Privacy Policy

PRIVACY POLICY

1. Introduction

PACO ART SUPPLIES IKE ("Paco Art Center", the "Company", "we", "our" or "us") is committed to protecting the privacy and personal data of all visitors, customers and users of www.pacoartcenter.gr.

This Privacy Policy explains how we collect, use, store, disclose and safeguard your personal information whenever you visit our Website, create an account, place an order or otherwise interact with our services.

We process personal data in accordance with:

• Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR);
• Greek data protection legislation;
• applicable European Union legislation.

By accessing or using our Website, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller

The Data Controller responsible for the processing of your personal data is:

PACO ART SUPPLIES IKE

Trade Name:

Paco Art Center

Registered Office:

11 N. Konsta Street

Koropi 19400

Greece

VAT Number:

801633896

G.E.M.I.:

160524003000

Email:

info@pacoartcenter.gr

Telephone:

+30 210 6626716

For any questions relating to the processing of your personal data, you may contact us using the details above.

3. Scope of this Privacy Policy

This Privacy Policy applies to individuals who:

• visit our Website;
• create a customer account;
• place orders;
• subscribe to our newsletter;
• contact our customer service;
• sign in using Facebook Login;
• sign in using Google Sign-In;
• interact with our online services.

4. Personal Data We Collect

Depending on how you use our Website, we may collect different categories of personal data.

Information You Provide

When you create an account, place an order or contact us, we may collect information including:

• Full Name
• Email Address
• Telephone Number
• Billing Address
• Shipping Address
• Country
• City
• Postal Code
• Company Name
• VAT Number
• Tax Office (where applicable)
• Order Notes
• Customer Support Requests
• Purchase History

Providing certain information is necessary for the performance of our contractual obligations and for processing your orders.

Information Collected Automatically

When you browse our Website, certain technical information may be collected automatically, including:

• IP Address
• Browser Type
• Browser Version
• Device Type
• Device Operating System
• Screen Resolution
• Preferred Language
• Date and Time of Access
• Pages Visited
• Session Duration
• Referring URL
• Cookies
• Session Identifiers
• Website Performance Data
• Anonymous Usage Statistics

This information is used to:

• operate the Website;
• improve performance;
• analyse Website usage;
• prevent fraud;
• maintain security;
• improve user experience.

5. Customer Account Information

If you create an account on our Website, we may store:

• Login credentials (encrypted where applicable)
• Purchase history
• Billing addresses
• Shipping addresses
• Saved favourites or wish lists
• Loyalty programme information (where applicable)
• Customer preferences

These data are processed solely for the operation of your customer account and to provide personalised services.

6. Facebook Login

Our Website allows users to authenticate using Facebook Login.

If you choose this authentication method, and subject to your consent and Facebook account settings, we may receive:

• Full Name
• Email Address
• Facebook User ID
• Profile Picture (where available)

This information is used solely to:

• create your customer account;
• authenticate your identity;
• facilitate secure login;
• associate your Facebook account with your Website account.

We do not post to your Facebook account, access your Facebook password or collect additional Facebook data beyond the permissions granted by you.

7. Google Sign-In

Our Website also supports authentication through Google Sign-In.

Subject to your consent, we may receive:

• Full Name
• Email Address
• Google Account ID
• Profile Picture (where available)

The information is used exclusively to:

• create your account;
• authenticate your identity;
• facilitate secure access to your account.

The Company never has access to your Google account password.

8. Purposes of Processing

We process personal data for the following purposes:

• creating and managing customer accounts;
• processing orders;
• delivering products;
• processing payments;
• issuing invoices;
• responding to customer enquiries;
• providing customer support;
• administering returns and refunds;
• complying with legal obligations;
• detecting and preventing fraud;
• protecting Website security;
• improving our Website and services;
• sending newsletters (where consent has been provided);
• measuring marketing effectiveness;
• analysing Website traffic.

9. Legal Basis for Processing

We process personal data only where we have a lawful basis under Article 6 GDPR.

Purpose

Legal Basis

Account Registration

Performance of a Contract

Order Processing

Performance of a Contract

Delivery

Performance of a Contract

Payment Processing

Performance of a Contract

Customer Support

Legitimate Interest / Contract

Accounting & Tax Compliance

Legal Obligation

Fraud Prevention

Legitimate Interest

Website Security

Legitimate Interest

Newsletter

Consent

Google Analytics

Consent (where required)

Meta Pixel

Consent (where required)

Facebook Login

Performance of a Contract / User Consent

Google Sign-In

Performance of a Contract / User Consent

10. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which they were collected, comply with our legal obligations, resolve disputes and enforce our agreements.

The retention period depends on the category of personal data and the applicable legal requirements.

Category of Personal Data

Retention Period

Customer Account Information

Until the account is deleted or remains inactive for a prolonged period, unless retention is required by law

Orders

As required by applicable accounting and tax legislation

Invoices and Tax Records

For the period required by applicable tax legislation

Customer Service Communications

For as long as necessary to resolve the request and manage any related legal claims

Newsletter Subscription

Until the user unsubscribes or withdraws consent

Cookies

According to the applicable Cookie Policy and the lifetime of each cookie

Security Logs

For a limited period required to maintain the security and integrity of the Website

Upon expiration of the applicable retention period, personal data are securely deleted, anonymised or otherwise disposed of unless further retention is required by law.

11. Recipients of Personal Data

Access to personal data is strictly limited to authorised personnel and carefully selected service providers acting on behalf of the Company.

Personal data are shared only where necessary for the provision of our services or to comply with legal obligations.

We do not sell, rent or disclose personal information to third parties for their own marketing purposes.

12. Third-Party Service Providers

To operate our Website and provide our services, we use carefully selected third-party service providers ("Processors") who process personal data strictly on our behalf and only to the extent necessary for providing their services.

These include, but are not limited to:

Service Provider

Purpose of Processing

Hetzner

Website hosting and server infrastructure

Google Tag Manager

Tag management

Google Analytics

Website analytics

Google reCAPTCHA

Website security and spam prevention

Google Maps

Interactive maps

YouTube

Embedded video content

Meta (Facebook Login & Meta Pixel)

Authentication and advertising analytics

Google Sign-In

User authentication

Mailchimp

Newsletter management

PayPal

Payment processing

Box Now

Parcel delivery

Geniki Taxydromiki

Parcel delivery

Elasticsearch

Website search functionality

Each provider processes personal data in accordance with its own privacy policy and applicable data protection legislation.

13. Google Analytics

Our Website uses Google Analytics to better understand how visitors use our Website.

Google Analytics may collect information such as:

• IP address (where applicable, anonymised);
• Browser information;
• Device information;
• Operating system;
• Pages visited;
• Session duration;
• Traffic source;
• User interactions.

These data help us:

• improve Website performance;
• understand visitor behaviour;
• optimise navigation;
• enhance user experience.

Google Analytics cookies are activated only where required by applicable consent preferences.

14. Google Tag Manager

Our Website uses Google Tag Manager, a tag management system provided by Google.

Google Tag Manager itself does not store personal data. Instead, it facilitates the deployment and management of other scripts and technologies that may process personal information in accordance with their respective privacy policies.

15. Meta Pixel

We use Meta Pixel to measure the effectiveness of advertising campaigns on Meta platforms.

Meta Pixel may collect information relating to:

• pages viewed;
• products viewed;
• purchases;
• conversions;
• browsing behaviour;
• advertising interactions.

This information allows us to evaluate advertising performance and improve our marketing activities.

Where required by applicable law, Meta Pixel operates only after obtaining your consent.

16. Google reCAPTCHA

To protect the Website against spam, automated abuse and malicious activity, we use Google reCAPTCHA.

Google reCAPTCHA may analyse technical information including:

• IP address;
• browser configuration;
• operating system;
• mouse movements;
• interaction patterns;
• device characteristics.

These data are processed exclusively for security purposes.

17. Mailchimp

We use Mailchimp as our email marketing platform.

If you subscribe to our newsletter, we may process:

• Full Name (if provided);
• Email Address.

Mailchimp may additionally record statistical information including:

• email opens;
• clicks;
• unsubscribe requests;
• campaign performance.

These statistics allow us to:

• improve our newsletters;
• provide more relevant content;
• measure campaign effectiveness.

You may unsubscribe at any time by clicking the "Unsubscribe" link contained in every newsletter or by contacting us directly.

18. PayPal

Where you choose PayPal as your payment method, certain transaction information is transmitted directly to PayPal for payment processing.

Such information may include:

• customer name;
• billing information;
• transaction amount;
• order reference.

The Company never stores your payment card details.

Payment information is processed exclusively by PayPal in accordance with its own Privacy Policy and applicable financial regulations.

19. Box Now

Where delivery is carried out through Box Now, we provide only the information necessary for the fulfilment of your order.

This may include:

• Full Name;
• Delivery Address or Locker Selection;
• Telephone Number;
• Email Address (where required);
• Order Reference.

These data are used exclusively for shipment and delivery purposes.

20. Geniki Taxydromiki

Where delivery is carried out by Geniki Taxydromiki, only the information strictly necessary to complete the shipment is transmitted.

The courier company acts as an independent service provider and processes personal data solely for transportation and delivery purposes.

21. Elasticsearch

To improve the Website's search functionality and user experience, we use Elasticsearch.

Search queries entered by users may be processed to:

• improve search accuracy;
• optimise product indexing;
• enhance Website performance;
• analyse anonymous search trends.

Search terms are not used to directly identify individual users.

22. Google Maps

The Website may include Google Maps to display the location of our physical stores, collection points or other business locations.

When Google Maps is loaded, Google may collect certain technical information, including:

• IP address;
• browser information;
• device information;
• approximate location (depending on your browser settings).

The processing of such information is governed by Google's own Privacy Policy.

23. Embedded YouTube Videos

Certain pages of the Website may contain embedded videos hosted on YouTube.

When viewing embedded YouTube content, YouTube may collect technical information and set cookies in accordance with your browser settings and consent preferences.

Such information may include:

• IP address;
• browser information;
• device information;
• interaction with embedded videos.

24. International Transfers of Personal Data

Some of the service providers used by the Company, including certain Google, Meta and Mailchimp services, may process personal data outside the European Economic Area (EEA).

Whenever personal data are transferred internationally, we take appropriate measures to ensure that such transfers comply with applicable data protection legislation.

Where required, appropriate safeguards may include:

• European Commission Adequacy Decisions;
• Standard Contractual Clauses (SCCs);
• or any other lawful transfer mechanism recognised under the GDPR.

25. Data Security

The Company implements appropriate technical and organisational measures designed to safeguard personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Such measures include, where appropriate:

• SSL/TLS encrypted communications;
• secure server infrastructure;
• controlled access to systems;
• password protection;
• firewall protection;
• regular software updates;
• monitoring against malicious activity;
• internal access controls.

Despite our efforts, no electronic transmission or storage system can guarantee absolute security.

26. Your Rights

Subject to applicable data protection legislation, you have the following rights regarding your personal data:

• Right of Access;
• Right to Rectification;
• Right to Erasure ("Right to be Forgotten");
• Right to Restriction of Processing;
• Right to Data Portability;
• Right to Object to Processing;
• Right to Withdraw Consent at any time where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before such withdrawal.

27. Exercising Your Rights

If you wish to exercise any of your rights, you may contact us at:

Email

info@pacoartcenter.gr

To protect your personal information, we may request additional information necessary to verify your identity before responding to your request.

We will respond within the timeframes required by applicable data protection legislation.

28. Right to Lodge a Complaint

If you believe that the processing of your personal data infringes applicable data protection legislation, you have the right to lodge a complaint with the competent supervisory authority.

For Greece, the competent supervisory authority is:

Hellenic Data Protection Authority (HDPA)

1-3 Kifisias Avenue

11523 Athens

Greece

Website:

https://www.dpa.gr

29. Account Deletion & Personal Data Deletion

You may request the deletion of your customer account and your personal data at any time by contacting:

info@pacoartcenter.gr

Following verification of your identity, we will delete or anonymise your personal data unless continued retention is required:

• to comply with legal obligations;
• for tax and accounting purposes;
• for the establishment, exercise or defence of legal claims;
• or where otherwise required by applicable law.

30. Facebook Login Data Deletion

Users who have registered or signed in using Facebook Login may request deletion of the personal data associated with their account by:

• logging into their customer account and requesting account deletion (where available); or
• contacting us at info@pacoartcenter.gr.

Upon verification of the request, personal data will be deleted or anonymised, except where retention is required by law.

This section is intended to comply with the Meta Platform Terms regarding user data deletion requests.

31. Google Sign-In Data Deletion

Users who have registered or signed in using Google Sign-In may request deletion of their account and associated personal data by contacting:

info@pacoartcenter.gr

Following verification, the Company will delete or anonymise the relevant personal data unless retention is required by applicable law.

32. Changes to this Privacy Policy

The Company reserves the right to amend or update this Privacy Policy at any time to reflect changes in:

• applicable legislation;
• our services;
• technological developments;
• business operations.

The latest version will always be available on this Website.

33. Contact Us

If you have any questions concerning this Privacy Policy or the processing of your personal data, please contact us:

PACO ART SUPPLIES IKE

11 N. Konsta Street

Koropi 19400

Greece

Telephone:

+30 210 6626716

Email:

info@pacoartcenter.gr