We respect your privacy and collect only what we need to make, sell and deliver our pieces and to answer your questions. This policy explains what personal data we process when you visit metallotexnia-tsatsis.gr or buy from us, why, and what rights you have under the EU General Data Protection Regulation (GDPR) and Greek law (Law 4624/2019).
1. Data controller
Metallotexnia Tsatsis
Neraida, 46100 Igoumenitsa, Thesprotia, Greece
VAT number (ΑΦΜ): 803246702
Email: info@metallotexnia-tsatsis.gr · Telephone: +30 26660 31209
We have not appointed a Data Protection Officer, as we are not required to; for any privacy question, please write to the email address above.
2. What data we collect and why
When you place an order
- Data: name, billing and delivery address, email, telephone, company and VAT number (if you buy as a business), order details, payment status. Card details are entered directly with our payment provider; we never see or store your full card number.
- Purpose: to process, deliver and invoice your order, handle returns and guarantee claims, and communicate with you about your order.
- Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with our tax and accounting obligations (Art. 6(1)(c) GDPR).
When you contact us (contact form, email, telephone or the WhatsApp button)
- Data: your name, contact details and the content of your message.
- Purpose: to answer your enquiry and, where relevant, prepare a quotation or a made-to-measure commission.
- Legal basis: steps prior to entering into a contract at your request (Art. 6(1)(b)), or our legitimate interest in answering enquiries (Art. 6(1)(f)).
When you browse the Website
- Data: technical data such as IP address, browser type, device, language and the pages you visit, recorded in server logs and by strictly necessary cookies (e.g. for your basket and language).
- Purpose: to deliver the Website securely, prevent fraud and abuse, and remember your basket and language.
- Legal basis: our legitimate interest in operating a secure online shop (Art. 6(1)(f)) and, for non-essential cookies, your consent (Art. 6(1)(a)). See our Cookie Policy.
Fraud prevention during payment
- Our payment provider analyses payment and device data to detect and prevent fraud. This is necessary to protect you and us (legitimate interest, Art. 6(1)(f)) and, for the provider, a legal obligation.
We do not currently send newsletters or marketing emails.
Advertising
- Data: an online identifier stored in a cookie, the ad you clicked, and whether the visit led to a purchase (order value and the products bought).
- Purpose: to measure which Google ads bring customers and to show our ads to people who have visited the shop (remarketing).
- Legal basis: for visitors in the EU/EEA, the UK and Switzerland, your consent (Art. 6(1)(a)), given by clicking Accept in the cookie banner; without it, Google Ads sets no cookies and receives only anonymous, cookieless signals. For visitors elsewhere, our legitimate interest in measuring and promoting our products (Art. 6(1)(f)); you can object by rejecting cookies in the banner.
- Recipient: Google Ireland Ltd; data may be transferred to the USA under the EU–US Data Privacy Framework.
Website statistics
- Data: pages viewed, approximate location (country/city), device and browser type, and how you arrived at the Website, collected by Google Analytics.
- Purpose: to understand which pages and products interest visitors and to improve the Website.
- Legal basis: for visitors in the EU/EEA, the UK and Switzerland, your consent (Art. 6(1)(a)), given by clicking Accept in the cookie banner; without it, no analytics cookies are set. For visitors elsewhere, our legitimate interest in measuring and improving the Website (Art. 6(1)(f)); you can object by rejecting cookies in the banner. You can withdraw consent at any time (see our Cookie Policy).
- Recipient: Google Ireland Ltd as our processor; data may be transferred to the USA under the EU–US Data Privacy Framework. Analytics data is kept for no longer than 14 months.
3. Who receives your data
We do not sell or rent your personal data. We share it only with the service providers we need, who act on our instructions or, where stated, as independent controllers:
- Hosting and website infrastructure: Hostinger (servers in the EU).
- Payments: WooPayments by Automattic, powered by Stripe, including Apple Pay and Google Pay when you choose them. Stripe also acts as an independent controller for fraud prevention and regulatory purposes.
- Couriers: the delivery company handling your parcel, which receives your name, address and telephone.
- Email delivery: the email service we use to send order confirmations.
- WhatsApp (Meta Platforms Ireland): only if you choose to contact us through the WhatsApp button.
- YouTube (Google Ireland): when you play videos embedded on the Website.
- Our accountant and tax authorities: for invoicing and legal obligations.
- Public authorities or courts: where the law requires it.
4. Transfers outside the European Economic Area
Some providers (for example Stripe, Automattic, Google and Meta) may process data in the United States. Such transfers rely on the EU–US Data Privacy Framework, for providers certified under it, or on the European Commission’s Standard Contractual Clauses, together with additional safeguards where necessary. If you buy from outside the EU, your delivery data is necessarily transferred to the courier and authorities in your country in order to deliver the order (Art. 49(1)(b) GDPR).
5. How long we keep your data
- Orders and invoices: for as long as Greek tax and accounting law requires (generally at least five years from the end of the relevant tax year), and in any case for as long as claims under the contract may be brought.
- Enquiries that do not lead to an order: up to 24 months after our last contact.
- Server logs and security data: up to 90 days.
- Cookies: as stated in our Cookie Policy.
6. Your rights
You have the right to:
- access the personal data we hold about you and receive a copy;
- rectify inaccurate or incomplete data;
- erase your data, where there is no longer a legal reason to keep it;
- restrict processing in certain circumstances;
- data portability — receive the data you gave us in a structured, machine-readable format;
- object at any time to processing based on our legitimate interests, for reasons relating to your particular situation, and always to direct marketing;
- withdraw your consent at any time, without affecting processing carried out before withdrawal.
To exercise any of these rights, email info@metallotexnia-tsatsis.gr. We will reply within one month; this may be extended by two further months for complex requests, in which case we will tell you why. We may ask you to confirm your identity.
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects, other than the automated fraud checks carried out by our payment provider, which you can ask to have reviewed by a person.
7. Right to complain
If you believe that we process your data unlawfully, you may lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα, Kifisias 1-3, 11523 Athens, www.dpa.gr), or with the data protection authority of the EU country where you live or work. We would appreciate the chance to address your concern first.
8. Security
We use appropriate technical and organisational measures to protect your data, including encrypted (HTTPS) connections, secure payment processing by a certified provider, and access restricted to people who need it. No transmission over the internet can be guaranteed to be completely secure, but we take care to keep risks as low as possible.
9. Children
The Website is not directed at children under 16, and we do not knowingly collect their data.
10. Changes to this policy
We will update this policy when our practices or the law change. The date of the latest version is shown at the top of this page; important changes will be highlighted on the Website.
