This is an English translation provided for convenience. If it differs from the Greek version, the Greek version applies.
1. Data controller
- Responsible party
- Nikos Spanos
- Address
- Evristhenous 4, Zografou 15773
- ellinikapeptidia@gmail.com
- Phone
- +30 695 543 5527
2. What we collect and why
Order details
When you place an order we collect your full name, email, phone number and shipping address, and your note, if you write one. Without these the order cannot be fulfilled or delivered.
Legal basis: performance of a contract — Article 6(1)(b) GDPR.
Order history
Each order is stored with its number, the products, the prices, the payment method, the courier, the tracking number and its status. It is linked to your email address, so that you can see your orders and so that we can respond to questions or return requests.
Legal basis: performance of a contract and legitimate interest, as well as the tax obligation to retain transaction records.
Sign-in with Google
If you choose to sign in with Google, we receive from Google only your email address and your name, and only if the address is verified. We do not gain access to your contacts, files, calendar or anything else in your account, nor do we receive or store your password.
Legal basis: consent — which you give by pressing the sign-in button.
Shopping cart
The cart is kept exclusively in your browser
(localStorage). It is not sent anywhere until you place an order,
and it is erased if you clear your browser data.
3. Cookies
The website does not use tracking, advertising or analytics cookies. There is no Google Analytics, no social media pixel, and no third-party script of any kind.
The only cookie set is the session cookie, and only after you sign in. It is cryptographically signed, contains only your identifier and its expiry, and is strictly necessary for signing in to work — which is why it does not require consent.
4. Where it is stored
The data is kept in a PostgreSQL database and the website is hosted on the Vercel platform. Both act as processors on our behalf. Order emails are sent through our email service provider.
Where processing takes place outside the European Economic Area, it relies on the Standard Contractual Clauses of the European Commission.
5. Who else sees it
We do not sell or rent personal data. We share it only where necessary for you to receive your order:
- Courier — name, address, phone number and, for cash on delivery, the amount to be collected.
- Public authorities — only where required by law.
6. For how long
- Orders and transaction records: for as long as tax legislation requires.
- Customer account: for as long as you keep it. It is deleted at your request.
- Sign-in links: expire after 30 minutes.
7. Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction, portability and objection, as well as the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before it.
You exercise them yourself: on the My account page you can change your name, phone number and address, and delete your account without having to ask us.
Deletion removes your account — name, phone number, address, password and the ability to sign in.
It does not remove the orders you have already placed. These are retained together with the details you provided for their shipment, for as long as tax legislation requires: they are transaction records, and a transaction record without a buyer cannot exist. This obligation overrides the right to erasure (Article 17(3)(b) GDPR) — we would rather say so clearly than promise a deletion we cannot carry out.
For anything that cannot be done from that page — changing the email address, which identifies the account, or obtaining a copy of your data — write to ellinikapeptidia@gmail.com. We reply within one month.
If you believe your rights are being infringed, you may lodge a complaint with the Hellenic Data Protection Authority (dpa.gr).
8. Security
The connection to the website is encrypted (HTTPS). Administrator and customer sessions are protected by a cryptographic signature. No method of transmission or storage is completely secure, and we do not claim otherwise.
9. Changes
Material changes are announced on this page with a new update date.