Home | My Account | Information | Blog

CONTACT
0
Contact

Last updated: 4 September 2025

This Privacy Policy explains how kafteroulis.gr collects, uses, stores and protects your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 – GDPR and Greek legislation.

1. Contact

     

      • Registered address: Psaron 14, Kalamata 24100

        • Telephone: 210 7102611

        • Data Protection Officer (if applicable): Full name / Email

      2. What data we collect

      We collect only the data strictly necessary to operate the online store and serve you:

         

          • Account information full name, email, password (hashed), language and preferences.

          • Order and delivery information: billing and shipping address, telephone number, cart contents and order notes.

          • Invoicing information: company name, tax office, VAT/tax number and registered address for issuing invoices.

          • Payments: transaction token/ID, payment method and payment status. We do not store full card details.

          • Support: contact-form messages, emails and request history.

          • Marketing (with consent): newsletter subscription, preferences and possible segmentation.

          • Technical and usage data: IP address, device and browser information, cookies and identifiers, and security and analytics logs.

          • Social media and advertising (with consent): pixel identifiers (e.g. Google/Meta) for measurement and personalised campaigns.

        We do not collect special categories of personal data (such as health data or religious beliefs).

        3. Purposes and legal bases

        Purpose Data Legal basis (GDPR)
        Account creation and management Account information Performance of a contract (Art. 6(1)(b))
        Order, payment and delivery Order, invoicing and delivery data Performance of a contract (b), legal obligation (c)
        Invoicing and tax compliance Invoicing and transaction data Legal obligation (c)
        Customer support Communications and request history Legitimate interests (f)
        Security and fraud prevention Technical data, logs and IP address Legitimate interests (f)
        Online store performance analytics Cookies/usage data Legitimate interests (f) or consent (a)*
        Newsletter and offers Email and preferences Consent (a)
        Advertising Cookies/pixel IDs Consent (a)

        * We rely on consent where required by applicable ePrivacy legislation.

        4. Cookies and similar technologies

        We use cookies for essential functionality (such as the cart), analytics and, with consent, advertising purposes.

           

            • Essential: cart operation, sign-in and checkout.

            • Performance and analytics: website usage (e.g. Google Analytics).

            • Advertising: campaign measurement and personalisation (e.g. Meta/Google Ads).

          You can manage your choices through the cookie banner or Cookie Preference Centre.
          Link to the detailed Cookie Policy and cookie table

          5. Payments

          Payments are processed through the following providers:

             

              • Piraeus Bank (ePOS/Payment Gateway): an independent data controller for card details.

              • PayPal (Europe) S.à r.l. et Cie, S.C.A.: an independent controller of PayPal account data.

            We receive only transaction completion and status information. We do not store full card details.

            6. Recipients and third-party partners

            We disclose data only where necessary:

               

                • Carriers and couriers: for delivery (e.g. Hellenic Post/ELTA Courier and other partners).

                • Payments: Piraeus Bank and PayPal.

                • Hosting and IT security: hosting, backups, anti-DDoS protection and CDN services.

                • Email and SMS services: sending updates and newsletters (with consent).

                • Analytics and advertising: Google, Meta and others (with consent where required).

                • Accountants and advisers: for tax and legal obligations.

                • Competent authorities: where required by law or to defend our rights.

              We enter into data processing agreements (Art. 28 GDPR) with all processors.

              7. International data transfers

              If data is transferred outside the EEA (for example, to providers with servers in the USA or other countries), we apply appropriate safeguards under Articles 44–49 GDPR, such as Standard Contractual Clauses (SCCs) and transfer impact assessments. You may request a copy of the safeguards by contacting us.

              8. Retention periods

              We retain data only for as long as necessary:

                 

                  • Customer account: until deletion or after 24 months of inactivity (unless there are outstanding obligations).

                  • Orders and invoicing: up to 10 years (tax obligation).

                  • Support: up to 24 months after a request is closed.

                  • Newsletter and marketing: until consent is withdrawn or after 24 months without interaction.

                  • Cookies and analytics: for the cookie’s stated duration or until consent is withdrawn.

                9. Security

                We implement technical and organisational measures, including TLS encryption, strong access controls, event logging, regular updates and patching, backups, and periodic reviews. No system is 100% secure, but we take every reasonable measure to protect your data.

                10. Your rights

                You have the following rights:

                   

                    • Access to your personal data.

                    • Rectification of inaccurate or incomplete data.

                    • Erasure (the “right to be forgotten”) where applicable.

                    • Restriction of processing.

                    • Data portability to receive data in a structured, commonly used format.

                    • Objection to processing based on legitimate interests or for direct marketing.

                    • Withdrawal of consent where processing is based on consent, without retroactive effect.

                  To exercise your rights, send a request to [hot@kafteroulis.gr]We respond within one (1) month, which may be extended by two (2) months for complex requests.

                  11. Complaints to the supervisory authority

                  You may lodge a complaint with the Hellenic Data Protection Authority (HDPA):

                   

                  12. Automated decision-making and profiling

                  We do not make decisions based solely on automated processing that produce legal effects for you. We may use basic segmentation (e.g. preferences or purchase history) to provide more relevant recommendations only with consent where required.

                  13. Children

                  Our services are intended for persons aged 18+. We do not knowingly collect children’s data. If you become aware that a child has provided us with personal data, please contact us so it can be deleted promptly.

                  14. Contact and requests

                  For questions about this Policy or to exercise your rights, contact us at: [hot@kafteroulis.gr], [210 7102611].

                  15. Changes

                  We may update this Policy to reflect changes in our practices or legal requirements. The current version is published on the Website with the “Last updated” date. We will provide an appropriate notice of material changes, for example through a banner or email.

                  Appendix A – Sample cookie table

                  Cookie name Provider Category Purpose Duration
                  _shop_session kafteroulis.gr Essential Maintains the session and cart Session
                  consent_prefs kafteroulis.gr Essential Stores cookie preferences 6 months
                  _ga Google Analytics Performance Usage statistics 13 months
                  _gid Google Analytics Performance Usage statistics 24 hours
                  _fbp Meta Advertising Advertising measurement and personalisation 3 months
                  test_cookie [Ads provider] Advertising Ad network test 15 minutes