Privacy Policy
Last updated: April 2026 · In accordance with GDPR (EU) 2016/679
1. Data Controller
GRAMILTD · VAT: 095394817 · Raktivan Square 12, Veria · Email: info@kasper.gr · Tel.: 2312315177
2. What data we collect and why
| Data category | What it includes | Purpose | Legal basis |
|---|---|---|---|
| Identity details | Name, surname, email, phone | Account creation, communication | Contract |
| Order details | Shipping/billing address, purchase history | Order execution, invoicing | Contract |
| Payment data | Card type, last 4 digits (only) | Payment processing | Contract |
| Technical data | IP, browser, device, cookies | Security, website improvement | Legitimate interest |
| Communication data | Queries, reviews, complaints | Customer service | Legitimate interest |
| Marketing | Email, communication preferences | Newsletter, offers | Consent |
We do not collect special categories of data (health, ethnic origin, political opinions, etc.).
3. How we collect your data
Directly from you
- Account creation
- Order completion
- Newsletter subscription
- Contact via form or email
- Product review submission
Automatically / Third parties
- Cookies and tracking technologies
- Google Analytics (traffic)
- Payment providers (Stripe, Viva, etc.)
- Logistics / courier providers
- Social media plugins
4. Who we share your data with
| Recipient | Purpose | Location |
|---|---|---|
| Payment providers (e.g. Stripe, Viva) | Transaction processing | EU / USA* |
| Courier companies (e.g. ACS, ELTA) | Order shipping | Greece |
| Google (Analytics, Ads) | Analytics & advertising | USA* |
| Meta (Facebook, Instagram) | Advertising | USA* |
| Email marketing provider | Newsletter sending | EU / USA* |
| Tax / accounting authorities | Legal obligation | Greece |
* Transfers outside the EU are carried out based on EU Standard Contractual Clauses or other appropriate safeguards.
5. Data retention periods
| Category | Duration |
|---|---|
| Order details / invoices | 10 years (tax obligation) |
| User account | Until deletion + 1 year |
| Marketing data | Until consent withdrawal |
| Log files | 12 months |
6. Data security
- SSL/TLS encryption on all transmissions
- Payment data encryption (PCI-DSS)
- Access control and staff authorization
- Regular backups
- Monitoring for suspicious activity
- Breach response procedure (72 hours)
7. Your rights
- Access: Receive a copy of your data
- Rectification: Correct inaccurate data
- Erasure: "Right to be forgotten"
- Restriction: Restrict processing
- Portability: Receive data in structured format
- Objection: Object to processing
To exercise rights: send email to info@kasper.gr. We respond within 30 days. Complaints to HDPA: www.dpa.gr · 210 6475600
8. Children
Our website is not intended for individuals under 16 years of age. We do not knowingly collect data from minors. If you notice anything like this, please contact us immediately.
9. Policy changes
We may update this policy periodically. Significant changes will be notified by email or a prominent banner on the website. Continued use after notification implies acceptance of the changes.
10. Contact
Data Protection Officer (DPO): GRAMILTD · Email: info@kasper.gr · Tel.: 2312315177 · Raktivan Square 12, Veria