1. Who is responsible for your data
1.1 CityLoot (the operator identified above) is the data controller for the personal data described in this policy. We process personal data in line with the GDPR (Regulation (EU) 2016/679), Greek Law 4624/2019 and, for cookies and electronic communications, Law 3471/2006.
1.2 This policy covers consumers who use the app, shop owners/representatives who use the business dashboard, and website visitors. For questions or to exercise your rights, contact us at privacy@cityloot.gr .
1.3 A Data Protection Officer (DPO) is not appointed: a DPO is not mandatory for an operation of CityLoot’s size and processing profile (GDPR Art. 37). Our contact point for data matters is the address above.
2. What data we collect
2.1 If you are a consumer
Account data: name/display name, email, optional phone, language, sign-in identifier (Google / Apple / email), profile photo.
Location data: your device’s precise GPS location, used to show nearby Deals and the map — only when you allow it (see Section 4).
Address / area you provide: at first login we ask you to enter your home address or pick your area so we can show the closest Deals and rank shops by distance. You can type an address (with autocomplete suggestions) or share your device location.
Transactions & loyalty: Deals claimed, redemption Codes, in-app payments, Points balance and history, missions and rewards, referrals, favourites, reviews.
If you are a CityLoot Ambassador or Creator: your referral code, the users or sales attributed to you, your commission/earnings records and payout details such as IBAN.
Usage & device data: app interactions, device/browser type, IP address, and similar technical data (see Cookies, Section 12).
Communications: messages you send us, issue reports and support correspondence.
2.2 If you are a shop (or shop representative)
Business & contact data: legal name (επωνυμία), trade name, representative’s name and contact details, address, opening hours.
Financial & tax data: ΑΦΜ/VAT number, IBAN, KYB/identity verification data held with Viva.com, transaction, settlement and fee data, invoices.
2.3 We collect data you give us, data generated as you use CityLoot, and limited data from providers you use to sign in (e.g. Google/Apple confirm your identity).
3. Why we use your data and our lawful bases (GDPR Art. 6)
Provide the service — Examples: Accounts, showing/claiming Deals, issuing Codes, Points, reviews · Lawful basis: Contract (Art. 6(1)(b))
Process payments — Examples: In-app payments and refunds via Viva.com; payouts to shops · Lawful basis: Contract (Art. 6(1)(b))
Show nearby Deals — Examples: Using your location and the map · Lawful basis: Consent (Art. 6(1)(a))
Legal & tax duties — Examples: Invoicing/myDATA, DAC7 reporting to ΑΑΔΕ, accounting, AML/KYB · Lawful basis: Legal obligation (Art. 6(1)(c))
Keep CityLoot safe — Examples: Fraud prevention, abuse detection, security, analytics · Lawful basis: Legitimate interests (Art. 6(1)(f))
Marketing (optional) — Examples: Offers/newsletters where you opt in · Lawful basis: Consent (Art. 6(1)(a))
4. Location data
4.1 Precise location is used to show Deals near you and to power the map. We ask for your permission first, and you can turn location off at any time in your device settings — CityLoot still works, but “ near me ” features will be limited.
4.1a At first login we also ask you to provide your home address or area. This declared location is stored on your profile and used to show nearby Deals and to rank shops by distance, even if you do not enable device GPS. You can change or remove it at any time from your account settings.
4.2 Location data is processed on the basis of your consent and in line with Article 6 of Law 3471/2006 on privacy in electronic communications. We do not sell your location and do not use it to track you outside the purpose of showing nearby Deals.
5. Shop financial data
5.1 We use shop financial data (ΑΦΜ, IBAN, settlement and fee data) to operate payments through Viva.com, to invoice, to pay out, and to meet tax-reporting duties (Section 8). Sensitive payment identifiers and precise location are access-restricted and masked even from CityLoot administrators in the admin panel.
6. Who we share data with
6.1 We do not sell your personal data. We share it only with service providers (processors) who act on our instructions, and with authorities where the law requires.
Viva.com (Viva Payments) — Purpose: Payments, KYB, settlement, payouts · Location / transfer: EU (Greece)
Supabase — Purpose: Database, authentication, storage · Location / transfer: EU — Germany (Frankfurt, AWS eu-central-1) ; Supabase Inc. (US) — DPA + SCCs
Vercel — Purpose: App hosting / delivery · Location / transfer: EU edge + US (Vercel Inc.) — SCCs
Vercel Web Analytics — Purpose: Aggregate, cookieless usage measurement (no consent required) · Location / transfer: US (Vercel Inc.) — SCCs
Upstash — Purpose: Rate-limiting / abuse prevention (Redis; processes IP transiently) · Location / transfer: EU region (Upstash Inc., US parent) — DPA + SCCs
Sentry — Purpose: Error monitoring / diagnostics (may include IP, user ID, request data) · Location / transfer: EU data residency — Germany (Functional Software Inc., US parent) — DPA + SCCs
Resend — Purpose: Transactional email · Location / transfer: US (Resend Inc.) — SCCs
Google (Sign-in / Places) — Purpose: Sign in with Google; optional shop rating data · Location / transfer: EU/US (Google Ireland/LLC) — SCCs
Google Fonts (self-hosted) — Purpose: Web fonts are bundled at build time and served from cityloot.gr; no request or IP is sent to Google when you use the app · Location / transfer: No transfer
Apple — Purpose: Sign in with Apple · Location / transfer: EU/US (Apple Ireland/Inc.) — SCCs
OpenFreeMap (map tiles) — Purpose: Map display (browser fetches tiles) · Location / transfer: EU host
DeepL — Purpose: Automated EL→EN translation of offer content · Location / transfer: EU — Germany (DeepL SE)
Cloudflare (Turnstile) — Purpose: Bot / abuse protection on sign-in · Location / transfer: US (Cloudflare Inc.) — SCCs
Telegram — Purpose: Internal operational alerts to CityLoot staff · Location / transfer: Telegram FZ-LLC — alerts kept free of personal data, or disclosed as recipient
ΑΑΔΕ (tax authority) — Purpose: DAC7 / tax reporting (shops) · Location / transfer: Greece
Expo (mobile app) — Purpose: Delivery of mobile push notifications (device push token) · Location / transfer: US (650 Industries, Inc.) — SCCs
Komoot Photon — Purpose: Address autocomplete when you type your area (query text, IP) · Location / transfer: EU — Germany (komoot GmbH)
6.2 Where a provider processes data outside the EEA, we rely on an adequacy decision or appropriate safeguards such as the European Commission’s Standard Contractual Clauses (GDPR Arts. 44–49). If CityLoot changes the map-tile provider by configuration (e.g. to MapTiler, Switzerland — an adequacy country), that provider is added to the table above.
7. How long we keep data
7.1 We keep personal data only as long as needed for the purposes above. Account data is kept while your account is active and for a reasonable period afterwards. Transaction, invoicing and tax records are kept for the period required by Greek tax law (generally 5 years, and up to 10 where audits or disputes require ). Location data is kept only as needed to provide the feature. (periods aligned with Greek tax-record rules; kept under review with our accountant).
7.2 When you delete your account, we delete or anonymise your data except where we must keep it by law (e.g. tax/accounting) or to resolve disputes and enforce our terms.
8. Tax reporting (DAC7)
8.1 As a digital platform, CityLoot must report certain shop (seller) information and earnings to the Greek tax authority (ΑΑΔΕ) each year under the EU DAC7 rules (Council Directive (EU) 2021/514, transposed into Greek law Law 5047/2023). This is a legal obligation (GDPR Art. 6(1)(c)).
9. Your rights
Under the GDPR you have the right to:
access your data and get a copy;
correct inaccurate data;
erase your data ( “ right to be forgotten ” ), where applicable;
restrict or object to certain processing;
data portability;
withdraw consent at any time (e.g. location, marketing) without affecting prior processing.
9.1 To exercise any right, contact privacy@cityloot.gr . We respond within one month (extendable as the GDPR allows). You can also use the in-app account and privacy controls.
9.2 You have the right to complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), 1–3 Kifisias Ave., 115 23 Athens, www.dpa.gr (established under Law 4624/2019 and P.D. 30/2024).
10. Automated decisions and ranking
10.1 We do not make decisions that produce legal or similarly significant effects about you by solely automated means. The order of Deals you see is determined mainly by distance / proximity, relevance and recency, and by paid placement (boosts), which is identified as such and does not override the distance-based order. (For business users, ranking transparency is also addressed under Regulation (EU) 2019/1150.)
11. Security and children
11.1 We use technical and organisational measures to protect data, including encryption in transit, access controls and database row-level security. No system is perfectly secure, but we work to keep your data safe.
11.2 CityLoot is not intended for children under 15. Where consent is the basis for an information-society service offered to a child, the minimum age is 15 under Article 21 of Law 4624/2019 (Article 8 GDPR). A 15+ confirmation is collected at sign-up.
12. Cookies and similar technologies
12.1 We use cookies and similar technologies (including local storage in the app/PWA). Cookies that are not strictly necessary are used only with your consent, which we request through a cookie banner in line with Article 4(5) of Law 3471/2006 and the Hellenic DPA’s guidance on cookies (Guidelines 1/2020). You can change your choices at any time in “ Settings ” .
Strictly necessary — Purpose: Sign-in/session, security, basic functionality · Consent?: Not required · Duration: Session / short
Functional — Purpose: Remember language and location preference · Consent?: Consent · Duration: 12 months
Analytics — Purpose: Understand usage to improve CityLoot · Consent?: Consent · Duration: 12 months
Marketing — Purpose: Measure campaigns (if used) · Consent?: Consent · Duration: 12 months
12.2 Cookies and storage currently in use: Supabase authentication cookies (strictly necessary; session), the cl_lang language preference (functional; 12 months), and an internal preview cookie used only by CityLoot staff (strictly necessary; ~30 days). Vercel Web Analytics is cookieless and loads only after you accept analytics in the banner. We use no third-party advertising cookies.
13. Changes to this policy
13.1 We may update this policy. We will post the new version with an updated date and, for material changes, notify you in the app or by email.
14. How to contact us
Data controller: Soufiane Salim Saed Alarifi, trading as CityLoot, Praxitelous 150, 18535 Piraeus, Attica, Greece. Email: privacy@cityloot.gr .
Legal basis and sources
Prepared on the basis of CityLoot internal documentation and the following instruments:
GDPR — Regulation (EU) 2016/679 .
Law 4624/2019 (ΦΕΚ Α΄137) — GDPR implementation & Hellenic DPA ; P.D. 30/2024 (ΦΕΚ Α΄89) — DPA organisation .
Law 3471/2006 (ΦΕΚ Α΄133) — privacy in electronic communications / cookies ; Hellenic DPA Guidelines 1/2020 on cookies.
DAC7 — Council Directive (EU) 2021/514 (Greek transposition Law 5047/2023).