Legal

Privacy policy

How total.support collects, uses and protects personal data — of its customers, of their users, and of visitors to this website.

Last updated: 20 October 2026

1. Statement of application

Compliance with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) is a priority for “ΑΛΕΞΑΝΔΡΟΣ ΧΑΤΖΗΔΗΜΗΤΡΙΟΥ & ΣΙΑ Ε.Ε.”, the sole owner of total.support and all of its content.

Data controller

Company name: ΑΛΕΞΑΝΔΡΟΣ ΧΑΤΖΗΔΗΜΗΤΡΙΟΥ & ΣΙΑ Ε.Ε.
Trading name: Verisys
VAT number (Greece): 998400145
Address: 22 Vasilissis Sofias St., Marousi 15124, Greece
Phone: +30 210 8056350
Email: [email protected]

This policy complies with the GDPR, Greek Law 4624/2019 and applicable national law, as well as the opinions, guidelines, recommendations and decisions of the Hellenic Data Protection Authority.

2. Definitions

Personal data: any information relating to an identified or identifiable natural person (“data subject”), such as a name, email address, phone number, IP address or online identifier.
Processing: any operation performed on personal data, such as collection, recording, storage, use, disclosure, restriction or erasure.
Controller: the person who determines the purposes and means of processing.
Processor: the person who processes personal data on behalf of the controller.
Customer: the business or organisation that holds an account on total.support.
User: any natural person who uses total.support — either as a member of the Customer's team (admin, agent), or as a customer or visitor of the Customer who chats through the widget, submits a support ticket or reads the help center.
Consent: any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they agree to the processing of their personal data.
Personal data breach: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

3. Introduction: what total.support is

total.support is a cloud platform that lets businesses organise customer support: live chat with automatic answers generated by artificial intelligence (AI), a public help center with articles, a support ticket system fed by email, announcements to customers, and integration tools (API, MCP server).

Verisys contracts with the Customer, i.e. the business that holds an account. For the data that the Customer and its own customers enter or generate inside the platform (conversations, tickets, articles, contacts), the Customer is the controller and Verisys acts as processor, under the service agreement and the accompanying data processing agreement (DPA).

For the data of visitors to this website (totalsupport.app) and of Customer representatives (account, billing, communication), Verisys is the controller.

4. Categories of data collected

4.1 Visitors to totalsupport.app

Details you submit through the contact form: full name, company, email, phone, your message.
Usage data through analytics cookies (see section 9), only if you accept them.
Technical data recorded automatically by our servers (IP address, browser type, pages visited, time), for security and operational purposes.

4.2 Customers (business representatives) and their team members

Account details: full name, email, password (stored only in hashed form), role, two-factor authentication (2FA) details.
Business and billing details: company name, VAT number, tax office, address, contact details, billing and payment history. Payment card details are not stored by us; they are processed by the payment provider.
Connection details for the Customer's support mailbox (IMAP/SMTP), stored encrypted and used exclusively to receive and send support messages on the Customer's behalf.
Application usage data: account activity, consumption of AI credits and storage, logs for security and troubleshooting.

4.3 Customers and visitors of our Customers (processing as processor)

When a natural person uses the widget, submits a support ticket or visits the help center of one of our Customers, we may process on the Customer's behalf:

Full name, email address, phone number and other contact details they provide.
The content of conversations, support tickets, replies and attached files.
Answer ratings and comments.
Technical data: IP address, device and browser type, language, the page from which the conversation started, session identifier.

4.4 Suppliers and partners

Identity, contact, tax and financial details of natural persons or representatives of legal entities we do business with.

4.5 Employees and job candidates

Identity, contact, social security and financial details, family status and, where required by law, health data (e.g. sick leave), for the operation of the employment relationship.

total.support is not directed at minors and we do not knowingly collect data from minors. We do not request or seek special categories of data; if a User includes such data in a conversation or ticket, we process it exclusively on behalf of the Customer and according to its instructions.

5. Purposes and legal bases of processing

Purpose of processing	Legal basis
Providing the total.support service to the Customer: creating and managing the account, operating chat, help center and tickets, billing and invoicing.	Performance of a contract [Art. 6(1)(b) GDPR]
Processing the data of our Customers' customers and visitors inside the platform (conversations, tickets, articles).	We act as processor, under the Customer's instructions and the data processing agreement [Art. 28 GDPR]. The legal basis towards the data subjects is determined by the Customer as controller.
Generating automatic answers, reply suggestions, translations and summaries with artificial intelligence.	Performance of the contract with the Customer [Art. 6(1)(b)]; for Users' data, as processor on the Customer's instructions.
Responding to enquiries through the contact form or email and arranging demos.	Steps prior to entering into a contract [Art. 6(1)(b)] and/or legitimate interest [Art. 6(1)(f)]
Security of systems, prevention of fraud and abuse, logging.	Legitimate interest [Art. 6(1)(f)]
Website traffic analysis (Google Analytics).	Consent via the cookie notice [Art. 6(1)(a) GDPR and Art. 4(5) of Greek Law 3471/2006]
Compliance with tax, accounting and other legal obligations; responding to requests from public authorities.	Legal obligation [Art. 6(1)(c)]
Updates about new features, service changes and security notices to Customers.	Performance of a contract [Art. 6(1)(b)] or legitimate interest [Art. 6(1)(f)]; for purely promotional messages, consent [Art. 6(1)(a)]
Management of employees, candidates and partners.	Contract [Art. 6(1)(b)], legal obligation [(c)], legitimate interest [(f)] and, for health data, Art. 9(2)(b) GDPR

Reference to more than one legal basis does not mean that Verisys switches between them at will, but that there are cases in which more than one applies. Verisys does not use consent as its main basis for processing; it asks for consent only where processing cannot rest on another legal basis (e.g. analytics cookies, promotional messages).

6. Artificial intelligence (AI)

total.support uses AI models from third-party providers (currently OpenAI and Anthropic) to answer questions from the Customer's knowledge base, suggest replies to agents, translate articles and draft articles. For this purpose, the relevant content (the question, article excerpts, conversation or ticket text) is transmitted to the provider through an application programming interface (API).

The providers act as sub-processors, bound by data processing agreements, and do not use the data to train their models, in accordance with the terms of their business (API) services.
The Customer chooses which model is used per brand and can disable AI features.
Automatic answers are based exclusively on the content entered by the Customer. Every answer is logged together with the articles used, so that it can be audited.
No decisions producing legal effects for data subjects are taken solely on the basis of automated processing (Art. 22 GDPR). A User can ask to be served by a human at any time.

7. Recipients and data transfers

Data is not sold or made available to third parties for their own purposes. It may be disclosed to third parties only where required by law or necessary for the provision of our services, subject to the safeguards of the applicable legislation. We entrust specialised providers (processors/sub-processors) with specific services; they receive only the data necessary and are contractually bound to confidentiality and security. The categories of recipients are:

Hosting and infrastructure: servers and database in a data centre within the European Union (Frankfurt, Germany) through Cloudways and DigitalOcean; file storage and backups within the EU.
AI providers: currently OpenAI and Anthropic (see section 6). These providers may process data outside the EEA; the transfer is covered by the European Commission's Standard Contractual Clauses and/or the EU–US Data Privacy Framework, where applicable.
Email: support messages are sent and received through the Customer's own email account (IMAP/SMTP) and the email provider the Customer has chosen.
Push notifications: Google Firebase Cloud Messaging for agent notifications in the browser or on mobile, if the agent enables them.
Payments: a certified payment provider (e.g. Stripe), which processes card details as an independent controller; we receive only confirmation of payment and the last digits of the card.
Traffic analysis: Google Analytics 4 for the totalsupport.app website, only with your consent.
Accountants, legal advisers and public authorities, where required by law.

A full list of sub-processors is made available to Customers as part of the data processing agreement and is updated before any change.

8. Retention periods

Customer account data: for the duration of the contract and up to 30 days after termination or deletion of the account, after which it is deleted or anonymised, unless retention is required by law.
Conversations, tickets, articles and contacts (our Customers' data): for as long as the Customer keeps them in its account. The Customer can delete them at any time; on termination of the account they are deleted within 30 days.
Backups: up to 3 months, on systems within the EU, after which they are automatically overwritten.
Billing details and invoices: for the period required by tax legislation (as a rule 5 years from the end of the year of issue).
Contact form messages: up to 12 months from the last communication, unless a business relationship follows.
Logs and technical data: up to 12 months.
Google Analytics data: up to 14 months, according to the tool's retention setting.

9. Cookies and similar technologies

The totalsupport.app website uses:

Strictly necessary: storage of your cookie choice (localStorage “ts-consent”) and technical security cookies. These do not require consent.
Analytics (Google Analytics 4): the _ga and _ga_* cookies (duration up to 2 years) for anonymous traffic statistics. They are set only if you click “Accept” on the cookie notice; we use Google Consent Mode so that, without consent, no cookies are created and no identifiers are transmitted. You can withdraw your choice by clearing the site data in your browser.
We do not use advertising cookies or cross-site tracking.

The total.support widget, when embedded on a Customer's website, uses only a technical session identifier so that the visitor's conversation is preserved, with no third-party cookies and no cross-site tracking.

10. Rights of data subjects

Verisys respects the rights of natural persons regarding the protection of their personal data. You have the right:

to be informed about the processing of your data;
to access the data concerning you and obtain a copy;
to request the rectification of inaccurate data and the completion of incomplete data;
to request the erasure of your data when it is no longer necessary or the processing is unlawful. Where processing rests on a legal obligation, the right to erasure is limited and assessed case by case;
to request the restriction of processing in specific cases;
to object to processing on grounds relating to your particular situation, subject to Art. 21 GDPR;
to receive your data in a structured, commonly used and machine-readable format (portability);
to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
to lodge a complaint with the Hellenic Data Protection Authority (1-3 Kifissias Ave., 11523 Athens, tel. +30 210 647 5600, www.dpa.gr) or with the supervisory authority of the EU member state where you live or work.

11. Exercising your rights and contact

The above rights are exercised by written request to the postal address of Verisys (22 Vasilissis Sofias St., Marousi 15124, Greece) or by email to [email protected]. We reply within one month; the deadline may be extended by two further months in complex cases, with notice to you.

If you are a customer or visitor of a business that uses total.support (e.g. you chatted with its bot or submitted a ticket), the controller of your data is that business. To exercise your rights, please contact it first. As a second step you may contact us and we will forward your request to the Customer or fulfil it according to its instructions.

12. Processing principles

Verisys observes the principles of Article 5 GDPR. Personal data:

is processed lawfully, fairly and in a transparent manner (“lawfulness, fairness and transparency”);
is collected for specified, explicit and legitimate purposes and not further processed in a manner incompatible with those purposes (“purpose limitation”);
is adequate, relevant and limited to what is necessary (“data minimisation”);
is accurate and, where necessary, kept up to date (“accuracy”);
is kept only for as long as necessary for the purposes of the processing (“storage limitation”);
is processed in a manner that ensures appropriate security (“integrity and confidentiality”).

13. Records of processing activities

Verisys maintains records of the processing activities for which it is controller or processor (Art. 30 GDPR), including the controller's contact details, the purposes of processing, the categories of data subjects and data, the categories of recipients, any transfers to third countries with the appropriate safeguards, the envisaged erasure deadlines and a general description of the technical and organisational security measures.

14. Data security

Taking into account the nature, scope, context and purposes of processing, as well as the risks to the rights and freedoms of natural persons, Verisys implements appropriate technical and organisational measures. Specifically for total.support:

We encrypt all communication with the service and with the widget using TLS (HTTPS).
We host the service and the database in a European data centre (Frankfurt), accessible only to authorised technicians.
We store passwords exclusively in hashed form and Customers' email credentials encrypted; we offer two-factor authentication (2FA).
We logically separate the data of each Customer and each brand, so that no Customer can access another's data.
We restrict data access to authorised Verisys staff and exclusively for providing the service, investigating technical problems and developing new features.
We keep backups for up to 3 months, on systems within the EU.
We apply a data breach response policy. In the event of a breach likely to result in a risk to the rights of natural persons, we notify the Customer without undue delay and the supervisory authority within 72 hours, where required.

15. Staff training

Verisys recognises that the protection of personal data requires awareness among its staff. Staff with access to data are trained in the basic principles of data protection and are bound by confidentiality clauses.

16. Changes to this policy

This policy may be amended. The current version is published on this page with the date of last update. In the event of a material change, Customers are notified by email or within the application.

17. Contact

ΑΛΕΞΑΝΔΡΟΣ ΧΑΤΖΗΔΗΜΗΤΡΙΟΥ & ΣΙΑ Ε.Ε. (Verisys)
22 Vasilissis Sofias St., Marousi 15124, Greece
Tel.: +30 210 8056350
Email: [email protected]