PART I – General Provisions

Contents

1. Introduction

2. Data Controller

3. Scope of this Privacy Policy

4. Categories of Personal Data

Article 1 – Introduction

1.1

Seventh Heaven Store ("the Store", "we", "us" or "our") respects your privacy and is committed to protecting your personal data in accordance with applicable data protection legislation, including the European Union General Data Protection Regulation (EU) 2016/679 ("GDPR") and any other applicable laws.

1.2

This Privacy Policy explains how we collect, use, store, disclose and otherwise process personal data when you visit our Store, create an account, place an order, communicate with us or otherwise interact with our services.

1.3

We are committed to processing personal data lawfully, fairly and transparently, while applying appropriate technical and organisational measures designed to safeguard your information.

1.4

By accessing or using the Store, you acknowledge that you have read this Privacy Policy. Where processing is based on your consent, you remain free to withdraw that consent at any time, without affecting the lawfulness of processing carried out before such withdrawal.

Article 2 – Data Controller

2.1

The Data Controller responsible for the processing of personal data collected through the Store is the business operating under the commercial name Seventh Heaven Store.

2.2

The final published version of this Privacy Policy will include all legally required business identification and contact information, including the Data Controller's contact details.

2.3

Where applicable, customers may contact the Data Controller regarding any matter relating to the processing of personal data or the exercise of their rights under applicable data protection legislation.

Article 3 – Scope of this Privacy Policy

3.1

This Privacy Policy applies to all personal data processed through the Store, including data collected when browsing the website, creating an account, placing orders, contacting customer support, subscribing to newsletters or otherwise interacting with our services.

3.2

This Privacy Policy applies solely to personal data processed by Seventh Heaven Store and does not govern third-party websites, platforms or services that may be accessible through external links provided on the Store.

3.3

Where third-party services process personal data independently, their own privacy policies and terms shall apply.

3.4

This Privacy Policy should be read together with our Terms & Conditions, Cookie Policy, Shipping & Returns Policy and any other legal documentation published by the Store.

Article 4 – Categories of Personal Data

Depending on how you interact with the Store, we may process one or more of the following categories of personal data:

4.1 Identity Data

Such as your name, billing details and other information necessary to identify you.

4.2 Contact Data

Such as your email address, telephone number, delivery address and billing address.

4.3 Account Data

Including login credentials, encrypted passwords, account preferences, wishlists and similar account-related information where applicable.

4.4 Transaction Data

Including order history, purchased products, payment status, invoices and related transaction records.

4.5 Payment Data

Payment information is generally processed by authorised payment service providers. Seventh Heaven Store does not normally store complete payment card details.

4.6 Technical Data

Including IP address, browser type, operating system, device information, language preferences, referral URLs and similar technical information collected automatically.

4.7 Usage Data

Including information regarding your interaction with the Store, pages visited, products viewed, search activity, shopping cart activity and similar behavioural information.

4.8 Marketing & Communication Data

Including newsletter subscriptions, communication preferences, responses to marketing campaigns and records of communications where applicable.

4.9 Customer Support Data

Including correspondence, enquiries, requests and any information voluntarily provided when contacting our customer support.

---------------------------------------------------------------------------------------

PART II – Data Processing

Contents

5. How We Collect Personal Data

6. Purposes of Processing

7. Legal Bases for Processing

8. Cookies & Similar Technologies

Article 5 – How We Collect Personal Data

5.1

We may collect personal data directly from you when you create an account, place an order, subscribe to our newsletter, contact us, participate in promotions or otherwise communicate with us.

5.2

Certain technical and usage information may be collected automatically when you visit the Store through cookies, server logs and similar technologies, subject to your preferences where required by applicable law.

5.3

We may also receive limited personal data from trusted third-party service providers involved in processing payments, delivering orders, preventing fraud, providing analytics or supporting the operation of the Store.

5.4

We do not knowingly collect personal data from unlawful sources or process personal data for purposes incompatible with those described in this Privacy Policy.

Article 6 – Purposes of Processing

We process personal data only where necessary for legitimate and specified purposes, including but not limited to:

6.1

Creating and managing customer accounts.

6.2

Processing and fulfilling orders.

6.3

Providing customer support and responding to enquiries.

6.4

Processing payments and preventing fraudulent transactions.

6.5

Managing shipping, deliveries, returns and refunds.

6.6

Complying with legal, accounting and tax obligations.

6.7

Maintaining the security, stability and proper functioning of the Store.

6.8

Improving our products, services and customer experience through analytics and performance monitoring.

6.9

Sending newsletters, promotional communications or marketing materials where permitted by law or based on your consent.

6.10

Protecting our legal rights, preventing abuse and enforcing our Terms & Conditions where necessary.

Article 7 – Legal Bases for Processing

Depending on the circumstances, personal data is processed on one or more of the following legal bases under Article 6 GDPR.

7.1 Contractual Necessity

Where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.

7.2 Legal Obligation

Where processing is necessary to comply with applicable legal or regulatory obligations.

7.3 Legitimate Interests

Where processing is necessary for our legitimate business interests, provided that such interests are not overridden by your fundamental rights and freedoms.

7.4 Consent

Where processing is based on your freely given, specific, informed and unambiguous consent. You may withdraw your consent at any time without affecting the lawfulness of processing carried out before its withdrawal.

7.5 Protection of Legal Claims

Where processing is necessary for the establishment, exercise or defence of legal claims.

Article 8 – Cookies & Similar Technologies

8.1

The Store uses cookies and similar technologies to ensure the proper operation of the website, enhance user experience, improve security and analyse website performance.

8.2

Certain cookies are strictly necessary for the operation of the Store, while others are used only with your consent where required by applicable law.

8.3

Cookies may be provided directly by the Store or by carefully selected third-party service providers supporting functions such as analytics, payment processing, fraud prevention, marketing or embedded content.

8.4

You may manage your cookie preferences through the Store's cookie banner or your browser settings. Disabling certain cookies may affect the functionality of some parts of the Store.

8.5

Further information regarding our use of cookies is available in our separate Cookie Policy.

SEVENTH HEAVEN STORE

Privacy Policy

PART III – Data Sharing, Retention & Security

Contents

9. Sharing Personal Data

10. International Data Transfers

11. Data Retention

12. Security Measures

Article 9 – Sharing Personal Data

9.1

We do not sell, rent or otherwise disclose your personal data to third parties except where necessary for the operation of the Store, the performance of our contractual obligations, compliance with legal requirements or as otherwise described in this Privacy Policy.

9.2

Personal data may be shared, where appropriate, with carefully selected service providers assisting us in operating the Store, including providers of:

• e-commerce platform services;

• payment processing;

• shipping and logistics;

• accounting and tax services;

• fraud prevention and security;

• website hosting and cloud infrastructure;

• analytics and performance monitoring;

• marketing and customer communication services; and

• other business support services.

9.3

All third-party service providers are expected to process personal data only for the purposes for which it is disclosed and in accordance with applicable data protection legislation.

9.4

Personal data may also be disclosed where required by law, court order, regulatory authority or other legally binding obligation.

9.5

In the event of a merger, acquisition, business restructuring or transfer of assets, personal data may be transferred where legally permitted and subject to appropriate safeguards.

Article 10 – International Data Transfers

10.1

Certain service providers used by the Store may process personal data outside the European Economic Area ("EEA").

10.2

Where personal data is transferred outside the EEA, we take reasonable steps to ensure that appropriate safeguards are implemented in accordance with the GDPR and other applicable legislation.

10.3

Such safeguards may include adequacy decisions issued by the European Commission, Standard Contractual Clauses ("SCCs"), or other lawful transfer mechanisms recognised under applicable legislation.

10.4

Where required by law, additional information regarding international transfers may be provided upon request.

Article 11 – Data Retention

11.1

Personal data is retained only for as long as necessary to fulfil the purposes for which it was collected, including compliance with legal, accounting, tax and regulatory obligations.

11.2

Retention periods may vary depending on the type of personal data, the applicable legal requirements and the legitimate operational needs of the Store.

11.3

Once personal data is no longer required, it will be securely deleted, anonymised or otherwise disposed of in accordance with applicable law and established retention procedures.

11.4

Where required for the establishment, exercise or defence of legal claims, certain information may be retained for longer periods permitted or required by law.

Article 12 – Security Measures

12.1

We implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

12.2

Security measures may include encrypted communications, access controls, authentication procedures, regular software updates, secure hosting environments and other reasonable safeguards appropriate to the nature of the data processed.

12.3

Although we strive to protect personal data using commercially reasonable security measures, no method of electronic transmission or storage can be guaranteed to be completely secure.

12.4

Users are encouraged to protect their account credentials, use strong passwords and notify us immediately if they believe their account has been compromised.

------------------------------------------------------------------------------------------

PART IV – Your Privacy Rights

Contents

13. Your Rights under the GDPR

14. Marketing Communications

15. Children's Privacy

16. Third-Party Services

Article 13 – Your Rights under the GDPR

13.1

Subject to applicable data protection legislation, you may have the right to:

• access your personal data;

• request the correction of inaccurate or incomplete personal data;

• request the deletion of your personal data ("right to be forgotten");

• request the restriction of processing;

• object to certain processing activities;

• request data portability where applicable; and

• withdraw your consent at any time where processing is based on consent.

13.2

The exercise of certain rights may be subject to legal limitations or conditions provided by applicable legislation.

13.3

Requests concerning the exercise of your rights may be submitted using the contact details provided in this Privacy Policy.

13.4

We will respond to legitimate requests within the time limits required by applicable data protection legislation.

Article 14 – Marketing Communications

14.1

Where permitted by law or based on your consent, we may send newsletters, promotional offers, product announcements and other marketing communications.

14.2

You may unsubscribe from marketing communications at any time by using the unsubscribe link included in our emails or by contacting us directly.

14.3

Opting out of marketing communications does not affect transactional communications relating to your orders, customer account, legal obligations or other essential service notifications.

14.4

We do not send unsolicited electronic marketing communications where prohibited by applicable law.

Article 15 – Children's Privacy

15.1

The Store is intended for a general audience and is not specifically directed toward children.

15.2

We do not knowingly collect personal data from children where parental consent is required under applicable legislation.

15.3

If we become aware that personal data has been collected from a child in violation of applicable law, we will take appropriate steps to delete such information without undue delay.

15.4

Parents or legal guardians who believe that a child has provided personal data may contact us using the contact details set out in this Privacy Policy.

Article 16 – Third-Party Services

16.1

The Store may integrate or interact with third-party services that support its operation, including payment providers, shipping providers, analytics services, embedded content, social media features, fraud prevention tools and other business-related services.

16.2

Where third-party providers independently determine the purposes and means of processing personal data, they act as independent data controllers and are governed by their own privacy policies.

16.3

Users are encouraged to review the privacy policies of third-party providers before using their services.

16.4

The inclusion of third-party services or external links does not imply endorsement of their privacy practices by Seventh Heaven Store.

-------------------------------------------------------------------------------------------

PART V – Final Provisions

Contents

17. Changes to this Privacy Policy

18. Contact Details

19. Supervisory Authority

20. Final Provisions

Article 17 – Changes to this Privacy Policy

17.1

Seventh Heaven Store may update this Privacy Policy from time to time in order to reflect changes in applicable legislation, regulatory requirements, business operations, technological developments or the services offered through the Store.

17.2

The most current version of this Privacy Policy will always be published on the Store and will indicate its effective date.

17.3

Material changes affecting the processing of personal data will be communicated where required by applicable law.

17.4

Continued use of the Store following the publication of an updated Privacy Policy constitutes acknowledgement of the revised version, without prejudice to any rights that require your explicit consent under applicable law.

Article 18 – Contact Details

18.1

Questions, requests or concerns relating to this Privacy Policy or the processing of personal data may be addressed to the Data Controller using the contact details published on the Store.

18.2

The final published version of this Privacy Policy will include all legally required contact information, including:

• Business Name;

• Business Address;

• Email Address;

• Telephone Number (where applicable); and

• Any additional contact information required by applicable legislation.

18.3

Requests relating to the exercise of data protection rights should contain sufficient information to allow us to verify the identity of the requesting individual where appropriate and permitted by law.

Article 19 – Supervisory Authority

19.1

If you believe that the processing of your personal data infringes applicable data protection legislation, you have the right to lodge a complaint with the competent supervisory authority.

19.2

Where the processing of personal data is subject to the GDPR and the Data Controller is established in Greece, the competent supervisory authority is the Hellenic Data Protection Authority (HDPA).

19.3

Nothing in this Privacy Policy limits your right to seek judicial remedies or to exercise any other rights available under applicable data protection legislation.

Article 20 – Final Provisions

20.1

This Privacy Policy forms an integral part of the Store's legal documentation and should be read together with the Terms & Conditions, Cookie Policy, Shipping & Returns Policy, Refund Policy and any other applicable legal notices published by the Store.

20.2

If any provision of this Privacy Policy is held to be invalid, unlawful or unenforceable, the remaining provisions shall remain in full force and effect.

20.3

Failure by Seventh Heaven Store to enforce any provision of this Privacy Policy shall not constitute a waiver of any right or provision.

20.4

This Privacy Policy remains effective until replaced by a newer published version.