The privacy and protection of our customers’ personal data are of primary importance to us. We want you to feel comfortable and secure when visiting our Website and to regard the implementation of data protection as a customer-oriented quality feature.

Please read this Privacy Policy carefully. It informs you of your rights and of the manner and extent to which personal data are processed through our Website, which is intended to comply with the General Data Protection Regulation (GDPR), Regulation (EU) 2016/679. The Regulation requires information provided to data subjects about the processing of their data to be concise, transparent, intelligible and easily accessible.

  1. Introduction

1.1. The website dervisis.gr is an online commercial store for the sale of products (spare parts and equipment for vehicle refrigeration chambers) via the Internet (hereinafter the “Online Store” or “Website”), created and operated by “A. & I. DERVISIS O.E.” (hereinafter the “Business”), with registered office at 8 Mikras Asias Street, Thessaloniki, Tax Identification No. 091504663 (KEFODE Thessaloniki Tax Office), contact e-mail info@dervisis.gr and Online Store customer-service telephone +30 2310 752601.

1.2. The Business undertakes to comply with all relevant European Union and Greek laws on personal-data protection in order to protect the rights and freedoms of individuals whose information is collected or processed, in accordance with the GDPR, Regulation (EU) 2016/679.

  1. What Personal Data Are and What We Collect

2.1. The Business created this Website solely for the purpose of serving its customers. To provide the best possible service, the Visitor/User/Customer must provide certain information relating to the processing of an order, which is safeguarded by the Business. “Personal data” means any information relating to an identified or identifiable natural person (“data subject”). Anonymous information is not personal data.

2.2. The Business collects personal data when you: (a) register with it; (b) register through its contact form; (c) visit its pages and/or enter its promotional/advertising programmes; and (d) participate in competitions. The personal data collected are the minimum required for these actions and may include identity data, contact data and/or financial data.

2.3. The following types of personal data may also be collected and processed: information concerning your computer, visits to our Website and activity, for the proper establishment of the connection, convenient use of the Website and system security, such as IP address, date and time of access, browser type and version, operating system and pages selected; information supplied when completing a profile on the Website or connected applications such as social networks; and any other personal information you choose to send to our Website. Such data are used only where permitted by law.

2.4. We DO NOT collect special categories of personal data, namely data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade-union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, health data, or data concerning a natural person’s sex life or sexual orientation (Article 9(1) GDPR), nor data relating to criminal convictions and offences (Article 10 GDPR). If you do not allow us to collect personal data for the purposes described here, we may be unable to provide our services in the best possible manner.

2.5. Information voluntarily provided by users is used so that Online Store users can communicate directly and effectively with the Store, receive answers to specific questions and have their orders serviced and executed. Information collected through the Website is used to measure traffic, determine customer demand for additional products and facilitate transactions with the Business. The Business does not distribute users’ or customers’ e-mail addresses or other information to unrelated organisations or partners. Information may be shared only under specified circumstances or as required by law, including with governmental authorities where disclosure is legally required; to protect or defend customers’ legitimate interests and rights; to respond to claims of infringement of third-party rights; and to protect customers’ health and safety in an emergency. Personal data may also be shared, where required, with employees bound by confidentiality, external professionals and service providers assisting our business activities, and governmental, public or judicial bodies and their officers, lawyers, advisers and representatives. Where a transfer to a third party takes place, the data subject will be informed in a timely and appropriate manner before the transfer where required. Persons acting on our behalf must maintain appropriate privacy safeguards. Apart from the recipients and purposes stated above, we do not use, disclose, sell or transfer identifiable personal data without consent unless required or permitted under data-protection rules.

2.6. The Business collects only: (1) information provided when the Visitor/User/Customer registers as a customer; (2) information provided for execution of an Online Store order; and (3) information provided when a question or request is submitted through the Website contact form.

2.7. Upon registration as a Customer, the Visitor/User/Customer provides: first name, surname, company name for legal entities, telephone number, e-mail address and address (street, city and postal code).

2.8. When completing an order form, the Visitor/User/Customer is asked for full name, address (street, city and postal code), e-mail address, telephone number and order payment method. More specific information may also be requested, such as shipping/delivery details, invoicing information (Tax Identification Number and competent Tax Office) or details concerning a requested quotation. The Business uses information submitted electronically to communicate concerning delivery, customer confirmation and identification where necessary, and new or alternative products offered by the Online Store.

2.9. When submitting a request or question through the Online Store contact form, the Visitor/User/Customer provides first name, surname, telephone number (optional) and e-mail address.

  1. Use of Information

In providing our services, we use the information you supply to process your requests and provide technical advice and information about our services. We may share such information only under specified conditions or where required by law, specifically: (1) with governmental authorities, but only to the extent required to disclose personally identifiable information in accordance with lawful process received from an authority; (2) to protect or defend our customers’ legitimate interests and rights; (3) to respond to allegations involving infringement of third-party rights; and (4) to protect our customers’ health and safety where an emergency exists.

  1. How We Use Your Personal Data

We use your personal data: (1) to communicate with you and other interested parties handling your case or matter and to process your questions, orders and requests; (2) to maintain employee records, if you are employed by us, or for a subsequent period of three years, including CVs submitted for consideration for possible employment; (3) to send important information concerning your matter to you or another administrative authority in accordance with law; (4) to manage our business operations in compliance with internal policies and procedures, including accounting records, information systems, business continuity and document/printing management; and (5) to resolve complaints and process requests for access to or rectification of data.

  1. Sharing Personal Data

5.1. The Business may share your personal data with the following parties for purposes required by law: (1) cookies may be used to provide visitors with a better experience; see Article 8 below for the cookie policy; (2) employees of the Business who have signed confidentiality agreements and follow internal policies and procedures; (3) where necessary, external third parties such as doctors, accountants, translators, auditors, experts, lawyers and other external advisers, specialist associates or external service providers assisting our business activities. Where data are transferred to a third party, the data subject will be informed in a timely and appropriate manner beforehand where required. We require persons acting on our behalf to follow appropriate privacy practices and implement safeguards to protect your information; and (4) governmental or other public bodies and authorities, including judicial bodies, data-processing third parties, officials, lawyers, court officers and other advisers and representatives, where necessary, while preserving fundamental data-protection principles.

5.2. Apart from the recipients and purposes referred to above, we do not use, disclose, sell or transfer identifiable personal data without your consent unless required or permitted under data-protection rules.

  1. How Long Do We Retain Your Personal Data?

Due to the nature of our work, we retain your personal data for no longer than ten years. We keep this information in an easily accessible form that can be transmitted to you upon request. We also allow and encourage the correction of inaccuracies in submitted information. Where permitted by law, erasure and objection to processing are allowed. However, no guarantee is given that data contained in the database are accurate or complete. If you wish to exercise any right under data-protection legislation, send an e-mail with your contact details to info@dervisis.gr.

  1. Physical and Electronic Protection of Your Personal Data

We recognize the importance of security for identifiable personal data and apply administrative, technical and organisational safeguards to protect them from loss, misuse and unauthorized processing or alteration. It is inherently impossible to guarantee that third parties will never defeat our protection methods, use information for improper purposes or that transmission errors will never occur; accordingly, liability for such loss is limited to the extent permitted by law. Access to identifiable personal data is restricted to employees and external associates acting on our instructions and behalf who need access to perform their assigned work. We maintain appropriate physical, electronic and procedural safeguards in compliance with applicable laws protecting personal data and our systems. We have active procedures for investigating possible personal-data breaches and, where applicable, will promptly inform you and the competent supervisory authority.

  1. Online Presence and Website Optimisation

8.1. Cookies – General Information: We use cookies on our Website on the basis of Article 6(1)(f) GDPR. Our interest in optimising the Website is regarded as legitimate within the meaning of that provision. Cookies are small files stored on your terminal device (laptop, tablet, smartphone, etc.) when you visit our Website. Cookies do not damage your device and do not contain viruses, Trojan horses or other harmful programs. Information associated with the specific device used is stored in the cookie; this does not mean that we thereby obtain direct knowledge of your identity.

Cookies are used, first, to make the Website more convenient. We use session cookies to recognise that you have already visited individual pages; these are automatically deleted when you leave our Website. We also use temporary cookies stored for a defined period to improve ease of use. If you revisit our Website, we can automatically recognise that you have visited us before and recall entries/settings so that you do not have to repeat them. Second, we use cookies to statistically analyse use of the Website in order to optimise our offering and display information tailored to you. Such cookies enable us to recognise automatically on a later visit that you have visited us before and are automatically deleted after a predefined period.

Most browsers accept cookies automatically. You can configure your browser so that cookies are not stored or so that a notice appears before a new cookie is stored. Completely disabling cookies may, however, prevent use of some Website functions. Companies managing behavioural advertising should also provide information on how to opt out. The original policy refers users to allaboutcookies.org for further information about cookies and preventing their installation.

8.2. Google Analytics

8.2.1. Purposes of data processing/legal bases: For needs-based design and continuous optimisation of our Website, we use Google Analytics, a web-analysis service, on the basis of Article 6(1)(f) GDPR. Our legitimate interest derives from these purposes. In this context, pseudonymised usage profiles are created and cookies are used. The cookie records information concerning use of the Website, including browser type/version, operating system, referrer URL, host name of the accessing computer (IP address) and time of server request. The information is used to evaluate Website use, compile reports on Website activity and provide further services connected with Website and Internet use for market research and needs-based design. IP addresses are anonymised so that attribution is not possible (“IP masking”).

You can prevent cookies from being installed through the appropriate browser setting, although in that case some Website functions may not be fully available. You may also prevent analysis of cookie-generated data concerning use of the Website, including the IP address, and processing of those data by the analytics provider by using the relevant browser opt-out mechanism. On mobile browsers, an opt-out cookie may be used; it applies only to that browser and Website and is stored only on your device. If you delete cookies, the opt-out cookie must be stored again.

8.2.2. Recipients/categories of recipients: Information generated by the cookie is transmitted to and stored on a server of the analytics provider, including servers in the United States as stated in the original policy. The IP address is not combined with other data held by the provider. Information may also be transferred to third parties where required by law or where third parties process the data on the provider’s behalf.

8.2.3. Storage period/criteria: After anonymisation of the IP address, the data can no longer be linked to you. Data generated for statistical purposes are stated in the original policy to be deleted from Google Analytics after 50 months. Reports based on Google Analytics no longer contain personal references.

8.3. Website Targeting and Website Optimisation

8.3.1. Purposes/legal bases: Information is analysed and evaluated through cookies to optimise our Website and any advertising displayed on it. In particular, this is intended to ensure that advertisements displayed on your device are tailored to your actual or presumed interests based on previous usage behaviour. Information processed for these purposes may include, for example, products in which you showed an interest. The legal basis stated in the original policy is Article 6(1)(f) GDPR. Website optimisation for a better shopping experience and avoidance of irrelevant advertising is described as being in both our interest and yours. Analysis and evaluation are carried out using a pseudonym and do not enable us to identify you; in particular, this information is not combined with your personal data.

8.3.2. Recipients/categories of recipients: Recipients are the service providers referred to above, which process data on a contractual basis solely for the specified purpose and in accordance with our instructions.

8.3.3. Storage period/criteria: Cookies used here and the information they contain are stored in accordance with the applicable Cookie Terms and are deleted immediately in the event of an objection where applicable.

8.4. Right to object/opt-out: You may prevent the technologies described in section 8.3 through the relevant cookie settings in your browser (see also section 8.1). You may also prevent personalised interest-based advertising through the relevant preference manager or by activating available opt-out cookies.

  1. Recipients Outside the European Union (EU)

With the exception of the processing described in Chapter 8, we do not provide your data to recipients established outside the European Union or European Economic Area. The processing referred to in Chapter 8 may result in transfers to servers of tracking and targeting technology providers, some of which are located in the United States. The original policy states that such transfers are made in accordance with the Privacy Shield principles and/or the European Commission’s Standard Contractual Clauses.

  1. As a Rule, Your Data Are Not Transferred to Third Parties

As an exception, data may be processed by processors acting on our instructions. They are selected carefully, monitored by us and contractually bound in accordance with Article 28 GDPR. It may also be necessary to transmit extracts from your request to our contractual partners, for example suppliers in connection with product enquiries, in order to process your request. Recipients may include auditors and professional advisers such as lawyers, accountants and banks; companies involved in transporting products; professional service providers such as marketing, advertising, support, Website optimisation and hosting services; payment-verification services; cybercrime authorities; consumer-protection services; fraud-prevention services in cases of malicious use; and social networks if you choose to link your account on those networks to our Website. If transfer of your personal data is required in an individual case, we will inform you where required in order to obtain your consent.

  1. Links to Other Websites

Our Website may provide links to other websites that are not owned or controlled by us and that we believe may be useful or interesting to visitors. We are not responsible for the privacy practices used on third-party websites or for the validity of their content.

  1. Your Rights as Data Subjects

In addition to the right to withdraw consent granted to us, you also have the following rights where the applicable legal conditions are met: access under Article 15 GDPR; rectification of inaccurate or incomplete data under Article 16; erasure under Article 17; restriction of processing under Article 18; data portability under Article 20; and objection under Article 21.

12.1. Right of access under Article 15 GDPR: Upon request and free of charge, you have the right to obtain information concerning personal data stored about you. This includes the purposes of processing; categories of personal data; recipients or categories of recipients; where possible, the envisaged storage period or criteria used to determine it; the existence of rights to rectification, erasure, restriction or objection; the right to lodge a complaint with a supervisory authority; where data were not collected from you, available information as to their source; and the existence of automated decision-making, including profiling under Article 22(1) and (4), together with meaningful information about the logic involved and the significance and envisaged consequences. Where personal data are transferred to a third country or international organisation, you have the right to be informed of the appropriate safeguards under Article 46 GDPR.

12.2. Right to rectification under Article 16 GDPR: You have the right to require us, without undue delay, to rectify inaccurate personal data concerning you. Having regard to the purposes of processing, you have the right to have incomplete personal data completed, including by means of a supplementary statement.

12.3. Right to erasure under Article 17 GDPR: You have the right to request erasure of personal data without undue delay where one of the applicable grounds exists, including where the data are no longer necessary for the purposes for which they were collected or processed; you withdraw consent and there is no other legal basis; you object under Article 21 and there are no overriding legitimate grounds; the data have been unlawfully processed; erasure is required for compliance with a legal obligation; or the data were collected in relation to information-society services referred to in Article 8(1) GDPR. Where we have made personal data public and are obliged to erase them, taking account of available technology and implementation costs, we will take reasonable steps to inform third parties processing those data that you have requested erasure of links to, copies of, or reproductions of those personal data.

12.4. Right to restriction of processing under Article 18 GDPR: You may request restriction where you contest the accuracy of personal data; processing is unlawful and you request restriction instead of erasure; the controller no longer needs the data for processing but you require them for the establishment, exercise or defence of legal claims; or you have objected under Article 21(1), pending verification of whether the controller’s legitimate grounds override yours.

12.5. Right to data portability under Article 20 GDPR: You have the right to receive personal data concerning you that you provided to us in a structured, commonly used and machine-readable format and to transmit those data to another controller without hindrance where processing is based on consent under Article 6(1)(a) or Article 9(2)(a), or on a contract under Article 6(1)(b), and processing is carried out by automated means. Where technically feasible, you may request that the personal data be transmitted directly by us to another controller.

12.6. Right to object under Article 21 GDPR: Subject to Article 21(1), you may object to processing on grounds relating to your particular situation. This general right applies to processing described in these data-protection terms that is based on Article 6(1)(f) GDPR. Unlike the specific right to object to processing for advertising purposes, we are required under the GDPR to give effect to the general objection where you put forward overriding reasons, for example a potential risk to life or health.

  1. Resolution of Complaints

In accordance with the GDPR, the Business undertakes to address complaints concerning the collection or use of personal data. The Business further undertakes to cooperate with EU data-protection authorities and in particular with the Hellenic Data Protection Authority (dpa.gr). If you do not receive a timely response from us to your complaint, or if our response is not satisfactory, you are invited to contact the competent authority for further information.

  1. Changes to Our Policy

This Data Protection Policy may change from time to time in accordance with legislation or developments in the sector. We will not expressly notify our customers or Website users of every such change. Instead, we recommend that you check this page occasionally for policy changes.