Privacy policy

In accordance with Regulation EU 2016/679 and Law 4624/2019.

1. Data Controller

GDPR Article 13

UNDER THE CROSS G.P., located at Gravias 32, Dafni, 17235, email underthecross.gr@gmail.com, and phone 6972208621, acts as the Data Controller of your personal data.

2. Data We Collect

We collect only the necessary data to provide our services:

  • Identification data (full name).
  • Contact data (shipping address, email, phone number).
  • Payment data (processed encrypted by Shopify Payments / Stripe — our company does not store card details).
  • Marketing preferences (if you opt-in to our newsletter).
  • Technical data (IP address, browser type via cookies).

3. Purpose and Legal Basis for Processing

  • Performance of the sales contract (GDPR Art. 6(1)(b)).
  • Compliance with legal obligations such as tax law (GDPR Art. 6(1)(c)).
  • Legitimate interest — security, fraud prevention (GDPR Art. 6(1)(f)).
  • User consent for marketing and non-essential cookies (GDPR Art. 6(1)(a)).

4. Data Recipients & International Transfers

Your data is shared with:

  • Shopify (e-commerce platform).
  • Payment providers (Stripe / PayPal).
  • Logistics partners ([INSERT COURIER COMPANY]).
  • Tax advisors and authorities.

International transfers

As Shopify and some payment providers are based outside the EEA, your data may be transferred to Canada or the USA. These transfers are protected by Standard Contractual Clauses (SCCs) and Shopify's Data Processing Addendum to ensure an adequate level of protection.

5. Retention Period

  • Order & transaction data: retained for 10 years as required by Greek tax legislation (myDATA compliance).
  • Marketing data: retained until you withdraw consent (unsubscribe).
  • Contact enquiries: retained for up to 2 years after the last communication.

6. Your Rights

GDPR Articles 15–22

You have the right to access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and objection.

Newsletter opt-out

You can withdraw your consent for marketing at any time by clicking the "Unsubscribe" link in any email or by contacting us directly.

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

7. Cookies & Tracking

We use a Consent Management Platform (CMP) compliant with Google Consent Mode v2.

  • Necessary cookies: required for the shopping cart and security (always active).
  • Analytical / marketing cookies: activated only after your explicit "Accept" via our cookie banner.

You can manage or revoke your cookie preferences at any time through the "Cookie Settings" link in the footer.