Privacy policy

Data controller and contact

The data controller is the business identified in full at the end of this page. For questions about personal data, contact info@somaderma.gr.

Your basket

We temporarily store products, quantities and any delivery-area selection so that you can return to your basket in the same browser. Necessary cookies enable this feature. The store checks prices and delivery charges again. You can remove products or select “Empty basket”. No contact details are needed for this feature.

Purposes and legal bases

We use basket selections and details you provide before buying to take steps you request before entering into a contract. Order, payment and delivery details are used to perform the contract. Fiscal records are retained to meet legal obligations. Withdrawal notices are recorded to fulfil legal obligations and document the exercise of rights.

Handling purchase-related enquiries is based on steps before, or performance of, a contract. For other enquiries, security and abuse prevention, we rely on our legitimate interest in operating and protecting the store, taking your rights into account. Where consent is required for additional processing, it is requested separately and can be withdrawn.

Hosting and security

Hosting and storage providers process necessary technical data, such as internet address, device details and access records, to serve pages, maintain security and prevent abuse. Access to data is limited to what is needed to operate and support the store.

Customer accounts

Guest purchases require no registration. An order is accessed using the secure link sent to its email address. Keep it private because it grants access to that order’s details. There is no public lookup using only an email address and order number.

Optional Google sign-in uses only your account identifier and verified email address to create an account, sign you in securely and display orders placed while signed in. We have no access to your Google password. Processing is based on providing the account service you request. Google provides sign-in under its own privacy policy. Your session expires after 7 days or when you sign out. Account details are retained while you use the service and as needed for legal obligations or related claims. Guest orders are not added automatically by matching email addresses.

If you create an email account, we store your full name, verified email address, and a secure password hash. Date of birth is optional and used only to display it in your profile, not for advertising, profiling, or birthday messages. Delivery details and phone are saved only if you choose. Verification and reset links expire and work once. Guest orders are not added to an account merely because the email matches.

Contact messages

When you use the form or email, we process your name, email address, any optional phone number, subject and message content to help you. Messages are delivered to our business mailbox through the email provider Hostinger and remain in correspondence for as long as needed to handle the enquiry. The form does not send an automatic acknowledgement.

The form uses Cloudflare Turnstile to prevent automated abuse. Cloudflare processes necessary browser, device and connection information to distinguish human use from automated messages.

Orders, delivery and withdrawal

Orders use contact details, delivery address, product selections, amounts and receipt or invoice details. Necessary shipping information is shared with ACS for delivery. Order and withdrawal confirmations are sent through our business email. Withdrawal notices are retained together with their receipt time and reference details.

The IRIS payment takes place in your banking app. The website receives neither bank login or card details nor payment confirmation from a bank API. The store manually checks receipt against the order number. Do not send banking credentials or card details in contact messages.

Recipients and international transfers

Necessary data may be accessed by authorised hosting, storage, email, security, accounting and delivery providers, and public authorities where required by law. We do not sell personal data or use automated decisions or profiling that have legal or similarly significant effects on you.

Some service providers may process data outside the European Economic Area. Such transfers require an applicable legal safeguard, such as an adequacy decision or standard contractual clauses. You can contact info@somaderma.gr for information on recipients, processing countries and a copy of the applicable safeguards.

Retention and deletion

The basket and its browser copy expire within 30 days of their last successful update. An expired basket cannot be restored; expired store records are cleared during subsequent saves. “Empty basket” removes the selections once it succeeds. Deleting cookies alone removes the link to the saved basket but does not guarantee immediate deletion of the store record. Also delete the website’s stored data to remove the local copy.

The language preference is retained for up to 365 days. Form-security data is used for short-term abuse prevention. Correspondence is kept as needed to handle enquiries and document claims. Orders and fiscal records are kept for contract performance, mandatory legal periods and the limitation periods for related claims, then deleted or anonymised where permitted.

Your rights

You may request access, rectification, erasure where permitted, restriction, objection and portability by contacting info@somaderma.gr. Appropriate information may be needed to verify your identity. Requests are handled without undue delay, generally within one month, subject to statutory exceptions and extensions. You may lodge a complaint with the Hellenic Data Protection Authority.

Business details

Samerka Sofia

VAT number:

127246156

GEMI number:

196284030000

Tax Office:

Kavala

Business / returns address:

Amerikanikou Erythrou Stavrou 251, Kavala, 65402, Greece

Email:

info@somaderma.gr