Kronn ERP Privacy Policy

01Who we are and what this covers

Kronn ERP is provided by “ΜΑΡΗΣ ΚΩΝΣΤΑΝΤΙΝΟΣ ΟΔΥΣΣΕΑΣ” (Konstantinos Odysseas Maris), a sole proprietorship trading as “Kronn” (VAT no. EL176307607, G.E.MI. no. 196859503000) (“Kronn”, “we”). Contact for data matters: hello@kronn.gr, +30 693 487 1363.

This policy covers the app at erp.kronn.gr, its API (api.kronn.gr) and the emails it sends. We have not appointed a Data Protection Officer (DPO); write to the address above about anything.

02Two roles: controller and processor

For your account details — the users and the business as our customer — we are the controller.

For the data your business enters or brings into the app (clients, documents, expense documents and their files, bank transactions, appointments, drivers, shipments, documents for signature) your business is the controller and we are its processor (Art. 28 GDPR), as set out in the Kronn ERP Terms of Service.

If you are a client or partner of a business that uses Kronn ERP and want to exercise your rights, contact that business. If you come to us, we will pass your request on.

03Data we process as controller

The app keeps your IP address in memory only, for attempt limits (e.g. 20 sign-ins per 5 minutes); it does not store a sign-in history. The Cloudflare network and the web server keep technical logs for security and fault finding.

We send no marketing emails or newsletters, sell no data, build no profiles and make no automated decisions with legal effects. The service sends data to an artificial-intelligence provider only for scanning expense documents, when your business uses it, as described under “AI scanning of expense documents”.

04Data we process on behalf of your business

Depending on the features you use:

• Clients and partners: legal or full name, VAT number, tax office, activity, address, country, email, phone, contact person, notes.
• Documents, collections and payments: items, amounts, VAT, the client’s details as they were at issue, the AADE MARK and UID, the request to the provider and its response, the PDF file.
• Bank transactions: date, amount, currency, counterparty name and IBAN, description and the transaction details as the bank provides them, with card and phone numbers masked.
• Suppliers and expense documents: supplier details, their documents (amounts, VAT, item lines), the files (PDFs or photos) you upload or forward by email, the email’s sender and subject, and the details read from the files.
• Payments through Stripe, if you connect your business’s Stripe account: amount, products, currency and, where present, the payer’s name, email and VAT number.
• Industry packs: staff (name, email, phone, licence expiry); appointments (date, time, doctor, contact details for the reminder); rentals (driver: name, licence number and expiry, phone, ID number, date of birth); shipments (recipient name, address and phone); vehicle plates.
• Emails to your clients: recipient, subject and delivery status.
• Documents for signature, if you use Contracts: the templates and documents, the signers’ details and the signing record, as described under “Electronic signatures”.

The app is not designed for special categories of data (Art. 9 GDPR) such as health data. Do not enter medical information in notes or free-text fields.

We process this data only to provide the service and on your instructions; we do not use it for our own purposes.

05AI scanning of expense documents

If your business uses AI scanning of documents, the files of the expense documents you upload or forward by email are read by an artificial-intelligence model so that their details are filled in automatically. Without active scanning, no file is sent to an AI provider.

• Providers: Anthropic (Anthropic Ireland, Limited and Anthropic, PBC; Claude models), OpenAI (GPT models) or Google (Gemini API). One of them is used for each business, chosen by Kronn. Access is through their business APIs, not their consumer apps.
• What is sent: the document’s file (up to the first 5 pages of a PDF; a photo at reduced resolution and without metadata) and your business’s name, VAT number and expense categories, so that it can be checked that the document is addressed to it. No other data from the app.
• Purpose: only reading the document and returning its details to Kronn ERP. The result is a proposal that a user reviews. The only step taken without review is linking the file to its matching myDATA document, when MARK, issuer and total agree.
• Retention: under their API terms, the providers do not use the data to train their models and keep it only for a limited period, to detect abuse, before deleting it. The file and the details read are kept in Kronn ERP like any other data of your business.
• Transfers: the providers are based in the United States. The transfer relies on the European Commission’s standard contractual clauses, included in their data processing terms.
• Roles: for these files your business is the controller, Kronn the processor and the AI provider a sub-processor (Art. 28(4) GDPR).

Expense documents mostly contain business details, but they may also contain the names of individuals, such as sole traders or employees. Do not send documents with special categories of data, such as medical reports, for scanning.

06Electronic signatures

When a document is signed through Kronn ERP — a contract a business sends with the “Contracts & e-signatures” add-on, or a business’s own contract with Kronn — the signer opens a personal link from an email, confirms their address with a 6-digit code, types their full name and draws their signature.

• What is recorded: the signer’s full name and email, IP address, device and browser, the time of each step (opening, code sent and confirmed, viewing, signing or declining), the signature image and the fingerprint (SHA-256) of the document viewed. The link and the code are stored only as hashes, and the code expires quickly.
• Roles: for documents a business sends, that business is the controller and Kronn its processor; for its customers’ contracts with Kronn itself, Kronn is the controller.
• Sealing: the signed PDF carries Kronn’s electronic seal (PAdES), a timestamp and an audit page with the signing details. The timestamp authority receives only the document’s fingerprint, no personal data. The signer and the sender receive the sealed PDF by email.
• Retention: the signed PDF and its signing record are kept locked so that the signature can be proven. The lock lasts one year and is renewed each year while we provide the Service, up to 10 years from the completion of the signature; while it lasts they cannot be altered or deleted, not even by us, so a request for erasure cannot be met (Art. 17(3)(e) GDPR). If we stop providing the Service, the lock is no longer renewed and they are deleted once it ends, at the latest one year after the last renewal. Documents that were not signed follow the business’s other data.
• Verification: anyone who has the PDF can check that it has not been altered on Kronn’s verification page (erp.kronn.gr/verify); the fingerprint is computed in the browser and the file is not uploaded.

07Demo mode

After sign-up your business starts in demo mode. Documents get a test MARK and are not sent to the provider or to AADE. Emails you send reach only you, marked “[ΔΟΚΙΜΗ]” (test), and automatic emails are not sent. Banking uses a demo bank or a file import.

When a plan is activated, demo documents, payments, collections, bank connections and samples are deleted automatically.

08Who receives data

We use no analytics, no third-party error tracking and no advertising networks.

Authorised Kronn staff can view your business’s account with owner permissions only when needed: to activate your plan, for support you asked for, or to resolve a fault or security issue. At your request they can also reset two-step sign-in or issue a temporary password. They are bound by confidentiality.

Data may be disclosed to public authorities only where the law requires it.

09Transfers outside the EEA

The database and files are stored in Germany and the encrypted backups in Finland (EU). Synci is based in Norway (EEA) and stores data in the EU. Cloudflare, Resend, Google, Stripe, Anthropic and OpenAI are based or operate in the United States. Where data is transferred outside the EEA, the transfer relies on the safeguards of Chapter V GDPR: the adequacy decision for the EU-U.S. Data Privacy Framework, for providers certified under it, or the European Commission’s standard contractual clauses.

10Cookies and browser storage

The app sets no cookies. It uses the browser’s local storage only for what it needs to work:

These are strictly necessary for the service you request, so no consent is needed (Art. 4(5) of Greek Law 3471/2006). If you use Sign in with Google, Google may use its own cookies under its own policy. The payment page loads Stripe.js, which may set its own cookies for payment security and fraud prevention, under Stripe’s policy.

11Emails the service sends

All emails are sent through Resend. To users we send only account and service emails, from support.kronn.gr addresses: email confirmation, password reset, invitations, security and two-step sign-in notices, purchases, plan activation and renewal reminders.

On behalf of your business we send its clients and partners, from notifications@invoices.kronn.gr, what it chooses: documents, quotes, rental agreements, delivery notes, statements, appointment reminders, automated reports, and documents for signature with their confirmation codes and sealed copies. They show your business’s name, and replies go to the address it has set.

Emails contain no open or click tracking. Each document opens from a signed link that does not expire: anyone who has the link can see the PDF. Automated-report links are valid for 90 days.

12How long we keep data

• Account and business data: for as long as the account is active.
• After the contract ends: 90 days for you to export your data, then deletion within 30 days. Encrypted backups are erased in their normal cycle, at the latest 13 months after deletion, and are not used for anything else until then.
• Signed documents and their signing record: locked one year at a time, renewed while we provide the Service, up to 10 years from signing, as described under “Electronic signatures”; this continues after the contract ends.
• Demo accounts with no activity for 12 months: may be deleted after we notify you by email 30 days in advance. Demo data is deleted automatically when a plan is activated.
• Links: email confirmation 7 days, password reset 60 minutes and single use, invitation 7 days, automated reports 90 days.
• Our own invoices to you for your plan: as long as tax law requires.
• Technical logs: for a short period, as needed for security and fault finding.

The duty to keep your documents and books rests with your business. Before closing your account, download your documents as PDF, the accountant pack and your reports. The provider keeps the documents it transmitted as the rules for e-invoicing providers require.

13Security

• The app runs over an encrypted connection (HTTPS).
• Passwords are stored only as Argon2id hashes and recovery codes as SHA-256 hashes.
• Optional two-step sign-in with a code (TOTP) or a passkey, with recovery codes, and an email notice whenever it changes.
• Two-step sign-in keys and bank connection credentials are stored encrypted.
• Your business’s provider key is not stored in Kronn ERP; a separate key-management service holds it. We never ask for or keep your TAXISnet credentials.
• Daily encrypted backups in a separate data centre, protected from deletion or alteration for at least 30 days.
• For electronic signatures, the seal’s key is held by a separate internal service that signs only document fingerprints.
• Document PDFs are kept in private storage and open only through a signed link.
• Limits on the number of requests per user and per IP address, stricter for sign-in, sign-up, password reset, one-time codes and sending email.
• Owner, accountant and employee roles, with permissions set by the owner.

If a personal data breach occurs, we notify the Hellenic Data Protection Authority and you as Articles 33 and 34 GDPR require. For data we process on behalf of your business, we notify the business as the Terms set out.

14Your rights

You have the right of access, rectification, erasure, restriction, portability and objection (Arts. 15–21 GDPR). You can correct most details yourself in Settings. For anything else, a full export of your data or account deletion, write to hello@kronn.gr from your account email; we reply within one month. A business account’s deletion is requested by its owner.

Deletion does not cover what the law requires us to keep. Documents already transmitted to AADE cannot be deleted from myDATA.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (1-3 Kifisias Ave., 115 23 Athens, www.dpa.gr).

15Minors and changes

Kronn ERP is for businesses and professionals, not for minors.

When we change this policy, we publish the new version here with a new date. For material changes or new sub-processors we notify you by email at least 15 days in advance.