Privacy Policy

1. Who we are and how to contact us

The controller for the HobbyDetective platform (hobbydetective.gr, the “Platform”) is HD NEXT IKE, Pindarou 4, Thessaloniki 54639, Greece, VAT number 802577241, General Commercial Registry (GEMI) number 178921006000.

For privacy questions or to exercise your rights, email [email protected], call +30 698 386 7651 or write to the address above.

2. Scope and roles

HobbyDetective operates an online marketplace connecting Customers with independent Providers (also called partners). We are the controller for operating accounts, the marketplace, bookings and orders, payments infrastructure, security, support, analytics, our own communications and our contacts with prospective Providers.

When a Customer contacts, books or buys from a Provider, that Provider receives the information reasonably needed to answer or deliver the service and acts as an independent controller for its own service, legal, safety, insurance, attendance and record-keeping purposes; its own privacy notice may also apply. When a Provider uses the Platform's tools to keep its own records — for example its students, including people without an account, their attendance, notes or health information — the Provider is the controller of those records and we process them on its behalf as processor, under the terms set out in section 21 of the Terms and Conditions. If you have questions about such records, contact the Provider; we will forward any request we receive.

3. Personal data we collect

Depending on how you use the Platform, we may process:

• Account data: email address, password (stored only as a hash), sign-in method and, for Google sign-in, your Google account identifier, account type, language, account status, two-factor codes, the date and version of the Terms you accepted and, for a Customer account, when you declared that you are at least 15; for team members of Providers, name and role.
• Customer profile: first and last name, phone, city and, if you enter them, billing details (VAT number, tax office, company and address), communication preferences and calendar-feed settings.
• Participants and family members: names and relationship of people you book for or add to your account, year of birth, the names and optional email of other participants in a booking and any notes about them, such as dietary needs. Health information is processed only if you provide it (section 6).
• Provider and business data: business type, brand, name of the person in charge, contact details, addresses and map location, VAT number (if given), opening hours, descriptions, logo, photos, videos, social-media links, team members, plan and billing, platform fees, referral data, the account details you give for payments outside the Platform (IBAN, account holder, bank and IRIS identifier) and the identifiers and status of your Stripe account.
• Records Providers keep about their students (as processor): names, contact details, date of birth, address, level, notes, allergies, conditions, emergency contacts, attendance, groups and family links.
• Bookings, packages and orders: what was booked or bought, when and for whom, prices, payment status, cancellations, refunds, attendance and no-shows, notes to the Provider, waitlist entries, participation and quote requests with your answers to the Provider's questions, shipping and billing addresses and returns.
• Communications and content: chat and support messages and their attachments, contact forms, appointments with our team, copies of the emails we send you, in-app notifications, reviews and replies, listings and other Content.
• AI features: what you write to AI assistants and their replies, as described in section 10.
• Connected services: if you connect Google Calendar, your Google email, calendar names, busy/free times and the events we create (section 7); if a Provider connects Instagram or TikTok, its public profile and posts.
• Technical and usage data: IP address, browser and device information, the pages and requests you make (server logs), searches and the location you search near, clicks on search results and filters, views of listings (counted in a form that does not identify you), clicks on a Provider's contact details when you are signed in, favourites, follows and your cookie choices.
• Newsletter: email address, whether you subscribed as a hobbyist or partner, language, the consent text you accepted and the time and IP address of the subscription.
• Prospective Providers: see section 12.

We do not store full payment-card numbers or security codes. Please do not submit sensitive personal data unless it is genuinely necessary for the requested service.

4. Where the data comes from

We obtain data directly from you; from other users — a Customer who books for another participant, a Provider who enters its students, bookings or attendance, invites you to leave a review or to join the Platform, or a team member; automatically from your browser or device; from services you choose to connect, such as Google Sign-In, Google Calendar, Instagram, TikTok or Stripe; and, for prospective Providers, from publicly available sources (section 12). We also derive operational information from Platform activity, such as booking status, Provider statistics or whether a message was delivered.

If you provide information about another person, you must have authority to do so and give them this Policy where appropriate.

5. Why we use data and our legal bases

We process personal data only where a legal basis under the GDPR applies:

• Contract and pre-contract steps (Art. 6(1)(b)): to create and administer accounts; publish, search and manage listings; handle messages, participation requests, bookings, orders, packages, payments, refunds, subscriptions and support; pass to Providers the information they need; send messages about your bookings, orders and account; and provide the features you choose to use, such as calendar synchronisation or AI assistants.
• Legal obligation (Art. 6(1)(c)): to keep tax and accounting records, meet consumer-protection and digital-services obligations and respond to lawful requests from authorities.
• Legitimate interests (Art. 6(1)(f)): to secure and maintain the Platform, keep logs and prevent fraud and abuse; to understand and improve the service through statistics and our own measurement of how search is used; to moderate content and enforce our Terms; to resolve disputes; to give support, including through support access to accounts (section 14); to notify our team internally; to send Providers news and tips about the service; to contact businesses about joining the Platform (section 12); and to send Customers who have booked through the Platform news about similar services. We balance these interests against your rights, and you may object at any time (section 20).
• Consent (Art. 6(1)(a) and, for health information, Art. 9(2)(a)): for non-essential cookies (analytics, advertising and third-party content), the newsletter, promotional emails to Customers who have not booked through the Platform, browser location and health information you choose to give. You may withdraw consent at any time; withdrawal does not affect processing already carried out.
• Legal claims or vital interests: where necessary to establish or defend claims, protect people or respond to emergencies.

Where information is required to create an account, complete a booking or payment, meet a legal requirement or provide a requested feature, failure to provide it may mean we cannot complete that action.

6. Health information and children

Health information. We do not ask for health information, but you may choose to give some — for example an injury, an allergy or a condition — in a booking note, in your answers to a Provider's questions or in the notes about a participant, so that the Provider can take care of the participant. Such information is a special category of data. We process it only with your explicit consent, which you give by entering it where the Platform tells you so, and we share it only with the Provider concerned. You can withdraw your consent at any time by deleting the information or by contacting us. Health information that a Provider records about its students is kept under the Provider's responsibility (section 2); the Provider must have the explicit consent of the person or of their parent or guardian.

Children. You must be at least 15 years old to create an account; people aged 15 to 17 may book, buy or pay only with the consent of a parent or guardian. Children under 15 do not have their own account: a parent or guardian may add them as participants and book for them, and must have authority to give their details. Providers may record data about children in their own records under their responsibility and must respect the rules on protecting children that apply to their activity.

7. Google Sign-In and Google Calendar

Google Sign-In (available to Customers). If you choose it, Google gives us the minimum identity information needed to authenticate you: your Google account identifier, verified email address, name and profile picture, and the token claims needed to validate the sign-in. We use them only to create, link, secure and display your account; your name and picture from Google are shown only in your browser and are not stored on our servers.

Google Calendar (optional). If you connect your Google Calendar from your account, we ask only for the permissions the feature needs. For Providers and their team members: to create and manage a separate “HobbyDetective” calendar where your sessions are written, to list the names of your calendars so you can choose which to take into account, and to read only the busy and free times of those calendars, so that busy times can block bookings — we never read the titles, guests, locations or descriptions of your events. For Customers: to write your bookings as events in your own calendars. We store your Google account identifier and email, the permissions you granted, the access tokens in encrypted form, the names of your calendars, the busy and free times and the events we created. You can disconnect at any time from your account or from your Google Account permissions.

We do not use Google user data for advertising, do not sell it and do not use it to develop or train AI models, and we share it only as described in this Policy for operating the feature, security or legal compliance. HobbyDetective's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Disconnecting stops future access but does not by itself delete data already linked to your HobbyDetective account; you can ask for deletion under section 20.

8. What Providers, other users and the public see

Provider profiles, published listings, prices, availability, locations, media and reviews are public; Providers' phone, email, website and social-media links are shown on paid plans. Reviews appear with your first name and the initial of your surname, or anonymously if you choose; after you close your account, they remain without a name. Do not publish personal information you do not want to be public.

When you contact, book or buy, we disclose to the Provider concerned the information needed to respond and perform the service: for bookings, your name, email, phone, the participants' names (and email, if given), your notes and, if entered, billing details; for orders, delivery details; for participation and quote requests, the details and answers you submit; and your messages. When you book or buy, the Provider's list of customers is updated with your name, email and phone. Providers see how many people clicked their contact details, not who. If you connect your account with another Customer's (for example a family member's), each of you sees the other's name and email and the packages you choose to share. A confirmation of attendance can be opened by anyone who has its link.

9. Payments

Card payments for bookings, packages and orders are made through Stripe directly to the Provider's Stripe account; payments for Provider plans and platform fees are made through Stripe to HobbyDetective. Card details are entered into interfaces controlled by Stripe; we receive transaction identifiers, amounts, currency, payment and refund status and information about disputes. Providers enter their identity, business and bank details directly with Stripe, which processes them under its own privacy notice to provide and verify its services.

If you choose to pay a Provider by IRIS or bank transfer, the Platform shows you the account details the Provider has entered. We use transaction data to complete purchases and bookings, handle refunds and disputes, calculate fees, prevent fraud and meet accounting and legal duties.

10. AI features and automatic translation

We use artificial intelligence in the following features: the AI assistant for Customers, which answers questions and recommends listings; tools for Providers that help write, improve, categorise and translate texts, a support assistant, a listing fill-in assistant, a statistics summary and a Premium Plus assistant that analyses participation requests; and tools our team uses to answer questions about the Platform and to research and contact prospective Providers. Listing, product and profile texts are also translated automatically into the other language of the Platform.

Depending on the feature, the following may be sent to the AI provider: what you write and the recent conversation; for the Customer assistant, your first name and the search results it uses; for Provider tools, the texts and the listing or account information needed (without customers' contact details); for the participation-request assistant, which a Provider may use on its own requests, the Customer's name, the name of the participant, the message and answers to the Provider's questions, the booking history with that Provider and recent chat messages; for automatic translation, the texts being translated, which may include business names and addresses; and for our team's tools, account, booking and order records (with masked email addresses) or information about prospective Providers.

The AI providers we use are DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd., China), for most features; Anthropic (Anthropic Ireland, Limited, with processing in the United States), for the listing fill-in assistant and for researching prospective Providers, when we select it instead of DeepSeek; and MyMemory (Translated S.r.l., Italy), a machine-translation service, for some automatic translations. DeepSeek stores and processes data in China (section 16). They process the data under their own terms. Our servers keep records of AI use (feature, time and cost), automatic labels that classify each conversation, short excerpts of conversations that are flagged as off-topic, sensitive or abusive, and the questions that the assistant passes to our team; the conversation with the Customer assistant is kept in your browser for the session. If a conversation is classified as extreme repeatedly, access to the assistants is suspended automatically and our team is notified; you can contact us to have it reviewed.

The output is advisory and may be inaccurate. Using the AI assistants is optional; if you do not want your messages to be processed in this way, do not use them. Do not include sensitive or unnecessary personal information in what you write to an AI feature.

11. Communications and marketing

Service messages. We send emails and in-app notifications about your account, bookings, orders, payments, packages, subscriptions, messages and reviews. Messages about orders, payments, account security and billing cannot be switched off; you can switch off most others in your notification settings. We keep copies of the emails we send through our system. Emails are sent through Mailgun (EU region). Some emails load images, such as a countdown, from our servers, so opening them sends your IP address and device information to our servers, where it is recorded in our logs; we do not use this to track whether you opened an email.

Promotional emails from HobbyDetective to Customers. We send them only if you have agreed, through the option “I want to receive updates & offers” in your account or by subscribing to the newsletter, or, if you have booked through the Platform, about similar services unless you object. Every such email has an unsubscribe link.

Newsletter. Our newsletter is sent through Brevo (Sendinblue SAS, France). Subscription requires confirmation through the link in a confirmation email (double opt-in). We keep a record of your consent and you can unsubscribe at any time through the link in every newsletter.

Providers. We send Providers news and tips about using the Platform; every such email has a link to stop them, and they can also be switched off in the notification settings. Emails about plans and billing cannot be switched off.

Messages on behalf of Providers. Through the Platform, Customers may receive news of new listings from Providers they follow, products or news from Providers whose list of customers they are on, messages a Provider sends about a booking and invitations to leave a review. You can stop them by unfollowing a Provider or through the notification settings (“Following”, “My providers”).

12. Prospective Providers

To grow the Platform, we contact businesses and organisations that offer activities and that we believe may be interested in joining. For this purpose we process: the business name, category and offering; the name and role of a contact person; business email addresses and phone numbers, which may include mobile numbers or email addresses that the business publishes; website, address or area and social-media accounts, and whether we follow each other; notes about our contacts (date, time, channel, outcome and our assessment of interest); meetings booked with our team; and whether you have asked us not to contact you.

We obtain this information from publicly available sources — the business's website, social media, maps and directories and web searches — from people who recommend the business to us or who invite it through the Platform, from visits and from what you tell us when we speak. We contact businesses by email (an invitation and follow-up messages), through Instagram and Facebook messages, by phone or in person. To research and summarise public information and to draft messages, we use AI tools (Anthropic and DeepSeek) and web searches (DuckDuckGo); an AI assistant may also read the replies to our Instagram messages and record them in our system.

The legal basis is our legitimate interest in informing businesses about the Platform (Art. 6(1)(f)). You can object at any time through the link in our emails, by replying or by writing to [email protected]; we will then stop contacting you and keep only the information needed to respect your choice. Otherwise, we keep this information for 24 months after our last contact with you, unless you ask us to delete it sooner.

13. Cookies, analytics, maps and embedded media

Strictly necessary technologies support sign-in, security, your cart, the choices you make (such as language and display preferences), checkout and your consent record. As part of the service and without consent, pages with a map or a location search load Google Maps and Places, sign-in pages load Google Sign-In, the plan and payment pages and some pages of the Provider panel load Stripe, and some pages load images and videos from ImageKit; these services receive your IP address and device information. We also record on our servers how searches are used — for example the filters chosen and the results clicked — without involving third parties, and we count listing views in a form that does not identify you and is deleted after 3 days.

With your consent we use: analytics (Google Analytics and Contentsquare, including recordings of how pages are used); advertising (the Meta pixel, to measure our advertising and show HobbyDetective ads to people who have visited the Platform; this consent also allows Google's advertising signals); and third-party content (embedded YouTube and Vimeo videos). For the data collected through the Meta pixel, HD NEXT IKE and Meta Platforms Ireland Limited are joint controllers for its collection and transmission to Meta; Meta's further processing is under its own responsibility and privacy policy. Optional technologies are switched off until you give consent, and you can change your choice at any time through “Cookie settings” at the bottom of the public pages or on the Cookie Policy page, which lists every technology, its provider and its duration.

14. Access by our team and internal tools

Authorised members of our team access personal data only as needed for the purposes in this Policy. With the support function described in the Terms and Conditions, they may open a user's account as the user sees it and act in it — for example to give support the user asked for, or to set up listings at a Provider's request; every such access is recorded. Members of our team with administrative access can see the data held on the Platform, including Providers' records about their students, when this is needed for support, security or the other purposes above.

Our team receives internal notifications about new registrations, contact forms, support messages, appointments, invitations and payment events by email (in a Gmail mailbox) and in a team chat service (Discord); these may contain names, email addresses, phone numbers and the content of the messages.

15. Who receives personal data

We do not sell personal data. We disclose only what is reasonably necessary to:

• the Provider or Customer involved in a request, booking, order, review, refund, dispute or message, and other users as described in section 8;
• Stripe (Stripe Payments Europe, Limited, Ireland, and its affiliates) for payments;
• Cloudflare, Inc. for the domain, content delivery and protection of the Platform — our servers are operated by us in Greece (section 17); IPHOST (Greece) for the hosting of our mailbox; and GitHub, Inc., where our software is developed;
• Mailgun Technologies, Inc. (EU region) for sending emails, and Brevo (Sendinblue SAS, France) for the newsletter;
• Google (Google Ireland Limited and Google LLC) for sign-in, maps and places, Google Calendar if you connect it, analytics and YouTube with your consent, the mailbox for our internal notifications and the fonts some of our emails load;
• Meta Platforms Ireland Limited for the Meta pixel (with your consent), and Meta or TikTok where a Provider connects its Instagram or TikTok account;
• Contentsquare SAS (France) for analytics with your consent, Vimeo.com, Inc. for embedded videos with your consent, and ImageKit Inc. for delivering images and videos;
• DeepSeek, Anthropic and MyMemory (Translated S.r.l.) for AI features and automatic translation (section 10), and DuckDuckGo for web searches about prospective Providers;
• Discord, Inc. for our team's internal notifications (section 14);
• professional advisers, accountants, auditors, insurers, prospective buyers of the business and competent authorities or courts, where lawfully required.

Service providers acting on our instructions are bound by data-protection and confidentiality obligations. Some of them, such as Stripe, Google and Meta, also act as independent controllers for parts of their services.

16. International data transfers

Some recipients are based, or process data, outside the European Economic Area. Transfers to the United States — for example to Google, Meta, Cloudflare, Mailgun, Stripe, Vimeo, GitHub, Discord, Anthropic and DuckDuckGo — rely on the EU–US Data Privacy Framework, where the recipient is certified under it, or on the European Commission's Standard Contractual Clauses.

Transfers to China. DeepSeek stores and processes data in the People's Republic of China. The European Commission has not adopted an adequacy decision for China, and we have not concluded Standard Contractual Clauses or other safeguards under Article 46 GDPR with DeepSeek. This means that the data sent to DeepSeek through the features described in section 10 may not enjoy a level of protection equivalent to that in the European Union, including as regards access by public authorities. If you do not want this, do not use the AI assistant; you can also object to the processing of your data by the participation-request assistant by contacting us. Texts that Providers publish are translated through DeepSeek, and our team's tools also use it (section 10).

You may contact us for more information about the safeguards relevant to a particular transfer.

17. Where we store data and how we protect it

The Platform's servers, database and files, and their backups, are located in Greece on infrastructure operated by HD NEXT IKE; access to the Platform passes through Cloudflare. We use proportionate technical and organisational measures, including encrypted connections (HTTPS), hashed passwords, encrypted storage of the access tokens of connected services, role-based permissions for Providers' team members, optional two-step verification for accounts, recording of our team's access to accounts, daily backups and the separation of card data, which is handled only by Stripe. No online service can guarantee absolute security. Report suspected security issues to [email protected].

18. How long we keep data

We keep personal data only as long as the purposes above need it. The periods below are enforced by our systems: every night, a scheduled job deletes or anonymises whatever has reached the end of its period.

• Accounts and listings: while the account is open. An account whose email address is never confirmed is deleted after 30 days. An account nobody signs in to for 3 years is closed; we email you 30 days before, and signing in once keeps it.
• Customer account closure: the profile and family members are deleted, the email address is replaced, sign-in methods are removed and active sessions end; your name and contact details are removed from bookings, requests and the records Providers keep about you (health information included); and we delete the files you sent in messages, the copies of the emails we sent you, your notifications, contact-form messages, your history with the AI assistant, favourites and cart, and your newsletter subscription on this site. Google Calendar access is revoked. What remains: bookings, orders and payments as tax records (see below; orders with their delivery details); the text of messages you exchanged with Providers, which is their correspondence too, until that conversation’s period below ends; and reviews, without your name.
• Provider account closure: it is handled as a request, because open bookings, payments, subscriptions or complaints must be settled first. The public profile and the logins are then removed, together with the records the Provider keeps about its students (health information included), the payment details shown to Customers (IBAN, IRIS), listing contact details, linked Google, Instagram and TikTok accounts (access revoked where the service allows it), copies of emails and the newsletter subscription. Tax and accounting records remain, as described below.
• Messages, support requests, inquiries, group and waitlist requests, contact forms and invitations: 2 years after the last activity.
• Copies of the emails we send: the content for 90 days; the record that an email was sent (recipient, subject, date) for 2 years.
• In-app notifications: read ones for 180 days, unread ones for 2 years.
• Security and application logs, IP addresses, and the labels and excerpts we keep about AI use: 90 days (AI cost figures are kept after that without your name); one-time codes and links shortly after they expire. Records of our team’s administrative actions: 2 years.
• Tax and accounting records (bookings, orders, payments, fees, subscriptions): at least 5 years from the end of the year to which they relate, as tax law requires; after that, the names and the contact and delivery details on them are anonymised.
• Newsletter: until you unsubscribe; until then we keep your sign-up (with the IP address it came from) as proof of your consent. A sign-up that is never confirmed is deleted after 30 days. Our newsletter provider keeps the record of your confirmation and of your unsubscription.
• Prospective Providers: 24 months after our last contact, as described in section 12.
• Other periods: the data used to count listing views is deleted after 3 days; your cookie choice is kept in your browser for about 6 months; backups are kept for 14 days, and one backup a week for about 92 days.

Data deleted from our systems also leaves the backups when those expire.

19. Automated decisions

We do not make decisions producing legal or similarly significant effects about you solely by automated means. Some processing is automated as part of the service: the order of search results (which includes a random order — Terms, section 7), AI recommendations and classifications, the automatic suspension of access to the AI assistants after repeated extreme use, and the automatic cancellation of unpaid bookings or orders after their deadline. You can contact us to have any such outcome reviewed by a person.

20. Your data-protection rights

Subject to the conditions and exceptions of the GDPR, you may request access, rectification, erasure, restriction and portability; object to processing based on legitimate interests, including at any time to direct marketing; and withdraw consent at any time.

You can do much of this yourself: edit your profile; change your notification, communication and cookie settings; unsubscribe through the link in our emails; delete your account from your account settings; and, as a Customer, download a copy of your main data from the Privacy tab of your account. For anything else, email [email protected]. We may need to verify your identity and clarify the request. We respond without undue delay and within one month, subject to any lawful extension. Rights may be limited where we must retain data, protect another person's rights or establish or defend legal claims.

You may also complain to the Hellenic Data Protection Authority, Kifissias 1–3, 115 23 Athens, Greece, telephone +30 210 6475600, www.dpa.gr, or to another competent supervisory authority.

21. Changes to this Policy

We may update this Policy to reflect service, legal or supplier changes. The current version is published here with its date. For material changes, we also notify registered users by email or through a prominent notice on the Platform. Where a new use requires consent, we will ask for it before that use.

22. Contact and related policies

Questions, complaints and requests to exercise your rights can be sent to:

HD NEXT IKE
Pindarou 4, Thessaloniki 54639, Greece
VAT 802577241 · GEMI 178921006000
Tel. +30 698 386 7651
[email protected]

Please also read our Terms and Conditions and Cookie Policy.