Privacy Policy (GDPR)

Last updated: 12.11.2026

1. Controller

The controller for the processing of your personal data is Arinela, …………, Greece, e-mail: …………, phone: …………. We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and Greek Law 4624/2019.

2. What we process, why, and on which legal basis

Orders and contract performance — name, addresses, e-mail, phone, order details, payment status. Legal basis: performance of a contract (art. 6(1)(b) GDPR).
Customer account — login data, order history, saved addresses. Legal basis: contract (art. 6(1)(b)).
Invoicing and accounting — data required by Greek tax law, including transmission of invoice data to the myDATA platform of the Independent Authority for Public Revenue (AADE). Legal basis: legal obligation (art. 6(1)(c)).
Customer service and withdrawal/return requests — your messages and related order data. Legal basis: contract and legal obligation.
Newsletter — e-mail address, only with your consent (art. 6(1)(a)); you can unsubscribe at any time via the link in each e-mail.
Website security and operation — IP address, browser data, logs, necessary cookies. Legal basis: legitimate interest (art. 6(1)(f)) in a secure and functioning shop.
Analytics and marketing cookies — only with your consent (art. 6(1)(a) GDPR and art. 4(5) Law 3471/2006). See our Cookie Policy.

3. Recipients

We share data only as necessary with: payment service providers, shipping and courier companies, our hosting and e-commerce platform provider (acting as processor under art. 28 GDPR), e-mail delivery providers, our accountant and the tax authorities, and—if you consent—analytics/advertising providers.

4. Transfers outside the EEA

Some providers may process data outside the European Economic Area. In such cases transfers take place only on the basis of an adequacy decision (e.g. EU-US Data Privacy Framework) or the European Commission's Standard Contractual Clauses.

5. Retention

Order and invoicing data are kept for as long as required by Greek tax and commercial law (generally 5 years from the end of the financial year, longer where the law requires). Account data are kept until you delete your account; newsletter data until you withdraw consent.

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, and the right to withdraw consent at any time without affecting the lawfulness of prior processing (arts. 15–21 GDPR). To exercise your rights, contact ………….

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1-3, 115 23 Athens, www.dpa.gr.

7. Automated decision-making

We do not use automated decision-making, including profiling, that produces legal effects concerning you.