This is a translation of the Greek text. If the two differ, the Greek text prevails.
Who we are
The controller of the personal data collected through the website ekfyseosfyteias.com is the Social Cooperative Enterprise of Collective and Social Benefit of Women «Ek Fyseos Fyteias» (KoinSEp), Fyteia, Veria, P.O. Box 80, 59100 Veria, Greece, Tax ID (ΑΦΜ) 996822137, G.E.MI. No. 178588061000.
For anything concerning your data you can write to us at ekfyseosfyteias@gmail.com, call us on +30 698 162 7561 or use the contact form.
When you send us a message
When you fill in the contact form, we record your name, email address and message, and the topic, if you choose one. We use them only to reply to you and to deal with your request, for example about the availability of a product, an order or working together on an event. The same applies when you email us directly or call us.
Legal basis. When your message concerns an order or working together, the processing is necessary to take steps at your request before entering into a contract (Article 6(1)(b) GDPR). In every other case it relies on our legitimate interest in replying to anyone who writes to us (Article 6(1)(f) GDPR).
Where it goes. The message is stored on our website's platform, and a notification email with your name, email address and message reaches our mailbox, ekfyseosfyteias@gmail.com. We do not send you any automatic email; we reply ourselves.
How long we keep it. For as long as it takes to deal with your request and anything that follows from it, for example an order, after which we delete it. You can ask us to delete it at any time.
The map on the contact page
The map showing where we are loads only if you press «Show map». Your browser then requests the map images from the CARTO service (CartoDB Inc., USA), which, like every website your device connects to, receives your IP address. Under its terms, CARTO truncates it as soon as it is received and keeps the truncated logs for 30 days, in the USA.
The «Google Maps» and «Apple Maps» buttons open our location in those services, in a new tab; from there on, their own terms apply.
Links to other websites
The links to Facebook and Instagram are plain links: our pages load nothing from those websites before you press them.
Server logs
Every time you visit ekfyseosfyteias.com, your browser necessarily sends some technical information, without which the page cannot be shown to you. For every request the following is recorded automatically:
- your device's IP address and the country the request comes from, as identified by the Cloudflare network,
- the date and time of the request, how long it took to serve and the status code the server answered with,
- the address (domain and path) of the page or file requested, the request method and protocol, and the size of the request and of the response,
- the browser and device identification your browser declares about itself (the user agent), and a code that locates the request in the Cloudflare network.
The parameters of the address (everything after the "?", such as search terms), cookies, sign-in credentials and the page you came from (the Referer) are not recorded. The codes that some links carry, such as links to reset a password, confirm an email address or a subscription, view a guest order, unsubscribe from emails, recover a basket or download a copy of your data, are replaced before anything is stored. In some cases the IP address also appears in the operational logs of the site's applications, for example when an error or a security event is recorded; the same purposes and the same retention period apply to them.
Purpose and legal basis. This information is used only to keep the site and the systems behind it secure (detecting and stopping attacks, abuse and attempts at unauthorised access) and to investigate and fix technical faults. The legal basis is the legitimate interest in keeping the site, and the platform it runs on, secure and available (Article 6(1)(f) GDPR; see also Recital 49). It is not used for advertising or for profiling.
How long it is kept. Server logs are deleted automatically 14 days after they are recorded.
Recipients. Ek Fyseos Fyteias runs on the GrooveShop e-commerce platform. The platform's provider hosts the site and keeps the server logs, which only its authorised technical staff can access. The logs are stored on servers of Hetzner Online GmbH in Germany. All or part of the traffic to the site (images, for example) passes through the network of Cloudflare, Inc. (USA), which processes the request data to deliver it and to protect the site from attacks. Transfers to the United States rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework and on standard contractual clauses. Information from the logs may be given to public authorities only where the law requires it.
Your rights. You can ask for access to this information, for its erasure or for its processing to be restricted, and for information about the legitimate-interest assessment the processing relies on, through the store's contact page. The logs are not organised by person, so finding the entries about you needs your IP address and the time of your visit; entries older than 14 days have already been deleted. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).
Right to object. You have the right to object at any time, on grounds relating to your particular situation, to this processing, because it is based on legitimate interest (Article 21 GDPR). Your data is then no longer processed, unless compelling legitimate grounds are demonstrated that override your interests, rights and freedoms, or the data is needed for the establishment, exercise or defence of legal claims.
Backups
The website's platform keeps daily backups of the database, on the same servers in Germany, and deletes them automatically after 7 days; backups taken on an ad-hoc basis, for example before an upgrade, are deleted in the weekly clean-up once they are 30 days old. Data we delete may therefore remain in these backups until they are deleted too.
Who else receives data
To run the website, data is processed on our behalf by:
- the provider of the GrooveShop platform the website runs on, which hosts the website and its data,
- Hetzner Online GmbH, on whose servers in Nuremberg, Germany, it is stored,
- Cloudflare, Inc. (USA), whose network carries the traffic to the website,
- Plus Five Five, Inc. (Resend, USA), which sends the notification email for every message from the form,
- Google, whose Gmail service holds our mailbox,
- CartoDB Inc. (CARTO, USA), only if you ask for the map.
Where data is transferred to the United States, the transfer relies on the safeguards of Chapter V GDPR: the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework or standard contractual clauses. We do not sell your data or give it to anyone for advertising.
Your rights
You have the right to ask for access to your data, for it to be corrected or erased or its processing restricted, to receive the data you gave us in a structured, commonly used format, and to object to processing based on our legitimate interest (Articles 15 to 21 GDPR). To exercise them, write to us or call us; we will reply within one month.
You also have the right to lodge a complaint with the Hellenic Data Protection Authority, Kifisias 1-3, 115 23 Athens, Greece, www.dpa.gr.
Changes
If the way we process your data changes, we will update this page.
Last updated: 15 October 2026