Privacy policy
Effective from 11 November 2026
This policy explains how we collect and use your personal data when you visit tepotente.com, shop with us, subscribe to our newsletter or contact us. It is written for the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Greek law.
1. Who is responsible for your data
The controller of your personal data is:
KYRIAKOS THEMELIDIS TOU PANAGIOTI (ΚΥΡΙΑΚΟΣ ΘΕΜΕΛΙΔΗΣ ΤΟΥ ΠΑΝΑΓΙΩΤΗ), sole proprietorship, distinctive title ECOM EXPERTS KT, owner of the brand Tè Potente
- Strati kai Ioannas Papadaki 32 (Στρατή και Ιωάννας Παπαδάκη 32), 16561 Glyfada, Greece
- VAT number (ΑΦΜ) 159284745 · ΓΕΜΗ 156179701000
- info@tepotente.com · +30 210 9625247
We haven't appointed a Data Protection Officer, as the law doesn't require one for us. For anything about your data, write to info@tepotente.com.
2. What data we use, why, and on what legal basis
| Purpose | Data | Legal basis (GDPR art. 6(1)) |
|---|---|---|
| Processing your order and delivering it | Name, email, phone, delivery and billing address, products ordered, amounts, discounts, order notes | Performance of the contract (b) |
| Payment | Payment status and limited payment details (e.g. card type, last 4 digits). Full card details go straight to the payment provider. We never see them | Performance of the contract (b) |
| Invoices, tax and accounting | Order and billing data, invoice/receipt data | Legal obligation (c): Greek tax and accounting law |
| Your customer account (optional) | Email, name, addresses, order history | Performance of the contract (b) |
| Customer service, questions and complaints | What you write to us, your contact details, order details | Performance of the contract (b) and our legitimate interest (f) in answering you |
| Withdrawals, returns and the legal guarantee | Your withdrawal statement, its date and time, order and return details, photos you send us | Legal obligation (c): consumer law; performance of the contract (b) |
| Newsletter (and the FIRSTSIP welcome code) | Email, the date and source of your consent, whether you open emails or click links | Your consent (a) |
| "Notify me when it's back" alerts | Email, the product you asked about | Your consent (a) |
| Keeping the site working and secure, preventing fraud | IP address, device and browser data, log data, necessary cookies, fraud signals from payment providers | Our legitimate interest (f) in a safe, working shop |
| Analytics: understanding how the site is used | Pages viewed, clicks, device, approximate location (from IP), cookie IDs | Your consent (a), given in the cookie banner |
| Advertising: measuring and personalising our ads on Meta (Facebook/Instagram), Google and TikTok and, if we enable it, on Pinterest | Cookie and pixel IDs, pages viewed, products added to cart, purchases, and hashed contact details (such as email, phone, name, location) where the platform supports it. Meta and TikTok also receive these events from our shop's server (Conversions API, Events API) | Your consent (a), given in the cookie banner |
| Defending legal claims | The data relevant to the claim | Our legitimate interest (f) |
What happens if you don't give us your data. We need your name, email and delivery address, and your phone number for the courier, to fulfil an order. Without them we can't sell to you. Everything else (account, newsletter, analytics and advertising cookies) is optional.
3. Where your data comes from
Mostly from you: at checkout, in your account, in forms or emails. We also receive:
- payment status and fraud signals from payment providers;
- delivery status from the courier;
- aggregated, statistical reports from the analytics and advertising platforms.
4. Cookies and similar technologies
We use cookies and similar technologies (pixels, tags, local storage). Only strictly necessary cookies run without your consent. On your first visit, a banner lets you accept all, reject all, or choose by category. Rejecting is as easy as accepting. You can change your choice at any time through «Cookie settings» at the bottom of every page.
| Category | What it does | Consent needed? |
|---|---|---|
| Strictly necessary | Cart, checkout, login, security, remembering your cookie choice and your language/country | No |
| Preferences | Remembering choices that improve your visit | Yes |
| Analytics | Statistics on how the site is used (Shopify analytics; Google Analytics) | Yes |
| Marketing | Measuring and personalising ads (Meta Pixel and Conversions API; Google Ads; TikTok Pixel and Events API; Pinterest Tag, if we enable it) | Yes |
The tools of Meta and TikTok, Google Analytics and Google Ads are active on our site. The Pinterest tools are used only if and when we enable them. All analytics and marketing tools run only after your consent. When an advertising platform's pixel runs on our site, we and that platform are jointly responsible for collecting and passing on the data. The platform alone is responsible for what it does with it afterwards, under its own privacy policy. We ask for your cookie consent again at least every 12 months.
5. Who we share your data with
We share only what each recipient needs.
| Recipient | Role | Why |
|---|---|---|
| Shopify (Shopify International Limited, Ireland) | Processor | Hosting our shop, checkout, customer accounts, analytics, our newsletter tool |
| Payment providers shown at checkout: Shopify Payments and its payment partners (cards, Apple Pay, Google Pay, Klarna) | Independent controllers for the payment | Processing your payment and preventing fraud. If you choose Klarna, Klarna may assess your creditworthiness under its own privacy notice |
| ACS Courier and its partner carriers abroad | Processor | Delivering your parcel and sending you delivery updates |
| Google (Google Ireland Limited) | Processor for our email (Google Workspace). Independent or joint controller for Google Analytics and Google Ads, with your consent | Our mailbox info@tepotente.com; analytics; advertising |
| Meta (Meta Platforms Ireland Limited), TikTok (TikTok Technology Limited, Ireland) and, if we enable it, Pinterest (Pinterest Europe Limited, Ireland) | Joint controllers for the data collection through their pixels (and, for Meta and TikTok, the Conversions API and Events API), with your consent | Measuring and personalising our ads |
| Our accountant | Processor | Bookkeeping and tax filings |
| Public authorities (e.g. the Independent Authority for Public Revenue (ΑΑΔΕ), courts) | Independent controllers | When the law requires it, e.g. electronic invoicing (myDATA) |
We don't sell your personal data.
6. Transfers outside the European Economic Area
Some providers (e.g. Shopify, Google, Meta, TikTok, Pinterest) may process data outside the EEA, including in the USA. When they do, the transfer is covered by an adequacy decision of the European Commission (for example the EU–US Data Privacy Framework, for certified companies) or by the Commission's Standard Contractual Clauses with additional safeguards. You can ask us for more information.
7. How long we keep your data
| Data | How long |
|---|---|
| Orders, invoices and accounting records | As long as Greek tax and accounting law requires. This is generally 5 years from the end of the tax year, longer if a tax audit period is extended |
| Customer account | Until you delete it or ask us to delete it. Order records are kept as above |
| Withdrawal, return and legal-guarantee records | Up to 5 years after delivery, or longer if a dispute is ongoing |
| Customer-service messages | Up to 2 years after the matter is closed |
| Newsletter | While you're subscribed. After you unsubscribe, we keep only your email and the record of your consent and unsubscription, for up to 3 years, to respect your choice and prove we acted lawfully |
| "Notify me" alerts | Until we've sent the alert, and at most 12 months |
| Analytics and marketing cookies | For the lifetime set for each cookie, and at most 13 months. Your consent choice is stored for 12 months |
8. Your rights
You have the right to:
- access your data and get a copy;
- have it corrected;
- have it erased ("right to be forgotten");
- restrict its processing;
- receive it in a portable format (data portability);
- object to processing based on our legitimate interest, and at any time to direct marketing;
- withdraw your consent at any time (newsletter: the unsubscribe link in every email; cookies: «Cookie settings»). This doesn't affect what we did before.
To use your rights, write to info@tepotente.com. We reply within one month. If needed, we may ask you to confirm your identity. We don't make decisions about you based solely on automated processing.
9. Complaints
If you think we've handled your data unlawfully, please tell us first so we can put it right. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Λεωφ. Κηφισίας 1-3, 115 23 Athens, www.dpa.gr, or with the data protection authority of the EU country where you live.
10. Security
Our shop runs on Shopify, which protects data with encryption (HTTPS) and a payment environment certified under PCI DSS. Only the people who need your data to serve you can access it, and our accounts are protected with two-factor authentication.
11. Children
Our products and site are intended for adults. We don't knowingly collect data from children under 15. If you believe a child has given us their data, contact us and we'll delete it.
12. Changes to this policy
We may update this policy. We'll post the new version here with its date. If the changes are significant, we'll tell you on the site or by email.
