons as such, the GDPR does not apply (Recital 14).
• Contact details from the business's own website: For data drawn from the business's own public website, the legal basis is legitimate interest alone (Article 6(1)(f) GDPR). It is not founded on Law 4727/2020, which concerns public sector information only. The details are published by the business itself for the purpose of being contacted by clients and partners, and their display in a professional directory serves that same purpose. Extraction is performed locally within EU infrastructure, the fields are not accessible to logged-out visitors or to search engines, and the right to object described in the following paragraph applies in full.
• Right to object: Any natural person may object to the processing of their data (Article 21 GDPR) and request correction of any inaccuracy or mistaken identification, at support@bizlist.gr. Requests are handled as described in section 8.
• Article 14 information: Because the data is not collected from the data subjects themselves and the number of persons concerned makes individual notification disproportionately burdensome, individual notice is omitted pursuant to Article 14(5)(b) GDPR. This Privacy Policy constitutes the public information provided for in that same provision.

G. User Notes

Premium users can write notes about companies. We store the note text, the company, the author's account, the sharing choice, and the dates of creation and update.

• Who can see them: Only the author. If the author chooses to share a note, members of the author's organization on bizlist.gr can also see it. The organization administrator can delete a shared note but cannot see private notes. Notes are never shown to other users, to visitors or to search engines.
• Where they are used: Notes appear on the company page, in the notes list and in the responses that you request: the API, MCP, links to the AI tool of your choice and CSV exports. When you send a company link to your own AI tool or connect MCP, your notes reach the provider that you chose. We do not use notes for model training, statistics, profiling or advertising, and we do not sell them.
• Personal data of third parties: You write the text. If it contains personal data of third parties, you are the controller for that data and we act as your processor (Article 28 GDPR), only to provide the service to you. Do not write special categories of data (Article 9 GDPR), such as health data.
• Logging: Our logs record the action (save or delete), the account and the company, not the note text.

3. Legal Basis for Processing

We process your data based on the following GDPR legal bases:

Public business data originates primarily from official public registries whose purpose is transparency and third-party access according to Law 4919/2022 (GEMI), EU Directive 2017/1132, and Law 4727/2020 (Open Data & Re-use of Public Sector Information). PEPs data originates from public sources and is maintained under Law 4557/2018. Sanctions data originates from official EU, UN, and OFAC publications.

In addition, for contact, presentation and online presence details, we draw data from the business's own public website, from mapping services, from public ad libraries and from public business pages on social networks. These sources are not public registries and do not fall under Law 4727/2020: they rest on legitimate interest alone, as described in section 2.F.

4. Purposes of Processing

We use your data to:

• Provide business search and discovery services
• Manage your account
• Operate the credits and Premium subscription system
• Perform AI document analysis upon your request
• Send informational / onboarding emails to registered users (every message includes an unsubscribe link)
• Ensure security and prevent fraud
• Improve our services
• Comply with legal obligations

5. Sharing with Third Parties

We may share data with the following third parties:

5.1 Joint controller: Meta

For the Meta Pixel and the Meta Conversions API, we and Meta Platforms Ireland Ltd (Merrion Road, Dublin 4, D04 X2K5, Ireland) are joint controllers (Article 26 GDPR). This processing happens only if you give consent in the cookie banner.

• What the joint controllership covers: the collection of data on bizlist.gr and its transmission to Meta. We decide what is collected and when it is transmitted: the _fbp/_fbc cookies and page views from the Pixel; registration and purchase events from our server with a hashed (SHA-256) email and account identifier, IP address, user-agent, fbc and fbp.
• What it does not cover: Meta's further processing after transmission (ad measurement, targeting, improving its products). For that, Meta is the sole controller under its own privacy policy.
• The arrangement: we have entered into Meta's Controller Addendum with Meta Ireland, via the Meta Business Tools Terms, to determine our respective responsibilities for compliance with the GDPR with regard to the joint processing. We agreed that:
  • we are responsible for providing you with the information in this section,
  • Meta Ireland is responsible for enabling your rights under Articles 15-20 GDPR (access, rectification, erasure, restriction, portability) with regard to the personal data it stores after the joint processing,
  • each party has its own legal basis for its own processing. Ours is your consent.
• Information about Meta: Meta Ireland's identity and contact details and those of its data protection officer, the legal basis it relies on, and how to exercise your rights against Meta Ireland are in Meta's Privacy Policy.
• Your rights: you can exercise them against us and directly against Meta Ireland (Article 26(3) GDPR). If you contact us about the joint processing, we forward the request to Meta without delay and cooperate on the reply. You withdraw consent via the "Cookies" link at the bottom of every page.
• Transfers outside the EU: Meta may transfer the data to Meta Platforms, Inc. in the USA. The transfer relies on the EU–US Data Privacy Framework, under which Meta Platforms, Inc. is certified, and on the European Commission's Standard Contractual Clauses.

5.2 Google Ads

For the Google Ads tag and offline conversions, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) acts as an independent controller, under the Google Ads Controller-Controller Data Protection Terms. This processing happens only if you give consent in the cookie banner.

• What is collected: the tag sets the _gcl_au and _gcl_aw cookies and records page views and registration and purchase events, with your email hashed in the browser. Our server sends the same events with your email hashed (SHA-256), the ad click identifier (gclid) where available, the IP address you signed up from, the time and the purchase value. With the hashed email and the IP address, Google matches the event to a click on one of its ads when the gclid is missing (enhanced conversions). Google does not see the email, only the hash.
• The tag may load through our own domain and forward the data to Google.
• Purpose: measuring registrations and purchases from Google ads, and showing our ads to people who visited the site.
• Information about Google: how Google uses the data and how you exercise your rights against it, in the Google Privacy Policy and on How Google uses information from sites or apps that use our services.
• Transfers outside the EU: Google may transfer the data to Google LLC in the USA. The transfer relies on the EU–US Data Privacy Framework, under which Google LLC is certified, and on the European Commission's Standard Contractual Clauses.

6. International Data Transfers

Some of our partners (e.g., AI service providers) may be located outside the European Economic Area (EEA).

In such cases, we ensure the protection of your data through:

• The EU–US Data Privacy Framework (DPF) adequacy decision, for providers certified under it (e.g., Google LLC)
• European Commission Standard Contractual Clauses (SCCs), where no adequacy decision applies

For the transfers by Meta and Google Ads to the USA, see sections 5.1 and 5.2.

7. Data Retention Period

8. Your Rights

Under the GDPR, you have the following rights:

• Right of access: To know what data we hold about you
• Right to rectification: To correct inaccurate data
• Right to erasure: You can delete your account from Account Settings or request data deletion
• Right to restriction: To restrict processing
• Right to portability: To receive your data in a machine-readable format
• Right to object: To object to processing
• Right to withdraw consent: At any time, without affecting the lawfulness of prior processing

To exercise your rights, contact us.

Account deletion: You can delete your account at any time through your settings. Upon deletion, technical logs are retained for their remaining retention period. Logs contain only an internal identifier (user ID) which, after deletion, does not correspond to any person.

Complaint to the Data Protection Authority

You have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA).

9. Data Security

We implement technical and organizational measures to protect your data:

• Encryption of sensitive data (AES-256-GCM)
• Secure authentication (JWT tokens, OAuth)
• Role-based access controls
• Regular security updates
• HTTPS for all communications

10. Cookies and Tracking

Essential (no consent required):

• Session cookies: Essential for authentication and service operation
• User preferences: Language and display theme (localStorage)
• bl_consent: Your choice for advertising cookies, so you are not asked again on the same device

Advertising (only with your consent, Art. 4(5) Greek Law 3471/2006 / ePrivacy):

• Meta Pixel (_fbp, _fbc): Measures registrations and purchases that originate from Facebook/Instagram ads. Loaded only after you click "Accept" in the cookie banner.
• Google Ads tag (_gcl_au, _gcl_aw): Measures registrations and purchases that originate from Google ads, and shows our ads to people who visited the site. Loaded only after you click "Accept".

Events sent from our server (Meta Conversions API, only with your consent, Art. 6(1)(a) GDPR): If you accept, we send registration and purchase events to Meta with a hashed (SHA-256) email and account identifier, IP address and user-agent, so they can be matched to the ad click. This is not a cookie. With the same consent, we send Google Ads the same events with a hashed (SHA-256) email, the ad click identifier (gclid) where available, the sign-up IP address, the time and the purchase value. Your consent is recorded on your account with a date.

You can withdraw or change your choice at any time via the "Cookies" link at the bottom of every page. Without consent, no third-party cookie is loaded and no identifier is sent to advertising platforms. Campaign attribution (which source you came from) is done server-side without cookies. We honour the browser's Global Privacy Control signal as a refusal.

Change cookie choices

11. Third-Party AI Connectors (Claude, ChatGPT and others)

When you connect your bizlist.gr account to a third-party AI assistant, such as Claude (Anthropic) or ChatGPT (OpenAI), via our OAuth integration (MCP), an access token is issued that ties your bizlist account to that assistant. The third-party application uses this token to call our API on your behalf.

What we receive: only the tool calls (requests) the assistant makes to our API, for example a search for companies in an area or a request to analyze financial documents. We do not receive any other content of your conversation with the assistant.

What we send: the responses to those requests. They contain the same public data you see on bizlist.gr: company details, financial data, names of directors, board members and shareholders with their role in each company, and your own notes. We never send the tax IDs (ΑΦΜ) of natural persons. The provider you chose processes the responses under its own privacy policy.

What is stored: the assistant's provider stores an encrypted copy of the access token on its side. bizlist.gr stores a hashed refresh token and a short-lived revocation list. Tool calls are logged for billing and abuse-prevention purposes under the same retention rules as other API usage.

Revoking access: you can disconnect the integration at any time from your account settings on bizlist.gr or by removing the connector from the assistant. Revocation invalidates the token immediately.

12. Browser Extension (Bizlist Extension)

We offer an optional browser extension that detects Greek business identifiers (Greek VAT/AFM, GEMI number, EU VAT, domain, email, phone, company names with legal suffixes) on the pages you visit and shows the corresponding public registry information from bizlist.gr.

How it works: Detection happens locally in your browser. When an identifier is found, the extension sends it to api.bizlist.gr to retrieve the matching public company data.

What we log:

• The lookups performed through the extension (the identifiers sent for lookup)
• When the extension matches a company on a page, it sends the page URL/host to the server along with correlation signals (domain and, where detected, email/phone) solely to match the correct company. Emails and phone numbers detected on pages are used only at the moment of matching. From these lookups we record the corporate identifiers (Greek VAT/AFM, GEMI number, EU VAT, domain, company name).
• On Google Maps, for each place shown on the page, we log the listing details as published by the business itself: Google place identifier, name, address, phone number and website.
• Any feedback messages you voluntarily submit through the extension

The recorded data (anonymous, no IP, no user account) is used for the quality and completeness of our database and to detect gaps (e.g. companies with an undeclared website). Google Maps listing details are also used to enrich and update public company data, e.g. a new business or a change of address, phone number or website.

How usage stays anonymous:

• Extension logs are written without your IP address, without an account and without a user-agent
• The extension works without an account or login
• The extension sends only the identifiers it detects and, on Google Maps, the listing details of the places shown. The rest of the page content stays in your browser
• The extension works without cookies and without recording browsing history

Legal basis: Legitimate interest (Article 6(1)(f) GDPR) for improving the service, preventing abuse and enriching public business data.

Retention: Extension logs are retained for 24 months, the same as other technical logs.

You can disable or uninstall the extension from your browser at any time.

13. Changes to This Policy

We may update this policy periodically. In case of material changes, we will notify you via email or a notification in the service.

Continued use of the service after changes constitutes acceptance of the updated policy.

14. Contact

For questions about the protection of your personal data or to exercise your rights: