Personal Data Protection Policy

Scope of the Privacy Policy

The company under the name «ZAPROUDIS ACHILLEAS MARGIN E.E.», with headquarters at
KILKIS 14, SERRON, (hereinafter referred to as the “Company”), with this Privacy Policy aims
to inform users of this website «https://margincoffee.gr/» (hereinafter referred to as the “Website”)
about the way and purpose of processing their personal data. The Company, as Data Controller, collects and
processes personal data of the users of the Website, only if absolutely necessary, for explicit and legitimate
purposes, in accordance with the existing legislation on personal data protection.

Definitions

For the purposes of this Policy, the following terms shall have the following meanings:

• “Personal Data” means any information relating to an identified or identifiable natural
  person (“data subject”); an identifiable natural person is one whose identity can be verified, directly or
  indirectly, in particular by reference to an identifier such as a name, an identification number, location
  data, an online identifier or one or more factors specific to the physical, physiological, genetic,
  psychological, economic, cultural or social identity of that natural person;
• “Special categories of personal data”: personal data revealing racial or ethnic origin,
  political opinions, religious or philosophical beliefs or trade union membership, as well as the processing
  of genetic data, biometric data for the purpose of positive identification, data concerning health or data
  concerning the sex life of a natural person or sexual orientation.
• “Processing”: means any operation or set of operations which is performed, whether or not
  by automated means, on personal data or on sets of personal data, such as collection, recording,
  organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by
  transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or
  destruction.
• “Controller” means the natural or legal person, public authority, agency or other body
  which alone or jointly with others determines the purposes and means of the processing of personal data;
  where the purposes and means of such processing are determined by Union or Member State law, the controller
  or the specific criteria for its appointment may be provided for by Union or Member State law.
• “Processor”: the natural or legal person, public authority, agency or other body which
  processes personal data on behalf of the controller.
• “Data Subject”: the natural person whose personal data are processed. In this particular
  case, the data subject of the processing is considered to be each user of our Website.
• “Consent” of the data subject: any freely given, specific, explicit and informed indication
  of the data subject’s wishes by which the data subject signifies his or her agreement, by a statement or by
  a clear affirmative action, to the processing of personal data concerning him or her.
• “Data Breach” means a breach of security leading to the accidental or unlawful destruction,
  loss, alteration, unauthorised disclosure or access of personal data transmitted, stored or otherwise
  processed.
• “Anonymisation”: the processing of personal data in such a way that the data can no longer
  be attributed to a specific data subject.
• “Pseudonymisation” means the processing of personal data in such a way that the data can no
  longer be attributed to a specific data subject without the use of supplementary information, provided that
  such supplementary information is kept separately and subject to technical and organisational measures to
  ensure that it cannot be attributed to an identified or identifiable natural person.
• “Existing legislation”: the respective national and EU legislation on personal data
  protection, in particular the General Data Protection Regulation (EU) 2016/679 (hereinafter “GDPR”), Law
  4624/2019 as well as the Decisions, Directives and Opinions of the Hellenic Data Protection Authority
  (hereinafter “Hellenic Data Protection Authority”).

General Principles of Personal Data Processing

The Company collects and processes the personal data of data subjects in accordance with the following processing
principles:

• Legitimacy, objectivity, transparency: The Company collects and processes these data
  lawfully, in a transparent manner in relation to the data subjects.
• Limitation of purpose: The Company processes personal data only for specified, explicit and
  legitimate purposes.
• Data minimization: The Company takes appropriate technical and organizational measures to
  ensure that the personal data processed are appropriate, relevant and limited to what is necessary for the
  purposes for which they are processed.
• Accuracy: The Company ensures that the personal data it maintains and processes is always
  accurate and up-to-date.
• Limitation of the storage period: The Company does not retain personal data for a period
  longer than the purposes for which they were collected and processed. However, it may retain it for a longer
  period if the processing of such data is necessary:
  • for compliance with a legal obligation requiring processing under a provision of law;
  • for the performance of a task carried out in the public interest;
  • for reasons of public interest;
  • for archiving purposes in the public interest, or for scientific or historical research purposes, or
    for statistical purposes, after appropriate technical and organisational measures, including
    pseudonymisation, have been taken, and only if these purposes cannot be served by anonymisation of
    the data;
  • for the establishment, exercise or maintenance of legal claims.
• Integrity and confidentiality: The Company ensures that the collection and processing of
  personal data is carried out in a secure manner, using appropriate technical and organizational means to
  protect it from any unauthorized or unlawful processing and accidental loss, destruction or damage.

Personal Data collected and processed through the website – Purpose of processing and lawful basis

Personal data collected through the contact form

Through the contact form, the user has the opportunity to contact the Company for any questions, clarifications,
complaints, etc. as well as to express interest in the services provided. In case the user wishes to use this
service, he/she should fill in the relevant fields such as name, telephone number, email, subject and the
relevant message.

Purpose of Processing and Lawful Basis

The purpose of the collection and processing of such personal data is the optimal communication and information
of the user with the Company. The legal basis for the processing of personal data is the user’s consent (GDPR
Article 6(1a)), which is provided by accepting this Privacy Policy before submitting the message. Such consent
may, in accordance with existing legislation, be withdrawn at any time, without affecting the lawfulness of the
processing until the moment of withdrawal.

Personal data collected through log data

Each time a user accesses the Company’s Website, personal data may be temporarily stored in a log file, such as
information about the browser and operating system used, the internet protocol address (IP address), the date
and time of the request on the server, the amount of data transferred and the resource requested.

Purpose of Processing and Lawful Basis

The purpose of collecting and processing such data is to provide the service for technical and security reasons.
These data are not personalised and are kept for a maximum of 6 months. IP addresses from which malicious
activity originates are permanently stored in the security system of the Website for security reasons and to
prevent further attacks. The legitimate basis for processing personal data is the legitimate interest of the
Company to improve and secure the services provided to the users of the Website [GDPR Article 6 §1 (f)].

Personal data collected from the use of cookies

When you browse our website, we may collect certain necessary information related to the traffic on the website
in question, such as the Internet Protocol (IP) address and the type of browser used by the user, etc. For more
information about the use of cookies on our Website, you can refer to Cookies Policy.

Purpose of Processing and Lawful Basis

The purpose of the collection and processing of this data is to improve the functionality of the Website and the
services provided, as well as to analyze the traffic. The legal basis for processing personal data is the user’s
consent (GDPR Article 6(1a)), which is provided by accepting the cookies in question, with the exception of the
strictly necessary cookies that are permanently installed and are absolutely necessary for the operation of the
Website, for which the legal basis for processing is the legitimate interest of the Company (GDPR Article
6(1f)).

Personal Data of Minor Users

This Website is not addressed to minors and does not wish to collect and process personal data of minors (i.e.
persons under the age of 18). However, since it is impossible to cross-check and verify the age of the users of
our Website, we request the parents/guardians of minors, in case they find any unauthorized data disclosure on
behalf of minors, to immediately notify the Company, as to take the necessary protective measures (e.g. deletion
of their data). If the Company becomes aware that personal data of a minor have been collected, it undertakes to
delete them immediately and to take all necessary measures to protect such data.

Transfer of Personal Data

The Company may transfer the above personal data to third parties to whom it has entrusted the processing of
personal data on its behalf (such as service providers, website developers, etc.). In any case, the third
parties to which user data may be transmitted are contractually bound to the Company in order to ensure the
confidentiality obligation and all obligations provided for by the Existing Legislation. At the same time,
users’ personal data may be transmitted to public authorities, independent authorities, etc. (e.g. Police
Departments, Prosecutor’s Court, Tax, Customs Authorities, the DPAA, etc.) in the exercise of their duties on
their own initiative or at the request of a third party claiming a legitimate interest and in accordance with
the legal procedures.

In the event of the transfer of users’ personal data collected through this Website to a country outside the
European Union (EU) or the European Economic Area (EEA), the Company shall first check whether:

• The Commission has issued an adequacy decision for the third country to which the transfer is to be made.
• Appropriate safeguards are in place in accordance with the Regulation for the transfer of such data.

Otherwise, the transfer to a third country is prohibited and the Company will not transfer users’ personal data
to that country, unless one of the special exceptions provided by the Existing Legislation applies (e.g. the
express consent of the user and informing him/her about the risks involved in the transfer, the transfer is
necessary for the performance of a contract at the request of the subject, there are reasons of public interest,
it is necessary to support legal claims and vital interests of the user and so on).

Data Retention Period

The personal data of users collected are kept for a predetermined and limited period of time, depending on the
purpose of processing, after which the data are deleted from our files. Where processing is imposed as an
obligation by provisions of the applicable legal framework or a specific retention period is provided, your
personal data will be stored for as long as the relevant provisions require. Personal data of users collected
and processed for the performance of a contract will be kept for as long as necessary for the performance of the
contract and for the establishment, exercise, and/or support of legal claims based on the contract. Personal
data of users processed for marketing purposes with the consent of the users shall be kept until the consent is
withdrawn, without such withdrawal affecting the lawfulness of the processing carried out until then.

Security of Personal Data

Taking into account the latest developments, the cost of implementation and the nature, scope, context and
purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of
users from processing, the Company takes the necessary technical and organizational measures to protect the
personal data of users. Although no method of transmission over the Internet or method of electronic storage is
completely secure, the Company takes all necessary digital data security measures (antivirus, firewall, etc.).

Data Protection Officer (DPO)

In order to ensure adequate protection of personal data, the Company has appointed a Data Protection Officer to
whom data subjects may address their requests and questions regarding the protection of their personal data and
this Policy, at the following contact details: at dpo@margincoffee.gr or by telephone:
+30 2321035777.

Rights of Personal Data Subjects

The Company shall ensure that it is able to respond immediately to the requests of users for the exercise of
their rights in accordance with the existing legislation.

In particular, each user has the following rights:

• Request information on the processing of his/her personal data by the Company.
• Request access to his/her personal data held by the Company. More specifically, he/she may request to
  receive a copy of his/her personal data held and to check the lawfulness of the processing.
• To request the correction of his/her personal data in case of incorrect or incomplete registration by the
  Company.
• Request the deletion of his/her personal data if their retention is not based on any legitimate basis or
  legitimate interest.
• Request restriction of the processing of his/her personal data, under certain conditions.
• Request the portability/transmission of his/her personal data either to himself/herself or to third parties.
• To withdraw at any time the consent given for the processing of his/her personal data, without this
  withdrawal affecting the lawfulness of the processing up to that time.
• To object to the processing of his/her personal data by the Company.
• To oppose a decision concerning him or her taken solely on the basis of automated processing, including
  profiling.

To exercise your rights, you can contact the contact details of the Data Protection Officer. In the event of
exercising any of the above rights, the Company shall provide the data subject with information on the
processing operations upon the relevant request submitted within one (1) month from the receipt of the request
and the identification of the data subject. This period may be extended by two (2) more months, if necessary, if
the request is complex or there is a large number of requests. In this case, the Company shall, within one month
of receiving the request, inform the data subject of the delay and the reasons for it. Within the aforementioned
period, it shall also inform the data subject of any refusal to comply with all or part of the request submitted
and of the reasons for the refusal.

For any complaint regarding this Policy or personal data protection issues, if we do not satisfy your request,
you may contact the Hellenic Data Protection Authority www.dpa.gr, 1-3
Kifissias Street, P.O. Box 115 23, Athens.

Disclaimer for Third Party Websites

In the event that our Website contains links that redirect users to third party websites, we inform you that the
Company does not control or is not responsible for the content, actions or policies of these websites, nor for
the way in which they process the personal data of users.

Updates to the Privacy Policy

This Privacy Policy may be amended/revised in the future, in the context of the Company’s regulatory compliance
as well as the optimization and upgrading of our Website services. We therefore recommend that you refer to the
updated version of this Policy each time for your adequate information.

Second edition: 2024-08-20