Privacy Policy

Privacy Policy
INFORMATION ON THE PROCESSING OF PERSONAL DATA
Art. 13 Regulation (EU) 2016/679 of the European Parliament and of the European Council

The Company, as the Data Controller, undertakes to protect the confidentiality and rights of the Interested Party and, in accordance with the principles provided by the aforementioned regulations, the processing of the data provided will be governed by the principles of legality, objectivity and of transparency.

1. PURPOSE OF PROCESSING
The personal information of the Interested Parties will be managed by the Company for the following processing purposes:

a) for the completion of the obligations in the context of the intention to enter into a contract or contract that are necessary to provide a sale to the Interested Party, since he has made an online purchase, or to provide any additional services requested by the Interested Party himself ( such as help, contacting customer service, sending emails and newsletters, using specific functions of the website)

b) to comply with the provisions of laws and regulations, national and international, or to execute an order of a judicial or other authority to which the Controller is subject
c) for the exercise of the rights of the Controller with special reference to that of defense in a trial.
d) for carrying out various marketing actions, such as promoting products and services, sending informative, advertising and promotional materials and messages

e) to carry out analyzes - through an automated process - in order to determine the profile of the Interested Party, so that marketing actions can be adapted to his needs
g) to carry out analyzes and market research, and in relation to the degree of satisfaction of the Interested Party.

Providing the data for the purposes of processing listed in points a, b and c is optional. However, the incomplete provision of data and/or possible refusal to process them will make it impossible to provide the requested services. The processing is lawful, as it is carried out in the context of a contract or intention to conclude a contract, respecting the provisions of the Law and the Regulations and exercising the rights of the Controller.

Η χορήγηση των στοιχείων για τους σκοπούς επεξεργασίας που αναγράφονται στα σημεία δ, ε και ζ είναι προαιρετική. Εντούτοις, η άρνηση χορήγησής τους θα καταστήσει αδύνατο για τον Υπεύθυνο να πραγματοποιήσει τις περιγραφόμενες ενέργειες. Ο Ενδιαφερόμενος θα μπορεί επίσης να ανακαλέσει τη συναίνεσή του οποιαδήποτε στιγμή, με την ίδια ευκολία με την οποία την παραχώρησε.

2. METHOD OF PROCESSING
The processing of the data is carried out in electronic and/or paper form, through registration, adaptation, archiving and transfer of the data, and with the help of other IT tools.
The tools and aids used in carrying out the processing procedures are suitable to guarantee the security and confidentiality of the data.

During the processing procedures, the Company commits to:
• to ensure the correctness and updating of the data and to make any corrections and/or additions requested by the Interested Party within a reasonable period of time
• to adopt security measures that ensure adequate data protection, taking into account the possible impact of the processing on the rights and fundamental freedoms of the Data Subject

• to notify the Interested Party, at the times and in the cases provided by the existing regulation, of a possible violation of personal data
• to ensure the compliance of the processing with the applicable provisions of the law.

3. DATA SHARING AND TRANSFER
With the exception of the notifications carried out for the execution of obligations arising from the law, the personal data of the Interested Party may be disclosed:
• to employees and partners of the Controller, in the capacity of those duly authorized to process the data (“Executors”)
• to companies inside the country and abroad that belong to the same group as the Manager
• to commercial representatives of the Controller who have taken over the management of the points of sale
• to companies that provide data entry (data entry) and digital archiving
• to marketing companies
• to administrative and accounting consultants
• to authorities, businesses, public bodies and organizations in general, both national and international exclusively for the aforementioned purposes and in accordance with the eventual consent of the Interested Party. Personal information is not transferred.

At our Company we choose reliable providers and try to set contractual restrictions on third parties who receive your personal data to ensure their lawful use. However, we cannot guarantee that they will not use or disclose this data without your permission. For this reason we recommend that you carefully review the privacy policies of any third party providers/suppliers connected to us.
In addition, our Company's website may contain links that lead to other websites of third parties, independent entities, such as, but not limited to, content providers, payment service providers, advertisers, transport service providers, etc. which are operated and maintained exclusively by them, and which we do not control, as we mentioned above, and therefore, we bear absolutely no responsibility for their content, actions or policies. Please read carefully the respective data protection policies on the websites you visit, as they may differ significantly from ours.

Skroutz Service Usage Data
Our company, in order to be able to evaluate and constantly improve the quality of the services it provides to the consumer, uses the Skroutz Analytics service, which works with cookies. Through this service, as long as you have previously given your consent through Skroutz.gr, usage statistics are securely shared by us at Skroutz. The data received by our company through this service is covered by the privacy policy as well as the cookies policy of Skroutz.gr, at the end of which you can also withdraw your consent.

4. TRANSFER ABROAD
Personal information is stored and processed within the European Union.
In case of personal data processing outside the European Union, this is done only after the appropriate guarantee has been previously adopted, as provided by the current regulation.

Some processing of personal data will be possible in Albania for which standard data protection clauses have been signed in accordance with Article 46(2)(c) GDPR. It is possible to request a copy from the controller through the appropriate communication channels indicated in this notice.

5. DATA RETENTION POLICY
The Company maintains in its systems the personal information in a form that allows the identification of the Interested Parties according to the following criteria:
• for a period that does not exceed the need to fulfill the processing purposes, unless something different is provided due to legal obligations or due to the execution of a contract
• to comply with specific legal obligations or perform a contract
• for as long as it is applicable and lawful, until the eventual deletion request from the Interested Party.

6. RIGHTS OF THE INTERESTED PARTY
The interested party can exercise his rights, which are recognized by the current regulation and specifically by articles 15 to 22 of the GDPR, namely:
• Right of access: The data subject has the right to receive from the Controller confirmation as to whether or not the personal data concerning him is being processed and, if this is the case, the right to access the personal data and additional information for the purposes of the processing, the relevant categories of personal data, the recipients of the data and/or their communication, etc.

• Right to rectification: the right to demand from the Controller without undue delay the correction of inaccurate personal data concerning him, as well as the completion of incomplete personal data, including through a supplementary statement.
• Right to erasure: right to request from the Data Controller the erasure of personal data concerning him, without undue delay, if one of the following reasons applies:
a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed 
b) the data subject withdraws the consent and there is no other legal basis for the processing
c) the personal data were processed unlawfully
d) personal data must be deleted in order to comply with a legal obligation.
• Right to object to the processing: the data subject has the right at any time to object to the processing and there are no compelling and legitimate reasons for the processing.

• Right to restriction of processing: The data subject has the right to obtain from the controller the restriction of processing, in the event that the accuracy of the data is disputed, for a period of time that allows the controller to verify the accuracy of the personal data, if the processing is unlawful and the data subject objects to it, if the controller no longer needs the personal data for the purposes of the processing, but such data is required by the data subject to establish, exercise or support legal claims, if the data subject objects to the processing, pending verification of whether the legitimate reasons of the controller prevail over those of the data subject.

• Right to data portability: to receive the data in a structured, commonly used and machine-readable format, as well as to transmit said data to another controller, only when the processing is based on consent or a contract and is carried out by automated means .|

• Right to non-automated individual decision-making: not to be subject to a decision made solely on the basis of automated processing, including profiling, which produces legal effects concerning him or significantly affects him in a similar way, unless it is necessary for the conclusion or the performance of a contract or is based on the express consent of the data subject.

• Right to submit a complaint to a supervisory authority: Without prejudice to any other administrative or judicial appeals, each data subject has the right to submit a complaint to a supervisory authority (www.dpa.gr) if he considers that the processing of the data concerning him violates the GDPR regulation. 

All of the above also applies to the data of minor children, even pregnant women, collected by the Company for the above purposes.