Privacy & Personal Data Protection Policy

1. Data Controller

ΑΦΟΙ ΚΑΒΟΥΡΑ Ο.Ε. (trading as Kavouras Brothers — Συνεργείο Αυτοκινήτων). Registered office: 34ου Συντάγματος Πεζικού 22, 185 31 Πειραιάς. VAT: 800765730, GEMI: 140139107000. For data protection matters: email kavouras.brothers@gmail.com, phone 6937460740. We are not required to appoint a DPO; please use the above details for any request.

2. Data we collect

We only collect data you provide or that is technically necessary:

• Identification & contact data: full name, phone and (optionally) email.
• Vehicle/request data: make, model, year, VIN, fault/part description, comments, preferred appointment date/time.
• Technical data: IP address and basic request data, for security and abuse prevention (anti-spam).
• Cookie/local-storage data (see Cookie Policy).

3. Purposes & legal basis

We process your data for the following purposes, with the corresponding legal basis (Art. 6 GDPR):

• Managing appointments, part requests and car interest, and communicating with you — Art. 6(1)(b) (contract / pre-contractual steps at your request).
• Website security, fraud/abuse prevention (anti-spam, logs) — Art. 6(1)(f) (legitimate interest).
• Compliance with legal obligations (e.g. tax) — Art. 6(1)(c).
• Non-essential cookies (if used in future) — Art. 6(1)(a) (consent).

4. Recipients & Processors

We do not sell or rent your data. Data may be accessible to carefully selected providers acting as processors on our behalf under Art. 28 GDPR agreements:

• Hetzner Online GmbH (Germany/EU) — server, database & file hosting (storage of submitted data).
• Resend — sending notification/confirmation emails.
• Public authorities where required by law.

5. International transfers

Some providers may process data outside the European Economic Area (EEA). In such cases, transfers are safeguarded by appropriate measures under Art. 46 GDPR (e.g. the European Commission's Standard Contractual Clauses) or an adequacy decision.

6. Retention

We retain data only as long as necessary. Indicatively: requests/appointments/interest not leading to a transaction are kept up to 24 months; data linked to services/transactions are kept as required by tax/accounting law (typically 5 years). After that, data is deleted or anonymised.

7. Your rights

As a data subject you have the rights to:

• Access your data (Art. 15).
• Rectify inaccurate data (Art. 16).
• Erasure ('right to be forgotten', Art. 17).
• Restriction of processing (Art. 18).
• Data portability (Art. 20).
• Object to processing (Art. 21).
• Withdraw consent at any time, without affecting prior lawful processing.

8. Exercising rights & complaints

To exercise any right, contact kavouras.brothers@gmail.com. We respond within one (1) month, free of charge. If you believe processing infringes the law, you may lodge a complaint with the Hellenic Data Protection Authority (1-3 Kifisias Ave., 115 23 Athens, +30 210 6475600, www.dpa.gr).

9. Security

We apply appropriate technical and organisational measures (HTTPS encryption in transit, access control, least privilege) to protect data from unauthorised access, loss or alteration.

10. Automated decision-making

We do not make decisions based solely on automated processing, nor do we carry out profiling.

11. Minors

The website is not directed at minors under 16 and we do not knowingly collect their data.

12. Cookies

For cookies and local storage we use, see the Cookie Policy.

13. Changes

We may update this Policy. The current version is posted on this page with its update date.