Privacy Policy

Last Updated: 27/12/2025

This Privacy Policy describes how Soil Naxian Creations (“we”, “our”, “us”) collects, uses, stores, and protects personal data of visitors and customers when using our website and services. We are committed to complying with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Greek data protection laws.

1. Data Controller

Soil Naxian Creations
Address: Fraro Chora Naxou 0, Naxos, 84300, Greece
VAT Number: 802757934
Tax Office (DOY): Naxou
Legal Form: Limited Partnership (Ετερόρρυθμη Εταιρεία)
Email: sales@naxiansoil.com
Tel.: +30 697 69 11 626

2. Personal Data We Collect

We collect and process the following categories of personal data:

Identity & Contact Data: Full name, email address, phone number.
Billing & Shipping Data: Billing address, shipping address, VAT number (where applicable, especially for wholesale transactions).
Payment Data: Payment method details (processed securely by third-party providers; we do not store full card details).
Order Data: Products purchased, order history, transaction details, custom order information.
Marketing Data: Newsletter subscriptions, marketing preferences.
Technical & Usage Data: IP address, browser type, device information, cookies (see separate Cookies Policy).
Analytics Data: Website usage statistics via Google Analytics.

3. Legal Basis for Processing

We process personal data under the following legal grounds, as required by GDPR:

Contractual necessity: To process and fulfill orders, manage custom creations, provide customer service, and deliver products.
Legal obligation: To issue invoices, maintain transaction records, and comply with tax and accounting regulations.
Consent: For marketing communications (newsletter, offers) and cookies/analytics tracking.
Legitimate interest: To prevent fraud, ensure website security, improve services, and enhance user experience.

4. How We Use Personal Data

We use your personal data for the following purposes:

Processing, preparing, and shipping orders.
Managing payments, ensuring transaction security and preventing fraud.
Providing customer support and handling inquiries.
Sending newsletters and promotional communications (where consent is given).
Complying with legal, tax, and accounting obligations.
Analyzing website performance and traffic to improve functionality and content.
Communicating with customers regarding orders, custom requests, weddings or baptism favors.

5. Sharing of Data with Third Parties

We only share personal data with trusted third parties that are necessary for the operation of our business:

Payment providers: Piraeus Bank (card payments), IRIS, Apple Pay, Google Pay.
Delivery provider: ACS Courier.
Analytics providers: Website analytics tools (e.g. Google Analytics).
Technical providers: Hosting, backup, and security service providers that store and process data securely.

All third parties process personal data in compliance with GDPR and applicable data protection laws.

6. Data Storage & Retention

Personal data is stored on secure servers located within the EU (our e-shop hosting server and backups).
Retention periods include:
- Order and payment data: Retained for up to 5 years to comply with tax and accounting legislation.
- Customer communication data: Retained as long as necessary to handle inquiries or active relationships.
- Marketing data: Retained until consent is withdrawn.
- Cookies and analytics data: Retained according to our Cookies Policy.

7. Security of Personal Data

We apply appropriate technical and organizational measures to protect personal data, including secure hosting environments, encrypted connections (SSL), secure payment gateways, limited access to data, and regular system monitoring.

8. Your Rights under GDPR

As a data subject, you have the following rights:

Right of access to your personal data.
Right to rectification of inaccurate or incomplete data.
Right to erasure (“right to be forgotten”).
Right to restriction of processing.
Right to object to processing, including direct marketing.
Right to data portability to receive your data in a structured format and transfer it elsewhere.
Right to withdraw consent at any time where processing is based on consent.
Right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

To exercise your rights, please contact us at sales@naxiansoil.com.

9. Children’s Privacy

Our website and services are intended for individuals aged 18 years and older. We do not knowingly collect personal data from minors. If you believe that a minor has provided us with personal data, please contact us immediately so we can take appropriate action.

10. International Data Transfers

Personal data is primarily processed and stored within the EU. In cases where third-party services may process data outside the EU (e.g. analytics tools), such transfers are safeguarded through adequacy decisions, Standard Contractual Clauses (SCCs), or other GDPR-compliant mechanisms.

11. Cookies Policy

We use cookies and similar technologies for essential website functionality and analytics (via Google Analytics). Consent for non-essential cookies is managed through the Complianz GDPR/CCPA Cookie Consent mechanism.

For details, please refer to our separate Cookies Policy.

12. Updates to This Policy

We reserve the right to update this Privacy Policy at any time to reflect changes in legal requirements or business practices. Any updates will be published on this page with a revised “Last Updated” date.