Privacy Policy

Last updated: 30 June 2026 · Effective: 30 June 2026

Superbo Ltd (“Superbo”, “we”, “us”, “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share and safeguard your information when you visit our website and use its features — including our AI-powered chat assistant (“Biz Expert”) — and describes your rights under the EU General Data Protection Regulation (GDPR) and applicable data-protection law.

1. Data Controller and Contact

Controller: Superbo Ltd Address: 145 Queen’s Road East, Wan Chai, Hong Kong Email: [email protected] Phone: +30 693 709 3160

We have appointed a Data Protection Officer (DPO) for matters relating to the processing of your personal data. You can contact the DPO at [email protected].

2. What Data We Collect

Information you provide directly:

  • Your name, email address, and any other information you choose to share when you contact us or fill in a form.
  • The content of messages you type into our AI chat assistant (Biz Expert).

Information collected automatically:

  • Technical data such as your IP address, device type, browser type, the pages you visit, and the date and time of your visit.
  • For the chat assistant: a randomly generated session identifier and a pseudonymised (hashed) form of your IP address used to enforce usage limits and prevent abuse.

Please do not enter sensitive personal data (such as health, financial, or other confidential information) into the chat assistant.

3. Our AI Chat Assistant ("Biz Expert")

Our website offers an AI-powered chat assistant. When you use it, we process the messages you type, your IP address (used in hashed form to enforce rate limits and prevent abuse), and a session identifier.

  • Logging and review: Conversations are logged and may be reviewed by our staff to monitor quality and security, prevent abuse, and improve the service.
  • Automated decision-making: The assistant generates responses automatically, but it makes no decisions that produce legal or similarly significant effects about you. Article 22 GDPR does not apply.
  • Accuracy: AI-generated responses may be incomplete or inaccurate and do not constitute professional, legal, financial, or other advice. Do not rely on them as such.

4. How and Why We Use Your Data (Legal Bases)

We process your personal data on the following legal bases:

Purpose

  • Responding to your queries and providing the chat assistant
  • Performing a contract with you, where applicable
  • Promotional communications
  • Security verification (anti-bot) on the chat assistant
  • Complying with our legal obligations

Legal basis (GDPR Art. 6)

  • Legitimate interests (Art. 6(1)(f)) — operating, securing and improving our services
  • Contract performance (Art. 6(1)(b))
  • Legitimate interests, or your consent where required (Art. 6(1)(a)/(f))
  • Your consent and/or legitimate interest in security
  • Legal obligation (Art. 6(1)(c))

Where we rely on consent, you may withdraw it at any time without affecting prior processing.

5. Service Providers (Sub-processors) and International Transfers

To operate the chat assistant we share the data described above with the following processors, each engaged under a data-processing agreement:

  • Anthropic, PBC (USA) — generates the assistant's responses.
  • OpenAI (USA) — generates the text embeddings used to retrieve relevant content.
  • Cloudflare, Inc. (USA) — provides bot and abuse protection ("Turnstile"); receives your IP address for this purpose.

Otherwise, your data is only shared among the members of our organisation who need it to respond to your queries, and with providers who help us operate the website, unless disclosure is required by law.

International transfers: The providers above are located outside the European Economic Area (EEA). Where we transfer personal data outside the EEA, we rely on appropriate safeguards — principally the European Commission’s Standard Contractual Clauses, together with any necessary supplementary measures. A copy of the relevant safeguards is available on request.

6. Cookies and Similar Technologies

We use cookies and similar technologies (including web beacons) to operate the website and improve your experience. You can manage your preferences via the cookie banner shown on your first visit and through your browser settings.

Cookie / technology

Cloudflare Turnstile

Provider

Cloudflare

Purpose

Security / anti-bot verification for the chat assistant

Category

Strictly necessary

7. Data Retention

We keep personal data only for as long as necessary for the purposes set out in this Policy:

  • Chat conversation logs: — retained for 24 months, after which they are deleted or anonymised, unless a longer period is required to handle a dispute or meet a legal obligation.
  • Contract-related data: — retained for the duration of the contract and as long as needed to establish, exercise or defend legal claims.
  • Data held to meet legal obligations: — retained for the period required by the applicable law.

8. Your Rights

Subject to the conditions in the GDPR, you have the right to:

  • Access your personal data and obtain a copy
  • Rectify inaccurate or incomplete data
  • Erase your data ("right to be forgotten"), within legal limits
  • Restrict processing
  • Object to processing based on legitimate interests, and to direct marketing at any time
  • Data portability
  • Withdraw consent at any time, where processing is based on consent

To exercise any of these rights — including requesting deletion of your chat conversation history — contact us at [email protected]. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr) or your local supervisory authority

9. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. However, no transmission over the Internet can be guaranteed to be completely secure, and we cannot guarantee the absolute security of data transmitted to our website.

10. Age Restriction

Our company and its websites are addressed to persons who have reached the age of 18. We do not knowingly collect personal data from minors.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top indicates when it was last revised. Material changes will be communicated through the website.