PRIVACY POLICY
Last updated: 30 September 2026
At Αγγελακούδη Ζαχαροπλαστική, we respect your privacy and are committed to protecting your personal data.
This Privacy Policy explains how Αγγελακούδη Ζαχαροπλαστική collects, uses, stores, and protects personal data when you visit or use our website and when you place an order for products and delivery services.
This Privacy Policy is intended to provide information in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Greek data-protection legislation.
1. Data Controller
The controller responsible for the processing of your personal data is:
Αγγελακούδη Ζαχαροπλαστική
Address: El. Venizelou 10, Chalkida 341 00, Greece
Email: support@aggelakoudicakes.com
For privacy-related questions or requests concerning your personal data, you may contact us using the email address above.
We have not designated a Data Protection Officer (DPO), unless otherwise required by applicable law.
2. What Personal Data We Collect
Depending on how you use our website, we may collect the following categories of personal data:
A. Information provided when placing an order
When you place an order, including as a guest, we may collect information necessary to process and deliver your order, such as:
- First and last name
- Telephone number
- Email address
- Delivery address
- Address details necessary for delivery
- Order details and products purchased
- Delivery instructions or other information you voluntarily provide
- Payment-related information necessary to identify and process your transaction
- Order date, time, amount and status
We only request information that is reasonably necessary to process and fulfil your order.
B. Customer account information
If you choose to create an account, we may process information such as:
- Name
- Email address
- Account login credentials
- Telephone number, where provided
- Saved delivery information
- Order history
- Other information you choose to add to your account
Creating an account is optional. You may place an order as a guest where this option is available.
C. Website and technical information
When you visit our website, certain technical information may be processed automatically by our website and hosting infrastructure, such as:
- IP address
- Browser type and version
- Device type
- Operating system
- Date and time of access
- Requested pages or resources
- Technical and security information
- Server and security logs
This information may be processed for purposes such as operating, securing, maintaining and troubleshooting the website.
D. Location and address-search information
Our website may use location, geocoding, address-search or mapping services provided by third parties, including HERE Technologies and Mapbox, to assist with address searches, geolocation functionality, delivery-address entry or mapping functionality.
Depending on the feature used and the settings of the relevant service, information entered into an address-search field or location information may be transmitted to the relevant service provider.
Mapbox states that its location services can process information such as IP addresses, session identifiers, address/location information and geolocation data depending on the functionality being used.
HERE also provides geolocation-based platform services and publishes information concerning its privacy practices.
You should avoid entering information into map or address-search fields that is not necessary for the relevant function.
3. How We Use Your Personal Data
We may process your personal data for the following purposes:
- To receive, process and fulfil online orders.
- To arrange and complete delivery to the address you provide.
- To communicate with you about your order.
- To contact you when necessary regarding delivery or an issue with your order.
- To process payments.
- To provide and maintain customer accounts.
- To provide address-search, geolocation and mapping functionality.
- To operate, maintain and secure our website.
- To prevent fraud, misuse and security incidents.
- To comply with legal, tax, accounting and regulatory obligations.
- To respond to customer enquiries, complaints and requests.
- To establish, exercise or defend legal claims where necessary.
We do not currently use your personal data for advertising profiling or behavioural advertising through Google Analytics, Meta Pixel, Google Ads or similar advertising systems, based on the information provided to us.
We also do not operate a newsletter or promotional email mailing list based on the information provided to us.
4. Legal Bases for Processing
Depending on the circumstances, we process personal data on one or more of the following legal bases under Article 6 of the GDPR:
Performance of a contract
We process information that is necessary to receive and fulfil your order, process your purchase, arrange delivery and provide services requested by you.
This includes information such as your name, contact details, delivery address and order information.
Article 6(1)(b) GDPR permits processing that is necessary for the performance of a contract or for taking steps at the request of the individual before entering into a contract.
Legal obligation
We may process and retain certain information where necessary to comply with applicable legal, tax, accounting or other statutory obligations.
Legitimate interests
Where appropriate, we may process information where this is necessary for our legitimate interests, such as:
- Maintaining and securing our website
- Preventing fraud and abuse
- Protecting our business and customers
- Maintaining appropriate business records
- Establishing, exercising or defending legal claims
Such processing is carried out only where our legitimate interests are not overridden by your rights and freedoms.
Consent
Where applicable, we may rely on your consent for specific processing activities for which consent is legally required.
Where processing is based on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
5. Online Orders and Delivery
When you place an order through our website, we use the information you provide to prepare and deliver your order.
Your delivery information may be provided to members of our authorised delivery staff to the extent necessary to complete the delivery.
Our delivery staff may need access to information such as:
- Your name
- Telephone number
- Delivery address
- Order details
- Delivery instructions
We do not use delivery information for unrelated purposes.
6. Guest Checkout
You may be able to place an order without creating a customer account.
When you use guest checkout, we still need to process the personal information necessary to receive, process, fulfil and deliver your order and to comply with applicable legal obligations.
Creating an account is therefore not required solely for the purpose of placing an order.
7. Customer Accounts
If you create a customer account, your account information is processed so that we can provide account functionality, such as allowing you to access relevant account information and order history.
You are responsible for keeping your account credentials confidential.
If you wish to request deletion of your account or personal information, you may contact us at:
Please note that certain information may need to be retained where we are legally required to do so or where it is necessary to establish, exercise or defend legal claims.
8. Card Payments
We offer card payments through Viva.com.
When you choose to pay by card, payment processing is handled through Viva.com’s payment infrastructure. Payment-card information may therefore be processed directly by Viva.com and its relevant payment infrastructure rather than being stored by us.
We do not intentionally store complete payment-card numbers or card security codes on our website.
Viva.com publishes its own privacy information concerning the processing of personal data in connection with its services.
For security reasons, payment information may also be subject to fraud-prevention, authentication and transaction-security procedures operated by the payment provider.
9. Cash on Delivery
If you select cash on delivery, we process the information necessary to identify your order, contact you where necessary and complete the delivery and collection of payment.
Our delivery staff may receive the information necessary to complete the delivery.
10. Maps and Address Services
Our website may use mapping and address-related services provided by:
- Google Maps
- HERE Technologies
- Mapbox
These services may be used for functions such as displaying our store location, allowing users to search for or select an address, geocoding an address, or assisting with delivery-address entry.
Google Maps
We may embed a Google Maps map showing our store location.
Google states that its services, including embedded Google Maps, may involve the collection and processing of information such as IP addresses, cookies and location-related information depending on the service and the user’s settings.
Google’s processing is also subject to Google’s own privacy terms.
HERE Technologies
Where HERE services are used for address search, geocoding or location functionality, information necessary to provide that functionality may be transmitted to HERE.
HERE publishes information concerning its privacy practices and location services.
Mapbox
Where Mapbox services are used for address search, geocoding or location functionality, information necessary for the relevant functionality may be transmitted to Mapbox.
Mapbox states that its products may process identifiers, IP addresses, internet/network activity and geolocation data depending on the functionality used.
Where a mapping service requires consent under applicable law, the relevant service will be activated only in accordance with the applicable consent requirements.
11. Social Media
Our website may contain links to our social-media pages, including Facebook and Instagram.
Simply providing a link to a social-media website does not necessarily mean that we receive your personal information from that platform.
If you follow a social-media link and interact with the relevant platform, the social-media provider may process your personal data according to its own privacy policy and terms.
We recommend reviewing the privacy information of the relevant social-media provider before using its services.
12. Cookies and Similar Technologies
Our website may use cookies and similar technologies.
Cookies may be used for purposes including:
- Essential website functionality
- Maintaining shopping-cart and checkout functionality
- Maintaining login or account functionality
- Security
- Remembering relevant website settings
- Technical operation and performance
- Third-party services such as maps, where applicable
Some cookies may be strictly necessary for the website to function and cannot be disabled through a consent mechanism without affecting website functionality.
Where applicable law requires consent for non-essential cookies or similar technologies, we will request consent before activating them.
Because the exact cookies used by a WordPress website depend on the active theme, plugins and services, the final cookie list should be checked against the actual website configuration before this Privacy Policy is published.
13. Who May Receive Your Personal Data
We may disclose or make personal data available to third parties where this is necessary for the purposes described in this Privacy Policy.
These may include:
- Payment service providers, including Viva.com
- Mapping and address-service providers, including Google, HERE Technologies and Mapbox where their services are used
- Website hosting and infrastructure providers
- Website/software service providers acting on our behalf
- IT, security and technical service providers
- Professional advisers where necessary
- Public authorities, courts or other competent bodies where legally required
- Our authorised delivery personnel, where necessary to complete an order
We do not sell your personal data.
14. International Transfers
Some third-party service providers may process personal data outside the European Economic Area (EEA).
Where personal data is transferred outside the EEA, we will take appropriate steps to ensure that the transfer is carried out in accordance with applicable data-protection law and that an appropriate legal transfer mechanism is in place where required.
Depending on the particular service, these mechanisms may include an adequacy decision, Standard Contractual Clauses or another legally recognised transfer mechanism.
For example, Mapbox explains in its privacy information that certain Mapbox services may process data through infrastructure located in the United States and other locations.
The privacy practices of the relevant third-party providers may also apply to their processing of personal data.
15. How Long We Keep Personal Data
We retain personal data only for as long as necessary for the purposes for which it was collected, including where necessary to fulfil an order, maintain an account, comply with legal and accounting obligations, resolve disputes and establish, exercise or defend legal claims.
Different categories of data may therefore be retained for different periods.
For example:
- Order and transaction information: retained for the period necessary for order fulfilment, customer-service purposes and applicable legal, accounting and tax obligations.
- Customer account information: retained while the account remains active and, where applicable, for a reasonable period afterwards unless longer retention is required by law or necessary for legal claims.
- Technical/security information: retained for the period reasonably necessary for security, troubleshooting and operational purposes.
- Data processed on the basis of consent: retained until consent is withdrawn or the relevant purpose ends, subject to any legal requirement to retain the information.
We periodically review retained information and delete or anonymise information when it is no longer necessary, subject to legal retention requirements.
16. Data Security
We take reasonable technical and organisational measures designed to protect personal data against:
- Unauthorised access
- Unauthorised disclosure
- Accidental loss
- Destruction
- Alteration
- Unlawful processing
However, no internet transmission or electronic storage system can be guaranteed to be completely secure.
The European Commission identifies integrity, confidentiality and appropriate technical and organisational measures as core GDPR requirements.
17. Your Data Protection Rights
Subject to the conditions and limitations established by the GDPR, you may have the right to:
- Access your personal data.
- Correct inaccurate or incomplete personal data.
- Request erasure of your personal data.
- Request restriction of processing.
- Object to certain processing.
- Request data portability, where applicable.
- Withdraw consent where processing is based on consent.
- Lodge a complaint with a competent data-protection supervisory authority.
The Hellenic Data Protection Authority confirms these rights, including access, rectification, erasure, restriction, portability and objection.
To exercise your rights, contact:
We may need to request information necessary to verify your identity before fulfilling certain requests.
We generally respond to valid GDPR requests within one month, subject to the conditions and extensions permitted by applicable law.
18. Right to Lodge a Complaint
If you believe that your personal data has been processed unlawfully or that your data-protection rights have not been respected, you may contact us first using:
You also have the right to lodge a complaint with the competent supervisory authority.
For Greece, the competent supervisory authority is:
Hellenic Data Protection Authority (HDPA)
Kifisias 1–3
115 23 Athens
Greece
Website: www.dpa.gr
The Hellenic Data Protection Authority accepts complaints concerning alleged violations of data-protection law and GDPR rights.
19. Children’s Privacy
Our website is intended for customers who are legally able to enter into transactions under applicable law.
We do not knowingly request or collect personal data from children for purposes unrelated to providing our services.
If you believe that a child has provided personal data to us without appropriate authorisation, please contact us at:
20. Automated Decision-Making and Profiling
We do not use your personal data for automated decision-making or profiling that produces legal effects or similarly significant effects on you.
21. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes to:
- Our website
- Our services
- The third-party services we use
- Applicable legislation
- Our data-processing practices
When we make changes, we will update the “Last updated” date shown at the beginning of this Privacy Policy.
We recommend reviewing this page periodically.
22. Contact Us
If you have questions about this Privacy Policy or the way we process your personal data, please contact us:
Αγγελακούδη Ζαχαροπλαστική
El. Venizelou 10
Chalkida 341 00
Greece
Email: support@aggelakoudicakes.com
We will make reasonable efforts to respond to privacy-related enquiries and requests within the timeframes required by applicable law.
Last updated: 30 September 2026