Privacy policy
DATA PROTECTION POLICY
Privacy Notice for Customers and Website Visitors
Controller: Viktoria Vigh Consumables IKE (short name: VVC IKE)
Store: VVC SHOP Sitia | Eleftheriou Venizelou 62, 723 00 Sitia, Crete, Greece
Website: https://viktoria-vigh.com/
Contact: viktoria@viktoria-vigh.com | +30 690 901 4360
Effective date: 8 August 2026
Scope. This Policy explains how VVC IKE collects, uses, discloses, retains and protects personal information when you visit or use our online shop, buy from us, create an account, subscribe to marketing, contact us, visit VVC SHOP Sitia, or receive a delivery. It includes disclosures for the EU/EEA, United Kingdom, Switzerland and the United States.
1. Who we are and how to contact us
VVC IKE is the controller of personal data processed for its retail and e-commerce activities unless this Policy states otherwise. Our service providers may act as processors, independent controllers or joint participants in processing, depending on the service and applicable law.
Privacy requests: Email viktoria@viktoria-vigh.com or write to VVC IKE, VVC SHOP Sitia, Eleftheriou Venizelou 62, 723 00 Sitia, Crete, Greece. You may also call +30 690 901 4360. We may need to verify your identity before completing a request.
2. Personal information we collect
| Category | Examples |
|---|---|
| Identifiers and contact details | Name, billing and delivery address, email address, telephone number, account identifier, IP address and device identifiers. |
| Transaction and commercial data | Products viewed, selected or purchased; basket and checkout contents; order history; discounts; delivery method; returns; refunds; payment status and, where applicable, cash-on-delivery amount. |
| Payment data | Payment method, transaction identifiers, payment status and limited payment details returned by the payment provider. VVC IKE does not ordinarily receive complete payment-card numbers from payment providers. |
| Account data | Login/account details, saved addresses, profile data, order history and account preferences. |
| Communications | Emails, telephone enquiries, voluntarily initiated WhatsApp messages, customer-service content and information you choose to provide. |
| Marketing and engagement data | Marketing subscription and consent status, signup source, email delivery, opens, clicks, conversions, opt-outs and interaction with automated messages. |
| Online activity and device data | Pages and products viewed, searches, clicks, referral URL, session activity, cart and checkout activity, browser, operating system, approximate location and cookie/pixel identifiers. |
| Fraud, security and compliance data | Risk indicators, authentication and access logs, suspected fraud information, legal requests, disputes and records required by tax, accounting or consumer law. |
| Inferences and advertising data | Likely product interests or audiences inferred from browsing, purchases and marketing interactions; advertising attribution and campaign performance. |
We generally collect information directly from you, automatically from your browser or device, from Shopify and connected applications, and from payment, advertising, analytics, delivery and fraud-prevention partners. If you provide information about another person, such as a gift recipient, please provide only information necessary for the order and ensure you are permitted to do so.
3. Why we use personal information and our legal bases
| Purpose | EU/EEA legal basis |
|---|---|
| Operate the shop; create and administer accounts; process orders, payments, returns, refunds, collection and delivery | Performance of a contract or steps requested before a contract; legal obligations where applicable. |
| Customer service by email, telephone or voluntarily initiated WhatsApp chat | Contract or pre-contract steps; legitimate interests in responding to enquiries and supporting customers. |
| Send order, payment, delivery, security and service messages | Contract; legal obligations; legitimate interests in operating and securing the service. |
| Newsletter, welcome discount and promotional email | Consent where required. You may withdraw consent at any time without affecting prior lawful processing. |
| Personalised browse, cart and checkout reminders; post-purchase marketing | Consent to email marketing and, where required, consent for the online tracking used to create or associate the relevant activity. |
| Analytics, store improvement, measurement and personalisation | Consent where required for non-essential cookies or similar technologies; otherwise legitimate interests where permitted by law. |
| Advertising, audience measurement and ad attribution through Meta and Google services | Consent where required; otherwise legitimate interests where applicable and subject to opt-out rights. |
| Prevent fraud, misuse and security incidents; establish or defend legal claims | Legitimate interests; legal obligations; establishment, exercise or defence of legal claims. |
| Accounting, tax, customs, product-safety and other legal compliance | Compliance with legal obligations. |
Where we rely on legitimate interests, we balance those interests against your rights and reasonable expectations. You may object to processing based on legitimate interests, especially direct marketing. Where consent is the basis, refusing or withdrawing consent does not prevent ordinary shopping, but may limit optional features.
4. Shopify, accounts and store operation
Our online shop is hosted and operated using Shopify. Shopify processes store, order, account, device and interaction data to provide hosting, checkout, security, fraud prevention, customer privacy tools, communications and connected commerce services. Shopify may process data in countries outside your own under its applicable contractual and legal safeguards.
Creating a customer account is voluntary and is not required merely to browse our online store. If you create an account, we process the information you choose to provide to administer it, enable access to order information and saved addresses, and provide the requested account functions. You are responsible for keeping login details confidential and for ensuring that your information is accurate and current. You may request correction or deletion, subject to legal retention duties for transaction and accounting records.
5. Orders, payments and fulfilment
Payments
Depending on availability at checkout, payments may be handled by PayPal, Viva.com or another payment method displayed at checkout. Cash on delivery may also be available. Payment providers receive information needed to authenticate and process payment, prevent fraud, handle disputes, meet legal duties and report transaction status to us. Their own privacy notices also apply where they act as independent controllers.
Delivery, collection and local service
We disclose the information needed to deliver or administer your order to the selected carrier and its delivery partners. Current providers may include Geniki Taxydromiki, ELTA / Hellenic Post, ACS Courier, DHL and UPS. Depending on destination and shipping option, DHL or UPS may act as an international delivery partner. Local delivery in Sitia may be carried out by VVC IKE. Store collection is available at VVC SHOP Sitia.
Delivery data may include name, delivery address, telephone number, email address, order and parcel details, delivery instructions and any cash-on-delivery amount. We do not automatically enrol customers in carrier SMS or email alerts. If you visit a carrier tracking page or activate alerts yourself, that carrier processes the information you submit and technical usage data under its own privacy notice.
6. Communications and marketing automation
You may contact us by email, telephone or a WhatsApp link that you voluntarily choose to open. If you use WhatsApp, Meta/WhatsApp may process your telephone number, profile information, message metadata, device and connection data and message content under its own terms. Please do not send unnecessary sensitive information through WhatsApp. The separate Shopify WhatsApp application is not currently connected for automated messages, and Shopify Forms is not currently used for contact or newsletter forms.
Shopify email and automation tools are used for newsletters and, for email-marketing subscribers, personalised messages. Current automated messages may include:
- a welcome email with a discount after subscription, subject to the configured signup condition;
- a product-browse reminder approximately 2 hours after an eligible abandoned browse;
- a cart reminder approximately 4 hours after an eligible abandoned cart;
- a checkout reminder approximately 10 hours after an eligible abandoned checkout; and
- a post-purchase thank-you marketing email approximately 2 days after an eligible purchase, tailored by order count.
The workflows apply availability, purchase and suppression checks and send marketing email only to email-marketing subscribers. Marketing emails include an unsubscribe link. We measure delivery, opens, clicks, conversions and revenue attribution. You may unsubscribe at any time. Necessary transactional messages, such as order and delivery communications, are not marketing and may continue where needed to perform the contract or comply with law.
7. Cookies, pixels, analytics and targeted advertising
We and our partners use cookies, pixels, tags, local storage and similar technologies for essential store functions, preferences, analytics, security, advertising, audience creation and measurement. Shopify customer privacy controls may present categories such as necessary, analytics, marketing and preferences/personalisation, depending on region and configuration.
Connected technologies include Meta services (Facebook and Instagram, including the Meta Pixel and, depending on the configured data-sharing level, server-side event sharing or advanced matching) and Google services (including Google and YouTube integrations, Merchant-related tags, advertising measurement and other connected Google functions where enabled). These services may receive identifiers, contact information in hashed or other protected form, device/browser data, viewed content, shopping activity, purchases and advertising interaction data.
Important current configuration disclosure: based on the configuration reviewed for this Policy, Meta Pixel and the Google Merchant-related tag are not technically restricted to activation only after a visitor gives consent. They may therefore process data when the relevant page loads. Where local law requires prior consent, this configuration should be corrected; this disclosure does not replace any consent requirement. You can use available cookie/privacy controls, browser settings, advertising controls and the data-sharing opt-out methods described below.
We do not sell personal information for money. However, disclosure of online identifiers and activity to advertising partners for cross-context behavioural or targeted advertising may be treated as “sale”, “sharing” or “targeted advertising” under some US state laws. Where those laws apply, you may opt out by using the “Do Not Sell or Share My Personal Information” / data-sharing opt-out control made available on the site or by contacting us. Where legally required and technically supported, we will also process recognised opt-out preference signals such as Global Privacy Control.
8. When we disclose personal information
We may disclose personal information to:
- Shopify and connected platform providers that host, secure and operate our store;
- payment providers and banks, including PayPal and Viva.com;
- delivery and logistics providers listed in Section 5;
- communications providers, including Shopify email tools and WhatsApp/Meta when you use those services;
- advertising, analytics and measurement partners, including Meta and Google;
- professional advisers, accountants, insurers, auditors and IT/security providers;
- public authorities, courts, regulators and law-enforcement bodies where required or permitted by law; and
- a buyer, investor, successor or adviser in connection with a genuine corporate transaction, subject to appropriate confidentiality and legal safeguards.
Service providers may use personal information only for agreed services and legal duties where they act as processors. Some recipients determine their own purposes and responsibilities under their privacy notices.
9. International transfers
We are established in Greece and sell and ship internationally, subject to destination availability, restrictions and checkout options. Shopify, Meta, Google, WhatsApp, payment providers and other partners may process information in the United States, Canada and other countries outside the EU/EEA, UK or Switzerland.
Where required, international transfers are supported by an adequacy decision, the EU Standard Contractual Clauses, the UK International Data Transfer Agreement or UK Addendum, the Swiss adaptations to recognised safeguards, another legally approved transfer mechanism, or a permitted derogation. We also consider supplementary safeguards where appropriate. You may contact us for further information about the safeguards relevant to your data, subject to confidentiality restrictions.
10. Data retention
| Data | Typical retention approach |
|---|---|
| Orders, invoices, payments and tax/accounting records | At least five years from the end of the relevant period, or longer where another law, audit, dispute or legal claim requires it. |
| Customer account data | While the account remains active or until deletion is requested, except that transaction and legally required records are retained separately. |
| General email, telephone and WhatsApp enquiries | For as long as needed to answer the enquiry, manage follow-up and protect legitimate legal interests. |
| Marketing subscription and engagement data | Until unsubscribe or withdrawal, plus limited suppression and consent records needed to honour the opt-out and demonstrate compliance. |
| Cookie, pixel and device data | According to the lifetime of the technology, partner settings, consent choice and applicable law. |
| Security, fraud, complaints and claims | For as long as reasonably necessary to investigate, protect the service and establish, exercise or defend claims. |
We may anonymise information so that it can no longer reasonably identify you and retain the anonymised information for legitimate business and statistical purposes.
11. Your rights in Europe
If the EU/EEA GDPR applies, you may have the right to access, rectify, erase or restrict your personal data; receive certain data in a portable format; object to processing based on legitimate interests and to direct marketing; withdraw consent; and complain to a supervisory authority. Rights are subject to legal conditions and exceptions.
The lead authority for our Greek establishment is the Hellenic Data Protection Authority, Kifissias 1–3, 115 23 Athens, Greece; telephone +30 210 6475600; email contact@dpa.gr; https://www.dpa.gr/. You may also contact the authority where you live or work where applicable.
If UK data-protection law applies, you may have corresponding UK GDPR rights and may complain to the UK Information Commissioner’s Office. If Swiss law applies, you may have rights under the Swiss Federal Act on Data Protection and may contact the Federal Data Protection and Information Commissioner. Local rules may require an additional representative; this Policy does not limit any mandatory local right.
12. United States privacy notice
This section supplements the rest of the Policy for US residents. US state privacy laws differ and usually apply only when statutory thresholds and other conditions are met. Where an applicable state law grants you rights, we will honour those rights as required.
Notice at collection and disclosures in the preceding 12 months
| US category | Collected / source / purpose / disclosure |
|---|---|
| Identifiers | Collected from you, devices, Shopify and partners; used for accounts, orders, communication, security, marketing and fulfilment; disclosed to platform, payment, delivery, communications, advertising and professional-service providers. |
| Customer records and contact information | Collected from you and transaction partners; used for contracting, payment, delivery, service and compliance; disclosed to the providers needed for those functions. |
| Commercial information | Collected from shopping and order activity; used for fulfilment, support, analytics, personalisation, marketing and legal records; disclosed to Shopify, payment, delivery, analytics and advertising providers. |
| Internet or electronic network activity | Collected from browsers, devices, cookies, pixels, Shopify, Meta and Google; used for security, store operation, analytics, attribution and targeted advertising; disclosed to platform, security, analytics and advertising providers. |
| Approximate geolocation | Derived from IP/device data; used for security, regional settings, delivery context, analytics and advertising; disclosed to relevant platform, security, analytics and advertising providers. |
| Inferences | Created from browsing, purchases and marketing activity; used for recommendations, segmentation and advertising; disclosed to Shopify and advertising/marketing providers. |
| Sensitive personal information | We do not seek to collect sensitive personal information for the purpose of inferring characteristics. Payment authentication and account credentials are handled for service and security purposes. Please do not send unnecessary sensitive information. |
US resident rights
Depending on your state and whether its law applies, you may have the right to:
- confirm whether we process your personal information and obtain access or a portable copy;
- request correction or deletion, subject to exceptions;
- obtain information about categories of personal information, sources, purposes and recipients;
- opt out of sale, sharing, targeted advertising and certain profiling with legal or similarly significant effects;
- limit certain uses or disclosures of sensitive personal information where applicable;
- receive equal service and not be discriminated against for exercising privacy rights; and
- appeal our refusal of a request where state law provides an appeal right.
To exercise a right, email viktoria@viktoria-vigh.com with the subject “US Privacy Request”, or use an available privacy/opt-out control on the website. Tell us your state of residence and the right you wish to exercise. We will use information reasonably necessary to verify and process the request. An authorised agent may submit a request where permitted; we may require proof of authority and direct verification with you.
California disclosure: We do not sell personal information for monetary payment. Advertising-related disclosure may constitute “sharing” under California law. We do not knowingly sell or share personal information of consumers under 16. We do not use or disclose sensitive personal information for purposes that would require a California right-to-limit notice based on the practices described here. California consumers may request the applicable information described above and may use Global Privacy Control as an opt-out preference signal where required.
Financial incentives: We may offer discounts, such as a newsletter welcome discount. Participation is voluntary. Unless separate terms state otherwise, the discount is offered for subscribing to marketing and is not intended as a payment for selling personal information. You may unsubscribe at any time, subject to the terms of any discount already used.
13. Children’s privacy
Our store is not directed to children under 18 in the United States or to children below the minimum age for valid independent consent in their country. We do not knowingly collect personal information online from children in circumstances requiring parental consent. If you believe a child has provided personal information improperly, contact us so we can investigate and delete it where required.
14. Security
We use reasonable administrative, technical and organisational measures appropriate to the nature of the information and the risks involved. No website, transmission or storage system can be guaranteed completely secure. You should use a unique password, protect account credentials and contact us promptly if you suspect unauthorised access.
15. Automated decision-making
Our marketing workflows select messages using events such as product viewing, cart or checkout abandonment, purchase status, product availability, marketing subscription and order count. These workflows are used for communications and personalisation; they do not, as currently configured, make decisions that produce legal or similarly significant effects about you. Fraud and payment providers may use automated risk tools under their own policies.
16. Changes to this Policy
We may update this Policy to reflect operational, technical, legal or regulatory changes. The updated version will be posted with a revised effective date. If a change materially affects how we use information or your choices, we will provide additional notice where required.
17. Contact and requests
Viktoria Vigh Consumables IKE (VVC IKE)
VVC SHOP Sitia
Eleftheriou Venizelou 62
723 00 Sitia, Crete, Greece
Email: viktoria@viktoria-vigh.com
Telephone: +30 690 901 4360
Website: https://viktoria-vigh.com/
We aim to respond within the period required by the law applicable to your request. We may retain a limited record of the request and our response to demonstrate compliance and prevent repeated processing of opted-out data.