Privacy policy
This policy explains what personal data PINAX collects, why, who receives it and what rights you have. It applies the EU General Data Protection Regulation (Regulation (EU) 2016/679, the GDPR) and Greek Law 4624/2019, which implements the GDPR in Greece. The data controller is the company named in the box above.
1. What we collect and why
| Data | Purpose | Legal basis (GDPR Article 6) |
|---|---|---|
| Name, billing and delivery addresses, email, phone, order contents | To take, pack, deliver and support your order | Contract, 6(1)(b) |
| Invoices and order records | To keep the accounting and tax records Greek law requires | Legal obligation, 6(1)(c) |
| Payment details | To take payment. Card numbers are handled by the payment provider and never reach our servers | Contract, 6(1)(b) |
| Account login, if you create one | To show your orders and saved addresses | Contract, 6(1)(b) |
| Waitlist and newsletter email | To tell you when a product or harvest drop opens, or to send the newsletter you asked for | Consent, 6(1)(a) |
| Emails you send us | To answer you | Legitimate interest, 6(1)(f), or contract where it concerns an order |
| Company name and VAT number | To issue a VAT invoice and check the number in the EU VIES system | Legal obligation, 6(1)(c) |
| IP address, browser, server logs | To keep the site secure and prevent fraud | Legitimate interest, 6(1)(f) |
| Chosen destination country | To show the right prices, VAT and restrictions | Legitimate interest, 6(1)(f); stored in a cookie, see Cookies |
We do not buy data, we do not sell data, and we do not use your data for automated decisions that affect you legally.
2. Who receives your data
- Payment provider: [to be confirmed].
- Couriers: name, delivery address, phone and parcel details, so they can deliver. Carriers: [to be confirmed].
- Customs brokers and authorities for deliveries outside the EU, including duties-paid shipments.
- The US Food and Drug Administration for food orders to the United States: US law requires a Prior Notice naming the recipient and delivery address before dispatch.
- Hosting and email providers that run the website and our mailbox: [to be confirmed].
- Our accountant and the Greek tax authority, for invoices and tax returns.
Each processor acts under a written agreement and only on our instructions.
3. Transfers outside the EU
When you order for delivery outside the EU, your delivery data must go to the destination country’s carriers and customs. That transfer is necessary to perform the contract you asked for (GDPR Article 49(1)(b)). Where a service provider processes data outside the EU for other purposes, we rely on an adequacy decision or the European Commission’s standard contractual clauses.
4. How long we keep it
- Orders and invoices: for the period required by Greek tax and accounting law.
- Accounts: until you delete your account, then as for orders.
- Waitlist and newsletter: until you unsubscribe, or until the product is withdrawn.
- Correspondence: up to two years after the matter is closed.
- Security logs: a short period, typically weeks, unless needed to investigate an incident.
5. Your rights
You have the right to access your data, have it corrected, have it erased, restrict or object to its processing, and receive it in a portable format (GDPR Articles 15 to 21). Where we rely on consent, you may withdraw it at any time; this does not affect processing already done. Write to the address on the Contact page. We answer within one month.
You also have the right to complain to a supervisory authority. In Greece this is the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), www.dpa.gr. You may also complain to the authority in the EU country where you live or work.
6. Cookies
The shop uses cookies needed for the cart, checkout, login and your destination country. We do not use advertising cookies. The full list, by name, is on the Cookies page.
7. Security
The site runs over an encrypted connection. Access to order data is limited to people who need it to fulfil orders. If a breach puts your data at risk, we will notify the Hellenic Data Protection Authority and, where required, you.
Version 0.1, prepared September 2026, awaiting legal review before launch.