1. Who we are
The online shop grifon.gr is owned and operated by GRIFON SPIRIDAKIS OE, which decides how and why your personal data is used.
- Registered office: Linoperamata, Gazi, Heraklion, Crete, postcode 71500
- Tax number: 802712744 · VAT: EL802712744 · Heraklion Tax Office · General Commercial Registry (ΓΕΜΗ): 181397127000
- Telephone: +30 2810 821627, +30 2810 821730, +30 6936 545855 (Monday–Friday, 8:00–16:00)
- Email address: info@grifon.gr
For anything concerning your data, email us at info@grifon.gr.
2. What this text covers
It covers the information you provide or leave when you visit grifon.gr, open an account, request wholesale access, place orders or contact us. The shop is intended exclusively for businesses; we do not sell to private consumers and we do not knowingly collect data about minors.
3. What we keep, why and on what basis
| What we keep | Why | Legal basis |
|---|---|---|
| First name, surname, email address and password when you open an account | To provide an account and allow you to order | Performance of our contract with you |
| Business name, address, city, postcode, country, tax number, the business contact’s full name and telephone number, and optionally two documents (company certificate, invoice), when you apply for wholesale access | To verify that you are a business and give you access to wholesale prices | Steps taken before entering into a contract, at your initiative |
| The status of your application and the reason if it is not accepted | To reply to you and know what has been decided | Our legitimate interest in managing our partner network |
| Orders: products, amounts, billing and delivery address, telephone number, carrier | To fulfil and deliver the order | Performance of our contract with you |
| Invoices and tax records, together with your tax number | To issue and retain records | Legal obligation |
| Card payment: card details are entered directly with the card payment provider (Cardlink, a Eurobank partner). We receive the payment status and, if you choose to save the card, retain a token, card type, last four digits and expiry date | To pay for the order | Performance of our contract with you |
| Messages in contact forms: name, email address, telephone number, in three forms also tax number and address, your message and files you attach (CV, price list, brochure, other attachments) | To reply to your request | Our legitimate interest in serving anyone who writes to us |
| Newsletter: your email address, the date and the network address used for registration | To send you news and offers | Your consent, which you may withdraw at any time |
| Technical operating data: the visit cookie, the automated protection of forms and checkout against automated programs (Google reCAPTCHA), and the history of changes made to your details | To make the basket work, prevent attacks and see what changed | Our legitimate interest in keeping the shop operational and secure |
| Visit statistics through Google Analytics, with an anonymised network address and, when you are logged in, an account identifier | To see which pages are read and improve the shop | Your cookie consent |
If you choose to sign in through Google, we receive an identifier, email, first name and surname from Google. We use them to create or sign in to your grifon.gr account.
Decisions to approve or reject a wholesale application are made by a person. Form checks score each submission automatically only to distinguish automated programs.
4. What we do not keep
We do not store the full card number or CVV. If you choose to save the card, we retain a token, card type, last four digits and expiry date. When you first register an account, we do not ask for gender or date of birth. We do not ask for marital status or interests. If you submit a CV for a job, its information is used to assess your application. There is no public account profile or username. If you submit a product review, we process the information you enter to manage it. Reviews are checked before publication; the text, rating and display name may appear publicly on the product page. We do not monitor your correspondence.
5. Who we share data with
Within the company, your data is seen only by staff handling applications, orders and customer service. Outside the company, we share it only with:
- Carriers that deliver orders, whether selected at checkout or by arrangement; we transfer only what is needed, such as name, address and telephone number.
- Our banks, when you pay by deposit or transfer.
- The card payment provider (Cardlink, a Eurobank partner), which processes the charge.
- Google, for visitor statistics and form checks.
- The external accounting office we work with, for the company’s records and books.
- The company that provides our shop software, for maintenance and synchronisation of its services.
- Public authorities, when required by law or to defend our rights.
The shop is hosted on a server with controlled access.
We do not sell or rent your data. We do not give it to third parties for their own advertising.
6. Transfers of data outside the European Union
Google is a company based outside the European Union, so some data may be processed outside the EU. These transfers are covered by the standard contractual clauses approved by the European Commission and applied by Google in its terms of use. The card payment provider (Cardlink, in cooperation with Eurobank) is based within the European Union.
7. How long we keep it
- Your account: while you keep it. When you request deletion, the request is checked and — provided there is no legal reason to retain it — the account and its data are deleted in full.
- Orders, invoices and tax records: at least five years from the end of the period or longer if another law requires it.
- Wholesale application and uploaded documents: for approved applications, for as long as our cooperation lasts. For rejected applications, three calendar months from rejection, after which the application and its attachments are deleted, unless retention is required by law or for a specific court case.
- Form messages: two years. CVs and attachments: one year, unless you ask us to keep them longer.
- Newsletter: until you unsubscribe.
- Visit cookie: 20 days. Your answer to the cookie message: up to one year (some browsers, such as Safari, limit this to a few days).
- Live chat conversations: one year.
We keep data beyond the periods above only when required by law or needed for court proceedings.
8. Security
We take the necessary technical and organisational measures so that your data is not lost, altered or accessed by the wrong people. The connection to the shop is encrypted. You are responsible for keeping your password secret — we will never ask you for it except when you log in to the shop. No transmission over the internet is completely secure, and we cannot guarantee otherwise.
9. Your rights
You have the right:
- to find out what data we keep about you and obtain a copy,
- to correct anything that is wrong or out of date,
- to request its deletion,
- to request that its use be restricted,
- to receive it in a format that can be transferred elsewhere,
- to object to its use when it is based on our legitimate interest,
- to withdraw your consent at any time — without affecting what took place before.
You can do most of this yourself from the “My Account” page, where you can view, download and request deletion of your data. For anything else, write to us at info@grifon.gr. We reply within one month and free of charge. If we are not sure who submitted the request, we may ask for something extra to confirm it.
If you believe we have not respected your rights, you may lodge a complaint with the Hellenic Data Protection Authority: Kifisias 1-3, postcode 115 23, Athens · telephone 210 6475600 · contact@dpa.gr · www.dpa.gr.
10. Cookies
The shop uses cookies: some are necessary for the site and basket to work, while others provide visitor statistics. The Cookies Policy, at the bottom of every page, explains exactly which ones they are, what each does, how long it lasts and how you can change your choice.
11. Other people’s data
If you give us another person’s data — for example, an employee or representative of your business — first make sure you have their consent to share it with us and for us to use it as described in this text.
12. Links to other websites
The shop contains links to third-party websites. We do not control or accept responsibility for their practices. Read their policy before giving them data.
13. Changes to this text
We may update this policy. The new version is published on this page and applies from the day it is published. Please tell us if any of the data we keep about you needs correcting.