Personal Data Protection Policy

1. Data controller

The processing manager is the company Olive Collection Epsilon Estate IKE, Loft Semeli, Malades, 715 00 Heraklion Crete, tel. +30 2810 319 222, email info@olivecollection.gr, which operates the website olivecollection.gr and its online store.

2. To whom it is addressed

The policy applies to all visitors and users of the e-shop, whether they create an account or make a purchase or not.

3. What data do we collect

• Identity details: Name, surname and account connection details (user name, password). For invoice issuance: Tax ID, VAT number, activity and name.
• Contact information: shipping and billing address (may vary), email, landline or mobile phone, and our communication history, such as help requests, complaints, and recorded telephone orders.
• Financial data: payment details and bank account for deposits to the company.
• Transaction details: purchases, previous orders and returns.
• Technical details: IP address, browser and operating system, connection speed, software elements, connection data to the server and information from cookies. Non-essential cookies require your consent.
• Advertising elements: Response to promotional actions, choices, search history, preferred product categories, referral links, and preferred method of communication. Collected primarily through advertising cookies and only with your consent.
• Investigations: Your answers to our surveys, unless they are anonymous.
• Contests: your participation in draws, competitions and promotional activities, for verification, communication with the winners and the delivery of gifts.
• Through social networking: if you connect through social media, your username or nickname, profile information, and as much content as your privacy settings allow.

Data that we do not collect

• Minors: The website is not intended for individuals under 18 years of age, and buyers declare that they are over 18 years of age. If we discover that we have collected data from an underage person, we delete it immediately.
• Special categories of data: Please do not send us sensitive data (e.g., origin, beliefs, health, biometrics, sexual orientation, union activity, criminal record). If we receive such data, we delete it immediately.
• Third-party websites and payment providers: We are not responsible for third-party websites to which links from our page lead. Payments made through independent providers are governed by those providers’ privacy policies.

4. Where we collect the data

• From you, when you place an order, create an account or participate in surveys and promotions.
• Automatically from your device when you use the website.
• From our mutual business relationship.
• From third parties (e.g., third-party cookies, social media connections) and from publicly available sources.
• From participating pickup locations: if you pick up your order from such a location, you can send us a signed delivery form with your name, order number, and the date of receipt.

If you provide data about third parties to us, you must do so legally. Also, make sure to keep your own data accurate and up to date.

5. For what purposes do we use them

• A. Execution of the contract: order processing and tracking, problem solving, billing, customer service and compliance with our obligations.
• B. Account management: if you create an account.
• G. Communication with you.
• D. Promotion: (a) newsletter, with your consent; (b) email for products, with your consent; (c) competitions and promotions, if you participate; (d) personalized advertising, based on browsing behavior, purchases, and cookies.
• E. Analysis and research: satisfaction surveys and improvements to our services.
• ST. Compliance with the law: legal and regulatory obligations, decisions of authorities and courts.
• Z. Legal interests: establishment and defense of legal claims; fraud prevention, security and protection of rights, systems, property, personnel and users; compliance with contracts with third parties; corporate transfers, such as the sale or transfer of assets.

6. Legal basis

• Execution of the contract: Purposes A and B. For communication with individuals with whom we do not have a contract, legitimate interest applies.
• Consent: Purposes B and C (a–d). Completing the registration form constitutes consent to the processing of the necessary data. You can revoke your consent at any time without consequences, by using the deletion link in our emails or by deleting your account; then you will no longer receive promotional messages and will lose your registered user status.
• Legal obligation: Purpose ST. The provision of this data is mandatory.
• Legitimate interest: Purposes E, Z and D (e). We have balanced our interests with your rights and concluded that they do not exceed them.

7. How long do we keep them

We retain data only for as long as necessary for the purpose for which it was collected, as required by law, or as necessary to establish or defend legal claims. If you close your account, your data will be deleted unless the law or legal claims require its retention.

8. Processing principles

• Legality, objectivity and transparency
• Limiting the purpose
• Minimization of data
• Accuracy, with immediate correction or deletion of inaccurate data
• Limiting the storage period
• Integrity and confidentiality

9. Security

We implement appropriate technical and organizational measures, such as encryption and pseudonymization, which we regularly review. No online system is completely secure, so we ask you to keep your connection details confidential.

10. Recipients of the data

• Authorized personnel and management, only those who need them.
• Service providers: email marketing, fraud prevention and security, analytics, customer service and communication, cloud and IT, postal and courier services, advertising and promotion, market and satisfaction research, call centers, review providers, and co-located pickup points (name only, order number, date, and products).
• Public, judicial and supervisory authorities, mediators and arbitration bodies, as well as professional advisors (lawyers, auditors, accountants).
• Potential buyers of the whole or part of the business or its assets.
• Third parties that collect data through cookies (e.g., advertisers), only with your consent.

Those recipients who are independent data controllers have their own privacy policies.

11. Transfers outside the EEA

We only transmit data outside the European Economic Area if the destination country has a decision of adequacy from the European Commission, if appropriate guarantees (usually standard contractual clauses) exist, or if a legal exception applies, such as explicit consent, performance of a contract, or legal claims.

12. Your rights

• Access to your data and information about its processing.
• Correction and completion.
• Restriction of processing.
• Objection to the processing.
• Deletion («right to be forgotten»), in certain cases.
• Portability of data.
• Withdrawal of consent at any time, without affecting the legality of the previous processing.
• Complaint to the Personal Data Protection Authority (Kifissia 1-3, 115 23 Athens, www.dpa.gr).

We may ask you for proof of identity. The rights of restriction, objection and deletion may be limited when the data is necessary for a contract or legal obligation.

13. How to exercise your rights

Write to us at Lophos Semeli, Malades, 715 00 Heraklion Crete or at info@olivecollection.gr. You can also revoke your consent via the opt-out link in our emails or by deleting your account, and view or correct your details from your account.

We respond within 30 days. For complex or multiple requests, the deadline can be extended by 60 days, and we will inform you within the first 30 days. Exercising your rights is free; for manifestly unfounded, excessive, or repetitive requests, a reasonable fee may be charged or rejected.

14. Changes in policy

We may update this policy to reflect legal requirements and actual processing. Important changes will be announced on the website or by email; smaller changes appear only on this page, so we suggest you check it regularly.