ΕΛ Apply
Legal

Privacy Policy

How we collect, use and protect your data — fully aligned with the General Data Protection Regulation (GDPR – EU 2016/679).

Last updated: January 2026

1. Introduction & Data Controller

1.1. Capify (the “Company” or “we”) respects your privacy and is committed to protecting the personal data it collects and processes, in accordance with the General Data Protection Regulation (GDPR – EU 2016/679) and applicable national law.

1.2. This Privacy Policy (the “Policy”) explains what data we collect, why and on what legal basis, who we share it with, how long we keep it and what rights you have.

1.3. The data controller is Capify. For questions about the processing of your data, you can contact us at sales@capify.gr.

2. What Data We Collect

2.1. Data you provide: when you apply or contact us, we collect the business name, website or e-shop, sales platform, industry, years in operation, monthly revenue, desired funding amount, contact name, email, phone and any comments.

2.2. Data from your Platforms: through an encrypted, read-only connection we collect sales and transaction data from your e-shop (e.g. Shopify, WooCommerce, Amazon) and your business bank account. We never move or hold your funds.

2.3. Technical data: IP address, device and browser type, pages visited, and the date and time of your visit, for operational and security purposes.

2.4. We do not collect special categories of data (Article 9 GDPR) and we do not require personal guarantees or property records.

3. Purpose & Legal Basis of Processing

  • Assessment and provision of funding: performance of a contract or steps taken prior to entering into a contract (Article 6(1)(b) GDPR).
  • Legal obligations: bookkeeping, tax and other regulatory compliance (Article 6(1)(c) GDPR).
  • Legitimate interest: Website security, fraud prevention and service improvement (Article 6(1)(f) GDPR).
  • Consent: optional communications or newsletter, where you request them (Article 6(1)(a) GDPR).

4. Sharing with Third Parties

4.1. We do not sell your data and we do not share it with third parties for marketing purposes.

4.2. We may share data with: (a) technology service providers processing data on our behalf (processors — e.g. hosting, platform connection providers), (b) banking or financial institutions supporting the disbursement, (c) auditors or legal advisers, (d) competent authorities where required by law.

4.3. Every processor operates under a written agreement that binds them to protect and retain data in accordance with the GDPR.

5. Data Retention

5.1. We keep your data for as long as necessary for the purpose of processing and for Capify's legal obligations.

  • Applications not leading to an agreement: basic details are kept for up to 12 months after the assessment is finalised.
  • Funding agreements: details are kept for up to 10 years after full repayment, for accounting and legal obligations.
  • Technical data (logs): up to 12 months.
  • Communication and requests: up to 24 months after the last contact.

5.2. Once the retention period expires, the data is securely deleted or anonymised.

6. Cookies

6.1. The Website uses cookies and similar technologies. We distinguish:

  • Strictly necessary: for the Website's operation (e.g. security, language preference) — no consent required.
  • Analytics: anonymous traffic measurement — used only with your consent.
  • Marketing: measuring advertising performance — used only with your consent.

6.2. You can manage your preferences from the cookie notice shown on your first visit or from your browser settings.

7. Security

7.1. We apply technical and organisational security measures, including TLS 256-bit encryption for data transfer, access controls and periodic security reviews.

7.2. The connection to your Platforms is read-only and does not give us the ability to move or hold funds.

8. Your Rights

8.1. Under the GDPR, you have the following rights:

  • Access (Article 15) — to know what data we process about you.
  • Rectification (Article 16) — to request the correction of inaccurate data.
  • Erasure (Article 17) — to request deletion of your data, where there is no legal retention obligation.
  • Restriction of processing (Article 18).
  • Data portability (Article 20) — to receive your data in a structured, commonly used and machine-readable format.
  • Objection (Article 21) — to object to processing based on legitimate interest.
  • Withdrawal of consent — at any time, without affecting the lawfulness of processing carried out beforehand.

8.2. To exercise your rights, email sales@capify.gr. We respond within 30 days.

8.3. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr) or, for users in Cyprus, the Office of the Commissioner for Personal Data Protection (www.dataprotection.gov.cy).

9. Mandatory & Optional Data

9.1. In a funding application, business details, contact name, email and phone are mandatory — without them we cannot assess the application or contact you.

9.2. VAT number and comments are optional.

10. International Transfers

10.1. Capify operates within the EU. Where a service provider is located outside the EU, we apply standard contractual clauses or other GDPR-compliant transfer safeguards.

11. Minors

11.1. Capify's services are addressed exclusively to businesses and adults. We do not knowingly collect data from minors.

12. Changes to this Policy

12.1. This Policy may be updated from time to time. The “Last updated” date is refreshed on every change, and material changes are announced on the Website.

13. Contact

13.1. For questions, requests or complaints about the processing of your data: