Privacy policy.
Plain answers.

HELIOS BRAIN SOCIETE ANONYME ("Helios Brain", "we", "us") is a Greek Société Anonyme registered in ΓΕΜΗ under number 190904001000, with registered office at Kifisias Avenue 265, 14561 Kifisia, Greece. We are the data controller for personal data processed through this website and in the course of our customer engagements, unless explicitly stated otherwise.

On this website we collect: (a) data you voluntarily provide through forms (name, email, organisation, message); (b) minimal technical data necessary to deliver the site (IP address, browser type, referrer, timestamp); and (c) optional analytics signals only where we have your consent through the cookie banner. We do not run third-party advertising trackers. We do not mine the messages you send us.

Lawful bases under GDPR Article 6: contact-form submissions are processed under Article 6(1)(b) (steps prior to entering into a contract) and Article 6(1)(f) (our legitimate interest in responding to inquiries); minimal technical data under Article 6(1)(f); analytics where applicable under Article 6(1)(a) (consent). Customer-engagement data is processed under contract.

Where Helios Brain operates a substrate inside a customer institution, that customer is the data controller for the personal data processed by that substrate. Helios Brain acts as a data processor under a Data Processing Agreement. Customer data does not leave the European data perimeter of the deploying institution. We do not aggregate customer data across institutions. We do not use customer data to train shared models.

Contact-form submissions: up to 24 months from last interaction, then deleted or anonymised. Technical logs: up to 90 days. Analytics: as defined per provider, never beyond 14 months. Customer-engagement data: as per the Data Processing Agreement with the relevant customer. You may request earlier deletion at any time.

Service providers acting under our written instructions: email infrastructure, website hosting, customer-relationship tooling. All processors are bound by Article 28 GDPR data-processing agreements and operate inside the EU/EEA, or transfer data under EU Standard Contractual Clauses with documented safeguards. We do not sell personal data. We do not share personal data for third-party marketing.

Under GDPR you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data, and to withdraw consent at any time. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1-3, 11523 Athens, Greece. To exercise your rights, write to hello@heliosbrain.com. We respond within 30 days.

We use a minimal set of strictly necessary cookies for site delivery. Analytics or preference cookies, where applicable, are loaded only after your consent through the cookie banner. You can change your choice at any time by clearing cookies in your browser or contacting hello@heliosbrain.com.

We apply technical and organisational measures appropriate to the risk: TLS in transit, encryption at rest for sensitive data, least-privilege access controls, periodic adversarial review, and a documented incident response procedure. Vulnerability reports are welcome at hello@heliosbrain.com.

We may update this policy. The effective date is shown at the foot of the page. Material changes affecting your rights will be communicated by email where we have your address, otherwise by a clear notice on this site.