Privacy Policy

1. Data controller

TOTHELO FOODS ΜΟΝΟΠΡΟΣΩΠΗ Ι.Κ.Ε., GEMI 195502001000, Atreidon 21, 11631 Athens, Greece.

Contact for data protection matters: [email protected] · tel. 694 499 0118.

2. What data we collect

• Contact form: your name, email, enquiry type (e.g. consumer, gym, nutritionist, retailer, distributor) and your message. We do not ask for anything more.
• Usage statistics (only if you accept them in the cookie banner): pages visited, time on page, device and browser type, approximate location and, through Microsoft Clarity, anonymised recordings of mouse movement and clicks on the page.
• Server technical data (e.g. IP address, request time) logged automatically by our hosting provider for security and operation.
• Map: the Contact page embeds an OpenStreetMap map. When it loads, the map provider receives your IP address.

3. Purposes and legal basis

• To reply to your enquiry or contact you about a partnership: pre-contractual steps / our legitimate interest in serving people who write to us (Art. 6(1)(b) and (f) GDPR).
• Statistics and improving the site: your consent (Art. 6(1)(a) GDPR). Without consent, no analytics tool is loaded.
• Security and smooth operation of the site: our legitimate interest (Art. 6(1)(f) GDPR).
• Compliance with legal obligations where required (Art. 6(1)(c) GDPR).

4. Who we share data with

We do not sell your data. We share it only with providers who serve us and act on our instructions:

• our site hosting and infrastructure provider;
• our enquiry-management and email provider (to receive and answer your messages);
• Google Ireland Limited (Google Tag Manager / Google Analytics) and Microsoft Ireland Operations Limited (Microsoft Clarity), only if you have given consent;
• OpenStreetMap Foundation (map on the Contact page).

5. Transfers outside the EEA

Some providers (e.g. Google, Microsoft) may process data outside the European Economic Area. In those cases we rely on an appropriate safeguard, such as an adequacy decision (EU–US Data Privacy Framework) or the European Commission’s Standard Contractual Clauses.

6. How long we keep data

• Messages and enquiries: as long as needed to handle the request and up to 24 months after the last contact, unless there is a legal obligation or an ongoing collaboration.
• Usage statistics: according to the retention settings of the tools, up to 14 months.
• Cookie choice: stored on your device for up to 12 months, after which we ask you again.

7. Your rights

You have the right of access, rectification, erasure, restriction of processing, portability and objection. Where processing is based on consent, you can withdraw it at any time, without affecting the lawfulness of earlier processing, through “Cookie settings” at the bottom of every page.

To exercise your rights, write to [email protected]. We will reply within one month at the latest.

If you believe your rights are being infringed, you can lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr, Kifisias 1-3, 115 23 Athens).

8. Security

We apply appropriate technical and organisational measures (e.g. encrypted HTTPS connection, restricted access) to protect your data.

9. Minors

This site is not aimed at children under 15 and we do not knowingly collect their data.

10. Changes to this policy

If we change this policy we will publish the updated version here with a new date.