Privacy policy

Controller

[to be completed], VAT no. [to be completed], [to be completed]. Data protection contact: [to be completed].

What we collect

• Name, email, phone and delivery address when you place an order.
• Your order details (products, amounts, history).
• Anything you write in the contact form.
• Card details are processed only by Stripe; we never see them.

Why, and on what legal basis

• To fulfil your order (GDPR Art. 6(1)(b)).
• To meet our tax and accounting obligations (Art. 6(1)(c)).
• For shop security and fraud prevention (legitimate interest, Art. 6(1)(f)).
• To send one reminder about an unfinished order, only if you ask for it (consent, Art. 6(1)(a)).

Who we share it with

• Stripe (payments).
• CJ Dropshipping, the supplier that ships most products from warehouses in China, and courier companies: name, address and phone, as needed for delivery.
• Resend (email), Vercel and Neon (hosting and database).
• The Greek tax authority AADE (electronic receipts) and our accountant.

Transfers outside the EU

Some providers are in the US; transfers rely on the EU-US Data Privacy Framework or Standard Contractual Clauses. Sharing delivery details with China is necessary to fulfil your order (GDPR Art. 49(1)(b)).

How long we keep it

• Completed orders: as long as tax law requires.
• Unfinished orders: deleted within 90 days.
• Contact messages: up to 2 years.

Your rights

You have the right to access, rectify, erase, restrict, port and object to the processing of your data, and to withdraw consent. Write to us at [to be completed]. You may also complain to the Hellenic Data Protection Authority (www.dpa.gr).