Privacy notice: ReplySharp (replysharp.com)
Last updated: 20 October 2026
1. Who we are
ReplySharp is a trading name of Nikolaos Sotiriou, a sole trader based in Greece, Leagrou 8, 11631 Athens, Greece. Email: [email protected] (privacy questions: same address, subject "Privacy"). For the purposes of this notice, we are the controller of the personal data described below.
UK representative (UK GDPR Art. 27): we are appointing a UK representative and will name them here. Until then, UK residents can contact us directly at [email protected].
2. Important: enquiry data we handle for our clients
We run an enquiry-response service for businesses such as plumbers, heating engineers, electricians and letting agents. If you sent an enquiry to one of those businesses, that business is the controller of your data and we act only as its processor, under a written data processing agreement. Please see that business's privacy notice and contact it to exercise your rights (we'll pass on any request we receive). In short, we use your enquiry only to help that business reply to you, follow up on your enquiry and report to it. We use AI tools to help draft replies, and a person checks them. Every reply is sent in that business's name. We don't sell your data or use it for our own marketing.
3. What we collect and why (as controller)
| Who | Data | Purpose | Lawful basis (UK GDPR / EU GDPR Art. 6) | How long |
|---|---|---|---|---|
| Prospective business clients (owners, directors, staff of businesses we contact) | Name, job title, business name, business email/phone/address published on the business's website, Companies House / CRO status, notes on publicly visible business information (e.g. services, areas, recent news), our emails/messages and your replies; if we ran a speed test, when and how the business replied | To contact businesses about our service (B2B outreach by email, phone or LinkedIn) and keep records of contact | Legitimate interests (Art. 6(1)(f)): telling relevant businesses about a relevant service, at low volume. You can object at any time. Greece: we email only with your prior consent (Law 3471/2006 art. 11); consent (Art. 6(1)(a)) | 90 days after last contact if we don't work together; longer if a conversation is ongoing |
| People who opt out | Email/phone, business, date, reason | To make sure we never contact you again (suppression list) | Legitimate interests / legal obligation to respect objections | Indefinitely, while we do outreach (the minimum data needed) |
| Enquirers and demo bookings (via email or the website) | Name, business, contact details, message, booking time | To reply and run the demo or speed test you asked for | Steps before entering a contract (6(1)(b)) / legitimate interests | 12 months after last contact |
| Clients and their contacts | Names, business details, contact details, approver numbers, billing details, contract, support emails | To provide the service, manage the contract, invoice | Contract (6(1)(b)); legal obligation (6(1)(c)) for invoices/tax | Contract term + 6 years; invoices and accounting records as long as Greek tax law requires (normally at least 5 years from the end of the tax year, longer if the limitation period is extended) |
| Testimonials / case studies | Name, business, quote, results | Publishing with your permission | Consent (6(1)(a)) | Until you withdraw consent |
Where we get data: from you, from your business's public website and listings, from Companies House / the CRO, from LinkedIn when you're a connection, and from our test enquiry if you agreed to a speed test (or, for UK/Irish companies, the single test described in §6).
We don't collect special-category data for our own purposes. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
4. Who we share it with
Service providers who process data for us under contracts with data-protection terms: email hosting (Microsoft 365, Microsoft Ireland Operations Ltd), Cloudflare (domain, website hosting, email routing), AI model providers (used on business/API terms that don't allow training on our data), our accountant (Greece), and banks/payment providers. Tax authorities (AADE) receive invoice data as Greek law requires. We don't sell personal data. The current list is in our sub-processor list: replysharp.com/subprocessors.
5. International transfers
We're based in Greece (EU). Some providers are in the UK or the US. Transfers between the EU and the UK rely on adequacy decisions (EU: Commission Implementing Decision (EU) 2025/2574; UK: the UK's adequacy regulations for the EEA). Transfers to the US rely on the EU-US Data Privacy Framework (and its UK Extension) where the provider is certified, or on Standard Contractual Clauses / the UK International Data Transfer Addendum. Ask us for a copy of the safeguards.
6. Speed tests
If you agree, we send your business one small enquiry and/or one call to measure response time, then send you the result. For UK/Irish limited companies we may, without asking first, send one short, honest enquiry through the business's own website form or published email address (never via paid lead platforms, never by phone, never with false details), and we tell you about it in our first email. We keep the result for 90 days if we don't work together.
7. Your rights
You can ask for access, rectification, erasure, restriction, portability (where applicable) and object to processing based on legitimate interests. You can object to direct marketing at any time, and we will stop (reply "no thanks", or email [email protected]). Where we rely on consent, you can withdraw it at any time. We reply within one month.
Complaints: please contact us first. You can also complain to: - Greece (our lead authority): Hellenic Data Protection Authority (ΑΠΔΠΧ), Kifissias 1-3, 11523 Athens, www.dpa.gr - UK: Information Commissioner's Office, ico.org.uk, 0303 123 1113 - Ireland: Data Protection Commission, www.dataprotection.ie
8. Security
We use access controls, multi-factor authentication, encryption in transit, minimal data in messages, and deletion schedules. No method is 100% secure. If a breach is likely to put you at risk, we'll tell you as the law requires.
9. Cookies
This website doesn't currently use cookies or analytics. If that changes, we'll ask for your consent first (UK PECR reg. 6 / Greek Law 3471/2006 art. 4(5)) and update this notice.
10. Changes
We'll post any changes here with a new date.