Privacy Policy
Last updated: 5 October 2026
1. Who we are
This Privacy Policy explains how the general partnership “AVARI SOLUTIONS G.P.”, seated in Moschato, Attica, at 97 Thermopylon Street, 18345 Moschato, Tax ID (ΑΦΜ) 803381623, GEMI no. 195717907000 (“we”, “the Company”), collects and processes personal data, in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Greek Law 4624/2019.
Contact details for personal-data matters: info@paideus.com.
2. Our two roles — please read this first
The Company provides the Paideus educational-institution management platform to tutoring centres, foreign-language schools and other educational organisations. It is important to understand that we act in two different roles:
(a) As controller — for data we collect ourselves: when you visit our website, contact us, request a walkthrough or trial of the platform, or when you are our customer (a representative of an educational institution). This Policy applies to that data.
(b) As processor — for data that our customer educational institutions enter into the platform (student, parent/guardian and teacher details, grades, attendance, tuition finance data, and so on). For that data, the controller is the relevant educational institution (your tutoring centre or language school), which decides what is recorded and why. We process it solely on their behalf and on their instructions.
The platform is accessed through the website app.paideus.com and the Paideus mobile app. Its users include students, some of whom are minors, who always use an account created by their educational institution. The institution, as controller, is responsible for the legal basis of the processing, including parental/guardian consent where required.
If you are a student, parent/guardian or teacher and you wish to exercise your rights (access, rectification, erasure, etc.) in relation to data held on the platform, please contact your educational institution, which is the controller. If you contact us anyway, we will forward your request to your educational institution and inform them, without responding on the merits, because we have no authority to decide about that data. To delete an account, see Account deletion.
3. What data we collect as controller
Website visitors: technical data strictly necessary for the operation and security of the website (IP address, browser type, server logs). We do not use analytics or advertising-tracking tools.
Prospects (contact form / request for a walkthrough or trial): name, email, phone number, the name and details of the educational institution, and the content of your message.
Customers and their representatives: identification and contact details of representatives, billing details (Tax ID, address, payment details), and the history of communications and technical-support requests.
Account administration data: sign-in details and technical logs relating to the operation and security of the platform.
We do not collect special-category data for our own purposes, and we do not direct our website services at children.
This section concerns exclusively the processing operations for which we act as controller. Personal data of students, parents/guardians, teachers and other End Users that our Customers enter into the Platform is processed solely on behalf of and on the instructions of our Customers, who act as controllers, while we act as processor in accordance with Article 28 GDPR.
4. Mobile app and notifications
The Paideus mobile app shows the same platform as the website app.paideus.com. Data entered through the app is governed by section 2(b), exactly as on the website.
Push notifications: if you allow them, your device receives a notification identifier (token) from Google's Firebase Cloud Messaging service or, on Apple devices, from the Apple Push Notification service. We store it linked to your account solely to send you platform notifications (for example announcements, grades and schedule changes). The title and text of each notification pass through the respective service so that it can be delivered to your device. You can turn notifications off at any time in your device settings; when you sign out, the identifier is deactivated and no longer used.
Device permissions: the only permission the app asks for is notifications. The camera and the files on your device are used only when you choose to attach a photo or file. The app uses no analytics, no advertising and no advertising identifier, and does not collect location or contacts.
Problem reports: if you send a problem report from within the platform, it includes, besides your text, a screenshot of the screen and technical information (device and browser type, screen size, language, time zone and the page you were on). We use it solely to investigate and fix the problem.
5. Purposes and legal bases
We process the above data for the following purposes: to respond to contact requests and to provide a walkthrough or trial period, on the legal basis of taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR); to perform the contract with our customers, including billing and technical support (Article 6(1)(b)); to comply with tax and other legal obligations (Article 6(1)(c)); for the security of the website and the platform, prevention of abuse, and the establishment or defence of legal claims, based on our legitimate interests (Article 6(1)(f)); and to send service-related updates to existing customers, based on our legitimate interests, with the right to object at any time, without prejudice to the more specific requirements of applicable electronic-communications and commercial-promotion law.
The above purposes and legal bases concern exclusively the processing operations for which we act as controller. As regards data we process on behalf of our Customers as processor, determining the purpose and the appropriate legal basis is the responsibility of each Customer as controller.
6. Recipients
Access to the data is limited to strictly necessary staff and contractors. We use the following service providers: Microsoft (Azure services) for hosting the website and the platform and for sending email, with processing in data centres within the European Union; and Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service) to deliver push notifications to your devices. We may also disclose data to public authorities where required by law. We do not sell or grant data to third parties for advertising purposes.
7. Transfers outside the EEA
Data is stored on infrastructure within the European Union. To the extent that global providers (for example Microsoft) may perform limited remote support access outside the EEA, that access is covered by the safeguards of Chapter V GDPR (standard contractual clauses and, where applicable, the EU-US Data Privacy Framework). The Google and Apple notification services operate globally and may process the device identifier and the notification content outside the EEA, under the same safeguards.
8. Retention
We keep data only for as long as necessary: contact and walkthrough requests for 12 months from the last contact if no cooperation follows; trial-account data that did not convert into a customer relationship, in accordance with the Terms of Use; contractual and billing data of customers for the duration of the relationship and thereafter for the period required by tax law (as a rule five years, or as otherwise required by law) and by the limitation of claims; security logs for 12 months; notification identifiers for as long as the device is signed in to the account, after which (on sign-out, or when the notification service reports them invalid) they are deactivated and no longer used. After those periods, data is deleted or anonymised.
9. Your rights
For data in respect of which we act as controller, you have the right of access; rectification of inaccurate data; erasure (“right to be forgotten”); restriction of processing; data portability; and objection to processing based on legitimate interests. You may exercise your rights by emailing info@paideus.com. We will respond within one month, with a possible two-month extension for complex requests, in which case we will inform you. To delete your account on the platform and in the app, see Account deletion.
If you consider that your rights have been infringed, you have the right to lodge a complaint with the Hellenic Data Protection Authority (1-3 Kifisias Avenue, 115 23 Athens, tel. +30 210 6475600, www.dpa.gr).
Reminder: for data held on the platform on behalf of an educational institution, that institution is responsible for fulfilling your rights (see section 2).
10. Security
We apply appropriate technical and organisational measures, including encryption in transit and at rest, role-based access control, regular backups, and limited staff access on a need-to-know basis.
11. Changes to this Policy
We may update this Policy. The current version is posted on our website with the last-updated date. In the event of material changes, we will inform our customers in an appropriate manner.