Privacy Policy

The protection of your personal data is important to us. This Privacy Policy explains what data we collect through the website enneaodoi.gr, for what purpose, on what legal basis, with whom we share it, and what rights you have. Processing is carried out in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Law 4624/2019.

1. Data Controller

The controller for the processing of your data is:

[COMPANY NAME] Address: [REGISTERED OFFICE ADDRESS] VAT ID: [VAT ID] — Tax Office: [TAX OFFICE] Email: [EMAIL] · Tel.: [TELEPHONE] Website: https://enneaodoi.gr

For any issue relating to your personal data, you can contact us at the email address stated above.

2. What data we collect

When placing an order: full name, shipping and billing address, telephone number, email address, details of your order and —if an invoice is requested— company name, VAT ID and Tax Office.

Payment details: payment is processed through a secure provider/bank. We do not store full card details on our systems.

User account (if you create one): the details you enter in your profile, as well as your order history.

Communication: when you send us a message or email, we keep the content and your contact details to respond.

Automatic data: IP address, browser type, and browsing data via cookies (see section 7).

Optional — only if the website has comments/a blog: when you leave a comment, we collect the data from the comment form, as well as your IP address and browser, to prevent spam.

3. Purposes of processing & legal basis

We process your data for the following purposes:

  • Fulfilment of your order — processing, shipping, and after-sales service. Legal basis: performance of a contract.
  • Issuing invoices and tax compliance. Legal basis: compliance with a legal obligation.
  • Responding to requests and communicating with you. Legal basis: legitimate interest / performance of a contract.
  • Website security, fraud and spam prevention. Legal basis: legitimate interest.
  • Sending newsletters/promotional messages, if you have opted in. Legal basis: consent, which you can withdraw at any time.

4. Recipients of your data

We only share data to the extent necessary with:

  • Courier company / haulier [COURIER NAME], for order delivery.
  • Payment service provider / bank [NAME], for transaction completion.
  • Accountancy firm / accountant, for invoicing and our tax obligations.
  • Hosting provider [NAME], where the website is hosted.
  • [Optional] Marketing/analytics services [e.g. newsletter tool, Google Analytics], if used and you have given relevant consent.
  • Public authorities, only when required by law.

All of the above process your data exclusively for the purposes we assign them and are bound by confidentiality.

5. Transfer outside the European Economic Area

As a rule, your data remains within the EU/EEA. If any of the services we use (e.g. analytics or email tool) transfer data outside the EEA, this is done with the appropriate safeguards provided by GDPR (e.g. standard contractual clauses).

6. Retention Period

  • Order and invoice data: for as long as required by tax and accounting legislation (minimum five years). Confirm the exact period with your accountant.
  • User account data: for as long as you keep your account active. You can request its deletion at any time.
  • Communications: for as long as necessary to handle your request.
  • Newsletter consent: until you withdraw your consent.

7. Cookies

Our website uses cookies for its proper functioning, to maintain your shopping basket, for security and —if you consent— for statistics and marketing. Strictly necessary cookies operate without consent; for the others, your consent is requested via the relevant banner, which you can modify or withdraw at any time.

Optional — if you have WordPress accounts/comments: when you leave a comment, you can optionally save your name, email and website in cookies, so you don't have to fill them in again. They last up to one year. When logging in, temporary cookies are stored to manage your session.

8. Embedded content from other websites

Some pages may include embedded content (e.g. videos, images, maps). This content behaves as if you have visited the third-party website, and such websites may collect data, use cookies, and track your interaction with that content, in accordance with their own policies.

9. Data Security

We take reasonable technical and organisational measures to protect your data from loss, misuse, or unauthorised access, such as encrypted connection (SSL) and controlled access to our systems.

10. Your Rights

Under the GDPR, you have the right:

  • To access the data we hold about you.
  • To rectify inaccurate or incomplete data.
  • To erasure (the "right to be forgotten"), provided there is no legal obligation to retain it.
  • To restrict processing.
  • To data portability.
  • To object to processing.
  • To withdraw your consent at any time, without affecting the lawfulness of previous processing.

To exercise any right, please contact us at [EMAIL]. We will respond within one (1) month.

11. Right to Complain

If you believe that the processing of your data violates the law, you have the right to lodge a complaint with the Hellenic Data Protection Authority (1-3 Kifissias Ave, 115 23 Athens · www.dpa.gr).

12. Changes to this Policy

We may update this Privacy Policy. Any changes will be posted on this page with an updated date.

13. Contact

For any questions regarding this policy or your personal data:

[SURNAME] · Email: [EMAIL] · Tel.: [TELEPHONE]