01Who is responsible for your data
The controller of the personal data collected through h2onlybattery.eu and in the course of serving your orders is Georgios Vilanakis (H2OnlyBattery), Industrial Area, 7th Street, 716 01 Heraklion, Crete, Greece, VAT number 045553150, Heraklion Tax Office.
We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Greek law 4624/2019.
02What we collect
Categories of personal data
Identity and contact: name, billing and delivery address, email address, telephone number.
Account: email, username, password (stored encrypted), order history, saved addresses.
Order and payment: items bought, amounts, invoices, delivery method and status, returns. Card payments are made through our payment providers: we receive confirmation of the payment, never your full card number.
Communications: contact form messages, emails, live chat conversations and the product reviews you post.
Newsletter: your email address, if you subscribe.
Technical and usage data: IP address, device and browser type, pages viewed and actions taken on the website, through cookies and similar technologies. For the categories that need consent, only after you give it.
We do not buy personal data from third parties and we do not sell your personal data.
03Why we use it, and on what legal basis
Purpose and legal basis
To fulfil your order: processing payment, preparing and shipping the parcel, returns, answering questions about the order. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Legal obligations: invoicing, tax and accounting records, responding to lawful requests from authorities. Legal basis: legal obligation (Art. 6(1)(c) GDPR).
Answering your questions: through the contact form, email, telephone or live chat, and partnership requests. Legal basis: steps prior to entering into a contract, or our legitimate interest in answering those who contact us (Art. 6(1)(b) or (f) GDPR).
Running and securing the shop: preventing fraud and abuse, protecting our forms from spam, website security, improving our service. Legal basis: our legitimate interests (Art. 6(1)(f) GDPR), balanced against your rights.
Newsletter, statistics and advertising: sending the newsletter, measuring how the website is used and showing relevant advertising. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
04Newsletter
You receive our newsletter only if you asked for it. You can unsubscribe at any time through the unsubscribe link in our messages or by writing to info@h2onlybattery.eu.
Withdrawing consent does not affect the lawfulness of what we sent before, and it does not stop the service messages about an order you have placed (confirmation, dispatch, refund).
05Cookies and tracking
Statistics and advertising tools do not use cookies before you consent to the relevant category, and consent signals start as denied.
The categories in use, the storage periods and how to change your choice at any time are set out in full in our Cookie Policy.
06Who we share it with
We share personal data only with those who need it to serve you, and only to the extent necessary. They act on our instructions as processors or, where the law makes them one, as independent controllers.
Recipients
Delivery companies: the courier or BOX NOW (parcel lockers), which need your name, address and telephone number to deliver the parcel.
Payment providers: Viva.com and PayPal, which process the transaction and carry out fraud checks.
Technology providers: our hosting provider, the email delivery service, Tawk.to for live chat, and the partner who maintains the website.
Statistics and advertising platforms: Google (Google Analytics), Meta (Facebook, Instagram), TikTok and the Linkwise affiliate network, as described in our
Cookie Policy.
Professional advisers and authorities: our accountant, and public authorities where the law requires it.
We do not sell, rent or trade your personal data.
07Transfers outside the EEA
Some providers, such as Google, Meta, TikTok, PayPal and Tawk.to, may process data outside the European Economic Area. In those cases the transfer relies on GDPR safeguards, such as an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework) or standard contractual clauses.
08How long we keep it
Retention
Orders and invoices: for as long as tax and accounting law requires.
Customer account: while your account is active or until you ask us to delete it.
Messages and requests: for as long as needed to answer and close your matter.
Newsletter: until you unsubscribe.
After these periods, the data is deleted or anonymised.
09How we protect it
The website runs only over an encrypted connection (HTTPS). Card details are processed directly by the payment providers and are not stored on our website. Access to data is limited to the people who need it for their work, and our forms are protected against automated abuse.
No system is completely secure. If we learn of a breach that may affect you, we will inform you and the competent authority, as the law requires.
10Your rights
You can ask for
Access: a copy of the data we hold about you.
Rectification: of inaccurate or incomplete data.
Erasure: when there is no longer a reason to keep it, except what the law requires us to keep.
Restriction: of processing, in certain cases.
Portability: of the data you gave us, in a structured format.
Objection: to processing based on our legitimate interest, and at any time to direct marketing.
Withdrawal of consent: at any time, without affecting the lawfulness of processing before the withdrawal.
To exercise your rights, email info@h2onlybattery.eu. We will reply within one month and may ask you to confirm your identity. Exercising your rights is free of charge.
11Complaints
If you believe that the processing of your data breaks the law, you have the right to lodge a complaint with the Hellenic Data Protection Authority, Kifisias 1-3, 115 23 Athens, Greece, www.dpa.gr, or with the supervisory authority of the EU country where you live.
We would appreciate it, however, if you contacted us first, so that we can try to resolve the matter.
12Children
The shop is not directed at children. We do not knowingly collect data from anyone under 15. If you believe a child has given us personal data, please contact us so that we can delete it.
13Changes to this policy
We may update this policy when our services or the law change. The date of the last update is shown at the top of the page.
