Privacy policy

Last updated: August 13, 2026

1. Who we are

The data controller for the website kostarelos.gr is ΥΙΟΙ ΧΡ. ΚΩΣΤΑΡΕΛΟΥ & ΣΙΑ Ε.Ε. (Yioi Chr. Kostarelou & SIA E.E.), with registered offices at 26th km Markopoulou Avenue, Markopoulo, Attica, Greece (hereinafter "KOSTARELOS", "we" or "the company").

For any matter concerning the protection of personal data, you can contact us at info@kostarelos.gr or by post at the address above.

2. Who and what this policy applies to

This Privacy Policy explains how we collect and use personal data when you visit kostarelos.gr, contact us through the contact form, by email or by phone, or manage your cookie preferences.

3. What data we collect

Depending on how you use the website, we may collect:

• Contact details and the content of your request: full name, email address, phone number, your message and any other information you choose to share with us.

• Technical and security data: IP address, browser and device type, operating system, date and time of access, log files and information required for the secure and proper operation of the website.

• Usage data and cookie preferences: information about how you use the website and your consent choices, according to the cookie settings you select.

We do not ask you to send us special categories of personal data through the contact form.

4. Why and on what legal basis we use your data

We use your personal data:

• To respond to your questions, requests or proposals and to communicate with you. Depending on the request, processing is based on taking steps prior to entering into a contract, or on our legitimate interest in serving and communicating with those who contact the company.

• To operate, maintain, secure and protect the website, prevent abuse and resolve technical issues. Processing is based on our legitimate interest in running a secure and reliable website and, where required, on compliance with our legal obligations.

• For traffic analytics, personalization or marketing communications, only where required and where you have given your consent through the cookie management tool. You can withdraw your consent at any time.

5. Cookies and similar technologies

The website uses cookies and similar technologies. Some cookies are strictly necessary for its operation and security. Others, such as preference, analytics or marketing cookies, are used only in accordance with your consent choices.

Through the cookie banner you can accept, reject or manage cookie categories. You can later change or withdraw your choices via the "Cookie preferences" link on the website.

Rejecting non-essential cookies does not prevent you from accessing the main content of the website.

6. Who we share data with

We may share personal data, only to the extent necessary, with:

• hosting, technical support and security providers and other partners who support the operation of the website,

• Shopify, which provides the platform on which the website runs, and its approved sub-processors,

• professional advisers, where necessary,

• competent public, judicial or supervisory authorities, where there is a legal obligation to do so.

We do not sell your personal data.

7. Transfers outside the European Economic Area

Some of our service providers, including Shopify and its partners, may process data in countries outside the European Economic Area. Where required, transfers are made with appropriate legal safeguards, such as adequacy decisions or approved standard contractual clauses.

8. How long we keep your data

We keep personal data only for as long as necessary for the purpose for which it was collected and for as long as required by law. The retention period depends on the nature of the request, the need to document the communication, security requirements and any legal obligations we may have. When data is no longer needed, it is securely deleted or anonymized.

9. Your rights

Subject to applicable law, you may request:

• access to the personal data we hold about you,

• correction of inaccurate or incomplete data,

• deletion of your data,

• restriction of processing,

• portability of your data,

• objection to processing based on legitimate interest,

• withdrawal of your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

To exercise your rights, contact us at info@kostarelos.gr. We may ask for the minimum information needed to verify your identity. We normally respond within one month, in accordance with the General Data Protection Regulation.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority: www.dpa.gr.

10. Third-party links and services — online ordering via Wolt

The website contains links to third-party services. In particular, the "Order online" button leads to an external ordering service provided through Wolt/order.site. Once you move to that service, data is collected and processed under its own terms and privacy policy. We recommend reading them before placing an order or submitting personal details.

11. Security

We apply appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration or disclosure. No system for transmitting or storing data can, however, be considered completely secure.

12. Children's data

The website is not specifically aimed at minors and we do not knowingly seek to collect personal data from children. If you believe a minor has sent us personal data without the required consent, please contact us.

13. Changes to this policy

We may update this Privacy Policy when our services, the technologies we use or the legal framework change. The current version is published on this page with its last-updated date.

14. Contact

For questions about this Privacy Policy or the processing of your personal data:

YIOI CHR. KOSTARELOU & SIA E.E.
26th km Markopoulou Avenue, Markopoulo, Attica, Greece
info@kostarelos.gr