Privacy Policy
Last updated: 15 October 2026
1. Introduction
Protóleo respects your privacy and is committed to handling personal information responsibly.
This Privacy Policy explains how personal data is collected, used, stored and shared when you visit www.protoleo.com or place an order through the website.
2. Who We Are
The data controller responsible for your personal information is:
Legal name: KARYDI I. & TZAVARAS D. G.P.
Business address: Alexandrou Soutsou 6, 10671, Athens Greece
Country: Greece
Email: demetriostzavaras@gmail.com
Website: www.protoleo.com
3. Information We Collect
Depending on how you use the website, we may collect:
Contact details, such as your name, email address, telephone number and delivery address.
Order information, including the products purchased, order value and shipping details.
Payment-related information processed by our payment provider.
Communications you send to us, including enquiries and requests.
Technical information, such as browser or device information and website usage data, where collected through the website or its services.
Please do not send sensitive personal information unless it is necessary for your enquiry.
4. How We Use Your Information
We may use personal data to:
Process and fulfil orders.
Arrange shipping and delivery.
Communicate with you about purchases or enquiries.
Maintain business, accounting and tax records.
Meet legal obligations.
Protect the website and help prevent fraud or misuse.
Improve the website and its services, where permitted.
We will only use your information where we have an appropriate legal basis under applicable data protection law.
5. Legal Bases for Processing
Depending on the circumstances, processing may be based on:
Contract: to process and deliver your order.
Legal obligation: to meet accounting, tax and other legal requirements.
Legitimate interests: to operate and protect the business, where those interests do not override your rights.
Consent: where consent is required, for example for certain non-essential cookies or marketing communications.
Where processing is based on consent, you may withdraw that consent at any time.
6. Service Providers
We may share the information necessary to provide our services with trusted providers, including:
Stripe, for payment processing.
Shippo and relevant courier companies, for shipping and delivery arrangements.
Cargo, as the website platform.
Website hosting, technical support and other service providers, where necessary.
These providers process personal data according to their respective roles, contractual arrangements and applicable privacy obligations.
We do not sell your personal information.
7. Cookies and Website Technologies
The website or its service providers may use cookies and similar technologies for essential website functions, security, preferences, analytics or other purposes.
Where consent is legally required for non-essential cookies or similar technologies, they should only be activated in accordance with the applicable consent requirements.
You may also be able to manage cookies through your browser settings. Blocking certain cookies may affect website functionality.
8. International Transfers
Some service providers may process personal data outside Greece or the European Economic Area.
Where personal data is transferred internationally, appropriate safeguards will be used where required by applicable data protection law.
9. How Long We Keep Information
We retain personal data only for as long as reasonably necessary for the purposes described in this policy.
Order and transaction records may be retained for the periods required by Greek accounting and tax legislation. Other information may be retained for a shorter period, depending on its purpose and any applicable legal obligations.
10. Your Rights
Under applicable data protection law, including the GDPR, you may have the right to:
Access your personal data.
Request correction of inaccurate information.
Request deletion of your data in certain circumstances.
Request restriction of processing.
Object to certain processing.
Request data portability where applicable.
Withdraw consent where processing is based on consent.
Lodge a complaint with the competent data protection authority.