1. Controller and contact
The controller of www.lalousi.com is the sole proprietorship trading as “LALOUSI MARIA”, VAT No. 158056609, registered address Kefallinias 111, Agioi Anargyroi, GR-135 61, Greece, email [email protected]. For any personal-data request, email [email protected] with the subject “Privacy request”.
2. Data we collect
Depending on how you use the website, we may process:
- account and order details: name, email, telephone number, billing/delivery address, products, value, status and order history;
- contact details and the content of messages you send us;
- technical and usage data: IP address, cookies, device/browser identifiers, logs and pages visited, to the extent relevant services are used;
- payment data: payments are processed securely by authorised payment service providers or via bank transfer. Lalousi does not receive or store full card details or CVV;
- Gift Card recipient data: name, email, optional message and scheduled delivery date, supplied by the purchaser;
- newsletter data: email and, if requested, name/preferences.
Please do not send us sensitive personal data that is not necessary for customer service.
Providing identification, contact, and delivery details is necessary for the conclusion and performance of the sales contract. Without these details, we cannot process, invoice, or dispatch your order.
3. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Account creation, orders, payment, production, delivery, service and returns | account/order/contact details | performance of a contract or steps before entering a contract |
| Accounting, tax, consumer-law and other legal obligations | invoices, orders and related records | compliance with a legal obligation |
| Website protection, fraud prevention, security, dispute management and defence of claims | technical data, logs, transactions and communications | our legitimate interests, balanced against your rights |
| Newsletter and direct marketing | email, name/preferences | consent or, where permitted, legitimate interests for existing customers with an easy right to object |
| Non-essential cookies, analytics and advertising pixels | cookies/online identifiers | consent |
| Gift Card delivery | recipient data and message | performance of the Gift Card purchase; the purchaser must have a lawful basis to provide the recipient’s details |
4. Recipients and service providers
We disclose data only as necessary to the following recipients/processors:
- courier companies to deliver orders;
- authorised payment service providers and banking institutions to process payments;
- web hosting, technical maintenance, and website security providers;
- transactional email and newsletter service providers;
- cookie management and traffic analytics providers, strictly in line with your cookie preferences;
- accountants, legal advisers, public authorities, or courts when required by law or for exercising/defending legal claims.
We do not sell personal data. We select providers contractually bound to use the data for their services and in accordance with our instructions where they act as processors.
5. Transfers outside the EEA
Some providers may process data outside the European Economic Area. Where this occurs, we use appropriate safeguards, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, and additional measures where required.
6. Retention
We retain data only for as long as needed for the purpose collected:
- order and invoicing records: for 5 years in accordance with applicable tax regulations;
- customer account: until deletion or as needed for outstanding obligations/disputes;
- contact requests: until 6 months after the request is resolved;
- newsletter: until consent is withdrawn or you object/unsubscribe;
- Gift Card information: until delivery and redemption/resolution of any related issue, unless required for order records or obligations;
- cookies: as stated in the cookie banner/cookie table.
We then delete or anonymise the data unless law or a claim requires longer retention.
7. Cookies and similar technologies
We use strictly necessary cookies for website operation, cart, checkout, security and language selection. These do not require consent where permitted by law. Analytics, marketing and other non-essential cookies are enabled only after your consent through the cookie banner. You can change or withdraw choices at any time through the “Cookie Settings” link in the website footer.
8. Your rights
Subject to the GDPR, you have rights of access, rectification, erasure, restriction, portability, objection to processing based on legitimate interests, and withdrawal of consent at any time without affecting prior lawful processing. For marketing, you may object or use the unsubscribe link in every message.
We normally respond within one month of a valid request, with a lawful extension where necessary. We may request reasonable information to verify identity. You may also lodge a complaint with the Hellenic Data Protection Authority (HDPA), www.dpa.gr.
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or significantly affect you.
9. Security
We use reasonable technical and organisational measures to protect data. No internet transmission or storage is completely secure, so we limit access and work with suitable providers.
10. Changes to this policy
We may update this policy to reflect changes in our services or the law. The current version and last-updated date will be published on this page.