PRIVACY POLICY

1. Introduction

PoTolo Workers’ Cooperative is committed to protecting your personal data and your right to privacy. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights in relation to it.

This policy applies to all users of www.potolo.gr worldwide. For users in the European Union and European Economic Area, this policy is fully compliant with the General Data Protection Regulation (GDPR – EU 2016/679). For users in other jurisdictions, we apply equivalent standards of care in accordance with applicable local privacy laws.

2. Data Controller

The data controller responsible for your personal data is:

PoTolo Workers’ Cooperative

Website: www.potolo.gr

Email: welcome@potolo.gr

3. What Data We Collect

When you use our website or place an order, we may collect the following personal data:

Full name
Shipping and billing address (including country)
Email address
Phone number
Date of birth or age confirmation (for age-restricted products)
Payment information (processed securely via our payment provider; no card details are stored by PoTolo)
Order history
IP address, browser type, and browsing behaviour (via cookies and analytics tools)

4. How We Use Your Data

We use your personal data for the following purposes:

To process, fulfil, and deliver your orders
To verify age for the purchase of alcoholic products
To communicate with you about your order, including shipping updates
To handle returns, complaints, or customer service requests
To comply with legal, tax, and regulatory obligations
To improve our website and shopping experience
To send marketing communications, only where you have given explicit consent

5. Legal Basis for Processing (EU/EEA Users)

For users in the EU and EEA, we process your personal data on the following legal bases:

Contract performance: to process and deliver your orders (Art. 6(1)(b) GDPR)
Legal obligation: to comply with applicable laws, including food safety and age verification requirements (Art. 6(1)(c) GDPR)
Legitimate interest: to improve our services, prevent fraud, and ensure secure transactions (Art. 6(1)(f) GDPR)
Consent: for marketing communications and non-essential cookies (Art. 6(1)(a) GDPR) — you may withdraw consent at any time

6. International Data Transfers

Your personal data may be processed by service providers located outside your country of residence, including outside the European Union. Where such transfers occur, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or equivalent mechanisms under applicable law.

7. Data Sharing

We do not sell or rent your personal data to third parties. We may share your data with:

Courier and logistics providers, solely for order fulfilment and delivery
Payment processors, for secure transaction handling
IT, hosting, and cloud service providers, under data processing agreements
Customs and border authorities, where required for international shipments
Regulatory and public authorities, where required by law

8. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this policy, or as required by law (e.g. financial and tax records for up to 10 years). You may request deletion of your data at any time, subject to any legal retention obligations.

9. Cookies

Our website uses cookies and similar technologies to improve your experience, remember your preferences, and analyse website traffic. You can manage cookie preferences through your browser settings or our on-site cookie consent tool. For full details, please refer to our Cookie Policy on our website.

10. Your Rights

Depending on your country of residence, you may have the following rights regarding your personal data:

Right of access: to obtain a copy of the personal data we hold about you
Right to rectification: to correct inaccurate or incomplete data
Right to erasure (‘right to be forgotten’): to request deletion of your data
Right to restriction of processing
Right to data portability
Right to object to processing based on legitimate interests
Right to withdraw consent at any time, without affecting the lawfulness of prior processing

To exercise any of these rights, please contact us at welcome@potolo.gr. We will respond within 30 days. We may ask you to verify your identity before processing your request.

EU/EEA users also have the right to lodge a complaint with their national data protection authority. In Greece, this is the Hellenic Data Protection Authority (HDPA) at www.dpa.gr. You may also contact the supervisory authority in your country of residence.

11. Data Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. Our website uses SSL/TLS encryption for all data transmissions. Access to personal data is restricted to authorised personnel only.

12. Children’s Privacy

Our website is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected such data, please contact us immediately at welcome@potolo.gr and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Any updates will be posted on this page with a revised date. We encourage you to review this policy periodically. Continued use of our website after changes are posted constitutes acceptance of the updated policy.

14. Contact

For any questions, requests, or concerns regarding this Privacy Policy, please contact us at:

PoTolo Workers’ Cooperative

Website: www.potolo.gr

Email: welcome@potolo.gr