Privacy policy

INTRODUCTION

These Policies govern access to and use of the website and online store www.funky-buddha.com (hereinafter the “site” and/or “website”).

The website www.funky-buddha.com was created, is managed and operated by the société anonyme “ALTEX COMMERCIAL IMPORTS EXPORTS-REPRESENTATION-MANAGEMENT SOCIETE ANONYME” (42 Pavlou Bakogianni Street, Metamorfosi, Attica, Tax Identification Number 999080500, KEFODE Attikis Tax Office, tel. 211 9555555) (hereinafter the “Company”).

This Personal Data Policy is issued pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR), to provide data subjects with information regarding the processing of their personal data.

The Company acts as an independent Data Controller for all processing operations described herein.

Any natural person who visits the website or uses the services is referred to as the “Personal Data Subject” or the “Data Subject”.

This Policy forms an integral part of the Terms and Conditions of Use of www.funky-buddha.com. The Company may amend this Policy by posting the amended version on the website. In the event of material changes, you will be notified in an appropriate manner (by email or by an announcement on the Website).

The services are not intended for minors under 15 years of age. The Company does not knowingly collect minors’ data without parental consent. For questions, please contact the Company’s Data Protection Officer (DPO): Konstantinos Alexiou / email: [email protected] / tel. 6946713966 / Address: 42 Pavlou Bakogianni Street, Metamorfosi, Postal Code 14452.

1/ DATA CONTROLLER

“ALTEX COMMERCIAL IMPORTS EXPORTS-REPRESENTATION-MANAGEMENT SOCIETE ANONYME”

42 Pavlou Bakogianni Street, Metamorfosi, Attica, Postal Code 14452, Tax Identification Number 999080500, KEFODE Attikis Tax Office, tel. 211 9555555, email: [email protected]

DATA PROTECTION OFFICER (DPO)

Konstantinos Alexiou

[email protected]

211 9555511

42 Pavlou Bakogianni Street, Metamorfosi, Postal Code 14452

2/ DEFINITION OF PERSONAL DATA

“Personal Data” means any information relating to an identified or identifiable natural person (Article 4(1) GDPR). Examples include: name, address, date of birth, mobile telephone number, email, username, password and IP address.

3/ DETAILED DESCRIPTION OF PROCESSING OPERATIONS AND LEGAL BASIS (GDPR)

3.1. Statistics and Analytics / Retargeting

Legal basis: Article 6(1)(f) GDPR (analytics) or Article 6(1)(a) GDPR (retargeting — through the Cookie Policy).

We use pseudonymised browsing data for statistical analyses. Personalised advertisements (Facebook Ads, Google Ads, TikTok, remarketing) are displayed exclusively following express consent through the Cookie Policy.

3.2 Member Registration / Account Creation

Legal basis: Article 6(1)(b) GDPR.

To create an account, we collect: full name, email and password (encrypted). Optionally: gender, date of birth, categories of interest and mobile telephone number.

3.3 Newsletter and Commercial Communications

Legal basis: Article 6(1)(a) GDPR (consent) and Article 11 of Law 3471/2006.

If you select the relevant checkbox (opt-in), we collect an email address and/or mobile telephone number to send newsletters and Viber/SMS messages. Email marketing processing is carried out by the processors Klaviyo, Inc under a data processing agreement (Article 28 GDPR). For SMS marketing: EMSTAT S.A.

You may withdraw your consent at any time: through the unsubscribe link in emails, by replying STOP to SMS messages, or by sending an email to [email protected].

3.4 Order Fulfilment

Legal basis: Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(c) GDPR (legal obligation).

We collect the data necessary to complete, fulfil and dispatch an order: full name, email, telephone number, shipping and billing address, payment details (masked card number) and document type. Where an invoice is requested: company name, Tax Identification Number, tax office, business activity, registered office address and telephone numbers. Where a refund is made for a cash-on-delivery transaction, the bank, IBAN and beneficiary name are requested.

3.5. Customer Service

Legal basis: Article 6(1)(b) GDPR and Article 6(1)(f) GDPR (legitimate interest).

When you contact the Customer Service Department (by telephone, email, form or in-store), we collect: full name, email, telephone number, order number and communication history. Customer service processing is carried out by the processors ICOMM CALL CENTER IKE and Gorgias, Inc under a data processing agreement (Article 28 GDPR), and the data are retained for 6 months after the request is closed.

3.6 Coupons and Promotional Activities

Legal basis: Article 6(1)(a) GDPR (consent).

For participation in competitions/prize draws or promotional activities, we collect the information stated on the relevant coupon (full name, mobile number, email, and optionally date of birth, address and gender). The data are transmitted in encrypted form to the processor MENA Services IKE for technical support of the activity.

3.7 Garment Alteration and Repair

Legal basis: Article 6(1)(b) GDPR (performance of a contract).

When garment alteration/repair services are provided, we collect a full name and telephone number for identification and notification of completion. The data are retained until the limitation period for civil claims expires.

3.8 Social Networks (Social Media)

Legal basis: Article 6(1)(f) GDPR (legitimate interest).

We process messages/comments through Facebook, Instagram and similar platforms solely in order to respond to your requests. The platforms operate as independent Data Controllers — please refer to their own policies. Do not use social media to exercise GDPR rights — please contact: [email protected].

3.9 Fraud Prevention

Legal basis: Article 6(1)(f) GDPR (legitimate interest) and Article 6(1)(c) GDPR (legal obligation — PSD2).

Where there are reasonable indications of fraud or unlawful use, we collect and process the necessary data (order data, IP address, purchasing behaviour) for detection and response.

3.10 Provision of Third-Party Data

If you provide third-party data (for example, when purchasing a gift or arranging delivery to a third party), you confirm that you have informed that third party about the processing of their data.

4. DATA RETENTION PERIOD

The Company applies the following data retention periods:

• Order data and tax documents: 5 years (or longer if required by tax legislation)
• Member account: until deletion + 1 year, or 5 years from the last transaction
• Newsletter / commercial communications: until consent is withdrawn/removal from the list
• Customer service (email/form): 6 months after the request is closed
• Call Centre (recordings): 1 year
• Fraud prevention: 3 years from the identified suspicious transaction
• Invoices issued to individuals and business operators: 10 years
• Cookies / Analytics: see below
• Legal claims: until expiry of the limitation period (general five-year period — Article 250 of the Greek Civil Code)

5. RECIPIENTS AND DATA TRANSFERS

The Company may transfer data to the following recipients:

• Courier companies: for product delivery (Article 6(1)(b) GDPR)
• Payment providers / banks: for payment processing
• Klaviyo, Inc: for email marketing under an Article 28 GDPR agreement
• EMSTAT S.A.: for SMS/Viber marketing
• MENA Services IKE: for coupons/competitions
• ICOMM CALL CENTER IKE and Gorgias, Inc: for the customer service call centre
• Analytics / technical support / hosting providers (processors): under an Article 28 GDPR agreement
• Judicial / Supervisory / Administrative authorities: on the basis of a legal obligation or Article 6(1)(f) GDPR

The Company does not sell, lease or transfer personal data to third parties for commercial exploitation.

Where data are transferred to countries outside the EU/EEA, the transfer is carried out subject to appropriate safeguards (Standard Contractual Clauses — SCCs under Article 46 GDPR, or another lawful mechanism).

6. LEGAL BASES FOR PROCESSING

The Company processes your personal data on the following legal bases:

• Article 6(1)(a) — Consent: for newsletters, SMS/Viber marketing, retargeting advertisements, competitions, non-essential cookies and call recording. Consent is given through an express action (opt-in) and may be withdrawn at any time.
• Article 6(1)(b) — Performance of a contract: for processing orders, payments, shipments and returns, creating an account and repairing garments
• Article 6(1)(c) — Legal obligation: for keeping tax/accounting records, invoicing, PSD2/AML compliance and complying with requests from authorities.
• Article 6(1)(f) — Legitimate interest: for fraud prevention, customer service, analytics, social media and legal claims. The legitimate interest has been balanced following an assessment that the rights of data subjects do not override it.

7. CONSENT

Your consent is requested only where consent is the applicable legal basis and is provided through an express action (checkbox opt-in). Consent is not required for processing based on a contract or legal obligation.

You may withdraw your consent at any time without affecting the lawfulness of processing carried out before its withdrawal (Article 7(3) GDPR), by sending an email to [email protected], through the unsubscribe link or by replying STOP to an SMS/Viber message.

8. DATA TRANSFER AND SECURITY

Data are transferred between the Website and your browser over a secure HTTPS connection using the TLS (Transport Layer Security) encryption protocol. Data are stored on secure servers within the EU/EEA. Where a processor outside the EU/EEA is used, the transfer is made using Standard Contractual Clauses (SCCs) under Article 46(2)(c) GDPR or another lawful mechanism.

The Company implements appropriate technical and organisational security measures (role-based access restriction, encryption, authentication systems and incident-management procedures). In the event of a data breach that may place your rights at risk, the Company is required to notify the Hellenic Data Protection Authority within 72 hours.

9. DATA SUBJECT RIGHTS

After your identity has been verified, you have the following rights:

The exercise of rights is subject to any data-retention obligations applicable to the Company.

10. SUBMITTING REQUESTS — CONTACT

To exercise your rights, you may:

• Send an email to [email protected]
• Contact the DPO Office in writing at: 42 P. Bakogianni Street, Metamorfosi, Attica, Postal Code 14452 — for the attention of the Data Protection Officer
• Contact us by telephone: 211 9555555

We respond free of charge within 1 month of receiving the request. In the event of complexity or multiple requests, the deadline may be extended by a further 2 months, with notice provided within the first month (Article 12(3) GDPR). Manifestly unfounded or repetitive requests may be subject to a reasonable fee (Article 12(5) GDPR).

11. LEGAL FRAMEWORK

Data processing is governed by:

• Regulation (EU) 2016/679 (GDPR)
• Law 4624/2019 (implementation of the GDPR in Greece)
• Law 3471/2006 (electronic communications and privacy — ePrivacy)
• Law 4308/2014 (Greek Accounting Standards)
• Decisions and guidelines of the Hellenic Data Protection Authority and the EDPB

12. INFORMATION ABOUT COOKIES

Cookies are small text files stored on the device used to browse our website, in order to make your visit functional and attractive. Some of them are deleted at the end of the browser session (session cookies).
Others remain on the device and allow the Company to recognise the browser on the next visit (persistent cookies). You may configure your browser so that you are informed about the setting of cookies and can decide whether to accept or reject them in specific cases or in general. If you do not accept the installation of cookies, the functionality of the website or application may be reduced.

COOKIE CATEGORIES

FUNCTIONALITY COOKIES:

They allow information already submitted to be stored and improve the user’s ability to enjoy personalised browsing. They collect anonymised information and do not enable tracking of browsing on the website.

PERFORMANCE COOKIES:

They collect information about the use of a website/application and do not store information that allows the user to be identified. Any information stored is used exclusively to improve and implement the performance of the website and, consequently, the experience provided to the user.

COOKIES FOR PRODUCT PROMOTION PURPOSES:

They are used to provide targeted advertising that is relevant and tailored to the user’s interests. They are also used to limit how often an advertisement is shown and to measure the effectiveness of the advertising campaign. They primarily record whether or not you visited the website. This information may be shared with third parties to improve targeted advertising.

13. CONFIDENTIALITY OF TRANSACTIONS

Maintaining confidentiality is considered self-evident.
The same fundamental principles that govern conventional transactions also apply to e-commerce.

All information transmitted by the user/member to the Company is confidential, and the Company has taken all necessary measures to ensure that it is used only to the extent deemed necessary in the context of the services provided.

The Company does not disclose customer or transaction details unless it has your written authorisation or disclosure is required by a court decision or a decision of another public authority.

Where the Company uses third parties to support its systems, it ensures that confidentiality is protected.

You may request any information held about you and its rectification if you can substantiate the existence of an error.
For your own security, you must also treat all information provided through the service as confidential and private and must not disclose it to third parties.

14. TRANSACTION SECURITY

The Company recognises the importance of the security of your Personal Data and electronic transactions and takes all necessary measures, using the most modern and advanced methods, to ensure the highest possible level of security.

All information relating to your personal details and transactions is secure and confidential.

The security of the Company’s online store is achieved by the following method: User identification

Your email address and personal secret security code (password) are used to identify you; each time you enter them, they provide you with secure access to your personal data. You may change your Personal Secret Security Code (password) and email address as often as you wish.

Only you have access to your information by means of the above credentials, and you are solely responsible for keeping them secret and concealing them from third parties. In the event of loss or disclosure, you must notify us immediately; otherwise, the Company’s online store shall not be liable for the use of your secret password by an unauthorised person.

For security reasons, we recommend changing your password regularly and avoiding the use of the same or easily identifiable passwords (for example, your date of birth). We also recommend using symbols, in addition to letters and numbers, when creating a password.

15. PAYMENT

The Company recognises the importance of the security of your personal data and electronic transactions and takes all necessary measures, using the most modern and advanced methods, to ensure the highest possible level of security. All information relating to your personal details and transactions is secure and confidential. To ensure the secure and confidential transfer of data, we use the TLS (Transport Layer Security) encryption protocol.

Payment by credit card or PayPal is an entirely secure payment method for our customers.

The Company will never have knowledge of your card or account information. The available methods for payment of an order are:

• a) Payment by card/IRIS -> Redirect to Viva
• b) Payment by PayPal
• c) Payment by Klarna
• d) Payment through digital wallets (Apple Pay, Google Pay) via the Shopify Payments service.

The Company does not, under any circumstances, come into contact with the details and data of your credit/debit card.
You transmit this information through an encrypted connection via the secure transaction systems of the above providers.

RIGHT TO AMEND THIS POLICY AND FINAL PROVISIONS

The Company reserves the right to amend this Personal Data and Privacy Policy in order to comply with applicable legal or regulatory obligations. Appropriate notice will be provided for every significant change.
The Company takes all necessary technical and organisational measures to protect the data that are important to you and of which you are the owners. The less information you provide, the more control you have.

If you wish to browse anonymously and do not want your behaviour while browsing to be evaluated by our Company and our certified partners, you must configure your browser accordingly.