Privacy Policy

Principles governing data processing

• a) Legality and Transparency
  All personal data we collect is processed lawfully and fairly, always in accordance with applicable law and in a transparent manner regarding the information we collect about you.
• b) Purpose limitation and data minimisation
  Art & Colour collects your personal data for specified, explicit and legitimate purposes, and does not process it further in any manner incompatible with those purposes. We collect only the data that is adequate and necessary for the purpose for which it is processed.
• c) Accuracy
  We keep your personal data accurate and, where necessary, up to date. Art & Colour takes all reasonable steps to erase or correct inaccurate personal data promptly. You can reach us by email, as set out below.
• d) Storage limitation
  Art & Colour keeps your personal data only for as long as it is needed for the purposes of processing, or for as long as the law requires. Full details are in the Data Retention Periods section.
• e) Data Integrity, Confidentiality and Security
  Art & Colour applies appropriate security policies and procedures to ensure that your personal data is processed in a manner that guarantees appropriate security, including protection against unauthorised or unlawful processing and accidental loss, destruction or damage, using appropriate technical and organisational measures.

Despite the efforts made by Art & Colour, security cannot absolutely guarantee against all threats. In the event of a loss or breach of personal data we have a dedicated incident response team and a procedure for dealing with such incidents in order to remedy the breach as quickly as possible, limit the potential consequences and comply with our obligations under the law.

We make every effort to ensure that access to your personal data is limited to those who need to know it. Persons who have access to the data are obliged to respect the confidentiality of this data. In the event of a breach of your personal data, we inform you immediately and by any appropriate means.

Lawfulness of processing

For the processing of your personal data and information to be lawful, certain conditions must be met. Art & Colour is always in compliance with Greek and EU legislation and collects only the personal data that is necessary and required, in compliance with the above legal requirements, which are the following:

Your consent: in certain cases we ask for your consent separately, through a deliberate action on your part each time. This applies to cookies that are not necessary for the shop to function, and to signing up for our newsletter. Accepting the terms of use or reading this policy does not constitute consent.

You can withdraw your consent at any time: for cookies, through the Cookie settings link at the foot of every page; for the newsletter, through the unsubscribe link in every message; or by writing to us at info@artcolour.gr. Withdrawing consent does not affect the lawfulness of processing carried out before it, and it does not affect your ability to buy from us.

• Performance of a contract: this is when the processing of your personal data is necessary for the performance of our obligations arising from a contract, when you are a party to a contract or at your request prior to entering into a contract.
• Legal obligation: this is where we are required to process your personal data in order to comply with a legal obligation, such as to keep records for tax purposes or to provide information to a public body or law enforcement authority.
• Legitimate interest: we may process data about you where we have a legitimate interest in carrying out a lawful activity in order to ensure the continuation of that activity, as long as it does not override your interests.

Minors

Protecting children’s personal data matters to us. Under Greek Law 4624/2019, a minor who has reached the age of 15 can give their own consent to the processing of their personal data. For a minor under 15, consent is given or authorised by the holder of parental responsibility.

Collection and use of Personal Data

What data we collect

We receive your personal data if you choose to provide it (for example, if you contact us by e-mail or if you subscribe to certain services). Depending on your activity on our website we collect different data and more specifically, we can separate users of our website into three categories.

We use the data you give us only for the purposes described in this Policy. We do not use it for any other purpose unless you ask us to or the law requires it.

For example, if you register on the Art & Colour website and provide information about your preferences, we will use this information to personalise your user experience. When you register or log in using a third party unique registration service, we may identify you as the same user regardless of your use of different devices and personalise your user experience on any other Art & Colour websites you visit.

In some cases where you have registered for certain services, we may temporarily store your email address until we receive confirmation of the information you provided via email (i.e. by sending an email to the email address you provided as part of your registration to confirm your registration request). In some cases, it is possible that you may have previously provided your Personal Data to Art & Colour.

Automatic collection of Personal Data

In some cases, Art & Colour and its service providers use cookies and other technologies to automatically collect certain categories of data when you visit us online and through any emails we may exchange. The collection of this data allows us to personalise your online experience, to improve the performance, usability and effectiveness of Art & Colour’s online presence and to assess the effectiveness of our marketing activities for our services.

IP addresses

An IP address is a number assigned to your computer every time you access the internet. It allows computers and network service computers (servers) to identify and communicate with each other. The IP addresses from which visitors appear to originate may be logged for information technology security and system diagnostic purposes. This data may also be used in aggregate form in order to perform an analysis of trends and site performance.

Cookies

Our site uses cookies and similar technologies. Some are necessary for the shop to work, such as the ones that keep your basket. Others, like the ones used for statistics, we only use if you give us your consent.

The first time you visit, you will see a consent banner. You can change your choice at any time through the Cookie settings link at the foot of every page.

The full list of cookies we use, with the purpose and duration of each, is in our Cookie Policy.

Google Analytics

We use Google Analytics to understand how our site is used: how many visitors come, where they come from and which pages they view. We see this information in aggregate and it does not allow us to identify you.

Google Analytics is only activated if you have given your consent to statistics cookies. You can withdraw that consent at any time through the Cookie settings link at the foot of every page.

Newsletters

We use the MailerLite platform to send our newsletter. It holds your email address, your name if you have given it, the subject areas you are interested in, and information about whether you open our messages. This lets us send you content relevant to the materials you work with.

You are only signed up through a deliberate action on your part, either through the form on the site or when completing an order. You can unsubscribe at any time through the unsubscribe link in every message, or by writing to us at info@artcolour.gr. Unsubscribing takes effect immediately and does not affect your orders.

If you leave items in your basket without completing the order and you have already given us your address, we may send you a reminder. You can ask us not to send these reminders in the same way.

Separately from the above, we send you messages about the order itself, such as confirmation, dispatch and invoicing. These messages are necessary to fulfil the order and are sent regardless of whether you have signed up for the newsletter.

Sales through Skroutz Marketplace

We sell some of our products through Skroutz Marketplace. Those orders are placed on the Skroutz platform, not on artcolour.gr. To fulfil the order, we receive from Skroutz the details needed for delivery and invoicing: name, delivery address, telephone number and the order details. We process this data solely to fulfil the order and to comply with tax legislation.

Your browsing on the Skroutz platform, and any data Skroutz collects there, is governed by the Skroutz.gr privacy policy. artcolour.gr does not use the Skroutz Analytics service and does not place Skroutz cookies on your device.

Social Media

On our site you will find links to our pages on Facebook, Instagram, Pinterest and TikTok. These are plain links: if you follow them, you are taken to those platforms, where their own terms and privacy policies apply.

Anything you post on our social media pages is visible to the other users of that platform. Posting other people’s personal data without their consent is not permitted.

Data collected during your registration

When you create an account or place an order, we ask for the details we need in order to serve you:

• Contact and delivery details: name, billing and delivery address, email address and telephone number.
• Invoicing details, if you request an invoice or buy wholesale: business name, VAT number, tax office and profession or line of business.
• Account details: username and password. The password is stored encrypted and is not visible to us.
• Order and basket history: what you have bought and when, along with the contents of your basket, so that you can find it if you come back later.
• Technical details: IP address, information about your device and data from cookies, as described in our Cookie Policy.

We ask you for personal data in the following cases:

• When you place an order, in the online shop, in our shop in Kavala or by telephone.
• When you create an account.
• When you sign up for our newsletter.
• When you contact us with a question or a request.

Data collected from users who purchase products without registration

In this case you give us only the details needed to complete the order: name, address, email address and telephone number. No account is created and we do not keep a customer profile.

We keep the order and invoice details for as long as tax legislation requires, as described in the Data Retention Periods section.

Transfer of Personal Data to third parties

We do not share personal data with third parties who are not affiliated with us, except as required for our legitimate business and professional needs, in order to respond to your requests and/or as required or permitted by law or professional standards.
This includes the following third parties:

• External service providers: where necessary, we engage other companies and individuals to carry out certain tasks that support our services on our behalf, under data processing agreements. For example, we may provide personal data to partners who host our databases and applications, who provide data processing services, or who send you information you have requested.

All Art & Colour partners are fully compliant with the General Data Protection Regulation (GDPR compliant) and are contractually bound to comply with it. Art & Colour only transfers personal data to them when they meet our strict data processing and security standards. We only disclose personal data that enables them to provide their services.

• Transfer of business: in the event of a reorganisation, restructuring, merger, sale or other transfer of assets, we will transfer data, including personal data, on a reasonable scale, provided that the recipient agrees to respect your personal data in a manner consistent with applicable data protection laws. We will continue to ensure the confidentiality of any personal data and will notify you when your personal data becomes subject to a different privacy policy.
• Courts, judicial or regulatory authorities:Art & Colour may disclose personal data in order to respond to requests from courts, judicial, governmental or police authorities, or where required and where it is prudent to comply with applicable law, court orders or orders of courts or judicial authorities.
• Public bodies: Art & Colour may disclose personal data in cases of audits by public bodies and authorities, such as, for example, audits concerning personal data protection, security, tax audits.

By way of example, your personal data may be disclosed to the following recipients or categories of recipients:

Infrastructure
– Website hosting provider, with servers within the European Union
– Content delivery network and security provider

Orders Shipping
– ACS Courier
– Courier Center
– Elta Courier
– Geniki Taxydromiki
– DHL Express

Payments
– Stripe
– PayPal
– Banks we work with (in the case of Bank Transfer)

Business and accounting administration
– Business management system provider
– External accountancy firm

Communications and marketing
– MailerLite (sending newsletters)
– Google (statistics, advertising)
– Meta Platforms Ireland (social media)

Sales and listing platforms
– Skroutz (sales through Skroutz Marketplace)
– BestPrice (product listings)

Transfers of data outside the European Economic Area

Most of our partners process your data within the European Economic Area. Where a partner is located outside the EEA, or holds data there, the transfer is made either on the basis of an adequacy decision by the European Commission or under the Standard Contractual Clauses approved by the Commission, together with any additional measures required in each case.

Art & Colour will not forward the personal data you provide to any third parties for their direct use for marketing purposes.

Data Retention Periods

We keep your personal data only for as long as it is needed, depending on the reason we collected it.

• Orders, invoices and accounting records: for as long as tax legislation requires. As a general rule, the tax authority’s right to carry out an assessment lapses five years from the end of the year in which the filing deadline falls, and in certain cases the law provides for a longer period.
• Customer account: for as long as it remains active. You can ask us to delete it at any time.
• Newsletter subscription: until you unsubscribe.
• Contacting us: for as long as needed to answer your request, and for a reasonable period afterwards.
• Cookies: the duration of each cookie is given in our Cookie Policy.

When the data is no longer needed, we delete it.