Privacy notice

Last updated: 25 October 2026

1. Who we are

The controller is ZOGRAFIDIS O.E. (ΖΩΓΡΑΦΙΔΗΣ Ο.Ε.), Greece, trading as Apofis Group, business registry 183276638000. Questions and requests about personal data go to request@apofisgroup.com.

2. What this notice covers

It covers the public website and the Valistra panel, including sign-up, sign-in, your account and your test records.

3. The website

The website does not use analytics, advertising or tracking. Optional cookies stay off unless you allow them in the cookie banner or on the cookie settings page. It sets one cookie of its own, described in the cookie notice. Cloudflare, which delivers the site, receives the technical data every web request carries, such as your IP address and browser details.

The landing pages are static files. They run no server code of ours, so we keep no logs of visits to them. Cloudflare delivers the files and keeps its own security and network records under its data processing terms.

The Valistra panel is a separate service. Its request logs are switched off, and it keeps only the security event records described in section 4.

If you write to us, we use your message and contact details to reply and to handle the matter. We keep them for as long as the matter needs and the law requires.

4. The Valistra panel

Sign-up

We ask for your name, email address, country (an EU member state), customer type, a confirmation that you are 18 or over, and your acceptance of the terms. We keep the version of the terms you accepted and a fingerprint of that version. These details are needed to create an account; without them we cannot open one. We review each sign-up, and the account stays inactive until we approve it.

Accounts and sign-in

We keep your display name and email address. Your password is stored only as a one-way hash. Passkeys store a public key, not a secret. Authenticator secrets are encrypted at rest, and recovery codes are stored as hashes. Each signed-in session keeps a keyed hash of your IP address and of your browser's user-agent string, not the values themselves.

Security and audit records

We record account and security events, such as a sign-in, a changed setting or a failed sign-in. These are event records, not a log of every request. Each record holds a keyed hash of your IP address and of your browser's user-agent string, not the values themselves. Login attempts are recorded the same way. We use these records to prevent abuse and fraud, to protect accounts and to show what happened in an account.

Test records

You register the domains you own. We keep verification records, test runs and their results so that you and we can review them. Test records are kept for 12 months by default.

Transaction archive

Account actions are kept in a tamper-evident archive, as a legal record and for audit. Each entry is kept for 10 years after the contract ends by default. After that, the content of the entry is removed, and the entry itself stays as the record that it existed.

Retention summary

The periods below are the defaults. Records covered by a legal hold are kept until the hold is released.

Session records: deleted 30 days after the session ends. A session itself lasts up to 12 hours and ends after 60 minutes without activity.
Security and login records: 90 days.
Sign-up records for onboarding that is not completed: 90 days.
Setup links (invitations, password and second-factor resets, email checks): deleted 30 days after they are used, revoked or expire.
Identity details after an account is closed: anonymized 30 days after closure.
Copies of the emails and in-panel notices we send you: kept as the record that a notice was given. Their address and text are removed when your identity details are anonymized.
Test records: 12 months after the test.
Transaction archive: 10 years after the contract ends. Then the content of each entry is removed, and the entry stays as a record.

5. Who receives your data

Cloudflare, Inc. hosts and delivers the website and the panel, stores panel data in EU-restricted locations, and sends panel email. Cloudflare acts as our processor under a data processing agreement. Some processing can take place outside the EU through Cloudflare's global network, under the transfer safeguards in that agreement.
Our mailbox provider hosts request@apofisgroup.com and receives your messages to us.

We do not sell personal data. We will update this notice before we add any further provider that receives personal data.

6. Why we process it and on what basis

Replying to a request for a test and preparing the contract: steps before a contract (Article 6(1)(b) GDPR).
Replying to other messages, including security and accessibility reports: legitimate interests in answering the people who write to us (Article 6(1)(f) GDPR).
Handling your requests about your personal data: legal obligation (Article 6(1)(c) GDPR).
Delivering the website and protecting it through Cloudflare: legitimate interests in a working and secure website (Article 6(1)(f) GDPR).
Your panel account, sign-in, second factors and test records: contract (Article 6(1)(b) GDPR).
Security and login records: legitimate interests in keeping accounts secure and preventing abuse and fraud (Article 6(1)(f) GDPR).
The terms version you accepted and your age confirmation: contract, and legitimate interests in keeping evidence of what was agreed (Article 6(1)(b) and (f) GDPR).
The transaction archive: legal obligation where a law requires the record (Article 6(1)(c) GDPR), otherwise legitimate interests in establishing, exercising or defending legal claims (Article 6(1)(f) GDPR).

We rely on consent only for optional cookies. We use none today. If we add any, we will update the cookie notice and ask you again before they run, and you can withdraw consent on the cookie settings page at any time.

7. Your rights

You can ask us for access to your data, correction, erasure, restriction, portability, and to object to processing based on legitimate interests. Write to request@apofisgroup.com. We reply within the time the GDPR sets: one month, which the law allows us to extend in some cases.

You may also complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα).

8. Children

The service is for businesses and adults. The panel requires a confirmation that you are 18 or over. We do not knowingly accept accounts from anyone under 18.

9. Changes

We update this notice when our processing changes and show the date of the latest update at the top.