Privacy Policy – SSphere ERP

Effective 2 November 2026

1. Who we are

The SSphere ERP app for iPhone, iPad and Mac and the SSphere ERP service (erp.ssphere.gr) are provided by «ΓΟΥΛΑΣ ΑΛΕΞΑΝΔΡΟΣ – STRATEGIC SPHERE» ("SSphere", "we"), Irakleous 48, Kallithea 17671, Athens. Privacy contact: [email protected], +30 210 977 2121.

2. Who the app is for

SSphere ERP is business software. User accounts are created by the customer business or by SSphere. The app offers no sign-up and no purchases, and it is not intended for children.

3. Data we process

  • Account data: name, email, username, roles and permissions, security settings (e.g. two-step verification). Passwords are stored only as hashes.
  • Data the business enters: company details (name, VAT number, addresses, phone numbers, logo, bank accounts/IBAN), customers and suppliers, products and warehouses, invoices, collections and payments, expenses, employees (e.g. for the ERGANI work card), calendar, notifications and uploaded files.
  • Technical data: IP address, device or browser type, app version, time and page of each request, in the server logs.

4. What is stored on your device

  • The sign-in cookie, so you stay signed in.
  • App settings (server address, Face ID/Touch ID lock, startup sound), the last page and the theme (light or dark).
  • For widgets: a summary of figures (sales, receivables, VAT, today's card payments, unread notifications) in a shared app container on the device. It is deleted when you sign out. Amounts are marked as sensitive, so the system can hide them while the device is locked.
  • Face ID / Touch ID: the operating system performs the check. The app never receives or stores biometric data.
  • Camera and files: used only when you choose to (e.g. scanning a barcode, uploading a file or photo). Only what you select is uploaded.
  • Mac: the app checks erp.ssphere.gr for new versions. The request carries only standard technical details (app and OS version).

The app contains no advertising and no third-party analytics or tracking tools.

5. Purposes and legal bases

  • To provide the service your business has agreed with SSphere (performance of a contract).
  • To let the business meet its legal obligations, e.g. transmitting invoices to the Greek tax authority (AADE myDATA) and ERGANI filings (legal obligation).
  • To keep the service secure, prevent abuse and provide support (legitimate interest).

We do not use data for advertising or profiling, we do not sell it, and we do not track you.

6. Who is responsible for business data

For data the business enters (customers, suppliers, employees and so on), the business is the controller. SSphere processes it on the business's behalf as a processor, only on its instructions and under the contract. Requests about such data should go to the business first, and we help it respond.

7. Who we share data with

  • AADE (myDATA), through a certified e-invoicing provider, when you issue invoices.
  • ERGANI, when you use the work card.
  • Services the business itself turns on: card payments (POS terminals), email sent from its own account, telephony, connections to other systems (API).
  • Infrastructure providers that host and protect the service: our server hosting company and Cloudflare, Inc., through which all traffic to the service passes for secure connections (HTTPS) and attack protection. Cloudflare does not keep the data shown on your pages; it only temporarily caches public files (e.g. images and stylesheets) and keeps technical logs (e.g. IP address, time).
  • Public authorities, where the law requires it.

Where data is transferred outside the European Economic Area, GDPR safeguards apply (e.g. Standard Contractual Clauses or the EU-U.S. Data Privacy Framework).

8. How long we keep data

For as long as the contract with the business is in force. After it ends we delete or return the data as the contract says, except what the law requires us to keep (e.g. tax records). Server logs are kept for a limited period, as needed for security and troubleshooting.

9. Security

HTTPS-only connections, passwords stored only as hashes, optional two-step verification, per-user and per-company permissions, and an app lock with Face ID/Touch ID.

10. Your rights

You have the right to access, rectify, erase, restrict, port and object. Write to [email protected]. You may also lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

11. Deleting your account

Ask your business administrator, or email [email protected] from your account's address. We delete the account and its data, except what the law requires us to keep. Signing out ends your session and deletes the widget data. Deleting the app removes everything it stored on the device.

12. Changes

If this policy changes, we update the date at the top. We will tell you about significant changes.