1. Introduction

SYNERGIA S.A., operating under the trade name “Eviotopoi”, respects the privacy of visitors and customers of www.eviotopoi.gr. This Privacy Policy explains how we process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, GDPR) and applicable Greek law.

2. Data controller

SYNERGIA S.A. | Trade name: Eviotopoi | 168 Kifisias Avenue, Neo Psychiko, 11525, Greece | Greek Tax ID (AFM): 095756187 | Tel.: +30 210 6777173 | Email: [email protected] | Website: www.eviotopoi.gr

3. Personal data we collect

Depending on how you use our services, we may collect: Name, email address, telephone number, delivery and billing address. Order details, purchase history, transaction information and invoice details. Customer account information, if an account is created. Information you provide when contacting us. Technical information such as IP address, device type, browser and cookie-related data, where applicable.

4. Purposes and legal bases

We process personal data to accept, fulfil and deliver orders, manage payments and customer accounts (performance of a contract); issue and retain tax documents (legal obligation); provide customer support, maintain system security and prevent fraud (performance of a contract or legitimate interests, depending on the circumstances); and send marketing communications or use non-essential cookies where valid consent or another applicable legal basis exists. When relying on legitimate interests, we balance those interests against individuals’ rights.

5. Orders and payments

We use the information necessary to confirm, process and deliver orders. Card payments are handled by our payment service providers. We handle only payment-related information necessary for processing and documenting the transaction, subject to the actual technical setup.

6. Marketing communications

Where permitted by law, we may send emails or SMS messages about products, offers and news. Where consent is required, you may withdraw it at any time. You may also object to direct marketing or unsubscribe using the method provided in the message or by contacting [email protected].

7. Recipients of personal data

We do not sell personal data. Where necessary, we may share it with delivery partners, payment service providers and banks, website hosting and technical support providers, accounting/IT service providers, and communications or marketing providers where applicable. We may also disclose information to authorities where legally required. Processors are subject to appropriate data-processing agreements.

8. Cookies

Our website uses strictly necessary cookies for core functions such as the shopping basket and checkout, and may use functionality, analytics and advertising cookies. Non-essential cookies are used only after the required consent has been obtained. You can change or withdraw your choices via the website’s cookie settings. Details of specific providers, purposes and retention periods are available in the website’s cookie information or Cookie Policy.

9. Data retention

We retain personal data only for as long as required for the relevant purpose or by law: transaction and invoicing records in line with statutory duties; account information while necessary for account operation and legal claims; correspondence for as long as needed to handle requests; and marketing data until consent is withdrawn or an objection is made, unless another lawful retention ground applies. Afterwards, data is deleted or anonymised where lawful and feasible.

10. Security

We implement appropriate technical and organisational safeguards against unauthorised access, loss or unlawful use. Access is limited to authorised personnel and service providers who need the data for their work.

11. Your rights

Subject to applicable legal conditions, you have rights of access, rectification, erasure, restriction, data portability, objection, withdrawal of consent and rights relating to automated decision-making. To exercise your rights, email [email protected]. We normally respond within one month, in accordance with the GDPR.

12. Transfers outside the EEA

If our service providers involve transfers of personal data outside the European Economic Area, the relevant GDPR safeguards will apply, such as adequacy decisions or standard contractual clauses where required. Contact us for information about applicable safeguards.

13. Children

Our website is not specifically directed at children. We do not seek to collect children’s personal data in breach of applicable law and will take appropriate action if we become aware of such collection.

14. Complaints

You may contact us at [email protected]. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

15. Changes to this policy

We may update this policy to reflect changes in our services or applicable laws. The current version and its last-update date will be published at www.eviotopoi.gr.