ΕΛ | EN
When you request a scan, for 10-20 minutes we see where your device connects — not what you say or write. We install nothing, we do not read communications, and we do not keep your raw traffic. Analysis takes place only with your express consent, which you may withdraw at any time by disconnecting the VPN.
| Data | Purpose | Legal basis |
|---|---|---|
| Email, order details | Conclusion/performance of contract, invoicing | Art. 6(1)(b) (contract), (c) (tax law) |
| Traffic metadata (destination addresses/domains, ports, timestamps, volumes — NOT content) | Detection of indications of surveillance software | Express consent (Art. 6(1)(a), 9(2)(a)) |
| Findings & PDF report | Deliverable of the scan | As above |
| Consent record (timestamp, text version, IP) | Proof of lawful performance | Art. 7(1) (accountability) |
| Security logs | Protection of infrastructure | Legitimate interest (Art. 6(1)(f)) |
We ask for express consent because the domains a device communicates with may indirectly reveal sensitive information (e.g. health apps). Withdrawal does not affect the lawfulness of processing carried out beforehand.
Our infrastructure is located exclusively within the EU: analysis and storage server in Germany (Contabo GmbH), notification email service in France (Scaleway). Your account, findings and reports are stored only within the EU.
None of your data leaves the European Union.
The analysis of your traffic is carried out entirely on our own systems within the EU. We do not submit queries to any third-party service regarding your device, your findings or any element of your traffic — neither to reputation services, nor to artificial intelligence services, nor to any other provider outside the EU.
| Data | Retention |
|---|---|
| Raw traffic | Not stored |
| Technical analysis files | Up to 90 days (automated deletion) |
| Findings & report | 12 months or until your deletion request — whichever comes first |
| Account | Duration of the relationship + 12 months from last activity |
| Consent record | Retained after deletion (see §7) |
| Tax documents | As required by tax legislation |
Access, rectification, erasure, restriction, portability, objection, withdrawal of consent — at grypas@4ip.gr, response within one month. Regarding erasure: we remove your account, findings, reports and files, and anonymise security traces; we retain only the record of your consent (timestamp, text version) as proof that the scan was lawfully performed (Articles 5(2), 7(1) GDPR) — it contains no findings or details of your device. Right to lodge a complaint: Hellenic Data Protection Authority, 1-3 Kifissias Ave., 115 23 Athens, dpa.gr.
Encryption on all transfers (TLS/HSTS, encrypted tunnel), EU-only infrastructure, access via unique links of limited validity with immediate revocation capability, cryptographic integrity sealing of reports (SHA-256). In the event of a breach we notify the Hellenic DPA and, where required, you (Articles 33-34). Analysis is automated; the report does not constitute a decision producing legal effects under Article 22 — its use rests with you. Cookies: only a technically necessary session cookie is used for the operation of your login — no consent is required (Article 4(5) of Greek Law 3471/2006); no advertising or third-party cookies are used. Material changes are published with a date.