Privacy Policy

Data controller

The controller of your personal data is:

Personal data is processed in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), Greek Law 4624/2019, Greek Law 3471/2006 and the other applicable legislation.

What data we collect

Depending on how you use the website, we may process:

Contact details

Your name, email address and telephone number.

Delivery details

Address, postcode, city, country and any other information needed for delivery.

Order details

The products you bought, the amounts, the order number, and the payment and delivery method.

Invoicing details

VAT number and tax office, where you ask us to issue an invoice.

Account details

The details needed to create and manage a customer account.

Communications

The content of messages or requests you send us.

Technical data

Data needed for the operation and security of the website, such as your IP address and technical information about your device and browser.

Cookie and related technology data

Data collected through cookies or similar technologies, in line with your choices and the applicable legislation.

We do not store, through the systems of kosmima-shop.gr, your full card number, your CVV code or other complete card details needed to carry out the payment. Card details are processed by the payment provider.

Why we process your data

We process your personal data for the following purposes:

Carrying out and managing orders

To process the order, to communicate with you and to deliver the products.LEGAL BASIS: PERFORMANCE OF A CONTRACT

Issuing documents and keeping accounting records

To meet our tax and accounting obligations.LEGAL BASIS: COMPLIANCE WITH A LEGAL OBLIGATION

Managing a customer account

To create and run your account, where you choose to create one.LEGAL BASIS: PERFORMANCE OF A CONTRACT

Communication and customer service

To answer your questions, requests and complaints.LEGAL BASIS: PERFORMANCE OF THE CONTRACT, WHERE THE REQUEST CONCERNS CARRYING OUT OR MANAGING AN ORDER · LEGITIMATE INTERESTS, WHERE IT IS A GENERAL REQUEST FOR INFORMATION OR ASSISTANCE

Website security and prevention of malicious activity

To protect the website, our systems and our users from fraud, abuse and other unlawful acts.LEGAL BASIS: LEGITIMATE INTERESTS

Newsletter and promotional communications

To send updates and offers, where applicable.LEGAL BASIS: CONSENT, WHERE REQUIRED BY THE APPLICABLE LEGISLATION

Non-essential cookies and related technologies

For statistics, traffic analysis or marketing, where applicable.LEGAL BASIS: CONSENT

Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

Who receives your data

Your personal data is disclosed only where this is necessary to run the shop, to carry out your order, to meet a legal obligation, or where another lawful basis requires it.

We may disclose data to the following categories:

Payment providers

The data needed to complete and confirm transactions.

Courier companies and delivery partners

Name, address, telephone number and, where required, details relating to cash on delivery.

Hosting and technical support providers

The data and technical access needed to run, maintain and secure the online shop.

Accountants and professional advisers

Order, document and invoicing details, to the extent needed for them to provide their services.

Google Ireland Limited

Data about how the website is used, for statistics and for measuring our advertising. Before you answer the cookie banner a signal is sent that carries no cookies and no identifiers, containing your IP address and your browser details; data that identifies you as a particular person is sent only with your consent.

Meta Platforms Ireland Limited

Data about how the website is used and about your orders, for advertising purposes, only where you have given consent for marketing. Without it, no data is sent.

Public or judicial authorities

Where this is required by the applicable legislation or by a lawful order.

We do not sell or rent your personal data.

Retention periods

We keep your personal data only for as long as is necessary for the purpose for which it was collected, or for as long as the applicable legislation requires.

By way of indication:

Order and document data

For as long as the tax and accounting legislation requires.

Customer account

Until your account is deleted, unless there is a lawful reason to keep it longer.

Newsletter

Until you withdraw your consent or the service is discontinued. Every message carries an unsubscribe link.

Communication data

For as long as is necessary to deal with your request and, where required, to defend or bring legal claims.

Technical data and security logs

For as long as is necessary for the security and proper operation of our systems.

Cookies

For the period set for each particular cookie.

Your rights

Subject to the conditions the GDPR provides, you have, among others, the following rights:

Access

To be told what personal data of yours we process, and to receive a copy of it.

Rectification

To ask that inaccurate or incomplete data be corrected.

Erasure

To ask that your data be deleted, where there is no lawful reason to keep it.

Restriction

To ask that processing be restricted, in the cases the law provides.

Portability

To receive the data you have given us in a structured, commonly used and machine-readable format, where applicable.

Objection

To object to processing based on legitimate interests, and to processing for direct marketing purposes.

Withdrawal of consent

Where processing is based on your consent, you may withdraw it at any time.

To exercise your rights, you can write to us at [email protected].

We answer your requests without undue delay and, as a rule, within one month of receiving the request.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) if you consider that the processing of your personal data infringes the applicable legislation.

Cookies and similar technologies

kosmima-shop.gr uses cookies and related technologies for the proper operation of the website and, where you have given your consent, for statistics and marketing.

Strictly necessary cookies

These are necessary for functions you have asked for, or for the safe and proper operation of the website, and are used without consent where they fall within the relevant statutory exemption.

Statistics cookies

These are used to understand how the website is used, and are set only with your consent, where consent is required.

Marketing cookies

These are used for advertising and related purposes, and are set only with your consent.

Non-essential cookies are not set before you consent.

For Google’s tools we use Consent Mode. Before you answer the banner, all the relevant signals are switched off and a signal is sent to Google that carries no cookies and no identifiers, containing your IP address and your browser details. No information is stored on or read from your device before you consent. Meta’s tools have no equivalent: nothing is loaded and nothing is sent before you give consent for marketing.

On your first visit you can accept or reject non-essential cookies. You can change your choice at any time from the Cookie Settings link in the footer.

Security

We take appropriate technical and organisational measures to protect personal data, and the website uses an encrypted HTTPS connection.

Transfers outside the European Economic Area

Where we use providers that process personal data outside the European Economic Area, those transfers are made in accordance with the conditions and appropriate safeguards the GDPR provides.

Further information about particular transfers can be provided on request.

Automated decision-making

We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you, within the meaning of Article 22 GDPR.

Changes

This Privacy Policy may be updated when our services, our processing methods or the relevant legal requirements change.

The date of the last update appears at the head of the page.

Where changes are material and significantly affect how we process your data, we will take appropriate steps to inform you and, where required, ask for fresh consent.

Contact

For any question about this Privacy Policy, or to exercise your rights: