Privacy Policy

The data controller is Velova IKE, a company registered in Athens, Greece. For all privacy-related inquiries, contact our Data Protection Officer at dpo@velova.com.

We collect the following categories of personal data:

• Account data: name, email address, phone number, role (customer or mover)
• Survey data: move details, room inventory, item lists, access conditions, preferred dates
• Media: photos and videos uploaded as part of the AirSurvey room walkthrough (classified as personal data under GDPR)
• Payment data: processed by Stripe; Velova does not store card numbers
• Mover compliance data: AFM (tax ID), GEMI number, IBAN, insurance certificates (DAC7 requirement)
• Usage data: anonymised analytics via PostHog, cookies (see section 10)

We process your data under the following legal bases as defined by GDPR Article 6:

• Contract performance (Art. 6(1)(b)): processing necessary to provide our marketplace services
• Legitimate interest (Art. 6(1)(f)): fraud prevention, platform security, service improvement
• Consent (Art. 6(1)(a)): marketing communications, photo/video upload
• Legal obligation (Art. 6(1)(c)): DAC7 tax reporting, accounting records retention

We use collected data to: facilitate survey submissions and quote matching, process payments via Stripe Connect, generate structured briefs for movers (see section 5), resolve disputes, comply with tax reporting obligations, and improve our platform through anonymised analytics.

Payment service provider: Stripe Inc. processes all payments. Stripe's privacy policy applies to payment data.

Movers: Movers receive a structured brief prepared by the Velova team. This brief includes move details, CBM estimates, access conditions, and special item flags. Movers never receive raw photos, videos, or the customer's exact address before a booking is confirmed.

We do not sell personal data to third parties.

Photos and videos uploaded during the room walkthrough survey are classified as personal data. They are:

• Stored on Cloudinary servers within the European Union (Frankfurt region)
• Reviewed by the Velova team to prepare the survey report
• Never shared with movers in raw form
• Automatically deleted 6 months after job completion

Explicit consent is obtained before any media upload. You can withdraw consent at any time, though this may affect the accuracy of your survey.

Under EU Directive 2021/514 (DAC7), Velova is required to collect and report the following information about movers to the Greek tax authority (AADE) annually: legal name, tax identification number (AFM), IBAN, registered address, and total annual earnings on the platform. This reporting is a legal obligation and cannot be opted out of.

• Account data: retained while the account is active, deleted 12 months after account closure
• Survey and job data: retained for 5 years (Greek tax law requirement)
• Photos and videos: deleted 6 months after job completion
• Payment records: retained for 5 years (legal obligation)
• Audit logs: retained for 5 years (compliance requirement)

Under GDPR, you have the right to:

• Access: request a copy of your personal data
• Rectification: correct inaccurate data
• Erasure: request deletion of your data (subject to legal retention obligations)
• Portability: receive your data in a structured, machine-readable format
• Restriction: limit processing in certain circumstances
• Objection: object to processing based on legitimate interest

To exercise any of these rights, contact dpo@velova.com. We respond within 30 days as required by GDPR.

We use essential cookies for authentication and session management. Analytics cookies (PostHog, Google Analytics with Consent Mode v2) are only activated after you provide consent via our cookie banner. You can withdraw cookie consent at any time through your browser settings or by clicking “Manage cookies” in the site footer.

All primary data processing occurs within the EU (Supabase Frankfurt region, Cloudinary EU region). Where sub-processors are located outside the EU (e.g. Stripe US), transfers are protected by Standard Contractual Clauses (SCCs) as approved by the European Commission.

Velova IKE
Athens, Greece
Data Protection Officer: dpo@velova.com

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (DPA): www.dpa.gr