Privacy policy
What personal data Overvio collects about the people who use it and visit this website, why, for how long, who else receives it, and how to use your rights. If you shop at a store that uses Overvio, section 10 is for you.
Last updated
Cookies on this websiteWho we are
Overvio is email marketing software for online stores. It is made and sold by WHY ORDINARY IKE, a Greek private company (ΙΚΕ), trading as Overvio. In this policy "we" and "Overvio" mean that company.
- Company
- WHY ORDINARY IKE
- Activity
- Υπηρεσίες Marketing
- Tax no. (ΑΦΜ)
- 803028956
- Tax office (ΔΟΥ)
- Ηρακλείου
- Registered address
- ΠΕΤΡΑΚΟΓΙΩΡΓΗ ΜΟΙΡΕΣ ΗΡΑΚΛΕΙΟΥ 70400
- support@overvio.com
- General Commercial Registry (ΓΕΜΗ)
- 187753927000
- Privacy contact
- privacy@overvio.com
- Data protection officer
- None appointed: the law does not require one for Overvio. Write to the privacy contact above
- Version
- 31 October 2026, in force from that day
Whom this policy is for
Overvio has two roles under the GDPR, and the role decides who answers your questions.
| You are | Our role | Who decides about your data |
|---|---|---|
| A person who uses an Overvio account for a store (an owner or a team member), or a store's billing contact | Controller | Overvio. This policy explains what we do. |
| A visitor to overvio.com, or a person who writes to us | Controller | Overvio. This policy explains what we do. |
| A customer of a store that uses Overvio: you get the store's emails, you signed up on its site, or you shop on it | Processor for the store | The store. Read the store's own privacy policy. Section 10 explains how we help the store and how to reach us. |
How Overvio processes a store's data for the store is set out in the Data Processing Agreement, which is part of our Terms of Service.
Data we collect about account users
| What | Where it comes from | Why we use it | Legal basis | How long we keep it |
|---|---|---|---|---|
| Your name, email address and password (stored only as a hash) | You, when you create the account | To create and run your account and let you sign in | Contract (Art. 6(1)(b)) | As long as the account exists. When you ask us to close it, we delete it within 30 days |
| Your Google account email, name and Google id, if you choose "Sign in with Google" | Google, with your permission | To sign you in | Contract (Art. 6(1)(b)) | As long as the account exists, as above |
| The business name you give at sign-up and your role in the account (owner or member) | You | To run the account | Contract | As long as the account exists |
| Sign-in cookies on dashboard.overvio.com (listed below) | Our servers | To keep you signed in and to protect forms against cross-site requests | Contract; our legitimate interest in security (Art. 6(1)(f)) | The session ends after 120 minutes without activity. The "keep me signed in" cookie lasts until you sign out, at most 400 days |
| Application logs of your activity | Our servers | To run the service, find faults and protect it | Legitimate interest (Art. 6(1)(f)) | 14 days |
| A record each time someone in your account reads or exports your customers' personal data (who, which page, when) | Our servers | So the store can see who looked at its customers' data, and for our accountability (Art. 5(2) and 32) | Legal obligation (Art. 6(1)(c)) and legitimate interest | 365 days |
| A record of each action Overvio staff take on your account (for example opening it to help you), with the staff member's email, IP address and the reason given | Our servers | Accountability for staff access | Legitimate interest | 365 days |
| Error reports | Our servers, sent to our error-monitoring provider | To find and fix errors. Request bodies, headers and cookies are removed before a report leaves our servers | Legitimate interest | Up to 90 days at the provider |
| Messages we send you about your account: password reset, invoices, plan, limit and sending notices | Our servers | To run the service and tell you what you must know | Contract | A password reset link expires after 60 minutes and is deleted within 75 minutes |
| Your email address and name, for Overvio's own news and offers to the businesses that use it | Your account | To tell you about Overvio's products. Every such email has an unsubscribe link, and one click stops them | Legitimate interest (Art. 6(1)(f)), for an existing customer, as ePrivacy Art. 13(2) allows (in Greece, Article 11 of Law 3471/2006) | Until you unsubscribe or the account closes; an unsubscribe is kept so that it lasts |
When you connect a store
When you connect a WooCommerce or Shopify store, Overvio keeps the store's address and the credential the store platform gives us (a WooCommerce REST key pair, or a Shopify access token). We use them only to read and write what you ask Overvio to do with that store. When you disconnect a WooCommerce store, we delete its REST key from Overvio and stop using the store; you can also delete the key and our webhooks in WooCommerce. A Shopify store is disconnected by removing the app in Shopify, which ends our access token. The data we read from the store about your customers is your data, processed for you (section 10).
If you connect your Canva account, Overvio stores access tokens for it and your Canva user and team identifiers, and uses them only to list your designs and import the ones you choose into your Overvio library and templates. Disconnecting deletes the tokens and withdraws the access at Canva; imported pictures and templates stay in your account until you delete them.
Billing data
If you buy a paid plan, we process:
| What | Why | Legal basis | How long we keep it |
|---|---|---|---|
| Billing email, business legal name, Greek tax number (ΑΦΜ), tax office (ΔΟΥ), business address | To bill you and issue Greek invoices | Contract (Art. 6(1)(b)); legal obligation for the invoice (Art. 6(1)(c), Greek Law 4308/2014) | The billing profile: as long as the account is billed. Invoices and the payment records behind them: 10 years, during which an invoice cannot be erased |
| A Stripe customer id, plan, billing period, payment status and amounts | To take payments and keep a billing history | Contract | As above |
Card details go straight to Stripe and never reach Overvio's servers. How plans are billed is in the Billing Terms.
Visitors to this website and people who write to us
On overvio.com we collect only what the table below lists. Nothing that needs your consent runs until you give it.
| What | When | Why | Legal basis | How long we keep it |
|---|---|---|---|---|
| Your name, email, store address and message | You send the contact form | To answer you | Legitimate interest (Art. 6(1)(f)); steps before a contract when you ask about buying (Art. 6(1)(b)) | 24 months, then deleted automatically |
| The same message, emailed to our team through Amazon SES | You send the contact form | To tell us a message arrived | As above | No longer than the message itself: 24 months |
| Your IP address | You send the contact form | To stop spam: at most 5 messages in 10 minutes from one address | Legitimate interest | Held in the server's memory only, for those 10 minutes |
| Your IP address and browser signals, checked by Cloudflare Turnstile | You start filling in the contact form | To tell a person from a bot without a puzzle | Legitimate interest | As Cloudflare's Turnstile privacy addendum sets out. Cloudflare also uses these signals, as a controller, to improve Turnstile |
Pages viewed, referrer, device and browser, approximate location from your IP address, and a random id in the _ga cookies | Only after you choose Accept in the cookie banner | To see which pages help visitors | Consent (Art. 6(1)(a)), which you can withdraw at any time | Cookies: 13 months. Reports in Google Analytics: 14 months |
| Your name, email and the time you choose | Only if you load the Cal.com calendar on the demo page and book | To arrange the demo | Steps before a contract (Art. 6(1)(b)) | Until the demo has taken place and any follow-up you asked for is done, then deleted |
| IP address, address of the page, browser and time of each request | Every request to overvio.com | Security, and keeping the site running | Legitimate interest | As long as needed to keep the site secure and running, then deleted. Cloudflare keeps its own request data as its privacy policy sets out |
This website is for businesses and is not aimed at children, and it makes no decision about you by automated means. Your rights over this data are in section 9.
Who receives your data
We use service providers who process data for us under contract. The full list, with what each one does and where, is on our subprocessors page (its second list covers the data in this policy). In short:
- Hosting: Hetzner Online (Germany), for the dashboard and this website, including contact form messages; and DigitalOcean (a US company; our database there is in the EU).
- Email delivery, including the contact form's notification: Amazon Web Services (a US company; an EU region).
- Network, the website's delivery and protection, the Turnstile spam check, backups, and forwarding of mail sent to privacy@overvio.com: Cloudflare (a US company).
- Error reports: Sentry (a US company). Operator alerts: Slack, whose data is kept in the United States; an alert can name your business and its domain, never your customers.
- Payments: Stripe Payments Europe, Ltd. (Ireland). Invoices: Elorus (Greece), which sends each invoice to the Greek tax authority's myDATA system, as Greek law requires.
- Sign in with Google: Google, only if you choose it.
- Website analytics: Google, only if you accept them. Demo bookings: Cal.com, only if you load the calendar.
We also give data to a public authority when the law requires it. We do not sell personal data, and we do not share it for advertising.
Data outside the European Union
We store our data in EU data centres. Some of our providers are US companies or part of a US group: DigitalOcean, Amazon Web Services, Cloudflare, Google, Sentry and Cal.com, as the subprocessors page marks them. Slack, which carries our own operator alerts, keeps its data in the United States. Where such a company, or its staff, can reach data from outside the EU, the transfer is covered by the EU-US Data Privacy Framework, where the company is certified under it, or by the standard contractual clauses of the European Commission (Decision 2021/914) in its data processing terms.
Two services deliver content from their provider's global network: images in emails are served through Amazon CloudFront, and this website and our storefront script through Cloudflare. A request to them can be answered from outside the EU, under the same safeguards.
Your rights
You have the right to:
- see the personal data we hold about you and get a copy (Art. 15);
- correct it (Art. 16);
- have it erased (Art. 17), except where the law makes us keep it, for example invoices for 10 years;
- restrict how we use it (Art. 18);
- receive the data you gave us in a format a machine can read, and have it sent to another provider (Art. 20);
- object to processing based on our legitimate interest (Art. 21);
- withdraw a consent you gave, at any time, without affecting what was done before.
To use a right, write to privacy@overvio.com, from the email address on your account if you have one. We answer within one month (Art. 12(3)). You can change your name, email and password yourself in the dashboard.
You may complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1-3, 115 23 Athens, Greece, +30 210 6475600, contact@dpa.gr, www.dpa.gr, or to the authority of the EU country where you live or work.
We make no decision about you by automated means alone that has a legal or a similarly significant effect on you. Overvio pauses an account's sending automatically when a plan limit, a payment failure or a delivery rule is reached; that is a decision about the business account, not about you as a person.
If you are a customer of a store that uses Overvio
The store decides why and how your data is used. Overvio processes it for the store under a data processing agreement, and does not use it for its own purposes. Depending on what the store turns on, it can use Overvio for:
- Its email list: your email address, your name and other fields the store holds, and the record of your consent to marketing email (what you agreed to, when, how, and the words you saw).
- Its emails: whether each email was delivered, bounced, opened or clicked, with the IP address and browser of the open or click.
- Its storefront: if the store adds Overvio's script to its site, the pages and products you view and your cart and checkout steps, linked to a random identifier stored in your browser. The script reads the store's cookie banner choice.
- Its orders: to show which emails led to a sale.
- Your unsubscribe: if you unsubscribe or complain, we keep a record so that you are not emailed again.
Every marketing email has an unsubscribe link. To use your other rights, contact the store. If you contact us, we pass your request to the store and help it answer. Stores on WooCommerce send us your erasure request through the Overvio plugin when they process a WordPress erasure request; stores on Shopify send it through Shopify. How long the store's data is kept is in section 11 and in the store's own policy.
How long data is kept for stores
| Data | How long |
|---|---|
| Contacts on the store's lists | As long as the store keeps the contact. Deleted when the store deletes it, when you are erased, or, for a contact that came only from a Shopify store, when the store removes the Overvio app |
| The record of your marketing consent | While you are a contact of the store, then 5 years after the relationship ends (your withdrawal, your erasure or your removal from the store's contacts, whichever is first) |
| The record that you unsubscribed or complained, and bounce records | As long as the store's account exists, so that you are never emailed again, and deleted with the account. If you are erased, we keep only a one-way hash of your address for an unsubscribe |
| Email delivery and engagement events (sent, delivered, opened, clicked, bounced) | 365 days |
| Open and click tracking tokens | 180 days |
| Storefront browsing events | 365 days in the event store. The storefront service's working copy has no automatic expiry yet; it is erased when you are erased or the store leaves Overvio |
| Cart snapshots | Cart recovery is off at launch, so carts are kept without your email address. Once a store turns it on, a cart with your email is kept 30 days after its last activity |
| Orders and the record of which email earned them | As long as the store's account exists. On erasure your email is replaced by a one-way value, so totals stay correct |
| Email address verification results | 730 days |
| Erasure and data requests (the proof we handled them) | 365 days after the request was handled |
| Backups | 30 days, then they expire. An erasure applies to the live systems at once and reaches a backup when it expires |
Security
We encrypt data in transit (HTTPS and TLS) and at rest: the main database encrypts every table and its logs, the event store keeps every table on an encrypted disk, and backups are encrypted on our servers before they leave. Each store's data is kept apart by a tenant key in every query. Our staff reach a store's data only through an audited path that records who looked and why. We have a written security incident policy.
Changes to this policy
We publish each version at this address with its date. If a change matters to you, we tell account owners by email and in the dashboard at least 30 days before it applies.