Terms of Service

01 The agreement

1.1 These Terms of Service are an agreement between WHY ORDINARY IKE ("Overvio", "we"), whose details are below, and the business that creates an Overvio account ("you", "the merchant").

Company

WHY ORDINARY IKE

Activity

Υπηρεσίες Marketing

Tax no. (ΑΦΜ)

803028956

Tax office (ΔΟΥ)

Ηρακλείου

Registered address

ΠΕΤΡΑΚΟΓΙΩΡΓΗ ΜΟΙΡΕΣ ΗΡΑΚΛΕΙΟΥ 70400

Email

support@overvio.com

General Commercial Registry (ΓΕΜΗ)

187753927000

Version

29 October 2026, in force from that day

1.2 The agreement is made of these documents, and each one is part of it:

• these Terms of Service;
• the Billing Terms;
• the Data Processing Agreement (part two of this page), with its list of subprocessors on our subprocessors page;
• the acceptable use rules in section 6.

If two documents disagree, the Data Processing Agreement wins on personal data that Overvio processes for you, the Billing Terms win on fees and payment, and these Terms win on everything else.

1.3 Our Privacy Policy explains how we handle the personal data of your account users and billing contacts. It is information, not a part of this agreement, and you do not "agree" to it.

1.4 You accept this agreement when you create an account: by clicking "Create account", or "Continue with Google", after the notice that names these documents. If you accept for a business, you confirm that you may bind it.

1.5 Overvio is for businesses. You use it for your trade or business, not as a consumer.

02 Your account

2.1 Give true details and keep them current, including the account owner's email address, where we send notices.

2.2 The person who creates the account is its owner. The owner accepts changes to this agreement for the business and controls who else has access.

2.3 Keep your sign-in details secret. Tell us at once at support@overvio.com if you think someone else used your account.

03 The service

3.1 Overvio lets you build and send marketing email to your own contacts, connect your store (WooCommerce, a custom website or Shopify), import contacts and their consent, and measure the orders your emails earn. Some product areas are not available yet and are hidden in the dashboard. We may add, change or remove features. Removing a feature that is part of your paid plan is a material change, notified as section 14 says.

3.2 We send your email through our email provider from your own verified sending domain. We do our best for delivery, but we cannot promise that a mailbox provider accepts or places an email.

04 Fees

Fees, limits, payment, VAT, invoices, refunds and plan changes are in the Billing Terms.

05 Your data and our role

5.1 "Merchant Data" is everything you or your shoppers put into Overvio, and everything Overvio receives from your store connections for you. It includes the personal data of your contacts and shoppers. You own your Merchant Data.

5.2 For the personal data in your Merchant Data, you are the controller and Overvio is your processor under the GDPR. The Data Processing Agreement sets out what we do with it, how we protect it, which subprocessors we use, and how we help you answer your shoppers' requests. It applies from the moment you accept these Terms.

5.3 When you connect a store or turn on an import, Overvio reads only what that feature needs, and only on your instruction.

WooCommerce

The Overvio for WooCommerce plugin runs on your WordPress site. It answers only signed requests from Overvio and sends no store data on its own. "Import from your store" for WooCommerce reads, on your request:

The plugin also reports, as they happen: newsletter sign-ups and unsubscribes on your store (MailPoet, Mailchimp for WooCommerce), the consent boxes at checkout and account registration, and the cart and checkout steps a shopper's browser makes, linked to the overvio_anonymous_id cookie when your store's cookie consent allows it. Overvio uses them for consent, attribution and, once you switch it on, cart recovery. It runs even while cart recovery is off; until you switch it on, Overvio keeps those carts without the shopper's email. Your orders reach Overvio through WooCommerce's own webhooks. When your WordPress site processes a personal data erasure request, the plugin forwards it to Overvio, which erases the person.

A custom website

A custom website sends contacts and sign-ups through the Overvio contacts API and sign-up forms, signed with your API key.

Shopify

When you connect a Shopify store, the app asks Shopify for these permissions:

"Import from your store" for Shopify reads these seven fields of each customer and no others:

Overvio does not request phone numbers, addresses, birthdays, tags, notes, order history or amounts spent through this import. A customer who is neither subscribed nor unsubscribed is discarded in memory and nothing about them is stored. write_customers is not used yet. When it is, Overvio will use it only to tell Shopify about a subscribe or unsubscribe your customer gave through Overvio (state, opt-in level and date).

Overvio also receives the notifications Shopify sends about your customers and your shop: a customer created, updated or deleted in your store (to keep consent and contacts in step), a customer's data request or erasure request, and the shop erasure Shopify sends 48 hours after you remove the app. When that shop erasure arrives, Overvio revokes the store's credential and removes the contacts that came only from that store's import. Their unsubscribe and complaint records and their consent evidence stay, so they are never emailed again.

Files and manual entry

A contact file you import, and a contact you add by hand, contain what you put in them.

Your promises about consent

5.4 You are responsible for having a lawful basis for every contact you put into Overvio and every email you send. When you import a file, add a contact, import a group from your store, send contacts through the API as subscribed, or resubscribe someone, Overvio asks you to confirm one of these statements and records that you did, with the words you saw:

• File import: "I confirm that every contact in this file gave their consent to receive marketing email from us, that this consent was collected lawfully, and that I hold the proof."
• One contact by hand: "By adding this contact, I confirm that they gave their consent to receive marketing email from us, that this consent was collected lawfully, and that I hold the proof."
• Contacts API: "By sending these contacts as subscribed, I confirm that each of them gave their consent to receive marketing email from us, that this consent was collected lawfully, and that I hold the proof."
• A store group (customers or guest buyers): "I confirm that everyone in this group gave their consent to receive marketing email from us, that this consent was collected lawfully, and that I hold the proof." Beside it: "In the EU and the UK, a past buyer is not a subscriber. Buying from you, or typing an email at checkout, is not agreement to marketing email. Confirm this group only if everyone in it agreed."
• Resubscribing a suppressed customer: "I confirm that this customer asked us to email them again, that their consent was given lawfully, and that I hold the proof."

Each confirmation is a promise to Overvio. If it is not true, you are responsible for the result (section 12).

You also promise that:

• your privacy notice tells your shoppers that you use an email marketing service, and names Overvio where the law requires it;
• if you add Overvio's script to your storefront, your site asks for the cookie consent the law requires (ePrivacy Art. 5(3)), through your cookie banner. Overvio's script reads your banner's choice;
• you honour every unsubscribe, also one a shopper gives you outside Overvio.

5.5 Overvio is built to refuse a marketing email to an address without consent on record, to keep every unsubscribe, complaint and hard bounce from being emailed again (an import never re-subscribes such an address), to put an unsubscribe link in every marketing email, and to treat a "no" from your store as standing until the shopper says "yes" again themselves. These protections do not replace your own duties.

5.6 Overvio uses Merchant Data only to provide the service to you, as the Data Processing Agreement says. We do not sell it, we do not use it for advertising, and we do not use one merchant's data for another merchant.

5.7 You can export your contacts, audiences, suppressions, engagement data, bounces and campaign recipients from the dashboard at any time, in a format a machine can read.

5.8 You may switch to another provider, or to your own systems, at any time. If you want our help with the switch, tell us, with notice of no more than two months; we then help you for up to 30 days, and you can retrieve your data for at least 30 days after that. The data you can export is the data listed in 5.7, with your lists' consent records. This follows Art. 25 of the EU Data Act (Regulation 2023/2854).

5.9 You can export your data until the account closes. After it closes, Overvio deletes your Merchant Data as the Data Processing Agreement says, except invoices and the records the law makes us keep.

06 Acceptable use

6.1 You may send email only to people who agreed to receive it from you, or where the law lets you email them without consent: for example a similar-product email to an existing customer who did not object, under ePrivacy Art. 13(2) as your country applies it (in Greece, Article 11 of Law 3471/2006).

6.2 You may not:

• use bought, rented, shared, harvested or scraped lists;
• import or confirm a group of people who did not agree;
• hide who you are: every email must name your business and give its postal address;
• use false or misleading sender names, subject lines or headers;
• send content that is illegal, deceptive, a phishing attempt, malware, or that infringes someone's rights;
• try to get around a limit, a suppression, the consent check or an unsubscribe;
• use Overvio to process special categories of personal data (health, religion and the like, GDPR Art. 9) or data of children, unless we agree in writing;
• test, probe or attack the service, or reach the data of another merchant.

6.3 Our email provider and mailbox providers watch bounces and complaints. Overvio warns you when your permanent bounces reach 2% or your complaints 0.05% of your outcomes over 30 days (from 1,000 accepted sends). Our email provider may pause your sending on its own when your rates are too high; we tell you when it does. We may pause your sending ourselves to protect other merchants' delivery.

6.4 If you break this section, we may pause your sending or suspend the account, and we tell you why. For a serious or repeated breach we may end the agreement (section 7).

07 Suspension and termination

7.1 You may end the agreement at any time: leave the paid plan as the Billing Terms say, and ask us to close the account at support@overvio.com. We close it and delete its data within 30 days after you ask.

7.2 We may suspend or end the agreement for a breach, for non-payment as the Billing Terms say, or when the law requires. Except for a serious breach, or where the law or a risk to the service or to other merchants requires us to act at once, we tell the account owner by email first and give a reasonable time to fix the breach. We may also end the agreement for any reason with 30 days' notice.

7.3 When the agreement ends, you can export your data for 30 days, then it is deleted as the Data Processing Agreement says.

08 Intellectual property

8.1 Overvio keeps all rights in the software. You get a non-exclusive, non-transferable right to use it while the agreement lasts.

8.2 You keep all rights in your content and Merchant Data, and give Overvio the right to use them only to provide the service.

8.3 Overvio may name you as a customer, with your business name and logo.

09 Other services

WooCommerce and WordPress, Shopify, Stripe, Google and Canva are other companies. Their own terms apply when you connect them, and Overvio is not responsible for their services.

10 Warranties and disclaimers

10.1 We provide the service with reasonable skill and care. Apart from that, and from what these Terms and the Data Processing Agreement promise, the service is provided as it is and as available: we do not promise that it is uninterrupted or free of errors, or that it fits a particular purpose of yours.

10.2 Nothing in these Terms excludes a warranty or a right that the law does not let us exclude.

11 Liability

11.1 Each party's total liability under this agreement is limited to the fees you paid Overvio in the 12 months before the event that caused the claim.

11.2 Neither party is liable for indirect or consequential loss, or for lost profits, revenue, goodwill or data that could have been restored from your own copies.

11.3 These limits do not apply to liability for intent or gross negligence, to liability that the law does not let a party limit, to your breach of section 6 or of your duties in the Data Processing Agreement, or to your indemnity in section 12.

12 Indemnity

You indemnify Overvio against claims, fines and costs brought by others, including shoppers and authorities, that result from a confirmation in section 5.4 that was not true, or from your breach of section 6. Overvio tells you promptly of such a claim and lets you take part in its defence.

13 Confidentiality

Each party keeps confidential what it learns about the other's business through this agreement and is not public, uses it only for this agreement, and shares it only with people who need it for that and are bound to confidentiality. This does not cover what a party must disclose by law. Personal data is covered by the Data Processing Agreement.

14 Changes to this agreement

14.1 We may change this agreement. For a change that is not minor, we email the account owner and show a notice in the dashboard at least 30 days before it applies. A change the law requires sooner can apply sooner.

14.2 For a material change, the owner accepts the new version in the dashboard at the next sign-in after it applies. If you do not agree, you may end the agreement before the change applies, with no fee.

15 Notices

We send notices to the account owner's email address and in the dashboard. You send notices to support@overvio.com, and anything about personal data to privacy@overvio.com.

16 Law and courts

Greek law governs this agreement. The courts of Heraklion, Greece, decide any dispute about it. These Terms are written in English, and the English text prevails over any translation.

01 Parties and how this agreement is made

1.1 This Data Processing Agreement ("DPA") is between the merchant that accepted Overvio's Terms of Service ("the Merchant") and WHY ORDINARY IKE, trading as Overvio, ΠΕΤΡΑΚΟΓΙΩΡΓΗ ΜΟΙΡΕΣ ΗΡΑΚΛΕΙΟΥ 70400, Greece, ΑΦΜ 803028956, ΓΕΜΗ 187753927000 ("Overvio").

1.2 This DPA is part of the Terms of Service and is accepted with them. It is in electronic form, which GDPR Art. 28(9) allows. No separate signature is needed. On request to privacy@overvio.com, Overvio sends the Merchant a PDF of this DPA with the Merchant's details.

1.3 For an account opened before this DPA was published, it applies from the day the account owner accepts it.

02 Definitions

Words defined in the GDPR (Regulation (EU) 2016/679) have the same meaning here: personal data, processing, controller, processor, data subject, personal data breach, supervisory authority.

• Merchant Personal Data: the personal data Overvio processes for the Merchant under the Terms, the Merchant's contacts and shoppers, as Annex I describes.
• Subprocessor: another processor Overvio engages to process Merchant Personal Data.
• The service: the Overvio service the Terms describe.

03 Roles and scope

3.1 The Merchant is the controller of Merchant Personal Data, and Overvio its processor. If the Merchant is itself a processor for someone else, Overvio is its subprocessor, and the Merchant passes on to that controller what this DPA gives it.

3.2 This DPA does not cover the personal data of the Merchant's own account users and billing contacts. Overvio is the controller of that data, and its Privacy Policy explains it.

3.3 Annex I describes the processing: its subject, duration, nature and purpose, and the types of personal data and data subjects.

04 Instructions

4.1 Overvio processes Merchant Personal Data only on the Merchant's documented instructions. The instructions are: the Terms and this DPA; what the Merchant does in the service (the features it turns on, the stores it connects, the imports it runs, the emails it sends, the settings it chooses); and any other written instruction the parties agree.

4.2 Overvio transfers Merchant Personal Data to a third country only on those instructions, or where Union or Greek law requires it. In that case Overvio tells the Merchant first, unless that law forbids it.

4.3 If Overvio thinks an instruction breaks the GDPR or other data protection law, it tells the Merchant at once.

05 Confidentiality

Overvio lets only people who need it for the service reach Merchant Personal Data, and only people bound to confidentiality. Overvio staff reach a merchant's data only through the audited administration path, which asks for a reason and records each access.

06 Security

Overvio takes the technical and organisational measures of Annex II, which meet GDPR Art. 32. Overvio may change them, but not lower the protection they give.

07 Subprocessors

7.1 The Merchant gives Overvio general written authorisation to engage subprocessors. The current subprocessors are listed on the subprocessors page (Annex III).

7.2 Before Overvio adds or replaces a subprocessor, it tells the Merchant at least 15 days ahead, by email to the account owner.

7.3 The Merchant may object on reasonable data protection grounds within 10 days of the notice, in writing to privacy@overvio.com. The parties then try in good faith to find a solution. If they cannot, the Merchant may end the affected service, or the Terms, with no fee. Fees already paid are not refunded.

7.4 Overvio binds each subprocessor by a written contract to data protection duties at least as protective as this DPA, as far as they fit the service the subprocessor gives. Overvio remains fully liable to the Merchant for each subprocessor's work.

08 Help with data subjects' requests

8.1 The service gives the Merchant these tools to answer its shoppers' requests itself:

• delete a contact, or a whole list with its people (Email, Audiences);
• suppress a contact, and export the suppression list;
• export a list, an audience, the engagement data, the bounces and a campaign's recipients;
• an unsubscribe link and a preference page in every marketing email;
• for a WooCommerce store: an erasure the Merchant processes in WordPress is forwarded by the Overvio plugin and carried out automatically;
• for a Shopify store: Shopify's customer erasure request is carried out automatically across Overvio's systems, and Shopify's shop erasure (48 hours after the app is removed) removes the contacts that came only from that store.

8.2 Overvio helps the Merchant with any other request (access, rectification, restriction, portability, objection) without undue delay, as far as the nature of the processing allows. A Shopify customer data request reaches Overvio through Shopify; Overvio assembles that customer's data by hand and gives it to the Merchant within 30 days.

8.3 If a data subject asks Overvio directly, Overvio passes the request to the Merchant without undue delay and does not answer it itself, unless the Merchant asks it to.

09 Help with security, breaches and impact assessments

9.1 Overvio tells the Merchant about a personal data breach affecting Merchant Personal Data without undue delay after becoming aware of it, and aims to do so within 24 hours, so that the Merchant keeps most of its own 72 hours (GDPR Art. 33(1)).

9.2 The notice gives, as far as Overvio knows them: what happened and when; the categories and approximate numbers of data subjects and records; the likely consequences; what Overvio has done and proposes to do; and a contact. What is not known yet follows in phases. Overvio does not notify the Merchant's authority or shoppers on its own; that is the Merchant's decision, and Overvio supplies the facts and, when asked, the wording.

9.3 Overvio helps the Merchant, as far as the nature of the processing and the information Overvio holds allow, with its duties under GDPR Art. 32 to 36: security, breach notification, data protection impact assessments and prior consultation of the authority.

10 At the end of the service

10.1 The Merchant can export its data from the dashboard until the account closes.

10.2 Overvio deletes Merchant Personal Data within 30 days after the Merchant asks for the account to be closed, unless Union or Greek law requires Overvio to keep it. Overvio staff carry out the erasure, which covers every store of the account and the account itself. What the law or the shoppers' protection makes Overvio keep: the consent evidence of the Merchant's contacts (5 years after the erasure), invoices (10 years), and the record of the data subject requests Overvio handled. Backups expire 30 days after they are taken; until then a deleted record can remain only in an encrypted backup, which is not used except to restore the service.

11 Information and audits

11.1 Overvio makes available to the Merchant the information needed to show that it meets GDPR Art. 28: this DPA, the subprocessor list, a description of its security measures, and answers to a reasonable security questionnaire.

11.2 The Merchant, or an auditor it mandates who is bound to confidentiality, may audit Overvio's compliance with this DPA, with at least 30 days' notice, during business hours, at most once a year unless an authority requires more or a breach happened. Overvio first answers in writing or in a remote audit; an audit on site follows only when those do not settle the question. Each party bears its own costs of an audit.

12 Transfers outside the EU

12.1 Overvio processes Merchant Personal Data on servers in the European Union. Some subprocessors are companies based outside the EU, and the subprocessors page marks them.

12.2 Where a subprocessor's processing is a transfer to a third country, Overvio relies on the EU-US Data Privacy Framework for a certified US company, or on the standard contractual clauses of Commission Decision 2021/914, Module 3 (processor to processor).

12.3 Where the Merchant is established outside the EEA, Overvio's return of Merchant Personal Data to the Merchant is covered by the same clauses, Module 4 (processor to controller), which the parties conclude by accepting the Terms.

13 The Merchant's duties

The Merchant:

• has a lawful basis for all Merchant Personal Data and every email it sends, and holds the proof (the confirmations it gives in the service are recorded);
• tells its shoppers, in its own privacy notice, that it uses an email marketing processor;
• runs the cookie consent its storefront needs before Overvio's storefront script stores identifiers (ePrivacy Art. 5(3)); the script reads the store's cookie banner;
• gives only lawful instructions;
• does not put special categories of data (GDPR Art. 9) or children's data into the service, unless Overvio agrees in writing.

14 Liability, term and changes

14.1 Liability under this DPA follows the Terms of Service. Nothing in this DPA limits a data subject's rights against either party under GDPR Art. 82.

14.2 This DPA lasts as long as Overvio processes Merchant Personal Data.

14.3 Overvio may change this DPA as the Terms of Service say for changes: at least 30 days' notice for a material change, which the account owner accepts in the dashboard. A change the law requires can apply sooner. A change never lowers the protection of Merchant Personal Data.

14.4 If this DPA and the Terms disagree about Merchant Personal Data, this DPA wins.

Annex I Details of the processing

Subject matter

Overvio's email marketing service for online stores.

Duration

The term of the Terms of Service, then until deletion under section 10.

Nature

Collection, recording, storage, organisation, combination (a shopper's email hash is linked to their browser identifiers and orders), use, transmission (sending email), pseudonymisation and erasure. Continuous.

Purpose

To provide the service to the Merchant: keep its contact lists and their consent records; import contacts and consent from its store or files; send its marketing email; measure delivery, opens and clicks; record orders and which email earned them; honour unsubscribes, complaints and bounces; carry out erasure and other data subject requests.

Data subjects

The Merchant's contacts and subscribers; its store's customers and visitors; people who sign up on its forms.

Special categories

None intended. The Merchant must not put them in (section 13).

Categories of personal data, by service area. "Live" means available to every merchant on the date of this version; "off" means switched off for launch and processed only once switched on.

Retention follows the service's retention schedule, summarised in section 11 of the Privacy Policy: contacts as long as the Merchant keeps them; consent records for the relationship and 5 years after it ends; suppressions as long as the account can send; delivery and engagement events 365 days; backups 30 days.

Annex II Technical and organisational measures

Annex III Subprocessors

The subprocessors are those in the first list on the subprocessors page, as it stands on the day, with each one's purpose, data, location and transfer safeguard.