Privacy Policy

We are very delighted that you have shown interest in Korasís. Protecting your privacy is a priority for our company. While you may browse our website without providing personal information, certain services may require the processing of personal data. Where required by law, we obtain your consent before doing so.

All processing of personal data is carried out in accordance with the General Data Protection Regulation (GDPR) and applicable national legislation. This Privacy Policy explains what information we collect, how we use it, and the rights you are entitled to.

1. Definitions

The data protection declaration of Korasís (Kooreloo LLP) is based on the terms used by the European legislator for the adoption of the General Data Protection Regulation (GDPR). To ensure this is legible and understandable for the general public, we would like to first explain the terminology used.

• a) Personal data — any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physiological, genetic, mental, economic, cultural or social identity of that natural person.
• b) Data subject — any identified or identifiable natural person whose personal data is processed by the controller.
• c) Processing — any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
• d) Restriction of processing — the marking of stored personal data with the aim of limiting their processing in the future.
• e) Profiling — any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
• f) Pseudonymisation — the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures.
• g) Controller — the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• h) Processor — a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.
• i) Recipient — a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not.
• j) Third party — a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.
• k) Consent — any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

2. Name and Address of the Controller

Controller for the purposes of the General Data Protection Regulation (GDPR), other data protection laws applicable in Member states of the European Union and other provisions related to data protection is:

3. Data We Collect

We collect personal data in the following circumstances:

3.1 When you place an order

• Name, email address, shipping address, billing address, phone number
• Payment information (processed by Stripe — we do not store card details)
• Order history and bespoke configuration data

3.2 When you create an account

• Email address, name, and encrypted password
• Saved addresses, wishlist items, saved bespoke designs

3.3 When you browse our website

• IP address, browser type, operating system, referring URLs
• Pages visited, time spent on site (via analytics cookies — see Section 4)

3.4 When you contact us

• Name, email address, and the content of your message

3.5 Newsletter subscription

• Email address only. Unsubscribe at any time via the link in every email.

4. Cookies

Our website uses cookies — small text files stored on your device. We use the following categories:

• Strictly necessary cookies — required for the website to function (cart, login session). Cannot be disabled.
• Performance cookies — anonymous analytics to understand how visitors use the site (Google Analytics). Can be declined.
• Functional cookies — remember your preferences (language, currency). Can be declined.
• Marketing cookies — used to show relevant ads on third-party platforms. Only set with your consent.

You may manage your cookie preferences at any time via the cookie consent banner or your browser settings. Disabling cookies may affect the functionality of certain parts of the website.

5. Legal Basis for Processing

We process personal data on the following legal grounds under Article 6 GDPR:

• Contract performance (Art. 6(1)(b)) — processing your order, shipping your purchase, handling returns.
• Legal obligation (Art. 6(1)(c)) — tax records, VAT compliance, fraud prevention.
• Legitimate interest (Art. 6(1)(f)) — improving our website, preventing fraud, direct marketing to existing customers.
• Consent (Art. 6(1)(a)) — newsletter subscriptions, non-essential cookies, marketing communications.

6. Data Retention

We retain personal data only for as long as necessary for the purpose for which it was collected:

• Order data — retained for 7 years to comply with Greek tax law.
• Account data — retained while your account is active. You may delete your account at any time.
• Newsletter — retained until you unsubscribe.
• Contact form submissions — retained for 12 months.
• Analytics data — anonymised after 26 months.

7. Your Rights

Under the GDPR, you have the following rights:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — request deletion of your data where there is no lawful basis for continued processing.
• Right to restriction — request that we limit processing of your data.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA) at www.dpa.gr.

8. Third-Party Services

We work with the following third parties who may process your personal data on our behalf:

• Stripe — payment processing (PCI DSS compliant). Privacy policy at stripe.com/privacy.
• Google Analytics — anonymous website analytics. Opt out at tools.google.com/dlpage/gaoptout.
• Resend — transactional email delivery.
• Cloudinary — image storage and delivery CDN.
• Algolia — search functionality (search queries may be logged).
• Vercel — website hosting. Servers in the European Union.

We do not sell your personal data to third parties. We do not permit third-party advertising networks to profile our customers without explicit consent.

9. Contact & Data Protection Officer

For any questions regarding this Privacy Policy or the processing of your personal data, please contact: