01Who we are and what this covers
Kronn ERP is provided by “ΜΑΡΗΣ ΚΩΝΣΤΑΝΤΙΝΟΣ ΟΔΥΣΣΕΑΣ” (Konstantinos Odysseas Maris), a sole proprietorship trading as “Kronn” (VAT no. EL176307607) (“Kronn”, “we”). Contact for data matters: [email protected], +30 693 487 1363.
This policy covers the app at erp.kronn.gr, its API (api.kronn.gr) and the emails it sends. We have not appointed a Data Protection Officer (DPO); write to the address above about anything.
02Two roles: controller and processor
For your account details — the users and the business as our customer — we are the controller.
For the data your business enters or brings into the app (clients, documents, bank transactions, appointments, drivers, shipments) your business is the controller and we are its processor (Art. 28 GDPR), as set out in the Kronn ERP Terms of Service.
If you are a client or partner of a business that uses Kronn ERP and want to exercise your rights, contact that business. If you come to us, we will pass your request on.
03Data we process as controller
| Data | Source | Why | Legal basis |
|---|---|---|---|
| Users: full name, email, language, password (hash only), role and permissions, two-step sign-in settings, when you accepted the Terms and which version | From you at sign-up or invitation; from Google (email, name) if you sign in with Google | Account, sign-in, security, account emails | Contract (Art. 6(1)(b) GDPR) |
| Business: legal and trade name, VAT number, tax office, activity, address, phone, email, website, G.E.MI. number, IBAN and bank, logo, reply-to email | From you in the setup wizard; filled in from the AADE registry when you press “Look up” | Running the service, showing on your documents, activating and invoicing your plan | Contract; legal obligation for invoicing (6(1)(c)) |
| Plan and usage: plan, activation request, renewal date, credits used, bank connections | From the app | Billing, plan limits, support | Contract |
| Correspondence with us | From you (email, phone) | Support, replies | Contract or legitimate interest (6(1)(f)) |
| Technical: IP address, browser, request time | From your connection | Security, sign-in attempt limits, fault finding | Legitimate interest (6(1)(f)) |
The app keeps your IP address in memory only, for attempt limits (e.g. 20 sign-ins per 5 minutes); it does not store a sign-in history. The Cloudflare network and the web server keep technical logs for security and fault finding.
We send no marketing emails or newsletters, sell no data, build no profiles, make no automated decisions with legal effects, and the service sends no data to artificial-intelligence services.
04Data we process on behalf of your business
Depending on the features you use:
- Clients and partners: legal or full name, VAT number, tax office, activity, address, country, email, phone, contact person, notes.
- Documents, collections and payments: items, amounts, VAT, the client’s details as they were at issue, the AADE MARK and UID, the request to the provider and its response, the PDF file.
- Bank transactions: date, amount, currency, counterparty name and IBAN, description and the transaction details as the bank provides them, with card and phone numbers masked.
- Industry packs: staff (name, email, phone, licence expiry); appointments (date, time, doctor, contact details for the reminder); rentals (driver: name, licence number and expiry, phone, ID number, date of birth); shipments (recipient name, address and phone); vehicle plates.
- Emails to your clients: recipient, subject and delivery status.
The app is not designed for special categories of data (Art. 9 GDPR) such as health data. Do not enter medical information in notes or free-text fields.
We process this data only to provide the service and on your instructions; we do not use it for our own purposes.
05Demo mode
After sign-up your business starts in demo mode. Documents get a test MARK and are not sent to the provider or to AADE. Emails you send reach only you, marked “[ΔΟΚΙΜΗ]” (test), and automatic emails are not sent. Banking uses a demo bank or a file import.
When a plan is activated, demo documents, payments, collections, bank connections and samples are deleted automatically.
06Who receives data
| Recipient | What it does | Which data |
|---|---|---|
| Hetzner Online GmbH | Hosts the servers (database, app, PDF archive) in data centres in Germany | All service data |
| Cloudflare, Inc. | Delivery network, HTTPS and attack protection for erp.kronn.gr and api.kronn.gr | Traffic to the app, IP address |
| Bratnet (e-timologiera.gr) | Certified e-invoicing provider | Each document (issuer, client, items, amounts) for transmission to myDATA |
| Synci (synci.io), using GoCardless Bank Account Data | Bank connection, read-only | Business email and legal name; the accounts and transactions you authorise at your bank |
| Resend (Plus Five Five, Inc.) | Sends the service’s emails | Recipient, subject, content, attachments |
| Sign in with Google (optional) | Email and name from Google, and your IP address when Google’s script loads on the sign-in and sign-up pages | |
| AADE (Greek tax authority) | Public authority; recipient by law | Documents (through the provider, in myDATA); VAT numbers you look up in its registry |
We use no analytics, no third-party error tracking, no advertising networks and no external payment processors.
Authorised Kronn staff can view your business’s account with owner permissions only when needed: to activate your plan, for support you asked for, or to resolve a fault or security issue. At your request they can also reset two-step sign-in or issue a temporary password. They are bound by confidentiality.
Data may be disclosed to public authorities only where the law requires it.
07Transfers outside the EEA
The database and files are stored in Germany. Cloudflare, Resend and Google are based or operate in the United States. Where data is transferred outside the EEA, the transfer relies on the safeguards of Chapter V GDPR: the adequacy decision for the EU-U.S. Data Privacy Framework, for providers certified under it, or the European Commission’s standard contractual clauses.
08Cookies and browser storage
The app sets no cookies. It uses the browser’s local storage only for what it needs to work:
| Key | Purpose | Duration |
|---|---|---|
| kronn.token | Keeps you signed in | Until you sign out; the session expires after 12 hours |
| kronn.lang | App language | Until you clear it |
| kronn.pageSize.*, kronn.priceMode, kronn.inventory.location | View settings: rows per page, prices with or without VAT, selected warehouse | Until you clear them |
| kronn.twoFactorNudge | Remembers that you hid the two-step sign-in reminder | Until your next sign-in |
| kronn.synciAdding (sessionStorage) | Remembers a bank connection in progress while you are on the bank’s page | Up to 1 hour |
These are strictly necessary for the service you request, so no consent is needed (Art. 4(5) of Greek Law 3471/2006). If you use Sign in with Google, Google may use its own cookies under its own policy.
09Emails the service sends
All emails are sent from [email protected] through Resend. To users we send only account and service emails: email confirmation, password reset, invitations, two-step sign-in notices, plan request and activation.
On behalf of your business we send its clients and partners what it chooses: documents, quotes, rental agreements, delivery notes, statements, appointment reminders and automated reports. They show your business’s name, and replies go to the address it has set.
Emails contain no open or click tracking. Each document opens from a signed link that does not expire: anyone who has the link can see the PDF. Automated-report links are valid for 90 days.
10How long we keep data
- Account and business data: for as long as the account is active.
- After the contract ends: 90 days for you to export your data, then deletion within 30 days. Any backup copies are erased in their normal cycle.
- Demo accounts with no activity for 12 months: may be deleted after we notify you by email 30 days in advance. Demo data is deleted automatically when a plan is activated.
- Links: email confirmation 7 days, password reset 60 minutes and single use, invitation 7 days, automated reports 90 days.
- Our own invoices to you for your plan: as long as tax law requires.
- Technical logs: for a short period, as needed for security and fault finding.
The duty to keep your documents and books rests with your business. Before closing your account, download your documents as PDF, the accountant pack and your reports. The provider keeps the documents it transmitted as the rules for e-invoicing providers require.
11Security
- The app runs over an encrypted connection (HTTPS).
- Passwords are stored only as Argon2id hashes and recovery codes as SHA-256 hashes.
- Optional two-step sign-in (TOTP) with recovery codes, and an email notice whenever it changes.
- Two-step sign-in keys and bank connection credentials are stored encrypted.
- Your business’s provider key is not stored in Kronn ERP; a separate key-management service holds it.
- Document PDFs are kept in private storage and open only through a signed link.
- Limits on the number of requests per user and per IP address, stricter for sign-in, sign-up, password reset, one-time codes and sending email.
- Owner, accountant and employee roles, with permissions set by the owner.
If a personal data breach occurs, we notify the Hellenic Data Protection Authority and you as Articles 33 and 34 GDPR require. For data we process on behalf of your business, we notify the business as the Terms set out.
12Your rights
You have the right of access, rectification, erasure, restriction, portability and objection (Arts. 15–21 GDPR). You can correct most details yourself in Settings. For anything else, a full export of your data or account deletion, write to [email protected] from your account email; we reply within one month. A business account’s deletion is requested by its owner.
Deletion does not cover what the law requires us to keep. Documents already transmitted to AADE cannot be deleted from myDATA.
You also have the right to lodge a complaint with the Hellenic Data Protection Authority (1-3 Kifisias Ave., 115 23 Athens, www.dpa.gr).
13Minors and changes
Kronn ERP is for businesses and professionals, not for minors.
When we change this policy, we publish the new version here with a new date. For material changes or new sub-processors we notify you by email at least 15 days in advance.