askHermis P.C. (“askHermis”, “we”, “us”) is a private capital company (Ι.Κ.Ε.) incorporated in Greece, based in Athens, Greece. We build AI agents that help hotels answer guests, sell upgrades and run check-in.
This policy explains how we handle personal data when we decide why and how it is used (as a “controller” under the EU General Data Protection Regulation, the GDPR): when you visit our website, talk to us, use our platform as a customer, or apply for a job.
If you are a hotel guest: when you message a hotel that uses askHermis, the hotel is the controller of your data and we process it only on its behalf, under our Data Processing Addendum. Please contact the hotel to exercise your rights; if you contact us, we will pass your request to it. We do not use guest data to train or improve any AI model: our AI sub-processors are engaged under zero-retention, no-training terms and process it only to generate a response.
1. Who we are and how to reach us
The controller is askHermis P.C., Athens, Greece. For any question about this policy or your personal data, email team@askhermis.com. We answer privacy requests in English and Greek.
2. What we collect, why, and on what legal basis
| Data | What it includes | Why we use it | Legal basis (GDPR) |
|---|---|---|---|
| Website technical data | IP address, browser and device type, pages requested, date and time, referring page. | To deliver the website, keep it secure and fix errors. | Legitimate interests (Art. 6(1)(f)). |
| Analytics data | Pages viewed, time on page, approximate location derived from IP, device information, collected through Google Analytics cookies. | To understand which pages are useful and improve the website. | Consent (Art. 6(1)(a)), given in the cookie banner and withdrawable at any time. |
| Contact and demo requests | Name, business email, phone, company, role and what you write to us; demo bookings made through Calendly. | To answer you, arrange and hold a demo, and follow up on your request. | Steps at your request before a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)). |
| Customer account data | Names, business email and phone of the hotel’s authorised users, role, property details, login and activity records. | To provide the platform, authenticate users, give support and send service messages. | Performance of our contract (Art. 6(1)(b)). |
| Billing data | Company name, address, VAT number, billing contact, invoices and payment status. | To invoice, collect payment and keep the records tax law requires. | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)). |
| Platform usage data | Features used, settings, error and performance logs, security events. | To run, secure, support and improve the platform. | Legitimate interests (Art. 6(1)(f)). |
| Marketing communications | Business contact details and whether you opened or clicked our emails. | To send product news relevant to your business. | Legitimate interests for customers and business contacts; consent where the law requires it. You can unsubscribe at any time. |
| Job applications | CV, contact details, and the correspondence and notes from your application. | To assess your application and contact you about it. | Steps before a contract (Art. 6(1)(b)); consent (Art. 6(1)(a)) if we keep your CV for future roles. |
| Language selection | Approximate country derived from your IP address on your first visit to an unprefixed page. | To show the website in your language before you choose one, and to remember that choice for a year. This is separate from analytics and does not depend on your cookie choice. | Legitimate interests (Art. 6(1)(f)). |
| AI visibility check | Your work email, the hotel you choose, the guest market you pick and your language; your IP address, used in hashed form to limit abuse; and a security check of your browser by Cloudflare Turnstile. | To run the check, email you the report, subscribe you to our newsletter (the free report requires it), follow up about your results and protect the tool from abuse. | Steps at your request (Art. 6(1)(b)) for the check and the report; consent (Art. 6(1)(a)) for the newsletter, which you can withdraw at any time; legitimate interests (Art. 6(1)(f)) for follow-up and abuse prevention. |
We do not ask for special categories of personal data (such as health data) and ask you not to send them to us.
Automated decisions. We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing.
3. Where the data comes from
- From you, when you fill in a form, book a demo, email us, use the platform or apply for a job.
- Automatically, through our servers and, with your consent, analytics cookies. See our Cookie policy.
- From your organisation, when a hotel adds you as a user of its account.
- From public sources, when you run the AI visibility check: the hotel’s Google listing and its public website.
4. Who we share it with
We do not sell personal data. We share it only as needed:
- Service providers that host, secure and operate our website and platform, send email, and handle messaging, under contracts that bind them to confidentiality and data protection. The providers that process customer data are listed on our Sub-processors page.
- Professional advisers, such as accountants, auditors and lawyers, bound by confidentiality.
- Authorities, when the law requires it or to establish, exercise or defend legal claims.
- A buyer or successor, if askHermis is involved in a merger, acquisition or sale of assets, under equivalent protections.
5. International transfers
Our platform is hosted in the European Union. Some of our service providers are based outside the European Economic Area, mainly in the United States. Where personal data is transferred outside the EEA, we rely on a European Commission adequacy decision (including the EU–US Data Privacy Framework, where the recipient is certified) or on the European Commission’s Standard Contractual Clauses, with additional safeguards where needed.
6. How long we keep it
- Contact and demo requests: for as long as needed to handle your request and any follow-up, then deleted or anonymised if no business relationship follows.
- Customer account and usage data: for the duration of the contract, then deleted or anonymised, except what we must keep by law.
- Billing records: for the period Greek tax and accounting law requires.
- Analytics data: for no more than 14 months.
- Job applications: for the recruitment process, and longer only with your consent.
- Marketing lists: until you unsubscribe or object.
- AI visibility check: the report and the address it was sent to, for as long as needed to provide the report and follow up, then deleted or anonymised; the newsletter subscription until you unsubscribe.
We may keep data for longer where it is needed to establish, exercise or defend legal claims.
7. How we protect it
Data is hosted in the EU, encrypted at rest (AES-256) and in transit (TLS 1.3), and access is limited to people who need it for their work. Our platform runs on SOC 2 compliant infrastructure providers, and we are working towards ISO/IEC 27001 and ISO/IEC 27701 certification. More on our Security & trust page.
No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will notify the competent authority and, where required, you.
8. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you and receive a copy.
- Rectify data that is inaccurate or incomplete.
- Erase your data where there is no longer a reason to keep it.
- Restrict how we use your data in certain cases.
- Receive your data in a portable format and have it sent to another company.
- Object to processing based on our legitimate interests, and to direct marketing at any time.
- Withdraw consent at any time, without affecting processing that took place before.
To exercise any of these rights, email team@askhermis.com. We may ask you to confirm your identity. We reply within one month, which can be extended by two further months for complex requests; we will tell you if that happens.
You also have the right to lodge a complaint with a supervisory authority. In Greece, this is the Hellenic Data Protection Authority, Kifisias 1-3, 115 23 Athens (www.dpa.gr). You can also complain to the authority where you live or work.
9. Children
Our website and platform are meant for businesses and are not directed at children. We do not knowingly collect children’s personal data as a controller. If you believe a child has sent us personal data, please contact us and we will delete it.
10. Changes to this policy
We will update this policy when our practices or the law change. The date at the top shows the latest version. If a change is material, we will tell customers by email or in the platform before it takes effect.