Last updated: Σεπτέμβριος 2026
This policy explains how personal data is processed in connection with the Elaiou Kallos website and online store.
Controller
Privacy enquiries and rights requests: info@elaioukallos.gr.
Data we process and why
- Orders: identity, contact, billing/delivery, order contents, shipping and payment status to perform the sales contract.
- Invoice requests: company, activity, VAT country/number and tax-office information for invoicing, tax and accounting obligations.
- Payments: payment status and transaction references; card details are handled by the enabled ePay Redirection environment and are not stored by this website.
- Fiscal documents: necessary order data may be sent to Oxygen for receipt/invoice, myDATA-related processing and PDF delivery where the integration is enabled and verified.
- Delivery: necessary recipient and delivery data are shared with the selected courier, including ACS or BOX NOW where applicable.
- Support and business enquiries: information submitted through Contact or Wholesale/Hospitality forms is used to answer and reasonably follow up the request.
- Release notifications: email is processed on the basis of separate consent until unsubscribe or deletion.
- Analytics: GA4 is used only after analytics consent and must not receive names, email, telephone, VAT number, address or gift-message content.
Legal bases
Depending on the activity, processing is based on performance of a contract or steps requested before a contract, compliance with legal obligations, legitimate interests such as security and fraud prevention, or consent for optional analytics and release notifications.
Recipients and processors
Data may be disclosed only as necessary to hosting/email providers, payment providers, Oxygen/fiscal providers, couriers, professional advisers/accountants and public authorities where legally required. Optional analytics is subject to the privacy terms and safeguards of its provider.
Retention
Order and fiscal records are retained for the periods required by applicable accounting and tax law. Enquiries are retained only for as long as reasonably necessary for the request and any related legal claims. Waitlist data is retained until unsubscribe or deletion. Analytics retention follows the configured analytics settings and applies only where consent has been given.
Your rights
Subject to the GDPR and applicable law, you may have rights of access, rectification, erasure, restriction, portability and objection, and you may withdraw consent at any time without affecting prior lawful processing. You may also lodge a complaint with the Hellenic Data Protection Authority.
Security and changes
Reasonable technical and organisational safeguards are used to protect data. This policy may be updated when providers, processing activities or legal requirements change; the current version is published here.