PRIVACY POLICY – GDPR

Introduction

Whenever you contact our company, LFS EMPORIA EIDON KENTRIKIS THERMANSEIS KAI DOMIKON YLION ANONYMI ETAIRIA, under the distinctive title Link Fire and Stones, or use any of our products and services, you may disclose Personal Data to us.
The purpose of this Privacy Policy is to inform you about what Personal Data (PD) we collect, why we collect it, what is the legal framework that allows their processing, and how you can exercise your rights, i.e., request information, deletion, etc.
It also demonstrates our compliance with legislation, specifically EU Regulation 679/2016 on the Protection of Personal Data (GDPR), and our respect for the protection of their privacy and security.
This Privacy Policy applies to Personal Data that you provide to us and to the Personal Data that we collect in the course of our business activities.
This Privacy Policy was posted on our website on 12/22/2020 and replaces any previous version. It is addressed to any natural person who has or intends to have any kind of relationship with us.
The Privacy Policy may be amended from time to time.
Who we are
LFS TRADING OF CENTRAL HEATING AND BUILDING MATERIALS SOCIETE ANONYME with the distinctive title “Link Fire and Stones” is engaged in the marketing and distribution of heating products and natural stones in the Greek and foreign markets. It enters into partnerships with international companies and supplies its products to individuals and stores in Greece and abroad.

What Personal Data do we process?

Personal Data (PD) is any information through which your identity as a specific natural person can be verified, directly or indirectly.
We necessarily process (i.e., collect, record, store, delete) PD in the course of our business operations and, often, in the course of our compliance with laws and regulations.
You (as a natural person) are not obliged to provide us with the PD that we may request, but if you refuse, we may not be able to provide you with products or services or respond to your requests consistently, quickly, and with quality.
When you contact us, visit our website, work with us, or ask us questions, we may ask you for relevant personal information (PII) such as your name, address, email address, telephone number, etc., depending on the nature of our relationship.
Furthermore, you may choose to voluntarily disclose to us – via printed forms, electronic messages, or in person – additional personal data (such as when sending an advertisement or resume) or additional information (such as tax or commercial information, in the context of informing you or investigating cooperation or payment of benefits).

How we collect the Personal Data we process
The information we collect may include:
Information you send or give us (e.g., when you communicate with us)
Information we collect automatically (e.g., when you visit our website)
Information we collect from other sources (e.g. professional chamber)
As a rule, the Personal Data we process comes from voluntary disclosure for one of the following reasons:
You are interested in our products/services.
Information you provided to us when communicating with us (e.g., registration).
Information we receive from your use of our products and services (e.g., warranty card submission) or our partners’ services (e.g., service details).
We use various types of technologies to collect and store information, including the use of cookies.
Our website collects information (such as IP address, search engine, etc.) that is used for activities such as calculating the number of visitors to our website, identifying points of interest to visitors, communication effectiveness, etc.
You have requested some information or updates.
As a representative of the company or organization where you work.
We also receive personal information indirectly in the following scenarios:
From our partners or companies that work with us.
One of our employees gave us your contact details.
We may use information from advertising networks, our customers, or third parties to inform you about topics that may be of interest to you.
When you contact us, we keep a record of our communications to resolve any issues you may have. We do not allow unauthorized entities to access your information.
Our website collects the following information through third-party service code:

• Search Engine
• IP address
• Language
• Country
• City
• Time zone
• Operating system
• Device
• Screen analysis
• Time spent on the website
• Browsing pages
• Internet Service Provider
• The third parties that collect this data are as follows:
• Google Analytics
• Google Maps
• Google AdExchange
• Social Pixel

How we use Personal Data

We use (process) the information we collect, as described above, only for specific purposes. In addition, we may use your data when there is a legal basis for processing it, and for the purpose of:
process your order and complete its shipment,
provide you with personalized and up-to-date services and/or products,
contact you to inform you about new services or products that may be of interest to you,
process your payment or prevent or detect potential fraud,
respond to complaints or questions you have raised,
implement the framework of this Privacy Policy,
develop and improve our products, services, communication methods, and website functionality,
provide personalized communications and targeted advertising.

How long we keep your personal data

We retain your personal data only for as long as necessary, depending on the purpose of processing and this Privacy Policy.
For example, we may need to use your Personal Data to respond to your requests, complaints, or inquiries. We may also need to retain your personal data for a period specified by tax authorities. If we no longer need Personal Data, we delete it or make it anonymous by removing all details that identify you.
Furthermore, the duration of retention (storage) of personal data depends on the legal basis for processing, such as:
In cases where the legal basis for processing is the pursuit of our legitimate interests, the processing of personal data will be carried out for as long as necessary to achieve the intended purpose and for as long as necessary until the statute of limitations for any relevant claims expires.
In cases where personal data is provided consensually by natural persons themselves, we will retain your data for as long as we maintain a contractual relationship with you (both in printed and electronic form) or until the consent given is withdrawn or for a period specified by the tax authorities. If we have requested your permission (consent) to process your personal data and we have no other legal grounds to continue this processing, and you withdraw your consent, we will delete your personal data. Unless otherwise required by the tax authorities.
If the legal basis for processing is the performance of a contract (contractual relationship) or to take steps at your request prior to entering into a contract, then we will retain your data for as long as you maintain a contractual relationship with us and for as long as required by tax and financial authorities, or we will retain it for as long as necessary until the statute of limitations for any relevant claims has expired.

With whom we share your Personal Data

We do not disclose or share Personal Data with other companies, organizations, or individuals for direct or indirect advertising and communication purposes. We use your data only for the purpose for which you submitted it to us or for which we collected it, and within the framework of this Privacy Policy. It may only be disclosed to law enforcement agencies and only with a prosecutor’s order.
We disclose or share PII with third parties in the following cases:
With your consent: We share Personal Data with companies, organizations, and individuals when we have your explicit consent. In this case, the Company is not responsible for what other users do with your personal data.
For external processing: We provide Personal Data to our external partners and to companies or individuals we trust to process it for our own use (e.g., accounting or IT support) and in accordance with our Privacy Policy and appropriate confidentiality and security measures, as defined by EU Regulation 679/2016. Such external partners may include entities that provide services such as: website management, software support and maintenance, automation & management of emails or newsletters, credit card payments, posting comments, managing competition prizes, etc. For legal purposes: We share PD with competent public authorities when reasonably necessary and for the purpose of complying with laws, regulations, etc.
In the context of scientific research: We may provide anonymized Personal Data in the context of scientific or statistical studies.
If the ownership status of the Company changes, your personal data may be transferred to the new owner, but it will be protected by the Privacy Policy in force at the time.

Your rights

Our customers, users of our services, and visitors to our website have the following rights under the General Data Protection Regulation (which should not conflict with applicable law). We may ask you to verify your identity before we proceed with your request to exercise one of your rights (see also §10).
Your rights regarding Personal Data are:
Right to information: You have the right to receive clear and understandable information about how your personal data is used and your rights. This Privacy Policy provides you with relevant information.
Right of access, rectification, and completion: You have the right to access, rectify, or complete your personal data at any time.
Right to portability: You can receive the PD you have provided to us in a structured, readable, and interoperable format, and transmit it to another organization. This right is available to you when your personal data has been provided on the basis of your consent or in the context of the performance of a contract.
Right to erasure of personal data: You have the right to request that we erase your personal data, including because the personal data is no longer necessary in relation to the purposes of this policy or you withdraw the consent on which the processing is based, there are no other legal grounds for processing, you object to the processing, or the personal data has been processed unlawfully. You can always exercise your right in line with the conditions set out in the relevant laws (e.g., you can’t ask us to delete your personal data when labor laws or tax authorities say otherwise).
Right to restrict processing of Personal Data: You have the right to ask us to restrict the processing of Personal Data in certain circumstances, including processing for direct marketing.
Right to lodge a complaint with the Independent Authority for the Protection of Personal Data http://www.dpa.gr/ or any national Data Protection Authority regarding how we process your personal data.
Right to withdraw your consent: If you have given your consent to the processing of PII, you have the right to withdraw your consent at any time (if you do so, it does not mean that it is illegal for us to have processed your PII with your valid consent until the date of withdrawal). You can withdraw your consent to the processing of PD at any time by contacting us at the details listed in §13 “Contact us”.
For information on how to exercise your rights, see § 10.
More information and advice about your rights can be found on the website of the Hellenic Data Protection Authority (http://www.dpa.gr/) or any national data protection authority in your country.

Our Obligations

Our obligations include the principle of accountability with regard to the principles governing the processing of personal data (lawfulness, objectivity and transparency, purpose limitation, data minimization, accuracy of personal data, storage limitation, security, integrity, and confidentiality).
We process Personal Data only if one of the following legal conditions (legal basis) applies. We determine the legal basis for processing PD depending on the purpose for which we have collected and used your personal data.
In any case, the legal basis may be:
CONTRACT IMPLEMENTATION: when the processing of personal data is necessary for the performance of a contract to which the natural person (you) is a party or in order to take steps at the request of the natural person prior to entering into a contract, such as in cases of registration, interest in employment, submission of a CV for the purpose of finding employment, etc. This is also the legal basis in cases where, as a customer, registered user, partner, or supplier, there is a relevant contract between us.
CONSENT: the data subject (you) has, for example, consented to the use of cookies. You may withdraw your consent to the processing of Personal Data at any time by contacting us at the details provided in §13 “Contact Us.”
COMPLIANCE WITH LEGISLATION: when processing is necessary for our compliance with legal requirements (e.g., labor or tax legislation).
OUR LEGITIMATE INTERESTS: processing is necessary for the purposes of the legitimate interests pursued by the controller (us) unless the interests or fundamental rights and freedoms of the natural person (you) prevail. When it is necessary to understand our customer, promote our products/services, and operate our websites and applications effectively. For example, we will rely on our legitimate interest when we analyze the content that has been viewed on our websites and applications to understand how they are used. It is also in our legitimate interest to conduct marketing analyses to determine which products and services may be relevant to the interests of our customers and potential customers.
In addition, we implement appropriate technical and organizational measures to protect the Company (us), individuals (you), and our partners from unauthorized access or alteration, violation, or destruction of the PII we hold.
Specifically:
We encrypt some of our processes.
We control data collection, storage, and processing practices, including physical security measures, to protect against unauthorized access to systems and processes.
Access to the DPCs is restricted and controlled, and those with access are subject to strict contractual confidentiality obligations.
Throughout the entire PII processing cycle (from collection to destruction of PII), we take appropriate technical and organizational measures to ensure the confidentiality, integrity, and availability of PII. We require similar measures from third parties who handle or process PII on our behalf.
Our services and website may be accessible to children under the age of 16. We do not knowingly process the personal data of children under the age of 16.
Access to your information
Within the scope of your rights under the Data Protection Regulation, you may request access to, correction or restriction of the processing of, or erasure of your personal data (see Section 8 for details of your rights).
You can exercise your rights by sending an email to the address listed in the “Contact Us” section (section 13) requesting the Subject Access Request (SAR) form, completing it, and sending it to us. We are required to respond to you within one month of receiving your request. This deadline may be extended by two additional months, if necessary, taking into account the complexity of the request and the number of requests. In any case, we will inform you of this extension within one month of receiving the request, as well as the reasons for the delay.

Information about cookies

We use cookies to improve the speed and quality of service whenever you visit our website.
A cookie is a piece of information, in the form of a file, that is stored on your computer and improves the performance of the website in relation to your service. They are widely used to make websites work more efficiently and to provide information to us, the owners of the website.
The following information explains what cookies we use and why:
Session ID: This cookie (sessKey) is used for basic website functions and remembers visitor preferences such as language settings. Disabling this cookie may have unexpected side effects when browsing our website.
Cookie preference: This type of cookie (cookiePreferences) is used to remember a user’s choice regarding cookies on our website. Where users have previously indicated a preference, the user’s preference will be stored in this cookie.
Universal Analytics (Google): These cookies are used to collect information about how visitors use our website. We use the information to compile reports and improve the website. The cookies (_ga, _gat, _gid) collect information in an anonymous form, including the number of visitors to the site, what the previous website was, and the pages visited (Read Google’s overview of privacy and safeguarding data).
YouTube cookies: We embed videos from our own YouTube channel. This option may select cookie types (such as: PREF – * expires after eight months, VSC – * expires at the end of your session, VISITOR_INFO1_LIVE – * expires after eight months, remote_sid – * expires at the end of your session) on your computer when you select the YouTube video player (read more on YouTube’s information page).
NOTE: Most web browsers allow you to control cookies through your browser settings.

Links to other websites

Where we provide links to other organizations’ websites, this Privacy Policy does not cover how the other organization processes personal data. We encourage you to read the privacy policy of the other website you visit.
However, the transmission of information via the internet is not completely secure. Although we will do everything we can to protect your data, in the context of our cooperation, we cannot guarantee the security of PD during transmission, and therefore you provide it at your own risk.
The company has taken every possible measure to protect your personal data from any kind of infringement or violation. Although we have taken all reasonable measures, no security system is foolproof. Therefore, we cannot guarantee that your personal data will not be subject to arbitrary and illegal access.

Applicable law

The parties shall endeavor to amicably resolve any dispute that may arise from this agreement. If an amicable settlement is not possible, any claim relating to the processing of your data by our company and its website shall be subject to the provisions of Greek law and the courts of Thessaloniki shall have jurisdiction.