Privacy policy

Controller and contact

DEFRANCH EE, trading as ePoint, is responsible for personal data processed through shop.epoint.gr. Greek tax ID: 802259122 · Business registration (GEMI): 173139401000. Address: Ethnikis Antistasis 41, Nea Moudania, Halkidiki, 63200, Greece. For privacy requests: shop@epoint.gr · +30 237 117 1513.

Data we use

Orders use your name, email, telephone, delivery address or chosen locker, items, billing details, payment references and order status. Invoice lookup uses your Greek tax ID through our invoicing connection and returns basic business registry details for you to verify. Payment card details are entered with Viva or BOX NOW's payment provider; ePoint does not store full card numbers or security codes.

Optional accounts use email-link sign-in, session data, order history, saved addresses and shopping preferences. Support and business enquiries use the details and photographs you submit. Technical information, including IP addresses and security events, helps run and protect the service. Do not send passwords, complete card details or unrelated sensitive information.

Why we process data

Orders, delivery, requested account features and support: steps before a contract and contract performance. Invoicing and statutory records: legal obligations. Security, fraud prevention and legal claims: legitimate interests, balanced against your rights. Newsletters, optional performance statistics and external maps: the relevant separate consent.

Required information is needed for the service requested; without it we may be unable to complete the order or request. Transactional messages about sign-in, orders, delivery, cancellation or refunds are separate from marketing. Accepting purchase terms is not marketing consent.

Recipients

Vercel hosts the application, Neon provides the database and Resend sends email. They process entrusted content under the relevant agreements and may act independently for their own account, security or legal purposes. Authorised accounting, invoicing, order-management, technical-support and business-mail providers receive only information needed for their work. Authorities receive information where legally required.

Viva provides payment services. ACS and BOX NOW receive the necessary contact, delivery, locker and shipment details, order reference and amount to collect for the selected service. BOX NOW Pay on the go shares the full amount for online collection. These providers may act as independent controllers for payment, fraud prevention, carriage and legal obligations. ePoint does not sell customer data or disclose it to advertising networks for targeting.

Provider notices: Vercel · Neon · Resend · Viva.com · BOX NOW · ACS.

Processing locations and safeguards

The application is configured in Frankfurt and the database in the Frankfurt EU region. Provider delivery networks, support and subprocessors can also involve processing outside the EEA. Resend stores email content and related records in the United States; an EU sending region does not mean EU-only storage.

Where required, international transfers use applicable safeguards, including European Commission Standard Contractual Clauses under provider agreements. Contact shop@epoint.gr for information about the safeguards relevant to your data and how to obtain a copy. Provider terms describe their independent processing and retention.

Retention

Invoices and necessary order records: at least five years from the end of the relevant tax year in which the filing obligation arises, and longer where an audit, legal claim or other duty requires it. This is not automatic deletion five years after purchase.

Closed enquiries not linked to an order: 12 months. Necessary order, return, damage, repair and guarantee case records: five years after closure. Support photographs: 90 days after closure unless needed as evidence. Active cases and documented legal holds extend retention as necessary, with review.

Optional accounts: after 24 months of inactivity, a notice starts a removal process with at least 30 days after verified delivery. Returning cancels it. Active sessions, pending orders, unresolved cases and legal holds can prevent removal. Removing an account does not delete required transaction records.

Newsletter addresses: until withdrawal or 24 months after the latest affirmative subscription. Minimal separate consent evidence is retained for five years using a keyed identifier instead of the email address; it is not a marketing list.

Sign-in links last 15 minutes; account sessions and baskets last up to 30 days. Maintenance removes expired access credentials, unaccepted checkout details one day after expiry and email delivery events after 30 days. Queued email content is cleared after sending or expiry. Deletion identifiers used for recovery protection last 90 days. Scheduled deletion runs in batches.

Recovery copies are separate from active records and expire under provider recovery windows. Deletions must be reapplied after restoration. Resend publishes standard email/log retention of 30 days and backup retention of seven days, with the qualifications in its notice. Providers may retain records required for their own legal obligations.

Cookies and external maps

Essential storage supports your basket, sign-in, security and requested shopping tools. Performance statistics and external maps are off until you allow the relevant purpose. Acceptance and rejection are remembered equally for up to 180 days. You can change or withdraw either choice through Cookie settings in the footer. Newsletter consent is separate.

Allowed statistics contain grouped page-performance measurements and broad device/page categories, without full URLs, searches, email, order numbers or advertising IDs. No Google Analytics or Meta Pixel is installed. External BOX NOW maps and OpenStreetMap tiles load only with map consent; providers receive connection details such as your IP address and map requests. We do not request automatic geolocation. Locker lists remain usable without maps.

The storage inventory, durations, map-provider notices and withdrawal details are at Cookie policy. Withdrawal stops future optional reporting and unloads maps; it cannot erase information already received by external providers.

Optional communications

Newsletter subscription requires a separate choice. Email shop@epoint.gr to withdraw without affecting purchases. Product stock or price alerts are sent only when you enable them and can be managed through your account. Shopping preferences and requested order updates are separate from newsletter subscription.

Your rights

Subject to GDPR conditions, you may request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests or to direct marketing. Withdraw consent at any time without affecting earlier lawful processing. Erasure does not override mandatory record-retention duties.

Email shop@epoint.gr with your request. We may need proportionate identity checks. We respond without undue delay, normally within one month; a permitted extension of up to two further months is explained within the first month. You may complain to the Hellenic Data Protection Authority: Hellenic Data Protection Authority.

ePoint does not make solely automated decisions with legal or similarly significant effects about customer eligibility. Technical checks validate details, stock and payments. Payment providers or your bank may carry out their own automated fraud or payment checks under their notices.