Privacy Policy

The data controller is VELOVA ΜΟΝΟΠΡΟΣΩΠΗ Ι.Κ.Ε. (VELOVA SINGLE MEMBER P.C.), GEMI 194620801000, AFM 803325569, registered seat Zervou I 17A, 14121 Irakleio Attikis, Greece. Privacy contact: privacy@velova.io.

This Policy explains how Velova uses the personal data of customers, movers and visitors to velova.io and velova.gr. It is the information that Articles 13 and 14 of the GDPR require: you are not asked to agree to it, and it is not part of a contract.

Velova has not designated a Data Protection Officer, because the conditions of Article 37(1) GDPR are not met. Privacy requests are handled by Velova's management.

Once a booking is confirmed, the mover you booked becomes a separate controller for the data it needs to carry out the move: your name and contact details, the addresses and the access details. Velova and the mover are not joint controllers (Article 26 GDPR); each is responsible for its own processing. The mover's obligations are set out in the Mover Agreement, Section 13.

We collect only what each part of the service needs.

• Customer account: name, email, telephone and language. When you open an account from the registration page, we record your confirmation that you are 18 or older, with its date, version, IP address and browser.
• Request without an account: the same contact details, entered with the request.
• Your move: pickup, delivery and any second delivery address, and the point you mark on the map; floor, lift, parking and other access details; dates; the inventory of items and the volume; notes; vehicle details; storage needs; and, if you give them, the name and telephone of the person who will hand over keys or receive a delivery.
• Photos and videos you upload: rooms, special items, boxes, plants, vehicle, and any files you send when Velova asks you for more information (see Section 6).
• Booking and after: the offers you receive, the booking, payment records (amounts and refunds; card details are entered on Stripe's page and never reach Velova), the Proof of Delivery (POD) uploaded by the mover, extra-charge requests, complaints with their text and photos, and reviews.
• Movers: company or individual details, contact person, email and telephone; the tax and registration data required for DAC7 (Section 7), including date of birth for an individual and the IBAN you give us; your connected Stripe account; the areas and services you declare; offers, bookings, earnings and reviews; files you upload for a job (evidence for an extra charge, invoices); your acceptance of the Mover Agreement with its date, IP address and browser; and, if you turn them on, push-notification subscriptions with the device's browser identifier.
• Consent records: for each consent you give (photos and videos, vehicle photos, special-item photos, marketing emails), the version of the text you saw, the time, and the IP address and browser. Your marketing choices are recorded with each request; you can change them in Consent preferences or with the unsubscribe link in each email.
• Everyone, visitors included: the technical data every request to a website carries (IP address, browser, pages requested), in our hosting provider's logs and in the rate limiter that protects the site; error reports when something fails; and, only if you allow analytics, pseudonymised usage statistics (Section 10).

Velova is for adults: to open a customer account you confirm that you are 18 or older. We do not ask for identity documents. We do not seek special categories of data (Article 9 GDPR), but photos of a home can show them incidentally — see Section 14.

• To provide the service you ask for: account, request, invitations and offers, booking, payment, Proof of Delivery, extra charges, complaints and reviews; for movers, onboarding and the Mover Agreement. Legal basis: performance of a contract, or steps you ask for before entering into one (Article 6(1)(b) GDPR).
• To meet our legal obligations: DAC7 reporting (Section 7), tax and accounting records, and answering lawful requests from authorities (Article 6(1)(c)).
• To keep the platform secure and working: security logs, a limit on requests per IP address, error reports, a record of changes, cookieless statistics on how the site is used (Section 10), preventing fraud and circumvention of the platform, and establishing or defending legal claims. Legal basis: our legitimate interests (Article 6(1)(f)). You can object to this processing (Section 9).
• With your consent (Article 6(1)(a)): storing your survey photos and videos; sharing vehicle and special-item photos with movers; analytics cookies; marketing emails (two separate choices: tips and guides, and promotional offers); push notifications for movers. You can withdraw any consent at any time (Section 9); withdrawal does not affect what was done before it.

Reading this Policy is not a consent. Where you are asked to confirm that you have read it, the confirmation records that you were informed; it is not the legal basis of any processing.

(a) Your request. Velova's team reviews your request and the photos and videos you upload, and prepares the brief that movers price. The distribution engine then invites approved movers who serve your route, under the rules of the Mover Agreement (Section 4). What invited movers see is described in Section 5.

(b) Requests that are not booked. If a request is not booked, Velova closes it automatically 30 days after the moving date you chose (the last day, if you gave a range), or after 90 days without activity if you did not choose a date. We email you 7 days before. A closed request is cancelled at no cost to you, and its photos and videos are deleted 30 days later (Section 8).

(c) Links in our emails. If you use Velova without an account, the links in our emails open your request without a password. They work until 90 days after the move is completed or the request is cancelled; after that, if you made a booking, you can sign in with the email of your booking. We keep these links out of the page addresses sent to analytics, error-reporting and payment providers.

(d) Messages. We send service emails about your request, booking and payments; they are part of the service and need no consent. We send marketing emails only if you opted in, and each one has an unsubscribe link. Movers who turn on push notifications receive alerts about new invitations on their device.

(e) Automated decisions. Which movers are invited to a job is decided automatically by the distribution engine, using only the eligibility rules and criteria of the Mover Agreement (Sections 4.1 and 4.2); Velova's staff may add a mover only as Section 4.4 allows. A mover can ask for any such decision to be reviewed by a member of Velova's staff, give its view and contest it, through the Internal Complaint Mechanism of the Mover Agreement (Section 8.2); where the mover is a natural person, these are also its rights under Article 22(3) GDPR. No decision with legal or similarly significant effects is made about customers solely by automated means.

(a) Movers invited to quote receive Velova's brief: inventory, volume, access, dates, and the street and area of each address. When they open the job, they also see the full address, house number included, so they can assess access before pricing; the first view of each full address is recorded. They also see vehicle photos and special-item photos (for example a piano, artwork or a safe), only if you gave the separate consent for them. They never receive the photos or videos of your rooms or boxes, or your name, telephone or email. The Mover Agreement (Section 13.1) binds them to use the address only for their offer, not to contact you or visit the address before you accept an offer, and not to keep it if they do not win the job.

(b) The mover you book also receives, after booking, your name, telephone and email, and the name and telephone of anyone you named for the keys or for a second delivery. No other mover receives them.

(c) Customers, about movers. A customer who receives a mover's offer sees the mover's company name, rating, number of completed moves and reviews. Before paying, the booking screen also shows the mover's trader information: legal name, registered address, registration and tax numbers, business email and telephone; the booking confirmation repeats it. After booking, the customer also sees the mover's contact person.

(d) Service providers. The companies below process data for Velova under contracts that limit them to providing their service, except where the table says that they act under their own privacy policy.

(e) Google Maps. At the address step, the search and the map run on Google Maps: what you type there, the point on the map and, if you tap "My location", your device's location are sent to Google, together with your IP address. Google processes them under the Google Maps Platform terms and Google's privacy policy.

(f) Authorities and advisers. The Greek tax authority (AADE) for DAC7 (Section 7); courts and authorities where the law requires it; our lawyers and accountants, who are bound by confidentiality.

We do not sell personal data and do not use it for advertising.

Photos and videos of the inside of a home are personal data of a particularly private nature. Velova handles them as follows:

• You upload them only if you choose to; a request without them is always possible: choose “Quick item count” and add no photos.
• Your consent is asked at the last step of the request, before you submit it (media-consent@2.2). Files you upload before that step are kept only to complete your submission, and are deleted within 2 days if you do not submit it.
• Only Velova's team sees the photos and videos of your rooms and boxes; movers receive the brief prepared from them (Section 5). Vehicle and special-item photos are shared with the invited movers only with their separate consents.
• The files are stored by Cloudinary in the United States. They are not public: they open only inside the Velova platform, which checks on every request that the person asking may see the file. Velova staff accounts are protected by two-factor authentication, and staff access to the files is recorded.
• They are deleted automatically 30 days after the move is completed or the request is cancelled, including when a request closes automatically (Section 4(b)). You can ask for earlier deletion at privacy@velova.io.
• If you withdraw your consent from your profile (Consent preferences), the files are deleted within a day, unless a complaint or dispute about the move is open (Section 8). Without an account, write to privacy@velova.io.
• Velova does not use them to train AI models (Section 14).

We have assessed this processing in a data protection impact assessment (Article 35 GDPR), last revised in October 2026.

Under EU Directive 2021/514 (DAC7), Velova is required to collect information about movers and report it to the Greek tax authority (AADE). This is a legal obligation and cannot be opted out of.

What we collect from every mover. Whether they trade as a company or as an individual; their registered address; their tax identification number (AFM) and the country that issued it; their business registration number (GEMI) where they are a Greek company; and the IBAN they give us. The IBAN is collected for identification and tax reporting; Velova pays movers only through their connected Stripe account, to the bank account they have registered with Stripe. We also record when they confirmed these details, from which IP address and with which browser, as evidence that they provided them.

From a company we additionally collect the legal name. From an individual or sole trader we additionally collect first name, last name and date of birth — the Directive requires a date of birth for a natural person. A VAT number and any other EU country where the mover has a permanent establishment are collected where they exist; neither is required.

Verification. Where an official registry interface is available to us, we may check the details against it and keep the registry's response as our record that the check was made. Where no such interface is available — for example for a mover established outside Greece — the details are entered manually and verified from the documents we hold.

What we report, and how often. The identifying information above — including the IBAN the mover gave us, where the reporting rules require a financial account identifier — together with the amount paid to the mover and the fees we withheld, for each quarter of the reporting year, and the number of moves they completed in each quarter. The report itself is filed annually, by 31 January for the preceding year, but the amounts in it are broken down quarter by quarter.

We keep these data for the period set out in Section 8.

Hosting logs, error reports, email records and backups expire on their own schedule, so data erased from the platform can remain in them until they expire. If a complaint, a dispute, a payment dispute or a legal claim is open, we keep the records it concerns until it is resolved (Article 17(3)(e) GDPR).

You have the right to access your data and receive a copy (Article 15); to have inaccurate data corrected (16); to have data erased (17); to restrict processing (18); to receive the data you gave us in a machine-readable format (20); to object to processing based on our legitimate interests (21); to withdraw any consent at any time (7(3)); and, for movers, the rights in Section 4(e) on automated decisions (22). You can also complain to the Hellenic Data Protection Authority (Section 13).

How. Customers with an account can download the data of their account and delete the account from their profile, and withdraw consents in Consent preferences. Everyone else — customers without an account, movers, people who appear in a survey recording, visitors — can write to privacy@velova.io.

We answer within one month. For complex requests we may extend this by two further months; if so, we tell you why within the first month. We may ask you to confirm your identity.

What remains after you delete your account. Deletion takes effect at once. While a booking of yours is in progress, deletion is not possible; you can delete the account once the booking is settled. We keep only: what the law requires (payment records, invoices, DAC7 data — Section 8); for each booking, what is needed as evidence for possible claims (amounts, dates, towns, the Proof of Delivery and any extra charges with their evidence), without your name, contact details or addresses; complaints, with their photos and the mover's replies, for the period in Section 8; the record of the consents you gave, without the IP address after 12 months; the record of changes (Section 8); and data in our providers' logs and backups until they expire (Section 8). Reviews you wrote are deleted.

Velova stores a small amount of information on your device. Some of it is needed for the site to work; the rest runs only if you allow it. This is the complete list.

What runs without consent. Vercel Analytics, Vercel Speed Insights and Sentry (error reporting) load on every page. None of them sets a cookie or writes anything to your device — we checked this against the code they actually execute, not against their documentation. Because nothing is stored on or read from your device, they fall outside Article 5(3) of the ePrivacy Directive and do not require your consent. They are listed here so that you know they are running. At the address step, the Google Maps search and map load from Google (Section 5(e)); they are needed for the address you are entering.

Offline support. Velova installs a service worker so that, without a connection, the site shows an offline page instead of an error. It keeps copies of the site's own files (scripts, styles, fonts and images) and of that page in your browser's cache; it does not keep copies of the pages you visit. It holds no personal data and does no tracking, but those files stay on your device until you clear your browsing data.

No consent is needed today. Velova uses no analytics, advertising or tracking cookies, so there is nothing to accept or refuse. “Manage cookies”, at the foot of this page, shows these categories at any time. If we ever add analytics, we will ask for your consent first, and “Manage cookies” will be at the foot of every page.

Our database (Supabase) and our server functions (Vercel) are in Frankfurt; the photos, videos, Proofs of Delivery and invoices are stored by Cloudinary in the United States. Some providers are US companies or may access data from the US: Vercel, Stripe, Google, Resend, Sentry, Upstash, Cloudinary and, for movers' push notifications, Apple, Mozilla and Microsoft. Transfers to them rely on the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795) where the company is certified, and otherwise on the Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) in its data processing terms. You can ask privacy@velova.io for a copy of the safeguards.

We protect data with encryption in transit (HTTPS), access limited to what each role needs, two-factor authentication for every Velova staff account, private storage of files (Section 6), and records of changes and of staff access to sensitive data.

If you suspect that someone has accessed your account or your data, write at once to security@velova.io (mark it urgent). Change or reset your password on the platform, check your payment methods for activity you do not recognise, and forward any suspicious email to security@velova.io with its full headers. Security researchers can report vulnerabilities to the same address; our security contact is also published at /.well-known/security.txt (RFC 9116).

If a personal data breach occurs, we notify the Hellenic Data Protection Authority within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to you, and we inform you without undue delay where it is likely to result in a high risk to your rights and freedoms.

VELOVA ΜΟΝΟΠΡΟΣΩΠΗ Ι.Κ.Ε. (VELOVA SINGLE MEMBER P.C.)
Zervou I 17A, 14121 Irakleio Attikis, Greece
GEMI 194620801000 · AFM 803325569
Privacy contact: privacy@velova.io

You have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA):
Kifisias Avenue 1-3, 11523 Athens
Tel: +30 210 6475600
Web: www.dpa.gr

Velova does not train AI models on survey photos or videos and does not ask for consent to do so. Consents to AI training given in the past no longer extend how long files are kept: those files follow the 30-day rule in Section 8 and are deleted when you delete your account. If Velova ever plans to train models, it will first update this Policy and its impact assessment and ask for a new, separate consent.

Photos and videos are stored as you recorded them; we do not blur faces or mute voices. Before recording, make sure no one else is in shot, and avoid capturing documents, screens or other personal items. If someone else does appear, it is your responsibility to tell them. Anyone who appears in a recording can ask for its deletion at privacy@velova.io.

Velova does not extract biometric data (such as facial or voice features) from photos or videos.

Each version is published on this page with its number and date. If a change affects how we use data we already hold about you, we will tell you by email before it applies. You can ask privacy@velova.io for earlier versions.