Terms of Use – Privacy Policy

Who we are

Website address: https://plymood.gr

The online store plymood.gr is operated under the management and responsibility of the sole proprietorship Chli Eirini, which operates in the retail trade of furniture and clothing.

Plymood furniture is made from plywood and is based on predefined model codes.

We do not keep stock – production begins after the order & payment.

The customer may choose a colour or finish.

Dimensions are standardised and cut by machine.

Production Time:

• Unpainted product: 5–10 business days.
• Painted product: 25–30 business days.

Business owner details

• Business name: Chli Eirini
• VAT No. (Tax ID): 159632719
• Registered office: 14 Bampi Anninou St., Thessaloniki 546 46
• Phone: 6955238971
• Company website: https://plymood.gr

Business activity

 

Data controller

The controller responsible for processing personal data and implementing this privacy policy is Ms Eirini. For any matter relating to the protection of your personal data, you may contact us by phone at 6955238971.

 

Legal framework

Personal data is processed in accordance with:

• Regulation (EU) 2016/679 – General Data Protection Regulation (GDPR)
• Law 4624/2019 on the protection of personal data
• Applicable Greek and European legislation

 

What personal data we collect and why

We collect and process personal data solely for the operation of the online store, to serve our customers and to comply with our legal obligations. All processing is carried out in accordance with the GDPR and Greek law.

Categories of data we collect

Identification and contact details

• First and last name: for identification and delivery of products
• Email address: for communication and order confirmation
• Phone number: for communication regarding orders and deliveries
• Billing and shipping address: for processing and delivering orders

Transaction data

• Order history: for record-keeping and customer support
• Product preferences: to improve the shopping experience
• Payment details: are processed securely by Stripe (they are not stored on our servers)

Technical data

• IP address: for security and fraud prevention purposes
• Browser information: for technical support and optimisation
• Cookies: for website functionality and analytics

Legal basis for processing

The processing of your personal data is based on the following legal bases:

• Performance of a contract (Article 6(1)(b) GDPR): for processing and fulfilling orders
• Legitimate interest (Article 6(1)(f) GDPR): for service improvement, security and fraud prevention
• Legal obligation (Article 6(1)(c) GDPR): for compliance with tax and accounting obligations
• Consent (Article 6(1)(a) GDPR): for newsletters and promotional communications

Comments

When visitors leave comments on the site, we collect the data shown in the comments form, as well as the visitor’s IP address and browser user agent string, to help with spam detection.

An anonymised string created from your email address (also called a hash) may be provided to the Gravatar service in order to display your profile picture. The Gravatar privacy policy is available here.

Media

If you upload images to the website, you should avoid uploading images with embedded location data (EXIF GPS) included. Visitors to the website can download and extract any location data from images on the website.

Contact Forms

The website’s contact forms collect the following data:

• First and last name: to identify the sender
• Email address: to reply to the message
• Message content: to provide the requested support
• IP address and timestamp: for security purposes

This data is retained for six (6) months for customer service purposes and is not used for promotional purposes without your consent.

Cookies

Our website uses the following types of cookies:

Strictly Necessary Cookies

• Session cookies: to maintain the shopping cart and navigation
• Security cookies: to protect against malicious attacks
• Preference cookies: to remember user settings

Functional Cookies

• Login cookies: to remember login details (if selected)
• Language cookies: to remember the preferred language

Statistics Cookies (Google Analytics)

• _ga, _ga_*: to measure traffic and user behaviour
• Duration: up to 2 years
• Purpose: improving the user experience and our services

You can manage your cookie preferences through the consent banner or your browser settings.

Analytics

We use Google Analytics to collect anonymous statistics about the use of the website. This data helps us improve our services and the user experience.

How to opt out: You can opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on or by disabling statistics cookies in the website settings.

Google Privacy Policy: https://policies.google.com/privacy

Note: We do not collect sensitive personal data (such as health data, religious beliefs, etc.) through our website.

Who we share your data with

We do not sell, rent or assign your personal data to third parties for commercial purposes. We share your personal data only with trusted partners and service providers that are necessary for the operation of the online store and the fulfilment of your orders.

Service providers we work with

Payment Processing

Viva Wallet Group

• Data we share: Billing details, transaction amount, name, email address
• Purpose: Secure payment processing and fraud prevention
• Location: Athens, Greece
• Privacy Policy: https://www.viva.com/en-gr/terms-portal

Delivery Services

BoxNow and other courier companies

• Data we share: Name, delivery address, phone number, product description
• Purpose: Delivery of orders to the address you have selected
• Location: Greece, Cyprus, European Union
• Retention: For as long as required to complete the delivery and handle any claims

Analytics

Google LLC (Google Analytics)

• Data we share: Anonymous usage data, traffic statistics
• Purpose: Traffic analysis and website improvement
• Location: USA (with adequate safeguards)
• Privacy Policy: https://policies.google.com/privacy

Hosting and Technical Support

Web hosting provider

• Data we share: All data stored on the website
• Purpose: Operation and maintenance of the website
• Location: European Union
• Safeguards: GDPR compliance through a data processing agreement

Email Marketing (if you subscribe to the Newsletter)

Email marketing provider

• Data we share: Email address, name
• Purpose: Sending newsletters and updates
• Basis: Only with your explicit consent
• Safeguards: GDPR-compliant service

Legal obligations and exceptions

We may disclose your personal data to third parties in the following cases:

• Legal obligation: When required by law, court order or a public authority
• Protection of rights: To protect our legitimate interests, our rights or those of third parties
• Security: To investigate, prevent or address unlawful activities
• Business transfer: In the event of a sale, merger or acquisition of the business (with prior notice)

Protection safeguards

All our third-party partners:

• ✅ Comply with the GDPR and European data protection standards
• ✅ Sign processing agreements that set out the terms of data use
• ✅ Restrict the use of data to the agreed purposes
• ✅ Implement appropriate technical and organisational security measures
• ✅ Do not resell the data to other third parties

Embedded content from other websites

Articles on this website may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in exactly the same way as if the visitor had visited the other website.

These websites may collect data about you, use cookies, embed additional third-party tracking and monitor your interaction with that embedded content.

Note: By default, WordPress does not share personal data with third parties. All of the cases mentioned above concern additional services we have enabled to improve the operation of the online store.

How long we retain your data

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, in accordance with our legal obligations and legitimate interests. Retention periods are determined on the basis of Greek and European legislation.

Data retention periods table

User account data

• Profile details (name, email, phone): For as long as the account remains active + 3 years after the last login
• Preferences and settings: For as long as the account remains active
• Purpose of retention: Account functionality and customer service

Order and transaction data

• Order details: 5 years from the date of the order
• Billing and shipping details: 5 years from the date of the transaction
• Receipts and invoices: 5 years (legal obligation – Code of Tax Procedure)
• Returns history: 5 years from the completion of the return
• Purpose of retention: Tax and accounting obligations, product warranty, claims

Communication and support

• Contact forms: 6 months from submission
• Contact emails: 2 years for customer service purposes
• Support calls: 1 year from the resolution of the issue
• Purpose of retention: Provision of support, dispute resolution, service improvement

User comments and content

• Comments on the website: Retained indefinitely after approval
• Comment metadata (IP, timestamp): 1 year from publication
• Purpose of retention: Website functionality, automatic approval of future comments

Technical data and security

• Server logs (IP, User Agent): 30 days
• Traffic cookies: 2 years (Google Analytics)
• Functionality cookies: 1 year or until the session expires
• Security data: 90 days from the incident
• Purpose of retention: Security, technical support, performance improvement

Marketing and Newsletter

• Newsletter list: Until unsubscription + 30 days
• Mailing history: 2 years from submission
• Email marketing statistics: 1 year in anonymised form
• Purpose of retention: Keeping records of consents, campaign effectiveness

Automatic data deletion

We have implemented automated procedures for deleting data after the retention periods expire:

• 🔄 Monthly review: Server logs and temporary files
• 🔄 Quarterly review: Security data and contact forms
• 🔄 Annual review: Inactive accounts and old marketing data
• 🔄 Five-year review: Old order data and tax records

Retention exceptions

Data may be retained for a longer period in the following cases:

• Legal disputes: Until final resolution
• Court proceedings: In accordance with a court order
• Investigations: Until the investigation is completed
• Explicit consent: If you request an extended retention period

Anonymous and statistical data

After the retention periods expire, certain data may be retained in anonymised and aggregated form for statistical purposes and service improvement. This data cannot be linked to specific individuals.

Data erasure request

You may request the erasure of your personal data at any time by contacting us at example@email.gr. The request will be reviewed within 30 days and you will be notified once the process is complete.

Note: Some data may not be erased immediately due to legal obligations (e.g. tax records), but will be deleted automatically once the legal obligation expires.

What rights you have over your data

Under the General Data Protection Regulation (GDPR) and Greek legislation, you have specific rights regarding your personal data. You may exercise these rights at any time by contacting us.

Your rights in detail

🔍 Right of access (Article 15 GDPR)

What it includes:

• Confirmation as to whether we process your personal data
• Access to the personal data we hold about you
• Information about the purposes of processing
• Categories of personal data we process
• Recipients or categories of recipients of the data
• Data retention period
• Source of the data (if not collected directly from you)

✏️ Right to rectification (Article 16 GDPR)

You may request:

• Correction of inaccurate personal data
• Completion of incomplete personal data
• Updating of outdated information

Completion time: Within 30 days of the request

🗑️ Right to erasure – “Right to be forgotten” (Article 17 GDPR)

You may request erasure when:

• The data are no longer necessary for the purposes for which they were collected
• You withdraw your consent and there is no other legal basis
• The data have been unlawfully processed
• The data must be erased to comply with a legal obligation

Exceptions: We cannot erase data required for legal obligations (e.g. tax records)

⏸️ Right to restriction of processing (Article 18 GDPR)

You may request restriction when:

• You contest the accuracy of the data
• The processing is unlawful but you do not want the data erased
• You need the data for legal claims
• You have objected to the processing and are awaiting verification

Result: The data will be stored but not processed

📦 Right to data portability (Article 20 GDPR)

You may receive:

• Your personal data in a structured, commonly used and machine-readable format
• Transfer of the data to another controller

Available formats: JSON, CSV, PDF

Includes: Account details, order history, preferences

🚫 Right to object (Article 21 GDPR)

You may object to processing for:

• Direct marketing: At any time and without giving reasons
• Legitimate interests: On grounds relating to your particular situation
• Scientific/historical research: Unless it is necessary for reasons of public interest

🤖 Right not to be subject to automated decision-making (Article 22 GDPR)

Protection against:

• Automated decisions without human intervention
• Profiling that produces legal effects

Automated processes we use:

• Stripe fraud detection – Automated payment security checks
• Inventory management – Automatic updating of product availability
• Comment moderation – Automatic approval for approved users

Your rights: If an automated decision affects you (e.g. a declined payment), you have the right to:

• 🔔 Human review: Contact us to request a review
• 🔔 Explanation: Information about the logic behind the decision
• 🔔 Objection: Alternative solutions where possible.

How to exercise your rights

📧 Contact

 

• Phone: 6955238971
• Postal address: 14 Bampi Anninou St., Postal Code 546 46, Thessaloniki, Greece

📝 Information required in your request

• Full identification details (name, account email)
• Description of the right you wish to exercise
• The specific request or information you are seeking
• Copy of your ID (for identity verification)

⏱️ Response times

• Standard response: Within 30 days of receipt of the request
• Complex requests: May be extended by a further 60 days with justification
• Immediate notification: Within 72 hours for acknowledgement of receipt

🆓 Cost

Exercising your rights is free of charge. You may only be charged for additional copies or if the request is manifestly unfounded or excessive.

Right to lodge a complaint

If you believe your rights have been infringed, you may lodge a complaint with the:

Hellenic Data Protection Authority
📧 Email: contact@dpa.gr
📞 Phone: 210 6475600
🌐 Website: https://www.dpa.gr
📍 Address: 1-3 Kifisias Ave., 11523 Ampelokipoi, Athens

Automated rights management

For your convenience, we have enabled automated functions for certain rights:

• ✅ Correcting your details: Via your account, in the “My Account” section
• ✅ Newsletter unsubscribe: Via the link in every email
• ✅ Cookie management: Via the consent banner
• ✅ Data download: Request through your account

Our commitment: We handle all requests seriously and transparently, ensuring full compliance with the GDPR and Greek legislation.

Where your data are sent

The General Data Protection Regulation (GDPR) requires that the personal data of European Union residents transferred outside the EU be protected to the same high standards. Below we set out in detail where your data are stored and processed.

🇪🇺 Storage within the European Union

Primary data storage

• Web Hosting: Website data and database
• Location: European Union (Germany/Netherlands)
• Data stored:
  • User account details
  • Order and transaction data
  • Website content and comments
  • Server logs and security data
• Safeguards: Full GDPR compliance by default

Email and communications

• Email servers: Greece/European Union
• Backup systems: Within the EU, with encryption

🌍 Transfers outside the European Union

To provide certain services, we work with providers located outside the EU. All transfers are protected by appropriate safeguards:

Google LLC – Analytics and Services

• Data transferred: Anonymous usage statistics
• Purpose: Traffic analysis and website improvement
• Safeguards:
  • ✅ Google is covered by an adequacy decision for certain services
  • ✅ Standard Contractual Clauses (SCCs)
  • ✅ IP address anonymisation
  • ✅ GDPR-compliant data retention settings
• User control: Option to opt out via browser settings or opt-out tools
• Privacy Policy: https://policies.google.com/privacy

🛡️ Safeguards for international transfers

Legal safeguards

• Standard Contractual Clauses (SCCs): Approved by the European Commission
• Data Processing Agreements: Data processing agreements with all third-party providers
• Privacy Impact Assessments: Risk assessment for each transfer
• Regular compliance audits: Regular compliance audits

Technical security measures

• Encryption in transit: TLS 1.3 for all communications
• Encryption at rest: AES-256 for stored data
• Pseudonymization: Pseudonymisation where possible
• Restricted access: Authorised personnel only
• Monitoring and logging: Monitoring of all transfers

Organisational measures

• Data minimization: Transfer of strictly necessary data only
• Purpose limitation: Use solely for the stated purposes
• Regular training: Staff training on data protection
• Incident response plan: Data breach response plan

🔍 Transparency and control

User rights regarding international transfers

• Notification: You are always informed about transfers
• Objection: You may object to specific transfers
• Restriction: Request restriction of processing outside the EU
• Alternatives: Provision of alternative solutions where possible

Transfer assessment procedure

Before every new transfer outside the EU, we carry out:

1. Legal assessment: A legal assessment of the destination country
2. Risk evaluation: A risk assessment for user rights
3. Safeguards identification: Identification of appropriate safeguards
4. Documentation: Documentation of all protection measures
5. Regular review: Regular review of the safeguards

🚫 Restricted countries

We do not transfer data to:

• Countries without an adequate level of data protection
• Countries subject to EU sanctions on data protection matters
• Providers that do not offer appropriate GDPR safeguards

📞 Contact regarding transfers

For questions about international data transfers:

• Phone: 6955238971
• Subject: “International data transfers”
• Response: Within 10 working days

Our commitment: We continuously monitor legislative developments and adapt our practices to ensure the highest possible protection of your personal data, regardless of where it is processed.

Contact information

For any matter concerning the protection of your personal data, the exercise of your rights or clarifications regarding this Privacy Policy, you can contact us in the following ways.

👤 Data Protection Officer

Owner

Role: Data Controller & Data Protection Officer
Business: Chli Eirini
VAT No. (Tax ID): 159632719

📞 Contact details

Electronic communication (preferred)

• Email for data protection matters: -
• Email subject: “Data Protection – [Request type]”
• Maximum response time: 72 hours for acknowledgement of receipt, 30 days for a substantive response

Telephone contact

 

• Mobile phone: 6955238971
• Hours: -
• Note: For complex requests, please prefer email for better documentation

Postal contact

-

 

📝 Types of requests you can submit

GDPR rights

• Access to data: Request a copy of your personal data
• Rectification of data: Request correction of inaccurate or incomplete information
• Erasure of data: Request erasure (right to be forgotten)
• Restriction of processing: Request temporary restriction
• Data portability: Receive your data in a machine-readable format
• Objection to processing: Objection for specific purposes
• Withdrawal of consent: Withdraw previously given consent

General requests

• Clarifications: Questions about the Privacy Policy
• Complaints: Reporting possible data protection breaches
• Information: General information about data processing
• Technical issues: Problems with cookies, accounts, etc.

📋 Information required for requests

To process your request securely and promptly, please include:

Mandatory information

• ✅ Full identification details: First name, last name
• ✅ Account email: The email you use on the website
• ✅ Description of request: A clear description of what you are requesting
• ✅ Date of request: For better tracking

Optional but useful information

• 📋 Order number: If the request concerns a specific order
• 📋 Time frame: If you are referring to a specific period
• 📋 Preferred response format: Email, PDF, JSON, etc.

For complex requests

• 🔐 Copy of ID: For identity verification (will be deleted after verification)
• 🔐 Legal representation: If you are acting on behalf of a third party.

⏱️ Response timeline

Request type	Acknowledgement time	Response time
Simple questions	24 hours	3-5 business days
GDPR rights	72 hours	30 days
Complex requests	72 hours	60 days (with justification)
Complaints	24 hours	10 business days

🔒 Confidentiality and security

• Confidentiality: All communications are treated as confidential
• Secure handling: Requests are stored in secure systems
• Restricted access: Only authorized personnel have access
• Archiving: Records are retained for legal reasons (3 years)

🏛️ Alternative dispute resolution

If you are not satisfied with our response, you have the following rights:

Hellenic Data Protection Authority

Address: 1-3 Kifisias Ave., 11523 Ampelokipi, Athens

Phone: 210 6475600

Email: contact@dpa.gr

Website: www.dpa.gr

Legal action

You also retain the right to seek compensation through the courts in accordance with Article 82 of the GDPR.

Our commitment: We handle all requests with the utmost care and professionalism, ensuring full protection of your rights and compliance with applicable legislation.

Additional information

Due to the commercial nature of our website and the complex processing of personal data required to operate an online store, we provide the following additional information in accordance with GDPR requirements.

🛡️ How we protect your data

We implement a data protection system that includes technical, organizational and procedural security measures tailored to our capabilities as a small business.

Technical security measures

Encryption and data protection

• HTTPS/TLS 1.3: All communications are encrypted in transit
• SSL certificates: Let’s Encrypt certificates with automatic renewal
• Secure password management: Bcrypt hashing for passwords
• Protection of sensitive data: Minimal collection and secure storage

Infrastructure security

• Hosting provider security: Basic DDoS protection by top.host
• Firewall protection: Basic server-level firewalls
• Malware scanning: Automatic malware detection
• Server monitoring: 24/7 infrastructure monitoring by the hosting provider
• Daily backups: Automatic backups by top.host

Application security

• Input validation: Validation of all incoming data
• SQL injection protection: Parameterized queries and prepared statements
• XSS protection: Output encoding and Content Security Policy headers
• CSRF protection: Random tokens in forms
• Session security: Secure session management with HttpOnly cookies

Organizational security measures

Access control

• Principle of least privilege: Minimum necessary access rights
• Restricted access: Only authorized personnel have access to the data
• Automatic logout: After 30 minutes of inactivity
• Regular access reviews: Periodic review of access rights

Training and awareness

• GDPR awareness: Ongoing updates on data protection requirements
• Security best practices: Application of security best practices
• Incident response: Procedures for handling security incidents
• Regular updates: Regular updates on new security threats

Procedural measures

• Privacy by Design: Data protection by design
• Data minimization: Collection of only the data necessary for operation
• Purpose limitation: Use of data solely for the stated purposes
• Storage limitation: Deletion of data when no longer necessary
• Regular maintenance: Regular system maintenance and updates

Compliance and transparency

As a small business, we implement the necessary measures for:

• Compliance with the General Data Protection Regulation (GDPR)
• Transparent information about our data processing practices
• Respect for the rights of data subjects
• Secure processing of payment data through external providers

🚨 Data breach procedures

We have developed a comprehensive data breach response plan that complies with the requirements of Articles 33 and 34 of the GDPR.

Detection and reporting procedure

Immediate response (0-24 hours)

1. Incident detection: Automated systems or staff reports
2. Immediate containment: Isolation of affected systems
3. Initial assessment: First evaluation of scope and severity
4. Crisis team activation: Notification of responsible persons
5. Documentation: Recording of all actions taken

Detailed investigation (24-72 hours)

1. Forensic analysis: Detailed examination of the incident
2. Risk assessment: Assessment of the impact on individuals
3. Scope of the breach: Identification of affected data
4. Causes of the breach: Analysis of causes and vulnerabilities
5. Response measures: Implementation of corrective actions

Notification of authorities and affected parties

Notification to ADAE (within 72 hours)

• Mandatory reporting: For high-risk breaches
• Report content:
  • Description of the nature of the breach
  • Categories and number of affected individuals
  • Likely consequences
  • Measures taken or proposed

Notification of affected users

• Notification criteria: High risk to rights and freedoms
• Notification method: Email, SMS, notice on the website
• Notification content:
  • Description of the breach in plain language
  • Data affected
  • Actions we have taken
  • Recommendations for the user
  • Contact details for further information

Follow-up actions

• Root cause analysis: Root cause analysis
• Security improvements: Strengthening of protection systems
• Procedure updates: Review of protocols
• Staff training: Increased awareness
• Monitoring: Long-term monitoring of impacts

📥 Third parties from whom we receive data

Our website does not normally receive personal data from third parties. All data is collected directly from you through:

• Account creation: Information you enter
• The ordering process: Information you provide
• Communication: Messages you send
• Browsing: Automatic collection of technical data

Exceptions – Cases where data is received from third parties

Referrals and affiliates

• Source: Partner websites that refer you to us
• Data: Referrer URL, campaign ID
• Purpose: Measuring the effectiveness of partnerships
• Legal basis: Legitimate interest

Social networks (if used in the future)

• Source: Facebook, Google for social login
• Data: Name, email, public profile
• Purpose: Ease of account creation
• Legal basis: Consent

Open data sources

• Source: Public business registries (for B2B customers)
• Data: Company name, business address
• Purpose: Verification of details
• Legal basis: Legitimate interest

⚖️ Regulatory requirements

Our business is subject to the following regulatory requirements:

Greek legislation

• Law 4624/2019: Personal data protection
• Code of Tax Procedure: Retention of tax records
• Law 4072/2012: Distance selling
• E-commerce law: E-commerce obligations

European legislation

• GDPR (2016/679): General Data Protection Regulation
• ePrivacy Directive: Rules on electronic communications
• Consumer Rights Directive: Consumer rights
• Payment Services Directive (PSD2): Payment services

International standards

• ISO 27001: Information security management
• PCI DSS: Payment data security
• WCAG 2.1: Website accessibility

Compliance statements

• ✅ GDPR compliant: Full GDPR compliance
• ✅ Privacy by Design: Data protection by design
• ✅ Regular audits: Annual compliance review
• ✅ Ongoing training: Updates on legislative changes

Last regulatory compliance review: 17 August 2025

This privacy policy is a living document that is regularly updated to reflect current practices and evolving data protection legislation.

WordPress – Specific information

Our website runs on the WordPress content management system. The following information concerns specific WordPress features not covered in the previous sections:

🔐 Password reset

When you request a password reset:

• IP address: Your IP address is included in the password reset email
• Purpose: Security and verification of the requester’s identity
• Retention: The IP address is automatically deleted from the email after 24 hours
• Legal basis: Legitimate interest in account security

🛡️ Automated comment screening

Visitor comments are automatically screened to prevent unsolicited messages (spam):

• System: WordPress Akismet Anti-Spam
• Data analyzed:
  • Comment content
  • IP address and User Agent
  • Submission timestamp
  • Referring website (referrer)
• Purpose: Automatic spam detection and filtering
• Data transfer: Data may be sent to the Akismet service for analysis
• Akismet privacy policy: https://automattic.com/privacy/

👤 User profile management

For registered users of the website:

• Self-management: You can view, edit or delete your personal data at any time
• Exception: You cannot change your username after the account has been created
• Administrator access: Website administrators can view and edit your profile information
• Purpose of access: Technical support and account management

📝 Additional WordPress cookie details

In addition to the cookies already mentioned, WordPress uses:

Browser test cookie

• When it is created: When you log in to the website
• Purpose: Determines whether your browser accepts cookies
• Content: Contains no personal information
• Duration: Deleted when you close your browser

Content editing cookie

• When it is created: If you edit or publish content
• Content: Post ID of the article you edited
• Purpose: Technical editing functionality
• Duration: 1 day

Note: All other WordPress features (comments, media, embedded content, etc.) have already been covered in detail in the previous sections of this privacy policy.

WooCommerce – Specific online store information

Our online store runs on the WooCommerce platform. The following information concerns specific online store features not covered in the previous sections:

🛍️ Shopping behavior tracking

While you browse the online store, we track:

Recently viewed products

• Data we collect: List of products you visited, visit timestamps
• Purpose: Displaying products you viewed recently, improving the shopping experience
• Storage method: Cookies and session data
• Duration: 30 days or until cookies are cleared
• Legal basis: Legitimate interest in improving our services

Preliminary shipping estimate

• Data we request: Shipping address before the order is completed
• Purpose: Calculation of shipping costs and VAT
• Optional: You may skip this step
• Deletion: Automatically deleted if you do not complete the order within 24 hours

🛒 Shopping cart management

For the operation of the shopping cart we use specific cookies:

• Cart cookie: woocommerce_cart_hash
• Content: Encrypted data of the products in the cart
• Purpose: Keeping cart contents between pages and visits
• Duration: 14 days or until the order is completed/cleared
• Personal data: Contains no personal information, only product IDs

📊 Store experience optimization

Behavioral data is used for:

• Product recommendations: “Other customers also viewed” and related products
• Website improvement: Analysis of the most popular products and pages
• Content personalization: Displaying relevant content based on interests
• Trend analysis: Understanding customer preferences (in aggregate form)

🔍 Search and filtering

The search terms and filters you use:

• Temporary storage: For the duration of the session
• Purpose: Improving search and filtering results
• Anonymization: After 30 days, for statistical purposes

⭐ Product reviews and ratings

If you leave a product review:

• Public display: Your name and review will be displayed publicly
• Purchase verification: A “Verified purchase” label if you have purchased the product
• Consent: Submitting a review constitutes consent to its public display
• Deletion: You may request deletion of your review at any time

Note: All other WooCommerce functions (order details, payments, data sharing with third parties, data retention, user rights, etc.) have already been covered in detail in the previous sections of this Privacy Policy.

Cookie consent management – Complianz Privacy Suite

To manage your cookie consent and comply with GDPR requirements, our website uses the service Complianz Privacy Suite for WordPress.

🍪 How consent management works

Consent logging

• Method: Collection and logging of consent per browser and device
• Purpose:
  • Keeping proof of consent in accordance with the GDPR
  • Management of cookie preferences per user
  • Legal protection and compliance
• Legal basis: Legal obligation (Article 6(1)(c) GDPR)

Data processed

• IP address: Automatically anonymized before storage
• Browser identifier: Encrypted hash for device recognition
• Cookie preferences: Which cookie categories you have accepted/rejected
• Timestamp: When consent was given
• Policy version: Which version of the Cookie Policy was in effect

🔒 Personal data protection

Anonymization measures

• IP Anonymization: Your IP address is automatically anonymized (e.g. 192.168.1.XXX)
• Non-identifiable data: No personally identifiable information is stored
• Encryption: All data is encrypted in the database
• Local storage: The data remains on our servers

What we do NOT do

• ❌ Disclosure to third parties: We do not share data with Complianz or other providers
• ❌ External processing: No data is sent outside the website
• ❌ Linking to an account: We do not link consent to specific users
• ❌ Permanent identification: We do not create permanent user profiles

⚙️ Managing cookie preferences

Ways to manage

• Banner cookies: First visit – choice of categories
• Preference center: Accessible at any time through the website
• Changing preferences: Can be modified at any time
• Withdrawal of consent: Disable all cookies except the necessary ones

Cookie categories managed

• Necessary: Technically necessary for operation (do not require consent)
• Functional: Improve the user experience (require consent)
• Statistics: Google Analytics and similar (require consent)
• Marketing: Advertising cookies (require consent)

📊 Retention of consent data

• Storage period: 2 years from the last visit
• Reason for retention: Legal obligation to prove consent (GDPR)
• Automatic deletion: After the retention period expires
• Reconfirmation: New consent requested when the policy changes

🔗 Additional information

Technical details

• Compatibility: Compliance with the GDPR, CCPA and ePrivacy Directive
• Updates: Automatic updates for changes to cookie policies
• Languages: Multilingual support, including Greek
• Accessibility: Compatible with screen readers and accessibility standards

External sources

• Complianz Privacy Statement: https://complianz.io/privacy-statement/
• Technical documentation: https://complianz.io/wordpress-privacy/

📞 Resolving consent issues

If you experience a problem managing your cookies or preferences:

• Technical support: Help with browser settings
• Resetting preferences: Option to reset all settings

Important: Cookie consent management is fully automated and designed to protect your privacy, while ensuring the website’s legal compliance with European regulations.

Wallet – Payment processing

Our website uses the extension Viva Wallet for Woocommerce for the secure processing of credit and debit card payments.

⚠️ Important notice

When you use the payment service, we store personal data and share it with the external service Viva Wallet Group for the processing of your payments.

🔄 Viva Wallet processing summary

The following is a summary of the information already set out in detail in the sections “Who we share your data with” and “Where your data is sent”:

Data transferred to Stripe

• Payment details: Card number, expiry date, CVV
• Billing details: Name, billing address
• Transaction details: Amount, currency, purchase description
• Email address: For sending payment receipts

What we do NOT store

• ❌ Full card details: They are not stored on our servers
• ❌ CVV codes: Processed only by Stripe
• ❌ Sensitive payment data: All handled by Stripe

Security guarantees

• ✅ PCI DSS Level 1: Viva Wallet is certified to the highest standards
• ✅ Encryption: All data is encrypted end-to-end
• ✅ GDPR compliance: Full compliance with European regulations
• ✅ Standard clauses: Standard Contractual Clauses for international transfers

🔍 For more information

Detailed information on the processing of data by Stripe can be found in the following sections of this Privacy Policy:

• Section “Who we share your data with” → Subsection “Payment Processing – Viva Wallet Group”
• Section “Where your data is sent” → Subsection “Viva Wallet Group – Payment Processing”

External sources

• Viva Wallet Privacy Policy: https://www.viva.com/en-gr/privacy-notice
• Viva Wallet Security: https://www.viva.com/en-gr/security-and-technology

💳 Managing saved cards

If you choose to save your card for future purchases:

• Storage: Only on Stripe’s servers (not on ours)
• Data stored: Encrypted card token, last 4 digits, card brand
• Deletion: You can delete saved cards from your account
• Security: Full encryption and tokenization

Note: All details regarding Viva Wallet (legal bases, international transfers, protection safeguards, contact procedures, etc.) have already been covered extensively in the corresponding sections of this Privacy Policy.