Privacy policy

The controller is Vres Pet Sitter (vrespetsitter.gr). For anything about your data, write to us through the contact form.

• Account: email, first and last name, mobile, how you want your name shown, photo (optional), language, links to Google or Apple if you use them (and what they share: name, email, photo).
• Sign-ins: the devices where you're signed in (app or browser type), so you can see them and sign them out.
• Pets: name, species, and whatever you choose to add (photo, health, feeding, vet, emergency contact). The sitters you send a request to see its photo, age, sex and temperament.
• Your home: area, address and access notes. A sitter sees the address only once a booking there is confirmed.
• The Find A Pet badge: whether our team has given it to you (because your pet came from findapet.gr) and when. We use it to work out your lower service fee (performance of the contract), and sitters you send a request to can see it.
• Your badge on Find A Pet (sitters): only if you ask for it with one click, we send Find A Pet, our partner, a code that identifies you only there, your level, your number of reviews and dates, so that the "Pet sitter on Vres Pet Sitter" badge shows there (consent). We renew them automatically until you stop it; if you stop it, lose the level or close your account, we tell them and the badge is removed.
• Sitters: the public profile (display name, photo, description, area, experience and skills, which pets you take, services, prices, availability).
• Sitter application: date of birth, Greek tax number (stored encrypted), an emergency contact and your declarations. They never appear on your profile.
• Sitter tax details (DAC7): full name or company name, home or registered address, IBAN and account holder, and for a business its tax number and registry (GEMI) number (all stored encrypted), plus the amounts of your completed bookings per quarter.
• Bookings, messages, updates and photos from a booking, reviews, reports and support requests.
• Position at check-in or check-out (optional): if the sitter chooses to share it, we record their device's position at the moment of the update, rounded to about 10 metres, with its accuracy and time and its distance from the centre of the municipality where the care happens. Only the two people on the booking see it; it is never shown publicly or sent to third parties, and the device always asks for your permission.
• Pin for your home (optional): if you place one on the map, we store its position rounded to about 10 metres, only to work out how far from home a check-in was. Only you see it; others see at most the distance, never the point. You can also drop a pin for the place where care happens in one booking (for example in another area): it is deleted 30 days after the booking ends. Pins are deleted when you remove them, when you change area, and with your account. The other person sees only a rough distance band (for example "less than 50 m"), never metres.
• Waiting list (while the site isn't open to everyone): email, first name, what you're interested in, optionally your area, the language, and when and to what wording you agreed. If you confirm your email, we create an account without a password.
• Identity documents: a photo of an ID document, a short selfie video and a proof of residence (its kind and issue date, with your name and address), where the platform asks for them: from sitters and from home-stay exchange members who apply (the "ID check" page shows what applies to you). See the "Identity documents" section.
• Linked accounts (optional): your username and profile link on another platform (for example Instagram or Facebook), a confirmation code (on WhatsApp, the code you send from your account's mobile; we keep only the code, not the message), the automated comparison of its name with your account's, and our team's decision. The comparison only helps; a person always makes the decision.
• Home-stay exchange (optional): your ad (texts, photos of the home, area, dates and the animals), your member profile (experience, languages, availability, preferences), applications and their messages, the stay agreement (address, keys, Wi-Fi, vet, emergency contacts, arrival and departure times), references (the name and email of whoever you ask to vouch for you), reviews, and your saved searches with their alerts.
• Notifications: your device's push identifier, if you turn them on in the app.
• Advertising measurement from our server: only if you allow advertising, when you sign up, apply as a sitter, request a booking or write to us, we tell Meta and TikTok it happened, with your email and mobile hashed (they can't be read), your IP address, your browser and their cookies. We keep this for 90 days.
• News and offers by email: if you choose them, when you chose or stopped them, and which emails we sent you. We don't track whether you open them.
• Campaigns: if you've allowed statistics, which of our campaigns brought you here, so that your sign-up, application or booking request is recorded as coming from it. Without consent we only count how many visits each campaign brought, with nothing about you.
• Audio and video calls in Vres Pet Sitter: calls connect directly between the two devices, encrypted, and we never record or store them. To set up the connection, the devices exchange network information through connection servers (which may see the IP address). We keep only that a call happened: who called whom, when, and how it ended.

• To run your account, bookings and messages (performing our contract with you).
• For distinctions (levels and badges): every night we automatically work out, from bookings, reviews, reply times, cancellations and care checks over the last 12 months, which distinctions you have earned. It is profiling for a benefit (order in search, a badge on your profile) on public, measurable criteria (legitimate interest, GDPR Art. 6(1)(f)). It has no legal effect and doesn't limit your access; you can see the detail in your data export, object, or ask for a person to review it through the contact form. A badge our team withdraws comes with the reasons.
• To keep the platform safe: usage limits, hiding contact details in messages, preventing fraud, reviewing reports (our legitimate interest and that of other users).
• To fix faults in the website and the app: we automatically record the error itself (its kind, the page's route without any details, the version) with no personal data, no cookies and no IP address. It stays in our own database and is not sent to anyone else (legitimate interest).
• When something goes wrong on the website and you send us a report (or close the page without sending it, in which case it is sent automatically), we keep the error, your last steps on the site (pages and requests to our servers, with no content and nothing you typed into forms), the version, your browser and, if you wrote one, your description. A description also opens a case that our team handles like any other support request. If you are signed in, we also attach your account and email address, so we can find the fault and answer you; if you are not, we keep nothing that identifies you (our legitimate interest in the site's reliability and security, Art. 6(1)(f) GDPR). Reports stay in our own database and are not sent to anyone else. They are deleted at most 90 days after they were sent and, if you delete your account, they are deleted with it; they appear in the data you download.
• To check sitter applications: that you're 18 or older and that each sitter has one account (our legitimate interest and that of the owners who trust you with their pets). The emergency contact is used only if we can't reach you while you're caring for a pet.
• For our obligations as a platform, such as handling reports of illegal content (legal obligation).
• To report sitters' earnings to the tax authority (legal obligation, GDPR Art. 6(1)(c): Directive (EU) 2021/514 "DAC7" and Greek law 5047/2023). If you are a sitter with completed bookings, your tax details are needed to meet that obligation.
• For the home-stay exchange: to run the ad, application and agreement you asked for (performing our contract with you), and to keep members safe, with the ID check and linked accounts we require before you apply (our legitimate interest and that of the members who host or are hosted by you). Saved-search alerts are something you asked for; each has a link to turn it off with one click.
• To keep people safe when something goes wrong: we keep reports, the messages and bookings they concern, and our case records while a matter is open, and when we learn of something that may be a criminal offence threatening someone's life or safety, we inform the police (legal obligation under the EU Digital Services Act, Art. 18; and our and the people involved's legitimate interest in establishing, exercising or defending legal claims).
• For the ID check, linked accounts, statistics and advertising cookies, campaign measurement, push notifications, and news and offers by email (consent, which you can withdraw at any time: for emails, with one click in any of them or in your account settings).
• For the waiting list (consent, GDPR Art. 6(1)(a)): joining takes two steps. First you fill in the form and we email you a link; only if you open it and press "Confirm" are you on the list and do we create an account without a password. We'll send you one email when we open. You can withdraw at any time: with one click in that email, through the contact form, or by deleting your account.
• Service statistics in aggregate form, where no one can be singled out (legitimate interest). Profile views are counted as a number per day; the IP address is used only briefly so the same visit isn't counted twice, and it isn't stored.

• Other users see what is public (the name you choose to be shown by, your photo, sitter profiles, published reviews) and what a booking with them needs. Your full name and mobile are seen only by the other person in a confirmed booking, until it's over. Of your linked accounts, they see only which platforms were confirmed; only our team sees the username and link.
• In the home-stay exchange: everyone sees an ad (without the address and without a surname), signed-in members see a member card (name, linked platforms, profile, references, reviews), and only the two sides see a stay agreement. The email of whoever you ask for a reference is seen only by us, to send them the link.
• Our team (moderators and administrators), only as far as support and moderation need; their actions are logged.
• Providers who work for us: hosting for the website and database, and sending email; and, only when you use them or they're switched on, Google or Apple for sign-in, the app's push notification service and, when you pay or are paid by card, Stripe; and, only when you open the map on the search page, OpenFreeMap, which serves the map's images and so sees your IP address (it sets no cookies); and, only during a call, Google's public connection (STUN) servers, which see your IP address. Where a provider processes data outside the EEA, the transfer relies on the EU-US Data Privacy Framework or standard contractual clauses.
• Statistics and advertising platforms, only if you allow it: see the Cookie policy.
• Public authorities (the police, prosecutors and courts), only when the law requires it: a lawful order or request, or when we must report a suspected offence that threatens someone's life or safety. We check each request, share only what it needs, and keep a record of it.
• The Independent Authority for Public Revenue (AADE), to which we report each year the sitters' details and what they earned through the platform; AADE shares it with the tax authorities of other EU member states where the Directive requires. We tell you what was reported about you.
• We don't sell personal data.

• What and why: a photo of your ID, a selfie video and a proof of residence, so that owners and members know the person is real and lives where they say, for the safety of animals and homes. Legal basis: our legitimate interest, and that of the other users, in preventing harm and fraud (GDPR Art. 6(1)(f)).
• Archiving: approved documents are archived so that we can establish, exercise or defend legal claims (Art. 6(1)(f) and 17(3)(e)) and answer an authority's request (Art. 6(1)(c)) if something goes wrong. They are used for nothing else.
• Who sees them: while they wait for review, only our team's moderators and administrators, to compare them with the name and address on the account. After the decision, only administrators, stating a reason, and every view is recorded. Other users never see them and we don't give them to third parties, except to public authorities when they lawfully ask.
• Security: they are stored encrypted (AES-256-GCM) and reachable through no public link.
• Your rights: you can ask for a copy or use your other rights through the contact form. A request to erase doesn't apply while the documents must be archived (Art. 17(3)(e)): we tell you so and delete them as soon as the period ends.

• Only when card payment is switched on for a service: Stripe (the payment provider) receives your card details directly from its own form and processes them as an independent controller for the payment, fraud prevention and its legal obligations. We never see or store your card number; for a weekly series paid by card we keep only the reference of the card you saved with Stripe, so it can be charged automatically each week, and delete it 30 days after the series ends (or when your account is deleted); we keep only the transaction's identifiers, the amount, the status, refunds and payouts to the sitter.
• Promo codes: when you use one, we keep which code was used, for which booking, how much it took off our service fee and its status; a code lowers only our service fee. This record is a payment record and we keep it as long as the law requires for accounting records; it holds only identifiers and amounts and, if you delete your account, it is no longer tied to your name.
• Sitters who want to be paid by card connect a payout account with Stripe, which collects directly what the law asks of it (such as ID and IBAN) and tells us only whether the account can receive payments.
• Legal basis: carrying out the booking (Art. 6(1)(b)) and our legal obligations for accounting and tax records (Art. 6(1)(c)). We keep payment records as long as the law requires for accounting records. Stripe may process data outside the EEA under standard contractual clauses or the EU-US Data Privacy Framework.

• If you invite someone or join through an invitation, we keep who invited whom, when, whether the invitation was rewarded and the personal promo codes that resulted. In your list of invitations you see only the first name of the people you invited and whether the invitation led to a reward; the person invited sees the first name of whoever invited them, also on the sign-up page before they finish signing up. We don't show anyone why an invitation doesn't count.
• So that nobody counts themselves or a second account of theirs, we compare the email address, the mobile number and, for sitters, the tax number of the two accounts (that comparison decides whether an invitation counts).
• Through an invitation link we keep a small cookie in your browser for 7 days with the link's code (vres_ref), only so that the invitation can be applied when you finish the sign-up you started; it holds no personal data and we share it with nobody. We delete it once it has been used or if you remove it on the sign-up form.
• Legal basis: carrying out the service and the invitation programme you choose to use (Art. 6(1)(b)) and our legitimate interest in preventing abuse of the programme (point (f)), balanced against your rights; you can object by writing to us.

• Account, pets, bookings, messages and reviews: while your account exists.
• Promo code uses: as long as the other payment records, that is as long as the law requires for accounting records (only identifiers and amounts), even if you delete your account.
• Invitations to friends: as long as both accounts exist; deleted when either one is deleted. Invitations that led to no reward are deleted after 24 months. Promo codes already issued stay with the other account; their uses follow the payment records above.
• When you delete your account, it closes at once: you're signed out everywhere and your profile disappears. Your personal details, profile, photo, your pets' health details and contacts are erased 30 days later, so that anyone you dealt with can still report a safety problem (the law gives us up to one month to act on a request to erase). What the other person needs about your bookings together (the history and messages) stays, without your name.
• Reports, incidents and cases involving you, and what they need (for example the messages concerned and your contact details): while the matter is open, and for as long as a legal claim or a lawful request from an authority requires them. Until then your account can't be erased (GDPR Art. 17(3)(b) and (e)); it stays closed and that data is used for nothing else (Art. 18). We review every case where we keep data for this reason at least once a year, and erase it as soon as it's no longer needed.
• Sitter application details (date of birth, tax number, emergency contact): while your account exists; deleted with it. Exception: if you have completed bookings, your date of birth and tax number stay for the tax report, as in the next line.
• Sitter tax details (DAC7): 10 years after the end of the reporting year they relate to, even if you delete your account (GDPR Art. 17(3)(b)). We keep only what the report needs, encrypted, and delete it right after.
• Home-stay exchange: ads that closed or were removed, with their applications, 24 months after closing (for any dispute or complaint); ones left as drafts, 12 months. The agreement's address, keys, Wi-Fi and emergency details are deleted 30 days after the stay. The email of whoever vouches for you is deleted as soon as they write the reference or the link expires (30 days). Reviews stay on the profile of the person they are about while their account exists. Saved searches stay until you delete them; the history of their alerts, 60 days. All of it is deleted with your account.
• Identity documents that weren't approved: deleted 30 days after you send them, or straight away if you withdraw. Approved ones are archived: we keep them while your account exists and, once they are replaced by newer ones, taken back or the account is deleted, for 5 more years (today; it is the limitation period for torts, Art. 937 of the Civil Code, and the platform's administrators set the period). After that they are deleted automatically, unless a report, an incident or a lawful request about you is still open.
• Linked accounts: while they're linked; if you unlink one, it's deleted at once. Ones that weren't confirmed, 90 days after the decision; ones never finished, 30 days after they were started.
• Booking photos: 90 days after the booking ends (unposted ones after a day).
• Position at check-in or check-out: 30 days after the booking ends (if there is a dispute, until 30 days after its decision), and deleted with the account of whoever sent it.
• A problem raised on a booking (what the two sides write and the photos they attach as evidence): while the matter is open and for 24 months after the decision (for any claim); then it is made anonymous and the photos are deleted. Only the two people and the staff who took the case see the evidence, never the public, and we strip its metadata (for example location). Photos you attach are also deleted with your account, unless a matter is open or a legal hold applies, in which case they stay until it is closed. Photos that were never sent are deleted after a day.
• Call records (who called whom, when, and how it ended): 12 months.
• Sign-in codes and links: 2 days. Sign-ins that ended or were signed out: 30 days.
• Waiting list: if you don't confirm your email, the details are deleted 7 days after we sent you the link (and in any case 60 days after the form). If you confirm, they stay until we've sent you the opening email or you stop, and are deleted 90 days after that; they are also deleted with your account.
• Your cookie choice: 25 months, as proof of consent.
• What we sent Meta and TikTok to measure advertising: 90 days.
• Which news and offers emails we sent you: 25 months; your choice to get them or not stays while your account exists.
• Which campaign you came from: in your browser for 30 days; the record on a sign-up, application or booking stays while your account exists and is unlinked from you when you delete it.

You have the right to access, correct, erase, restrict and port your data, to object, and to withdraw a consent at any time. You can download your data or delete your account yourself; for anything else, write to us through the contact form. You can also complain to the Hellenic Data Protection Authority (www.dpa.gr).

If we can't act on a request, for example erasure while a report about you is open, we tell you why within one month, and you can complain to the Hellenic Data Protection Authority or go to court. The only exception is when the law doesn't allow us to say more, for example so as not to harm a criminal investigation (GDPR Art. 23, Law 4624/2019). We never tell anyone who reported them.

If anything in this policy changes, we'll publish a new version here; earlier versions stay in the page's history.