Protecting your personal data matters to us. This policy explains what data we collect when you order, why we collect it and what your rights are, in line with the General Data Protection Regulation (GDPR).
1. Data controller
The controller of your data is Repanis Patisserie (Arnaia, Halkidiki, Greece). For anything relating to your data, contact us using the details at the end of this page.
2. What we collect
When you place an order or booking we collect:
- Full name
- Email address
- Phone number (with country code)
- Order details: flavour, servings, pick-up date and time, text or design for the cake, any reference photo you upload
- For services: selected services, event date/time, number of guests and event details
- Technical data necessary for the operation and security of the site
3. Purpose & legal basis
We process your data for the following purposes:
- Fulfilling your order/booking and contacting you — legal basis: performance of a contract
- Sending your order confirmation email — legal basis: performance of a contract
- Processing the deposit payment — legal basis: performance of a contract
- Complying with legal obligations (e.g. tax) — legal basis: legal obligation
4. Payments
The deposit is paid through our provider, Viva Payments. Your card details are submitted directly to the provider and are never visible to or stored by us. The provider processes payment data under its own policy.
5. Who has access to your data
We do not sell your data. We share it only with the providers necessary to run our service, acting as our processors:
- Viva Payments — processing online payments
- Database/hosting providers (Supabase, Vercel) — securely storing orders and hosting the site
- Email provider (Google/Gmail) — sending your confirmation email
6. International transfers
Some providers may process data outside the EU. Where this happens, an adequate level of protection is ensured through the mechanisms provided by the GDPR (e.g. standard contractual clauses).
7. Retention
We keep your order data for as long as needed to fulfil it, and afterwards for as long as our legal (e.g. tax) obligations require. After that period the data is deleted or anonymised.
8. Security
We take reasonable technical and organisational measures to protect your data against unauthorised access, loss or alteration.
9. Your rights
Under the GDPR you have the right to:
- Access your data
- Rectify inaccurate data
- Erasure (the 'right to be forgotten')
- Restrict processing
- Data portability
- Object to processing
- Lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr)
10. Cookies
The site uses only the strictly necessary cookies required for it to work. We do not use advertising or tracking cookies.
11. Children
The site is intended for adults. We do not knowingly collect data from minors to place orders.
12. Changes
We may update this policy. The current version is always available on this page.