Last updated: 28 October 2026

This policy explains what personal data we collect when you visit solerio.gr, place an order or contact us, why we collect it, who we share it with, how long we keep it and what your rights are. It describes what our website actually does.

1. Who we are

Solerio is the trade name of the sole proprietorship of Myrophora Triantafyllidou (VAT No. 037703721), Mitropoleos 90, 54622 Thessaloniki, Greece. We are the controller of your personal data.

E-mail: [email protected]
Phone: +30 2310 284542

We have not appointed a Data Protection Officer, because the law does not require one for a business of our size and activity. For any question about your data, please contact us directly using the details above.

2. What this policy covers

This policy covers our website solerio.gr (in Greek and English), orders placed through it, and the messages you send us through the website, by e-mail or by phone.

3. What data we collect and why

3.1 When you place an order

• Data: first and last name, company name (if you enter one), billing and delivery address, phone number, e-mail address, the products you order, prices, the delivery and payment method you choose, and any notes you add to the order.
• Why: to process and deliver your order, to collect payment, to send you e-mails about your order (confirmation and status updates), and to handle exchanges and returns.
• Legal basis: the performance of our contract with you (Article 6(1)(b) GDPR). Issuing sales documents and keeping accounting records is a legal obligation (Article 6(1)(c) GDPR).
• Is it required? Yes. Without these details we cannot complete your order.

You order as a guest: we do not create customer accounts on the website.

3.2 Payment

You pay in cash on delivery (to the courier) or when you pick up your order from our store. We do not ask for or store payment card details on the website. If we add online card payments in the future, we will update this policy before they become available.

3.3 When you contact us

• Data: your name, e-mail address, the subject and the content of your message, and anything else you choose to tell us. If you call us, your phone number and what we discuss.
• Why: to answer your question or request.
• Legal basis: our legitimate interest in responding to the messages we receive (Article 6(1)(f) GDPR) or, when your message concerns a purchase, taking steps at your request before entering into a contract (Article 6(1)(b) GDPR).

Spam protection on the contact form. To protect our contact form from automated spam, we use Cloudflare Turnstile, a service of Cloudflare, Inc. It is loaded only on the contact page. When you use the form, Cloudflare processes technical information such as your IP address and characteristics of your browser and device, only to check that the form is being sent by a person and not by an automated program. Cloudflare does not receive the content of your message, and the information is not used for advertising. The legal basis is our legitimate interest in keeping our website secure (Article 6(1)(f) GDPR).

3.4 When you browse the website

• Data: your IP address, the date and time of your visit, the page you requested, the page you came from, your browser and device type, and the size of the request.
• Why: to deliver the website to you, to protect it against attacks and abuse, and to find and fix technical problems. These records are kept in our server logs and are also processed by Cloudflare, which delivers and protects our website (see section 5).
• Legal basis: our legitimate interest in operating a secure and working website (Article 6(1)(f) GDPR).

We do not use analytics or statistics tools, advertising, tracking pixels or social media plugins. The link to our Instagram page is a plain link: nothing is loaded from Instagram unless you click it. The fonts of the website are served from our own server.

4. Cookies and similar technologies

We only use cookies and browser storage that are strictly necessary for the website to work. Under Article 4(5) of Greek Law 3471/2006, these do not require your consent. When you first visit, a short notice tells you about them; when you close it, the website remembers this so the notice is not shown again. If we ever add cookies that are not strictly necessary, we will ask for your consent first.

Name	Purpose	Duration
wp-wpml_current_language	Remembers the language you chose (Greek or English).	1 day
wp_woocommerce_session_…	Keeps the contents of your cart while you move between pages.	2 days
woocommerce_items_in_cart, woocommerce_cart_hash	Tell the website that the contents of your cart have changed.	Until you close your browser
wc_cart_hash_…, wc_fragments_…, wc_cart_created (browser storage, not cookies)	Show your cart without reloading the page.	Until you close your browser, or until you clear your browser data
moove_gdpr_popup	Remembers that you have closed the cookie notice.	1 year
__cf_bm, cf_clearance (Cloudflare)	Set by Cloudflare only when it needs to check whether traffic is automated, to protect the website.	Usually 30 minutes

People who log in to manage the website receive additional login cookies; these are not set for visitors. You can delete cookies in your browser settings at any time, but your cart will then not work.

5. Who we share your data with

We do not sell or rent your personal data, and we do not share it for advertising. We share it only as described below.

• Courier: Geniki Taxydromiki S.A. receives your name, delivery address, phone number and, for cash on delivery, the amount to collect, so that it can deliver your order. If you ask us to use another courier or Hellenic Post (ELTA), they receive the same details.
• Accountant and tax authority: our accountant, who keeps our books, and the Independent Authority for Public Revenue (AADE), to which sales documents are transmitted as required by law.
• Service providers that process data on our behalf:

• AlphaVPS (DA International Group Ltd., Bulgaria) hosts our website and its database on servers in Sofia, Bulgaria (EU).
• Cloudflare (Cloudflare, Inc., USA) delivers our website (DNS and content delivery network), protects it against attacks and runs the Turnstile spam protection. All visits to the website pass through Cloudflare.
• Google (Gmail) provides our e-mail. Order e-mails are sent, and your messages are received, through Gmail.
• Backblaze (Backblaze, Inc., USA) stores encrypted backup copies of our website in its data centre in Amsterdam, the Netherlands (EU). The backups are encrypted before they leave our server, so Backblaze cannot read them.
• The person who manages our website technically on our behalf, who has access to the data only to the extent necessary to maintain, secure and back up the website.

We may also disclose data to public authorities (for example courts, the police or the tax authority) when the law requires it.

6. Transfers outside the European Economic Area

Cloudflare and Google are US companies and may process data in the United States; Backblaze is a US company, although our backups are stored in the EU. Such transfers are based on the European Commission’s adequacy decision for the EU–US Data Privacy Framework (10 July 2023), for companies certified under it, and/or on the Standard Contractual Clauses approved by the European Commission.

7. How long we keep your data

• Orders and sales documents: for as long as Greek tax law requires, as a rule five years from the end of the year in which the sale took place, or longer if the law requires it (for example during a tax audit). Our system automatically anonymises completed and refunded orders after six years. Orders that were never paid or completed are deleted after one month; failed and cancelled orders after one year.
• Messages and e-mails: for as long as needed to deal with your request and any follow-up, and no longer than two years after our last communication. Messages about an order are kept together with the order.
• Server logs: 14 days.
• Backups: the database copies on our server are kept for 7 days. The encrypted off-site backups follow a fixed schedule: daily copies for 14 days, weekly copies for 8 weeks, monthly copies for 12 months and yearly copies for 3 years. Data deleted from the website therefore remains in older backups until they expire (at most 3 years). Backups are used only to restore the website after a failure; if we ever restore one, we delete again any data that had already been deleted.

8. Your rights

Under the General Data Protection Regulation (EU) 2016/679 you have the right to:

• access your personal data and receive a copy of it;
• have inaccurate data corrected and incomplete data completed;
• have your data erased, unless we must keep it by law (for example sales documents);
• restrict the processing of your data in the cases provided by law;
• receive the data you gave us in a structured, commonly used, machine-readable format and have it transmitted to another controller (portability);
• object at any time to processing based on our legitimate interest, for reasons relating to your particular situation.

To exercise your rights, contact us at [email protected] or +30 2310 284542. It is free of charge. We will reply within one month; for complex requests this may be extended by two more months, in which case we will tell you why. We may ask you to confirm your identity before we act on your request.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority, Kifisias 1-3, 11523 Athens, www.dpa.gr.

9. No marketing, no profiling

We do not send newsletters or marketing e-mails; we only send e-mails about your order or in reply to your messages. We do not make decisions about you based solely on automated processing, and we do not create profiles. If we ever start a newsletter, we will ask for your consent separately.

10. Security

The website is served only over an encrypted connection (HTTPS) and is protected by Cloudflare. Access to the administration area is limited to authorised people and protected with two-factor authentication and limits on login attempts. The software is updated automatically, and backups are encrypted, stored off-site and protected against deletion. No system is completely secure; if a personal data breach occurs that is likely to put you at risk, we will notify the Hellenic Data Protection Authority within 72 hours and inform you where the law requires it.

11. Children

Our website is not intended for children under 15. We do not knowingly collect their personal data. If you believe a child has given us personal data, please contact us and we will delete it.

12. Links to other websites

Our website links to other websites, such as Instagram. These are operated by others, under their own privacy policies, which we encourage you to read.

13. Changes to this policy

We will update this policy when the way we process personal data changes, and we will change the date at the top. This version applies from 24 October 2026 and replaces the version of 20 December 2022.