What data we collect, why, for how long, who we share it with and what rights you have. Written in accordance with the General Data Protection Regulation (GDPR).
Contents
- Data controller
- What data we collect
- Purposes & legal bases
- How long we keep it
- Who we share it with
- Transfers outside the EEA
- Cookies & tracking technologies
- Newsletter & marketing communications
- Live chat & ZeoBot AI
- Automated decisions & profiling
- Data security
- Your rights
- Right to lodge a complaint
- Minors
- Changes to this policy
- Contact
1. Data controller
The controller of your personal data is:
Chatzigeorgiou Vassilios Chrysovalantis (sole proprietorship)
28 Thermopylon Street, Thessaloniki
VAT number 130821770 · Tax office Z’ Thessaloniki · General Commercial Registry (GEMI) No. 131014721000
For any personal data matter: [email protected] · 2311 29 55 20
Given the size and nature of our activity, we are not required to appoint a Data Protection Officer (DPO). Every request or question is answered directly by the business, at the contact details above.
2. What data we collect
You can browse our websites without giving any personal details. We collect data only when you give it to us or when it is technically necessary.
2.1 Data you give us
- Identification & contact: full name, email, telephone (landline or mobile).
- Address: street, number, city, post code, country — billing and shipping, as well as any delivery instructions you note.
- Invoicing details: for issuing an invoice, business name, VAT number, tax office and profession.
- Account details: username and encrypted password, order history, wishlist.
- Content of your communications: the messages you send us by email, contact form or live chat.
- Product reviews that you choose to publish.
2.2 Data collected automatically
- Technical data: IP address, browser type and version, operating system, language, device type.
- Usage data: pages you visited, time spent, referring page, date and time.
- Cookies and similar technologies — in detail in the Cookie Policy.
💳 We never see your card details
Card payments are processed exclusively within the secure environment of the payment providers (Viva, PayPal). We do not collect, do not see and do not store card numbers, CVV or passwords. We receive only the result of the transaction and a reference code.
ℹ️ We do not collect special categories of data
We do not ask for and do not process health data. If you voluntarily mention health information to us in a message or a telephone conversation (e.g. as part of a question about a MED® product), we use it only in order to answer you and we do not record it in a customer profile.
3. Purposes & legal bases
Every processing operation is carried out for a specific purpose and rests on a specific legal basis under Article 6 GDPR:
| Purpose | Data | Legal basis |
|---|---|---|
| Fulfilment of your order: processing, payment, shipment, communication about the order | Identification, contact, address, transaction details | Performance of a contract — Article 6(1)(b) |
| Creation and management of a user account | Account details, order history | Performance of a contract — Article 6(1)(b) |
| Issuing tax documents, keeping accounting and tax books | Invoicing details, transaction data | Legal obligation — Article 6(1)(c) |
| Handling withdrawals, returns and guarantees | Order & contact details | Legal obligation & performance of a contract |
| Answering questions, technical support, dosage advice | Contact details, message content | Legitimate interest — Article 6(1)(f) (customer service) |
| Newsletter and commercial offers by email | Full name, email | Consent — Article 6(1)(a) · or Article 11(3) of Law 3471/2006 for existing customers in respect of similar products, with the right to object in every message |
| Order updates by SMS | Mobile telephone number | Consent — you choose this at checkout |
| Usage statistics, performance measurement, website improvement | Technical data, usage data, cookies | Consent — through the cookie management tool |
| Advertising and remarketing | Cookies, device identifiers | Consent — through the cookie management tool |
| Website security, prevention of fraud and abuse | IP, technical data, log files | Legitimate interest — Article 6(1)(f) |
| Establishment, exercise or defence of legal claims | As applicable | Legitimate interest — Article 6(1)(f) |
Where the basis is consent, you can withdraw it at any time, without affecting the lawfulness of the processing carried out before the withdrawal. Where the basis is legitimate interest, you have the right to object (see section 12).
4. How long we keep it
| Category | Retention period |
|---|---|
| Tax documents & accounting records | 5 years from the end of the relevant tax year, as required by tax legislation |
| Order & delivery details | 5 years from completion of the order, to cover guarantees and any claims |
| User account | For as long as it remains active. Deleted after 3 years of inactivity, or immediately if you ask us to |
| Newsletter subscription | Until you unsubscribe or withdraw your consent |
| Correspondence & support enquiries | 2 years from the last contact |
| Live chat history | 12 months |
| Security log files (logs) | 6 months |
| Cookies | Per cookie — see the detailed table in the Cookie Policy |
| Product reviews | For as long as they remain published; they are deleted at your request |
Once the above periods expire, the data is securely deleted or anonymised. If a court dispute or an inspection by an authority is pending, the relevant data is kept until it is finally resolved.
5. Who we share it with
We do not sell and do not rent your data to anyone. We share it only with partners who need it in order for the service to work, on the basis of processing agreements pursuant to Article 28 GDPR:
| Recipient | Role | What they receive |
|---|---|---|
| BOX NOW | Delivery to a locker | Name, telephone, email, selected locker |
| Easy Mail · ELTA Courier | Courier deliveries within Greece | Name, address, telephone, cash on delivery amount |
| Hellenic Post (ELTA) | International shipments | Name, address, customs declaration details |
| The freight company you choose | Bulky shipments & pallets. We work with a network of around 35 freight companies by region — for example KIFA, Kasapis, Nea Idea, Kaimakas, Veria Express, Enosi Makedonias. The full list is available on request. | Name, address, telephone |
| Viva | Payment service provider | Amount, transaction details (it receives the card details directly from you) |
| PayPal | Payment service provider | Amount, transaction details |
| Retainful | Newsletter & abandoned cart emails | Name, email, cart contents |
| HubSpot | CRM, forms, live chat | Name, email, chat content, browsing data |
| Google (Analytics) | Usage statistics | Pseudonymised usage data — only with your consent |
| Skroutz · BestPrice | Price comparison engines | Visit & order identifier — only with your consent |
| Cloudflare | Content delivery network & attack protection | IP, technical request data |
| Hostinger | Website & database hosting | All of the store’s data |
| Accounting firm | Accounting & tax support | Tax documents & invoicing details |
| Public authorities | Only following a lawful request | Whatever the law provides for |
6. Transfers outside the EEA
Some of the partners above (for example Google, HubSpot, PayPal, Retainful, Cloudflare) are based, or maintain infrastructure, outside the European Economic Area (EEA), mainly in the USA.
These transfers are carried out with the safeguards of Chapter V GDPR:
- Adequacy decision of the European Commission, where the provider is certified under the EU–US Data Privacy Framework, or
- Standard Contractual Clauses (SCCs) of the European Commission, combined with additional technical and organisational measures.
A copy of the relevant safeguards is available on request at [email protected].
7. Cookies & tracking technologies
We use cookies and similar technologies. Those strictly necessary for the store to work are placed without consent. For all the others — statistical and advertising — we ask for your prior consent through the management tool that appears on your first visit.
A full list by category, provider, purpose and duration, together with instructions for withdrawing consent: Cookie Policy.
8. Newsletter & marketing communications
We send a newsletter roughly once a week, with guides, usage tips and offers. You can subscribe from the sign-up field on the website, when you create an account or when you place an order.
Unsubscribing is always available from the “Unsubscribe” link at the end of every message, or with an email to [email protected]. The request is carried out immediately and does not affect your orders.
The transactional emails concerning your order (confirmation, dispatch, invoice) are not marketing communications and are sent regardless of whether you are subscribed to the newsletter.
9. Live chat & ZeoBot AI
Two live communication channels operate on our websites:
- ZeoBot AI — our own assistant, which runs on Cloudflare Workers infrastructure under our own control.
- HubSpot live chat — for talking to a person from our team.
- What is recorded: the content of the conversation, the date and time, the IP address and — if you provide them — your full name and your email.
- Purpose: answering your question and improving our service.
- Replies are partly generated automatically. No decisions with legal consequences are taken through the chat, and you can always ask to be put in touch with a person.
- Please do not write sensitive personal data in the chat — nor card details or passwords.
10. Automated decisions & profiling
We do not take decisions based solely on automated processing that produce legal effects or significantly affect you, within the meaning of Article 22 GDPR.
If you have given consent for advertising cookies, you may see our ads on other websites based on a previous visit of yours (remarketing). You can stop this at any time by withdrawing your consent from the cookie settings.
11. Data security
We apply appropriate technical and organisational measures, proportionate to the risks:
- Encrypted TLS connection on all pages and forms.
- Encryption (“hashing”) of passwords — we cannot see your password.
- Access to the data limited to only those who need it for their work.
- Regular software updates, backups and protection against attacks through Cloudflare.
- Processing agreements with all our partners.
No transmission of data over the internet is absolutely secure. In the event of a breach that is likely to result in a high risk to your rights, we will inform you without undue delay and we will notify the Hellenic Data Protection Authority within 72 hours, pursuant to Articles 33–34 GDPR.
12. Your rights
As a data subject you have the following rights:
| Right | What it means |
|---|---|
| Access (Article 15) | To find out whether we process data about you and to receive a copy of it |
| Rectification (Article 16) | To correct inaccurate details or complete incomplete ones |
| Erasure (Article 17) | To ask for erasure, where there is no lawful ground for keeping the data |
| Restriction (Article 18) | To “freeze” the processing, e.g. while the accuracy of the data is being checked |
| Portability (Article 20) | To receive your data in a structured, commonly used file, or to have us transmit it to another controller |
| Objection (Article 21) | To object to processing based on legitimate interest. For direct marketing the right to object is absolute and is always satisfied |
| Withdrawal of consent (Article 7(3)) | To withdraw at any time a consent you have given, without affecting the lawfulness of the earlier processing |
How to exercise your rights
Send a request to [email protected] or by post to the business address. We reply within one month. For complex requests the deadline may be extended by a further two months, in which case we will inform you of the reason.
Exercising your rights is free of charge. We may ask you for additional details in order to confirm your identity — this is done for your own protection, so that your data is not given to a third party.
13. Right to lodge a complaint
If you consider that we are infringing data protection law, we would appreciate it if you contacted us first. Regardless of that, you have the right to lodge a complaint with the supervisory authority:
Hellenic Data Protection Authority (HDPA)
1-3 Kifisias Avenue, post code 115 23, Athens
Telephone: 210 6475600 · Email: [email protected]
Submitting a complaint: dpa.gr/el/wizard_kataggelion
14. Minors
Our online store is intended for adults. We do not knowingly collect data of children under 15 years of age — the age limit for consent to information society services under Law 4624/2019. If we become aware that we have collected such data without the consent of the holder of parental responsibility, we delete it immediately. If you are a parent or guardian and have a concern about this, write to us at [email protected].
15. Changes to this policy
We may update this policy, e.g. because of new services or changes in the law. The version in force is always posted on this page, with the date of the last update at the top. For material changes we will inform you in a prominent way or by email, before they take effect.
16. Contact
Personal data matters: [email protected]
Telephone: 2311 29 55 20, Monday – Friday 09:00 – 17:00
By post: Chatzigeorgiou Vassilios Chrysovalantis, 28 Thermopylon Street, Thessaloniki