Personal data protection

(GDPR)

Last update: 10 September 2025

1. Who we are (Data Controller)

Emmanuela Alevizopoulou – Emmanuela handcrafted for you, Gymnasiou 15, 57007 Chalkidona, Greece, VAT EL053866282, is the Data Controller for emmanuela.gr.

Contact: info@emmanuela.gr – T: 23910211321

If you believe we have not satisfied your request, you can contact the Data Protection Authority (DPA): dpa.gr.

2. What data we collect

  • Identification & contact details (e.g. name, email, phone, addresses).
  • Order, delivery & payment details (we do not store card details).
  • Marketing preferences (only with consent).
  • Online identifiers (cookies/similar technologies).

3. Purposes & legal bases

  • Contract execution: managing orders, payments, returns/warranties.
  • Legal obligation: tax/accounting compliance.
  • Legitimate interest: system security, fraud prevention, basic usage analysis.
  • Consent: newsletter, cookies analytics/marketing, personalization/recommendations.

We do not make automated decisions with legal or similarly significant effects for you.

4. Cookies & your choices

We use strictly necessary cookies for the site’s operation. Analytics/marketing are activated only with your explicit consent. You can change choices anytime via the banner or the “Cookie settings” link in the footer.

5. Who we share data with (indicative)

Processors & third parties contractually bound (DPA):

  • E-shop platform: Shopify (hosting/support).
  • Payments: Shopify Payments / PayPal etc.
  • Shipping: DHL, ELTA etc.
  • Email/CRM/Analytics/Ads: e.g. Klaviyo, Google Analytics, Meta, Pinterest.

Shopify acts as processor and/or controller for certain customer data, under the applicable Data Processing Addendum (DPA).

6. International transfers

Transfers outside the EU/EEA may occur. We use Standard Contractual Clauses (SCCs) and, where applicable, rely on the EU-US Data Privacy Framework, which was validated by the EU General Court on 03/09/2025 (appeal may follow).

7. Retention periods

Category Retention period
Orders & tax data At least 5 years (up to 20 years in tax evasion cases)
Support communication Up to 24 months from case closure
Marketing Until consent withdrawal or 24 months inactivity
Security/event logs Up to 12 months

8. Your rights

Access, correction, deletion, restriction, objection, portability, and consent withdrawal. We respond within 1 month of receiving the request (extension up to 2 months possible in complex cases).

9. Request submission (GDPR/DSAR)

Send us an email at info@emmanuela.gr with subject GDPR Request. We may ask for additional information to verify identity. Complaints can be made to the DPA (dpa.gr).

10. reCAPTCHA

We use Google reCAPTCHA to protect against malicious form use. Use is governed by Google’s Privacy Policy and Terms of Service.

11. Changes

We may update this policy; we will always post the date of last update.