Privacy Policy

Last updated: October 2026

1. Who we are

The controller of your personal data is Roam Free SKG PRODROMOS KEVEZITIDIS, VAT No. 165829625, Kamvounion 5, 546 21 Thessaloniki, Greece.
Contact for data protection matters: info@roamfreeskg.com · WhatsApp / phone +30 694 584 4474.

2. What data we collect

• Booking data: email, mobile number (if you provide it on the payment page), locker size and number, booking dates/times, booking ID, amount paid.
• Payment data: payments are processed by Stripe. We do not see or store your card details; we only receive a payment confirmation and the contact details you entered.
• Access codes: the temporary entry and locker codes created for your booking.
• Tax data: the details of the receipt issued for each payment (amount, date, document number).
• Communication: name, email and message content when you contact us via the form, email or WhatsApp.
• Video: the locker area is monitored by security cameras.
• Technical data: IP address and browser information logged automatically by our hosting providers, and cookies (see section 7).

3. Purposes and legal basis

• Providing your booking (Art. 6(1)(b) GDPR – contract): assigning a locker, creating access codes, sending confirmation by email and SMS, extensions, late-pickup fees, remote unlocking.
• Tax obligations (Art. 6(1)(c) – legal obligation): issuing receipts and transmitting them to the Greek tax authority (AADE / myDATA), keeping accounting records.
• Security of the premises and luggage (Art. 6(1)(f) – legitimate interest): video surveillance, fraud prevention and incident investigation.
• Answering your messages (Art. 6(1)(b) or (f)).
• Advertising measurement (Art. 6(1)(a) – consent): only if you accept the relevant cookies.

We do not send marketing messages and we do not make decisions based solely on automated processing that significantly affect you.

4. Who we share data with

We do not sell your data. We share it only with service providers that help us run the service, acting as processors, and only as much as needed:

• Stripe – payments.
• Google (Gmail, Google Sheets, Google Drive) – sending emails, keeping booking and receipt records.
• Cloudflare – running the booking system.
• Netlify – website hosting.
• Yuboto (Greece) – SMS delivery.
• Wrapp (Greece) – electronic receipts and transmission to AADE.
• TTLock – management of the electronic locks (does not receive your name, email or phone number).
• FormSubmit – forwarding contact-form messages to our email.
• Meta (Facebook/Instagram) – advertising measurement, only with your consent.

We may also disclose data to public authorities where required by law (e.g. tax or police authorities).

5. Transfers outside the European Economic Area

Some providers (e.g. Google, Cloudflare, Netlify, Stripe, Meta) may process data in the United States or other countries. Such transfers rely on GDPR safeguards such as the EU-U.S. Data Privacy Framework or the European Commission's Standard Contractual Clauses.

6. How long we keep data

• Booking and contact data: up to 12 months after the booking ends, unless needed to resolve a dispute.
• Receipts and accounting records: as long as required by Greek tax law (generally 5 years from the end of the financial year).
• Access codes: expire automatically at the end of the booking.
• Camera footage: up to 15 days, unless needed to investigate a specific incident.
• Form / email messages: up to 12 months.

7. Cookies

The website uses essential cookies / local storage to work properly (e.g. language preference, your consent choice). With your consent, it also uses the Meta Pixel to measure the performance of our ads. You can change or withdraw your choice at any time via the cookie banner or by deleting your browser cookies. The site also loads fonts from Google (Google Fonts), so your IP address is visible to Google.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and you may withdraw your consent at any time. To exercise them, email info@roamfreeskg.com; we will reply within one month. Some data (e.g. receipts) cannot be erased before the legal retention period ends.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (Kifisias 1-3, 115 23 Athens, www.dpa.gr).

9. Security

We take appropriate technical and organisational measures: encrypted connections (HTTPS), access to data only by authorised persons, temporary codes that expire automatically, and providers with certified security measures.

10. Changes

We may update this policy. The current version is always the one published on this page, with the last-updated date at the top.