ΠΟΛΙΤΙΚΗ ΠΡΟΣΤΑΣΙΑΣ ΠΡΟΣΩΠΙΚΩΝ ΔΕΔΟΜΕΝΩΝ

1. GENERAL INFORMATION

This Personal Data Protection Policy (hereinafter the “Policy”) applies to the online shop of the company trading as “ΚΑΛΟΓΗΡΟΥ ΜΕΛΠ ΠΑΠΑΔΟΠΟΥΛΟΣ ΔΗΜ ΙΚΕ” (VAT No. 800245921, Serres Tax Office), based in Amfipoli, Serres – Amfipoli-Drama National Road, Postcode 62041, Greece, tel. +30 697 337 8318 (hereinafter the “Company” or “NineRoads”), which is operated and managed by NineRoads through the Website www.nineroads.gr (hereinafter the “Website”, the “Site”, the “e-shop”). NINEROADS is the Controller of your personal data, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation). We value and respect your privacy to the greatest extent possible and necessary for the proper operation of the Website and its proper use by you.

This Policy should be read together with the Cookie Policy and the Terms & Conditions of our e-shop, as these texts form an integral part of this Policy and together govern the operation of the e-shop and the transactions made through it.

By continuing to browse our e-shop and/or making purchases, you automatically and unreservedly accept the terms of this Policy, as amended from time to time. We invite you to check this Policy periodically to stay informed of any changes we make. If you do not agree with the changes, you should not take any action (use of the website and/or purchase).

2. WHO THIS POLICY APPLIES TO

The following NINEROADS privacy policy applies to you if you:

– Browse our Site,

– Create an account and/or buy products from our e-shop,

– Contact us,

– Receive updates from us through our promotional activities

(hereinafter “you”).

3. HOW YOU CAN CONTACT US

Contact details: For any matter relating to this Policy and the processing of your personal data, you can contact us as follows:

– By phone on +30 697 337 8318 , Monday to Friday 9.00-17.00

– By post to the postal address: Amfipoli-Drama National Road, 62041 Amfipoli, Serres, Greece

– By e-mail to: info@nineroads.gr

4. YOUR PERSONAL DATA

4.1. Your Personal Data includes any information that, alone or in combination with other information, allows you to be uniquely identified, in accordance with the provisions of the Regulation, the Greek legislation in force at any time and the decisions of the Hellenic Data Protection Authority (HDPA), as well as the guidelines and decisions of the competent European bodies.

4.2. For example, we collect the following categories of Personal Data from you when you:

Contact and identity data (full name, e-mail), account login details (credentials)

Place an order

Identity data (full name)

Account login data (credentials)

Transaction/purchase data (billing address, delivery address, value and time of purchases, card type, payment method)

Contact data (phone number, e-mail)

Other financial and tax data (payment method, card type, transaction value, credits, refunds, receipt details)

Take part in an online survey/competition

As applicable, in accordance with the terms of each survey/competition

Data and information or general comments you share with us, e.g. about the products you use

Contact data (e-mail)

4.3. In addition, for example, we collect the following categories of personal data about you through automated means when you:

Browse the website

Technical data (Internet Protocol (IP) address, operating system)

Analytics data (statistical/pseudonymised data collected through cookies. You can find more details in our Cookie Policy)

4.4. Finally, for example, we collect the following categories of personal data about you from third parties when you:

Identity data (Facebook profile – your username)

Image data you have posted

Contact data (e-mail or phone)

4.5. Please note that for the processing of your Personal Data by Facebook and Google you will need to refer to their respective Privacy Policies. These companies are Joint Controllers with NINEROADS only for the processing of your personal data when you use them to log in to our e-shop.

4.6. Please note that during the payment process we do not collect, process, record or store payment information for that transaction, e.g. credit card numbers etc. You provide this information exclusively and directly to the relevant payment service provider.

4.7. If you provide Personal Data on behalf of a third party, you must make sure that this third party has first been made aware of this Policy.

4.8. To keep your information up to date, please let us know of any changes to the data we process about you.

4.9. This Website is not designed for children and we do not knowingly collect personal information from children/minors under 18. If you are under 18, please do not use our website and do not provide any information to us (i.e. do not create an account in our online shop, do not provide your e-mail to sign up to our newsletter, do not make any purchase and do not give us any information about yourself, including your name, address or contact details, etc).

5. COLLECTION & PROCESSING OF PERSONAL DATA (PURPOSE & LEGAL BASIS FOR PROCESSING)

5.1. The table below aims to inform you of the purposes for which each processing operation is carried out by NINEROADS (any operation or set of operations performed, with or without automated means, on personal data or sets of personal data, e.g. collection, storage, transfer, etc) and to present the legal basis (i.e. the lawful reason that allows us to process your personal data in the way and for the purpose we describe) on which each of them is based.

Purpose of Processing

Data

Legal Basis for Processing

Account Creation and Management

We collect the Personal Data you enter to create an account and/or the data you enter when ordering, which are automatically stored in your account, and we process them to create and maintain your account in our e-shop

Identity data (first name, surname)

Contact data (e-mail or phone)

Account login data (credentials – your e-mail/the details you have provided to a connected provider – Facebook: name and profile picture, e-mail address / Google: e-mail or phone)

Favourite products data

Order history data

Comments (content of the comment and the full name/nickname you use)

a) the performance of our contract. We process your Personal Data on the basis of the contract between us, at the pre-contractual stage, when it is concluded, during it or after it ends.

b) compliance with our legal obligations. We process the Personal Data that is necessary to fulfil our legal obligations regarding the management and keeping of tax records arising from the sales contract

c) our legitimate interest. We process your Personal Data to establish or defend any legal claim.

II.

Order Fulfilment

We collect your Personal Data when you place an order, exercise your right of withdrawal or return a product, or contact us about your order, and we process them to ship and deliver products, to process, manage and track your order and keep you updated on its progress, as well as to manage and complete your payments and secure our financial transaction

a) Identity data (full name)

Account login data (credentials)

Transaction/purchase data (billing address, delivery address, value, time of purchases, card type, payment method)

Contact data (phone number, e-mail)

Financial data (payment method, card type, transaction value, credits, refunds)

b) Tax data (receipt details)

a) the performance of our contract. We process your Personal Data on the basis of the contract between us, at the pre-contractual stage, when it is concluded, during it or after it ends.

our legitimate interest. We process your Personal Data to establish or defend any legal claim.

III.

Handling Requests

We collect the Personal Data you give us when you contact us by phone or e-mail, when you fill in the contact form on our site or when you message us on social media, and we process them to handle complaints you send us by e-mail or phone, to solve problems with orders or product defects after the sale, to meet your other requests and to record comments about the products we sell (either through the e-shop or in physical stores)

Identity data (first name, surname)

Contact data (e-mail, phone)

Transaction data, where required (type of purchase, time of purchase, time and place of delivery, withdrawal, your complaints, purchase history)

Information you share with us when you contact us

Given the different nature of the requests sent to NINEROADS by e-mail or phone, processing is based on the following legal bases:

a) the performance of our contract. We process your Personal Data on the basis of the contract between us, at the pre-contractual stage, when it is concluded, during it and/or after it ends, especially when you contact us with requests about your order,

b) compliance with our legal obligations. We process the Personal Data that is necessary for the customer service tools/means we use before and after the sale,

c) your consent, where applicable, for us to contact you about your request, following your request.

You can withdraw your consent at any time by sending an e-mail to info@nineroads.gr

IV.

Operation of the e-shop

We collect certain Personal Data through automated means when you browse the e-shop, and we process them to ensure the proper operation of the site, the security of transactions, the handling of technical issues and the improvement of our commercial processes and technical systems, so that we can offer you the best possible service and browsing experience on the Site

a) Technical data (Internet Protocol (IP) address, operating system)

b) Other data through Cookies and log files

a) Our company’s legitimate interest in the proper technical operation of our e-shop, the management and improvement of our technical systems and the security of transactions, which in this case is fairly balanced against your privacy and your rights.

b) Your consent, given by accepting the relevant cookies through the cookie banner of our website when browsing the e-shop – see our Cookie Policy for more details.

You can withdraw your consent through the cookie banner of our website.

Marketing Communication

We collect your contact details when:

a) you enter them in the relevant field on our website so that we can send you newsletters/abandoned cart reminders

b) you have made purchases in the e-shop, so that we can promote products related to your purchase

Contact data (e-mail)

a) Your consent. We process your data for marketing communication after you consent to sign up to our newsletter.

You can withdraw your consent at any time by clicking the unsubscribe button in the message you receive or by contacting our Company.

b) Our legitimate interest. If you have made purchases from the NINEROADS e-shop, we process your e-mail or any other data you have given us for this purpose, in order to contact you and suggest related and new products and services that we believe will interest you.

VI.

Taking part in an online survey or competition

We collect your personal data when we organise

– an online survey

– competition

and you express your wish to take part by sending us the details required for the relevant competition/survey, which we process in order to complete the competition/survey

Identity data (first name, surname)

Contact data (e-mail, phone)

Competition participation data

Data from the comments you send us

Your consent, so that we can process your personal data in order for you to take part in the online surveys or competitions we organise, in accordance with the terms of each competition.

You can withdraw your consent at any time by sending an e-mail to info@nineroads.gr

VII.

Submitting comments to NineRoads

We collect your personal data when you submit your comments, when you:

a) fill in the form

b) when we record calls relating to your comments

for the purpose of quality control of our products

The processing of personal data that you have manifestly made public to us is based on our obligation under Article 23 of Regulation (EU) 1223/2009 to maintain a procedure for collecting comments.

5.2. Where the legal basis for processing your data is our company’s legitimate interest, you can object to the processing by contacting the Company at info@nineroads.gr.

5.3. Where consent is required for commercial communication (e.g. for sending the NINEROADS Newsletter), you may choose to receive this communication at the e-mail address you provide to us. If you give us your consent to be contacted without providing an e-mail address (e.g. when creating an account), we will use the contact e-mail address you gave us when you registered.

5.4. Whenever you withdraw your consent, the withdrawal applies to the future.

5.5. Some of your personal data may be processed on the basis of our legitimate interest and our Company’s compliance with its legal obligations for other purposes, for example when we receive documents, requests, orders, court papers, warrants etc. from lawful third-party authorities or bodies, such as supervisory, prosecuting, judicial or tax authorities, for the investigation of crimes and to protect you against fraud or to combat any form of crime and infringement of legally protected interests.

5.6. During quality control of our products, when you submit your comments, no profiling takes place; this data is collected and used separately, for communication on a case-by-case basis depending on how you contacted us.

6. HOW LONG IS YOUR DATA KEPT?

We will keep your personal data for as long as you maintain your interaction with NINEROADS and/or for as long as it is necessary to fulfil the processing purposes described above (e.g. if you hold an Account, if you are subscribed to our newsletter, if you take part in competitions, if you buy any of our products, for tax purposes etc.). Your personal data is deleted immediately after the purposes for which it is kept have been fulfilled (e.g. if you hold an Account, if you buy a product from our shop, if you take part in competitions we organise, for tax purposes etc.), while some data (e.g. order data) may be kept in anonymised or pseudonymised form for statistical analysis. As long as their purpose has not been fulfilled, the data remains in the e-shop database until you request its deletion (e.g. if you request the deletion of your account), unless keeping it is required by a legal obligation (e.g. tax purposes) or to support a legal right of our Company.

7. WHAT ARE YOUR RIGHTS AND HOW CAN YOU EXERCISE THEM?

You can exercise your rights using our Company’s contact details above.

For your convenience, below is a detailed table of your rights with a relevant explanation (references to articles below relate to the General Data Protection Regulation (EU) 2016/679):

RIGHT

WHAT IS IT?

Access (Art. 15)

You can ask us to:

confirm that our Company processes your personal data

give you access to the data we process about you

give you information about how it is processed, such as: what data our company holds, why it uses it, to whom it is transferred, whether it is transferred to third countries, how it is protected, how long it is kept, what rights you have, how you can lodge a complaint, and where it was collected from if it was not collected from you.

Rectification (Art. 16)

You can ask our Company to correct untrue or inaccurate data about you, or to update it. In this context, our Company reserves the right to verify the accuracy of the data before correcting it and is obliged to inform the recipient to whom the personal data was disclosed, unless this proves impossible or involves disproportionate effort.

Erasure (Art. 17)

You can ask for your data to be erased when:

you have withdrawn the consent on which the processing is based

it is no longer needed for the purposes for which it was collected,

you find that it is being processed in another way or unlawfully

you object to the processing

Our company reserves the right to refuse to comply with the above right if the processing of the data is necessary a) for the purpose for which it was collected, b) for compliance with a legal obligation, c) for the establishment, exercise or defence of legal claims.

When you terminate the contracts between us, you can request the deletion of your Account and your data.

Erasure will be carried out when the above conditions are met.

Restriction (Art. 18)

You can ask our company to exercise your right to restriction of processing, i.e. for your personal data to be kept but not used, when:

its accuracy is contested, so that you can verify its accuracy

the processing is unlawful but you do not want the data erased

the processing of the data is no longer necessary for the purposes for which it was collected, but our company still needs it for the establishment, exercise or defence of legal claims

you object to its processing and are awaiting verification of the outcome, i.e. whether our company’s legitimate grounds override your own legitimate claims.

Portability (Art. 20)

You have the right to ask our Company to provide you with your personal data in a structured format, or you can ask for it to be transferred directly to another controller. This requires that the data was provided with consent or in the context of performing the contract, and that it is held by automated means and not on paper. A further condition is that the data was provided by you; this does not apply where the data has been derived by our company from the data you provided.

Objection (Art. 21)

You can object at any time to any processing of your personal data that is based on a) legitimate interest, b) the performance of a task, c) profiling. If you exercise this right, our Company must demonstrate compelling legitimate grounds that override your rights and freedoms, or that relate to the establishment, exercise or defence of legal claims, in order to continue the processing.

Withdrawal of consent

You have the right to withdraw your consent where consent is the basis for processing. You can withdraw your consent freely and at any time by contacting our Company using the contact details provided above. The withdrawal of consent applies to the future.

Right to human intervention (Art. 22)

Our Company does not take decisions by technical means that evaluate personal aspects of you and are based solely on automated processing which produces legal effects concerning you or similarly significantly affects you. Nor does it create a profile of you through automated processing of personal data without human intervention. You are hereby informed that you have the right to request human intervention in decisions taken through automated processing, and to express your point of view on the decision.

Supervisory authority / Alternative dispute resolution

You have the right to lodge a complaint with your local supervisory authority regarding the processing of your personal data. In Greece, the supervisory authority for data protection is the Hellenic Data Protection Authority – www.dpa.gr/

As protecting your privacy is a priority for our company, you can also contact our company at any time about any matter or complaint relating to the processing of your personal data.

In addition, our company suggests that you opt for alternative dispute resolution – mediation – as a more flexible way of resolving any disputes between you and our company.

8. PROCEDURE FOR EXERCISING YOUR RIGHTS

8.1. Identification: Our aim is to maintain a high level of confidentiality for all records kept by NINEROADS that contain personal data. For this reason, we reserve the right to ask you for certain information to prove your identity if you submit a request to exercise your rights in relation to these records.

8.2. Specific requests: Your request should include specific and true information and/or facts so that we can respond to it and/or fulfil it accurately. Otherwise, our Company reserves the right to reject requests that are unfounded, excessive, abusive or unlawful.

8.3. Timeframes: We will respond to your valid and accurate requests within one (1) month of receiving them, unless they are particularly complex or you have submitted a number of requests together. If we need more time to respond to your request, we will let you know within that month.

8.4. Cost: We will not charge you for exercising your rights in relation to your personal data unless, as provided by law, your request for access to information is unfounded or excessive, in which case we are entitled to charge a reasonable fee in the circumstances. In any case, we will inform you of any charges before completing your request.

8.5. Contact: You can contact us using the details given above and send us your comments, questions, observations or any complaints regarding this Policy and the collection and processing of your personal data in general.

9. RECIPIENTS OF YOUR DATA

9.1. For the proper operation of the e-shop and the fulfilment of its contractual obligations, our Company works with third-party companies which have access only to the data that is strictly necessary for activities such as those listed below:

Data recipients

Examples

Our service providers and partners, who provide services on our behalf according to our instructions

When we work with third parties for:

hosting our databases, building and providing technical support for the Website

transport and delivery of products

payments and refunds

accounting and legal services

marketing and communication activities

improving our products and services

the operational and IT organisation of the website

customer service by a partner company within the EU

case handling in compliance with the NineRoads procedure

NINEROADS Group companies

Within the scope of their responsibilities in each region where they operate

Any public, police, administrative or judicial authority

When required by law or by a decision of a competent court or Authority or another competent body/organisation (e.g. in the case of a lawful order, an official instruction or an official preliminary investigation)

9.2. When transferring your personal data, we always ensure the highest possible level of security. Your data will therefore only be transferred to service providers and partner companies that have been carefully selected and are bound by contract in advance.

9.3. All partner businesses that support our company’s systems and operations have access only to the data that is strictly necessary for the service they provide to us. They are bound by contract to keep your data confidential, to apply all technical and organisational measures for secure processing, and not to use your information in any way other than to help us provide you with the products and services we have agreed.

9.4. As a rule, the Company keeps your personal data on servers located within the European Economic Area (EEA). Where data is to be transferred to third countries outside the European Economic Area, it is mainly transferred to a country covered by an adequacy decision. If our Company needs to transfer your Personal Data to third countries for which there is no adequacy decision of the European Commission, or to International Organisations, all appropriate safeguards provided for in the applicable Greek and European data protection legislation and in the decisions and guidelines of the competent European data protection bodies regarding transfers to third countries will be applied, together with appropriate contractual, technical and organisational measures.

9.5. We may sell or buy shops, subsidiaries or business units as part of the development of our business. In such transactions, information concerning visitors to the Website remains subject to the commitments made in this Policy. After any sale or transfer, you will be able to contact the entity to which your personal data has been transferred with any questions about its processing.

10. DATA SECURITY

10.1. The Company takes all necessary technical and organisational security measures to protect and safeguard the confidentiality of your personal data (such as SSL, Web Application Firewall (WAF), Security Operation Center (SOC) for monitoring the WAF, Origin Lock on the WAF IP, regular updates of WordPress and WooCommerce, and other industry standards for the online and offline security of your personal data). If you have any questions about the security provided through the Website, you can send us an e-mail at info@nineroads.gr.

10.2. To carry out the processing, the Company selects people with the relevant professional qualifications who provide sufficient guarantees in terms of technical knowledge and personal integrity to maintain confidentiality. Through the relevant contractual commitments, including those with its partners, the Company takes all necessary security measures to protect and safeguard the secrecy, confidentiality and integrity of personal data. In any case, their security within the platform environment is subject to events beyond the Company’s control, as well as errors due to technical or other weaknesses of the network not controlled by the Company, or to force majeure or chance events.

10.3. You must not disclose the details/password of your Account and, in particular, you must protect it against unauthorised access by third parties.

11. CHANGES TO THIS POLICY

As the needs of e-shop visitors and our Company evolve, we reserve the right to amend this Policy at our discretion. Amendments to this Policy take effect from the date they are posted on this Website. We therefore recommend that you visit this section of the Website regularly so that you are always aware of any changes. Our right to process your personal data is set out in the Personal Data Protection Policy in force at any given time.

If, however, you would like any clarification or information about the changes, or you have any disagreement, reservation or question about them, you can contact us. Please note that any information/clarification given to you as above about possible changes to this Policy does not constitute a replacement, substitution or amendment of this Policy.

PRIVACY POLICY

PRIVACY POLICY

Shopping bag