PRIVACY POLICY

Please take a few moments to read this Privacy Policy and learn how our company, “STORMY COMMERCIAL AND ADVERTISING JOINT-STOCK COMPANY,” under the business name “STORMY SA,” registered with the General Commercial Registry (G.E.MI.) under registration number 001720501000 and Tax Identification Number (TIN) 094430558, with its registered office at 14 Kanari Street, PC 106 74, Athens, Greece, and contact details as follows: tel.: +30 2103618523 and email address: eshop@moleskine.gr (hereinafter referred to as the “Company” or “our Company”), acting as the controller of personal data (hereinafter the “Data Controller”within the meaning of articles 24 et seq. of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation – GDPR), processes your personal data (hereinafter referred to as “Personal Data” or “Data”) when you visit or use our website, www.moleskine.gr (hereinafter the “Website”), conduct transactions through it, register by creating an account, or subscribe to our Company’s promotional newsletter.

This privacy policy describes what Personal Data our Company collects, stores, uses, discloses and generally processes about you, the purposes and legal bases of the processing, the choices and rights you have regarding the processing of your Personal Data, and how you can contact us.

This Privacy Policy may be amended as necessary. In case there are significant changes to our privacy policy, we will amend the relevant text accordingly before these changes take effect and we will make every effort to inform you by any appropriate means.

We recommend that you check our website and read this privacy policy from time to time to stay informed about the processing of your Personal Data by our Company.

For any questions regarding personal data protection legislation, or if you believe that your rights have been infringed in connection with the processing of your Personal Data, you may contact the Hellenic Data Protection Authority, located at 1 Kifisias Avenue, Athens, PC 115 23, Greece, tel.: +30 2106475600, email: contact@dpa.gr, or visit its website at www.dpa.gr (hereinafter referred to as the “HDPA”).

 

Definitions
The following definitions are necessary to understand this policy and to avoid lengthy and repetitive sentences.

  • “GDPR”: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);
  • “personal data” or “data”: any information relating to an identified or identifiable natural person (the “data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification card number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person;
  • “processing”: any operation or set of operations performed, whether or not by automated means, on personal data or on sets of personal data, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval of information, consultation, use, disclosure by transmission, dissemination or otherwise making information available, alignment or combination, restriction, erasure or destruction;
  • “pseudonymization”: the processing of personal data in such a manner that the data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organizational measures to ensure that the personal data is not attributed to an identified or identifiable natural person;
  • “data controller”: the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and method of processing the personal data; where the purposes and method of such processing are determined by EU law or the law of a member-state, the data controller or the specific criteria for their appointment may be provided for by EU law or the law of the member-state;
  • “consent” of the data subject: any freely given, specific, explicit and fully informed indication by which the data subject indicates that they agree, by a declaration or a clear affirmative act, to have their personal data processed; and
  • “personal data breach”: a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal data transmitted, stored or otherwise processed.

 

Collection of personal data, purposes and legal basis for their processing
The following types/categories of personal data may be collected, stored, used and generally processed when you browse the Website or use the services provided through it, and, depending on how the personal data is collected, the purposes and legal basis of their processing are respectively defined. In particular:

Α. Data collected and processed during your browsing of the website

  • data relating to your computer, including your IP address, your approximate geographical location, your browser type and version, and your operating system; and
  • data relating to your visits to and use of the Website, including the duration of your visit, page views, and browsing path through the Website

We process the above data for the following purposes:

  • ensuring the proper and secure operation of the Website;
  • technical management and support of our systems (e.g. diagnosing technical issues and analyzing traffic on the Website).

The legal bases for processing the above data are:

  • your consent to the use of the Website, as provided for in Article 6(1)(a) of the GDPR; and
  • the Company’s legitimate interest in maintaining and operating the Website in the course of its business activities, and ensuring its proper and efficient functioning, as provided for in Article 6(1)(f) of the GDPR.

Β. Data collected and processed when you register/create an account on the Website

  • data you enter when creating your account on the Website, such as your first and last name, username, e-mail address; and
  • data relating to your purchases, the services you use, your order history, and the transactions you carry out on the Website, including your name, the postal address for product delivery, your telephone number, and any other data you may voluntarily provide to us while using your account on the Website.

We process the above data for the following purposes:

  • providing and managing account functionalities on the Website, managing any user requests, and responding to any communications with the user;
  • managing our agreement, should such an agreement arise through the maintenance of the account, such as when you purchase a product through the online store (e-shop) operated on the Website;
  • preparing and posting by mail each of your orders, as well as providing you with the best possible customer service in the event that you request any information regarding the status of an order you have placed; addressing any requests relating to your order, including any refunds or order cancellations, and, in general, resolving any issues relating to your order and facilitating the relevant communications between us;
  • sending newsletters and informational or promotional/advertising messages (provided that consent has been obtained);
  • complying with the Company’s legal obligations (including, but not limited to, tax obligations); and
  • protecting the Company’s corporate interests (including fraud prevention and system security) and representing the Company before administrative or judicial authorities.

The legal bases for processing the above data are:

  • providing your explicit consent upon creating an account, in accordance with Article 6(1)(a) of the GDPR;
  • performing our contract in cases when you purchase a product through the Website’s online store (e-shop), in accordance with Article 6(1)(b) of the GDPR;
  • the Company’s compliance with its legal obligations (including tax obligations, etc.), in accordance with Article 6(1)(c) of the GDPR; and
  • the pursuit of the Company’s legitimate interests in ensuring the best possible provision of its services through the Website, facilitating communications with you, and defending the Company’s rights before any administrative, judicial, or other authority, in accordance with Article 6(1)(f) of the GDPR.

C. Data collected and processed when you make purchases through the online store (-e–shop) operated on the website without creating an account

  • data necessary for the processing and postal delivery of your order, such as your full name, the shipping address, your email address; and
  • any other data you voluntarily provide when completing your purchase, such as your telephone number.We process the above data for the following purposes:
  • preparing and posting by mail each of your orders, as well as providing you with the best possible customer service in the event that you request any information regarding the status of an order you have placed; addressing any requests relating to your order, including any refunds or order cancellations, and, in general, resolving any issues relating to your order and facilitating the relevant communications between us;
  • complying with the Company’s legal obligations (including, but not limited to, tax obligations); and
  • protecting the Company’s corporate interests (including fraud prevention and system security) and representing the Company before administrative or judicial authorities.

The legal bases for processing the above data are:

  • performing our product sale and purchase agreement in cases when you purchase a product through the Website’s online store (e-shop), in accordance with Article 6(1)(b) of the GDPR;
  • the Company’s compliance with its legal obligations (including tax obligations, etc.), in accordance with Article 6(1)(c) of the GDPR; and
  • the pursuit of the Company’s legitimate interests in ensuring the best possible provision of its services through the Website, facilitating communications with you, and defending the Company’s rights before any administrative, judicial, or other authority, in accordance with Article 6(1)(f) of the GDPR.

D. Data collected and processed when you contact us by sending an email to our email address eshop@moleskine.gr:

  • email address, as well as any data you voluntarily provide (including, but not limited to, your full name, telephone number, etc.) in any communication with us via email; and
  • data relating to our communication, such as the date and time the message was sent/received, as well as the content of the relevant correspondence.

We process the above data for the following purposes:

  • managing of and responding to your requests or inquiries;
  • facilitating communications with you and providing information regarding the Company’s services or activities; and
  • protecting the Company’s rights and legitimate interests, including the establishment, exercise, or defence of legal claims.

The legal bases for processing the above data are:

  • taking measures at your request prior to entering into a contract and/or performing our contract, when your communication relates to services or transactions with the Company, in accordance with Article 6(1)(b) of the GDPR;
  • the Company’s compliance with its legal obligations, in accordance with Article 6(1)(c) of the GDPR; and
  • the pursuit of the Company’s legitimate interests in managing communications with third parties, ensuring the proper functioning and security of its services, and defending its rights before administrative, judicial, or other authorities, in accordance with Article 6(1)(f) of the GDPR.

Ε. Data collected and processed when you subscribe to the company’s newsletter

  • email address

We process the above data for the following purposes:

  • sending newsletters and promotional or informational content relating to the Company’s products and services.

The legal bases for processing the above data are:

  • your explicit consent to subscribe to and receive the newsletter, in accordance with Article 6(1)(a) of the GDPR; and
  • the pursuit of the Company’s legitimate interests in promoting its products and services in the course of its business activities, in accordance with Article 6(1)(f) of the GDPR.

Please note that:

  • we do not require, collect, or process special categories of personal data (otherwise known as “sensitive personal data”);
  • when the collection and processing of your personal data is based on the Company’s legitimate interests, we take your rights and freedoms into account and carry out a balancing test to ensure that our legitimate interests do not unduly override your rights and freedoms;
  • when the legal basis for the processing of your personal data is the performance of our contract or the Company’s compliance with its legal obligations, the provision of the relevant data by you is necessary, and without such data, it is not possible to perform our contract or, as applicable, for the Company to comply with its legal obligations; and
  • when a banking transaction is conducted through the Website, the Company does not collect, process, access in any way, or store any payment details (including, but not limited to, bank card numbers, CVC codes, etc.). Instead, the transaction is carried out by redirecting the user from the Website to a secure payment page operated by a partner bank, while the Company receives from the bank only confirmation as to whether or not the transaction has been successful. We recommend that you carefully read the privacy policy available on the relevant page of the bank’s website. The Company has neither access to nor exercises control over the processing of personal data carried out through the bank’s website.

We do not require the provision and collection of third-party personal data. Before disclosing any personal data of a third party, you should obtain that person’s consent to the disclosure and processing of their personal data, in accordance with this policy. The Company does not bear any responsibility in case it processes third-party personal data you have provided to us and you have not received the relevant consent or you have not informed the above people about the provision of their data to us.

How we protect your Personal Data

The security of your Personal Data is our priority. For this purpose, our Company implements appropriate technical and organizational measures to protect your Personal Data from loss, theft and unauthorized use, disclosure or modification, as well as from any unlawful processing.

In the event of a personal data security breach resulting in the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to personal data transmitted, stored or otherwise processed, which is likely to result in a high risk to your rights and freedoms, we will notify you of the relevant breach without undue delay and notify the competent authorities within the time limit prescribed by law.

How long we retain your personal data
This section sets out the procedures and policy governing the retention of personal data.
Personal data processed for any purpose shall not be retained for longer than is necessary to fulfil that purpose.

In particular:

  • Data collected during your browsing of the Website shall be stored for a maximum period of six (6) months from the date of collection.
  • Data collected when you create an account on the Website shall be retained for as long as your account remains active and shall be deleted within one (1) year of the date on which you delete your account, unless a longer retention period is required for the performance of our obligations under any contract or for compliance with our legal obligations.
  • Data collected when you make purchases through the online store (e-shop) operated on the Website without creating an account shall be retained for as long as necessary to fulfil our obligations under the relevant purchase and sales contract or for as long as necessary to comply with our legal obligations.
  • Data collected when you contact us by sending an email to eshop@moleskine.gr shall be retained for as long as necessary to complete our communication or, when such communication results in the conclusion of a contract between us, for as long as necessary to fulfil our obligations under that contract or to comply with our legal obligations.
  • Data collected when you subscribe to the Company’s newsletter shall be retained until you unsubscribe from the newsletter.

In any event, where your personal data relates to any ongoing legal proceedings and is required for the establishment, exercise or defence of our legal claims (including, but not limited to, the provision of information to third parties for the purposes of fraud prevention and the reduction of credit risk), we shall retain the relevant personal data for as long as necessary to safeguard the Company’s aforementioned rights.

Your rights in relation to the processing of your personal data

We hereby inform you that, in relation to the processing of your Personal Data, you have the following rights:

a) the right to be informed, at any time, about which of your Personal Data we process on each occasion, the manner and purposes of such processing, the legal basis for the processing, as well as the third parties (if any) to whom your Personal Data is disclosed on each occasion (right of access). You may request a copy of your data, which we will provide to you free of charge;

b) where your Personal Data is collected and processed with your consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of the processing of your Personal Data carried out on the basis of your consent prior to its withdrawal (right to withdraw consent). Please note that, in such cases, we may continue to process your Personal Data if another lawful basis for processing applies;

c) the right to request, without undue delay, the correction of inaccurate personal data concerning you and, considering the purposes of the processing, to have any incomplete data concerning you completed (right to rectification). In any case, when you provide us with your data, you represent and warrant that it is true and accurate and you have the responsibility to inform us of any change or modification to it, which we will do immediately;

d) the right to request, without undue delay, the erasure of your Personal Data (right to erasure / right to be forgotten), to the extent that it is no longer necessary for the purpose for which it was collected and we process it, as analyzed above, or when it is no longer necessary for us to comply with our legal obligations or we are generally no longer allowed by law to process it;

e) the right to request the restriction of the processing of your Personal Data (right to restriction of processing);

f) the right to data portability;

g) the right to lodge a complaint with the HDPA if you consider that the processing of your personal data infringes the applicable national and regulatory framework for the protection of personal data; and

h) the right to object, at any time, to the processing of your Personal Data (right to object to processing).

Exercise your rights regarding the processing of your personal data

To exercise your rights in relation to the processing of your Personal Data, you can submit a request to eshop@moleskine.gr under the heading “Exercise of Right” and we will take care to consider it and respond to you as soon as possible and, in any case, within one month of submitting the relevant request. That period may be extended by a further two months, if necessary, considering the complexity of the request and the number of requests. You will be informed of this extension within one month of receipt of the request and of the reasons for the delay. If you submit your request by electronic means, the information will be provided by electronic means, where possible, unless you request otherwise. Please note that the Company may refuse, in whole or in part, to comply with your request for the restriction of processing or erasure of your data, where the processing or retention of your Personal Data is necessary for establishing, exercising or defending its legal claims or for complying with its legal obligations.

If your request is unfounded or excessive, in particular because of its repetitive nature, the Company may impose a reasonable fee, taking into account the administrative costs of providing the information or performing the requested action, or refuse to act on the request.

Who can access your Personal Data

In order to best fulfil the processing purposes and best serve you, your Personal Data is collected and processed exclusively by specially authorized personnel of our Company, who are bound by confidentiality clauses, as well as by our authorized partners, who are also bound by confidentiality clauses. Your Personal Data may be disclosed to police authorities and any other judicial, administrative or public authority or, in general, to any legal or natural person to whom the Company may have an obligation or right to disclose such data by virtue of a law or a court decision. In addition, your Personal Data may need to be disclosed to a third-party transport company with which our Company cooperates for the purpose of fulfilling or delivering your registered order, if you choose to send it by post.

Transfer of your Personal Data to third countries outside the European Economic Area (EEA)

We do not transfer your Personal Data to third countries outside the European Economic Area (EEA). In any event, we note that the European Commission has recognized that certain countries outside the EEA provide an adequate level of data protection. For transfers from the EEA to countries not considered secure by the European Commission, we have in place, should such transfers take place, appropriate and appropriate safeguards aimed at protecting your personal data and ensuring its secure transfer in accordance with applicable data protection rules, such as standard contractual clauses or other legal tools.

Third-party websites

The Website may contain hyperlinks to, and information from, third-party websites. We have no control over and accept no responsibility for the privacy policies and practices of third parties, which we recommend that you read carefully.