Last updated: 26 August 2026
This policy explains what L&AS VENTURES SINGLE MEMBER PRIVATE COMPANY ("we"), Zeppou 33, 16675 Glyfada, Greece, AFM 802718607, does with personal data in connection with Build my reviews.
When we are the controller. For the people who subscribe to and use the dashboard — Merchants, their team members, and visitors to buildmyreviews.app — we decide why and how data is processed.
When we are the processor. For the customers of a Merchant who use a Player Page — the Players — the Merchant is the controller and we act on their instructions. If you are a Player and want your data corrected or deleted, you can ask us directly (see section 8) and we will act, and you may also contact the business whose QR code you scanned.
| Data | Why | Legal basis |
|---|---|---|
| Name, e-mail, workspace and listing details | To create and run your account | Performance of a contract |
| Sign-in tokens and session cookies | To keep you logged in securely | Performance of a contract |
| Billing details, VAT number, invoices | To sell you a subscription and meet accounting law | Contract and legal obligation |
| Support messages | To answer you | Legitimate interest |
| Product usage, error reports | To keep the Service working and improve it | Legitimate interest |
| Marketing e-mails about the product | To tell you about the Service | Consent, withdrawable in one click |
Payment card details never reach us. They are handled by Paddle.com Market Ltd, our reseller and Merchant of Record.
| Data | Why | Legal basis (controller = the Merchant) |
|---|---|---|
| Name, e-mail, profile picture from Google sign-in, or e-mail alone | To create the player account and send the prize | Performance of a contract with the Player |
| Consents given, with timestamp and text version | To prove consent was given | Legal obligation |
| Spins, prizes won, prize codes, redemption status | To run the game and let staff validate a prize | Contract |
| Events: scan, sign-in, spin, review-link click, time away from the page, skip | To produce the Merchant's reports and prevent abuse | Legitimate interest of the Merchant |
| A one-way hash of device and network characteristics | To stop the same person spinning repeatedly | Legitimate interest of the Merchant |
| Optional private feedback and rating | To pass the Player's message to the team | Consent |
| Marketing e-mails from the Merchant | To invite the Player back | Consent, withdrawable in one click |
What we never do. We do not read, write or publish reviews on anyone's behalf. We cannot tell whether a Player actually posted a review — no review platform provides that information — and we never ask a Player for the text of a review or for proof that one was left. We do not sell personal data. We do not use Player data to build profiles across different Merchants.
Once a day we ask the Google Places API for the public rating and review count of each Listing, so the Merchant can see how their profile is changing. This is public information about a business, not personal data about any reviewer.
The website uses a consent banner. Strictly necessary cookies (session, security, load balancing) are set without consent because the Service cannot work without them. Analytics is privacy-friendly and aggregated. Player Pages set only the cookies needed to keep the Player signed in and to remember that the wheel has been used.
| Sub-processor | Purpose | Location |
|---|---|---|
| Cloudflare, Inc. | Hosting, database, CDN, security | EU / global, SCCs |
| Paddle.com Market Ltd | Payments, invoicing, VAT | United Kingdom, adequacy decision |
| Brevo (Sendinblue SAS) | Transactional and marketing e-mail | France (EU) |
| Google Ireland Ltd | Sign-in, public place data | EU / US, SCCs |
| Functional Software, Inc. (Sentry) | Error monitoring | US, SCCs |
| Plausible Insights OÜ | Website analytics | Estonia (EU) |
| SiteGround Spain S.L. | Marketing website hosting | EU |
The current list is published at buildmyreviews.app/legal/subprocessors. We give 30 days' notice before adding a new one.
Data is stored in the European Union wherever the provider offers it. Where a provider processes data outside the EEA we rely on an adequacy decision or on the European Commission's Standard Contractual Clauses together with additional safeguards.
| Data | Kept for |
|---|---|
| Merchant account | While the account exists, then 30 days |
| Invoices and accounting records | 5 years, as Greek law requires |
| Player accounts and prizes | While the Merchant's workspace exists, or until deletion is requested |
| Event logs | 13 months |
| Private feedback | 24 months |
| Support messages | 24 months |
| Backups | 30 days, then overwritten |
You can ask for access, correction, deletion, restriction, portability, and you can object to processing based on legitimate interest. Where processing is based on consent you can withdraw it at any time without affecting what was done before. Write to support@buildmyreviews.app and we answer within 30 days. Merchants can export and delete Player data themselves from the dashboard, and Players can delete their own account and prizes from the account page linked in every e-mail we send them.
You can complain to the Hellenic Data Protection Authority (dpa.gr) or to the authority in your own country.
Encryption in transit and at rest, sessions signed and short-lived, secrets held in a managed vault, least-privilege access, nightly backups with a rehearsed restore, error monitoring, and rate limiting on sign-in and gameplay. No system is perfectly secure; we will notify you and the competent authority of a breach within the timeframes the GDPR requires.
The Service is not directed at children. Merchants must not run prize games aimed at minors. If you believe a child has created a Player account, write to us and we will delete it.
We will post any update here and, if it is material, tell Merchants by e-mail before it takes effect.
Contact: support@buildmyreviews.app — L&AS Ventures, Zeppou 33, 16675 Glyfada, Greece.