Privacy Policy

Introduction

Epirus Carpets (ΗΠΕΙΡΩΤΙΚΗ ΤΑΠΗΤΟΥΡΓΙΑ), registered at Plesio, Filiates 46300, Thesprotia, Epirus, Greece, is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, process, use, and protect your information in compliance with the General Data Protection Regulation (GDPR) and applicable Greek data protection law.

1. Who We Are (Data Controller)

The data controller responsible for your personal data is:

For data protection inquiries, contact us using the information above.

2. What Personal Data We Collect

We collect personal data only when you voluntarily provide it or when it is necessary to deliver our services. The categories of data we collect are:

A. Data Provided by You via Forms

• RFQ Form (Request for Quotation): Name, email, phone number, company name, message content, product preferences
• Newsletter Subscription: Email address
• Contact Forms: Name, email, message content

B. Technical Data (Collected Automatically)

• IP address (anonymized for analytics)
• Browser type and version
• Pages visited and time spent
• Referral source
• Device information (type, OS)
• Cookies and local storage data (see Cookie Policy)

C. Location Data

We do not collect precise location data. We may infer general location (country/region) from IP address for analytics purposes only.

3. Legal Basis for Processing Your Data

We process your personal data only when we have a valid legal basis under GDPR Article 6:

4. Third-Party Data Processors

We may share your personal data with the following processors to provide our services:

Contact Forms (Direct Email)

• Purpose: RFQ form submissions and newsletter subscription requests are composed as emails and sent directly to info@epiruscarpets.gr via the visitor's own email client
• Data Transferred: Name, email, phone, message content — transmitted only through the visitor's email provider, not via third-party form processors
• Processing: No third-party service stores or processes form data. All communication remains between the visitor and Epirus Carpets

Google Analytics (Website Analytics)

• Purpose: Anonymized website traffic analysis and user behaviour insights
• Data Transferred: Anonymized IP addresses, page views, session duration
• Location: United States (EU-US Data Privacy Framework compliant)
• Opt-Out: You can disable analytics via cookie preferences or using Google's opt-out extension

YouTube (Video Content)

• Purpose: Embedded video content (using youtube-nocookie.com to minimise tracking)
• Data Transferred: Minimal; no cookies set until video is played
• Location: United States

Google Maps (Location Information)

• Purpose: Display of company location and directions
• Data Transferred: Only loaded after you grant consent via cookie banner
• Location: United States (EU-US Data Privacy Framework compliant)

Note: All processors are bound by Data Processing Agreements (DPA) that ensure GDPR compliance. We do not sell or rent your personal data to third parties.

5. How Long We Keep Your Data

We retain your personal data only as long as necessary to fulfil the purposes for which it was collected:

After the retention period expires, data is securely deleted or anonymized. If you request deletion before the retention period ends, we will comply (subject to legal obligations to retain certain records).

6. Your Data Subject Rights (GDPR)

Under GDPR, you have the following rights regarding your personal data:

Right of Access (Article 15)

You may request a copy of all personal data we hold about you. We will provide this in a structured, commonly used, and machine-readable format within 30 days of your request.

Right to Rectification (Article 16)

You may correct or update any inaccurate or incomplete personal data. Contact us to request corrections.

Right to Erasure (Article 17)

You may request deletion of your personal data in certain circumstances (e.g., data no longer necessary, consent withdrawn). We will comply unless we are legally obligated to retain the data.

Right to Restrict Processing (Article 18)

You may request that we limit how we use your data (e.g., during a dispute about accuracy). Your data will be marked and processed only for specific purposes.

Right to Data Portability (Article 20)

You may request to receive your data in a machine-readable format and have it transferred to another organisation. We will provide this within 30 days.

Right to Object (Article 21)

You may object to processing based on legitimate interest or for direct marketing purposes. We will cease processing unless we have compelling reasons to continue.

Right Not to Be Subject to Automated Decision-Making (Article 22)

You have the right not to be subject to purely automated decisions with legal or significant effects. We do not use automated profiling on our website.

How to Exercise Your Rights

To exercise any of these rights, contact us at:

7. Cookies and Tracking Technologies

We use cookies to enhance your experience and analyse website usage. Our cookie approach is fully compliant with GDPR and ePrivacy Directive.

Cookie Categories

• Essential Cookies: Necessary for site functionality (e.g., security, consent management). No consent required.
• Analytics Cookies: Help us understand how you use the site. Opt-in via cookie banner.
• Marketing Cookies: Used for targeted advertising and remarketing. Opt-in via cookie banner.

Managing Cookies

You can manage cookie preferences at any time by clicking "Manage Cookies" in our footer. Your browser settings also allow you to:

• Disable all cookies
• Block cookies from specific domains
• Delete existing cookies

For detailed information, see our Cookie Policy.

8. International Data Transfers

Some of our data processors are located outside the European Union (specifically in the United States). These transfers are protected by:

• EU-US Data Privacy Framework: Adopted data adequacy decision for US companies that self-certify compliance
• Standard Contractual Clauses (SCCs): Contractual safeguards approved by the European Commission
• Data Processing Agreements (DPA): Binding agreements with all processors

We ensure that data transferred outside the EU/EEA maintains the same level of protection required by GDPR.

9. Data Security

We implement industry-standard security measures to protect your personal data against unauthorised access, alteration, or loss:

• SSL/TLS encryption for data in transit (HTTPS)
• Secure data storage with access controls
• Regular security audits and updates
• Limited access to personal data (need-to-know basis)
• Password protection for administrative access

While we strive to protect your data, no online system is completely secure. If you believe your data has been compromised, contact us immediately.

10. Children's Privacy

Our website is not intended for children under 16 years old. We do not knowingly collect personal data from children. If we become aware that a child has provided personal data, we will delete it immediately. Parents or guardians who believe their child has provided data can contact us at info@epiruscarpets.gr.

11. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be notified by updating the "Last updated" date at the top and, where appropriate, sending you an email notification. Continued use of our website after changes constitutes acceptance of the updated policy.

12. Contact Us & Lodge Complaints

For Privacy Inquiries

Right to Lodge a Complaint with the Greek Data Protection Authority

If you believe we have violated your data protection rights, you have the right to lodge a complaint with the Greek Data Protection Authority (Hellenic Data Protection Authority / Αρχή Προστασίας Δεδομένων Προσώπων):

You may also contact your local Data Protection Authority in your country of residence.

13. Legitimate Interest Assessment

Where we rely on legitimate interest as the legal basis for processing (e.g., analytics), we have conducted a Legitimate Interest Assessment (LIA) to ensure that our interests do not override your rights. Our legitimate interests include:

• Improving website functionality and user experience
• Analysing website traffic and user behaviour (for anonymized analytics)
• Maintaining website security and preventing fraud
• Complying with legal obligations

Your rights are protected through consent mechanisms (cookie banner), data minimisation, and transparency.

14. Summary of Data Processing Activities