Legal

Privacy policy

What we collect, why, who we share it with, and how you stay in control. In plain language.

Last updated: 29 September 2026

Who is responsible

The controller of your personal data is [Add legal name of the business in St. Delphine > Settings], [Add postal address in St. Delphine > Settings]. For anything about your data, write to [Add contact email in St. Delphine > Settings].

What we collect and why

Orders: name, email, delivery and billing address, phone if you give it, what you bought and payment status. We need this to make and deliver your order and to keep the accounting records the law requires. Legal basis: performing our contract with you, and our legal obligations (GDPR article 6(1)(b) and (c)).
Account: if you create one, your login details and saved addresses. Legal basis: contract.
Messages: what you send through the contact form or by email, so we can answer. Legal basis: our legitimate interest in replying to you, or steps before a contract.
Withdrawals and returns: the details you give in the withdrawal form, to process it and prove we received it. Legal basis: legal obligation.
Newsletter: your email address and the date you confirmed. Only if you sign up and confirm. Legal basis: your consent, which you can withdraw at any time with the link in every email.
Cookies and analytics: cookies needed to run the shop, and, only if you agree, cookies for measuring visits and adverts. Legal basis: necessary cookies, our legitimate interest; everything else, your consent. Cookie policy

We do not sell your data, and we do not make automated decisions about you.

Who we share it with

Only with the companies that help us run the shop, only what they need, and under contracts that oblige them to protect it:

Printful: our production partner, which makes and ships your order. It receives your name, delivery address, and order details. Its group includes companies outside the EU, so some data may be transferred under the European Commission's standard contractual clauses.
Payment provider: processes your payment and fraud checks. We never receive your full card details.
Carriers: receive your name, address and sometimes phone number to deliver the parcel.
Hosting and email providers: store the website and send its emails.
Invoicing and accounting: our invoicing service and accountant, and the Greek tax authority (AADE) through the myDATA system, as Greek law requires for every sale.

How long we keep it

Orders and invoices: as long as Greek tax and accounting law requires, generally five years from the end of the tax year, and longer if a tax audit is open.
Account: until you ask us to delete it.
Messages: up to two years after our last exchange.
Newsletter: until you unsubscribe. Unconfirmed sign-ups are deleted after 30 days.
Cookies: see the cookie policy.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. Write to us and we will answer within one month.

If you are not happy with our answer, you can complain to the Hellenic Data Protection Authority (dpa.gr) or to the data protection authority of the EU country where you live.

Security

The site runs on an encrypted connection. Access to order data is limited to the people who need it to serve you.

Changes

If we change this policy we will update the date at the top. For significant changes we will tell you by email if you have an account or subscribe to our newsletter.