1. General Introduction
The company under the name "PEXLIVANIDIS LAZAROS MONOPROSOPI I.K.E." and with the trade name "PEXLIVANIDIS SPARE PARTS" based in the Municipality of Oraiokastro, 10th km Dervenion Thessaloniki, with VAT number 801998768, Tax Office Lagada, G.E.M.I. number 167894304000, operates in the field of agricultural and forestry machinery, equipment, and supplies, including tractors.
Contact Information:
• Company Name:"PEXLIVANIDIS LAZAROS MONOPROSOPI I.K.E."
• Address: Municipality of Oraiokastro, 10th km Dervenion Thessaloniki
• Postal Code: 56429
• Telephone: 2310681597
• Email: info@pexlivanidis.gr
i. Policy Description
The company is responsible for processing personal data in the context of providing its services. This policy applies to all users, even if they have not created an account, those who place orders over the phone, recipients of the company's newsletter, as well as those who browse our website. As stated in the Terms of Use, our website is intended for adults only. Therefore, no personal data related to minors is collected.
ii. Policy Modification
The company may update or modify this privacy policy at any time without prior notice. Any updates or modifications will be posted on this website, so you can always stay informed. If it becomes necessary to process your personal data for a different purpose than initially collected, we are obliged to inform you and seek your explicit consent.

2. Data Controller
The company "PEXLIVANIDIS LAZAROS MONOPROSOPI I.K.E." with the trade name "PEXLIVANIDIS SPARE PARTS" based in the Municipality of Oraiokastro, 10th km Dervenion Thessaloniki, with VAT number 801998768, Tax Office Lagada, G.E.M.I. number 167894304000, acts as the data controller of your personal data, which you provide to it with your explicit consent for the purposes mentioned below.

3. Recipients of Personal Data - Processors
The processors are:
a) The company itself, which may simultaneously be the controller and processor through its authorized employees within the scope of its commercial transactions.
b) The web hosting company that supports this website.
c) The shipping and courier companies responsible for the delivery of the ordered products.
The company may disclose your personal data to the following recipients, as necessary for fulfilling
the purposes mentioned below:
a. Partner companies supporting the fulfillment of the above purposes (e.g., a shipping company to send the order to the customer or an advertising company responsible for promoting the company using marketing tools, a company responsible for sending newsletters), who use your data for the specific purpose each time, and only on behalf of the company, following a specific order from the company.
b. Partner companies or individuals responsible for managing and technically supporting this website, who use your data solely on behalf of the company, following a specific order from the company, aiming for the proper technical functioning of the website.
c. Any other administrative, judicial, or public authority to which the company must disclose the specific data (e.g., disclosure of billing information to the competent Financial Service). The company's personnel and the associates involved in collecting and processing personal data are authorized to do so only within the scope of fulfilling the specific purposes mentioned below. Both parties are required to respect the duty of confidentiality and secrecy as provided by relevant legislation. Under no circumstances does the company sell or trade the data collected from you as part of its
activities.

4. Data Transfer Outside the European Union
Your data is not transferred to third countries outside the European Economic Area (EEA). If the transfer of your personal data to international organizations becomes necessary, the company is committed to carrying out the transfer following Article 44 of the GDPR and the general principles of the GDPR, ensuring the highest level of security during their transfer.

5. Type of Data Collected and Method of Collection
Your data is collected and processed within the framework of our corporate obligations and commercial activities, always complying with the General Data Protection Regulation (GDPR 2016/679), effective from May 25, 2018, the applicable Greek legislation on personal data protection, the decisions of the Hellenic Data Protection Authority (HDPA), and any other specific national and European legislation. The data collected by the company concerns the data you provide for creating your account on the website or for the creation and execution of your order (e.g., name, shipping address, email, contact phone number, etc.). We assure you, however, that we do not collect or have access to your financial data (e.g., bank card details) or sensitive data related to you (e.g., religion, health, political beliefs, etc.).
If you call our Customer Service Department (2310 681597) to place a phone order, the information required for registering and executing the order is as follows:
a) Full name,
b) Email address, to receive updates regarding order confirmation and status,
c) Home address or shipping address of the products and postal code,
d) VAT number and Tax Office, if you wish to issue an invoice.
Any information you provide to a Payment Service will be subject to the Payment Service's privacy policy and not this Privacy Policy. We have no control over and are not responsible for any use of the information collected by the Payment Service. Furthermore, through the use of tools such as cookies, your personal data is collected to send commercial/promotional messages (marketing), only if you have given your explicit consent (see also the Cookie Policy).

6. Data Collection Methods
1. When you submit a query/request through our website's contact form
To serve you better and faster, our website provides a contact form, where you are asked to enter your name and email address so that we can respond to your request. Access to this data is only granted to those recipients/processors mentioned above who are deemed necessary to fulfill the purpose they serve. The company is committed to protecting your personal data by taking the necessary technical and organizational measures.
2. When you place a phone or online order
During your phone or online order, the following personal data is required to register and execute your order:
a. Full name
b. Contact phone number
c. Billing address and product shipping address
d. Postal Code
e. Email address
f. VAT number, Tax Office, and professional activity in case of invoice issuance
If payment by bank deposit is chosen, we request you to send proof of deposit of the transaction amount, indicating your name or company name and order number, for your identification, so that your order can be executed. If payment is made by debit or credit card, the entire process is carried out in the secure environment of the bank, which uses all the necessary security protocols. This way, your card's personal information is encrypted, preventing its transmission or alteration during internet transfer. To receive your products from our physical store, whether by you who completed the purchase online through our e-shop or by phone or by an authorized person, our company's personnel may ask you for certain identification details (full name, ID number, etc.) to ensure the safe delivery of the product to you.
3. When you create a user account
To facilitate your future purchases, our website offers the possibility to create a user account. The information required for creating a user account is the same as those requested when placing a phone or online order, as detailed above.
Additionally, a personal password is required, which you must keep secure. After creating your account, your personal information is stored so that you can conduct your future purchases more easily and quickly, without needing to re-enter them. If you wish to correct or modify the information you submitted during the user account creation process, you can make the changes through our website or notify us of the required corrective or modifying action via email at info@pexlivanidis.gr.

4. When you subscribe to the company's newsletter
While browsing our website, you may be asked to enter your email address to receive our news and offers, if you wish.
This data is retained by us for as long as you wish, as each email you receive provides the option to unsubscribe (opt-out) from the company's newsletter. Your data is processed by the advertising and communication company and the platform provider for sending newsletters, with whom we cooperate and are committed to securing your data by applying all modern and appropriate technical and organizational measures for processing. For this specific processing, we comply with the provisions of the e-Privacy Directive (2002/58/EC, as amended by 2009/136/EC), Law 3471/2006, and the HDPA's case law.

7. Purpose of Data Collection – Legal Basis for Data Processing
The purpose of collecting your data is to establish the sales contract with you and fulfill our obligations arising from it (e.g., sending the product to the address you specified). Additionally, your data is collected to comply with the company's legal obligations (e.g., invoicing) and to protect its legitimate interests (e.g., to establish and exercise its legal claims for non-payment of the price despite fulfilling its obligations). Another purpose for collecting your personal data is to provide
after-sales service (e.g., exercising your rights under the warranty, providing technical support, etc.). Failure to collect this necessary personal data would result in the company's inability to serve you. Regarding the purpose of collecting your data, you can find more detailed information in the diagram below:

8. Data Retention Period
The personal data you provide to us is retained for as long as necessary to complete the transaction
and for as long as required by applicable law. After fulfilling the purpose of collecting your data,
your data will be deleted unless the company is required to retain it longer to comply with
applicable law or intends to use it to exercise its legal claims. However, the phone calls we receive
are not recorded.

9. Rights of Data Subjects
A) Right of Access by the Data Subject (Articles 12 and 15 GDPR)
You have the right to request, at any time, copies of your personal data that has been collected, with the exceptions provided by European and national law. Specifically, data subjects have the right to:
a) Receive a copy of their personal data
b) Confirmation regarding its processing
To exercise this right, you only need to submit your request in writing or verbally. If additional copies are requested, or if your request is abusive, excessive, or repetitive, the company may ask you to pay a reasonable fee for administrative costs.
B) Right to Rectification (Article 16 GDPR)
You have the right to request the correction of your data when it is inaccurate or the completion of your data when it is incomplete (Articles 12, 15, 19 GDPR).
To exercise this right, you only need to submit your request in writing or verbally. The company must correct or complete this data without undue delay.
C) Right to Erasure (Right to be Forgotten, Article 17 GDPR)
You can request the deletion of personal data concerning you for any of the reasons listed in detail in Article 17 of the GDPR.
D) Right to Restriction of Processing
You are entitled to obtain a restriction of processing when one of the following applies:
a) The accuracy of the personal data is contested by you, for a period enabling the company (data controller) to verify the accuracy of the personal data.
b) The processing is unlawful, and you oppose the erasure of the personal data and request the
restriction of its use instead.
c) The company (as data controller) no longer needs the personal data for the purposes of processing, but you require it for the establishment, exercise, or defense of legal claims.
d) When you have objected to the processing according to Article 21(1), pending the verification of whether the legitimate grounds of the company override yours. When processing has been restricted according to paragraph
1, such personal data, except for storage, shall only be processed with your consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State. The data subject who has obtained restriction of processing according to paragraph 1 shall be informed by the data controller before the restriction is lifted.
E) Obligation to Notify regarding the Rectification or Erasure of Personal Data or Restriction of Processing (Article 19 GDPR)
The data controller-company shall communicate any rectification or erasure of personal data or restriction of processing carried out under Article 16, Article 17(1), and Article 18 to each recipient to whom the personal data has been disclosed unless this proves impossible or involves disproportionate effort. The data controller-company shall inform the data subject about those recipients if the data subject requests it.
F) Right to Data Portability (Article 20 GDPR)
You have the right to receive the personal data concerning you, which you have provided to the company (data controller), in a structured, commonly used, and machine-readable format, and you have the right to transmit that data to another data controller without hindrance from us, under the conditions of Article 20 GDPR.
G) Right to Object (Article 21 GDPR)
At any time, you may object verbally or in writing to the processing of your data, which is based on Article 6(1)(e) and (f), including profiling based on those provisions.
H) Right to Withdraw Consent (Article 7 Consent Conditions)
You can withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
I) Notification of Personal Data Breach to the Data Subject
In the event of a personal data breach, we are obliged to notify you without undue delay and, if possible, within 72 hours of becoming aware of the breach of personal data to the supervisory authority competent according to Article 55 GDPR unless the personal data breach is unlikely to result in a risk to your rights and freedoms. When the notification to the supervisory authority is not made within 72 hours, it shall be accompanied by reasons for the delay.
J) Automated Individual Decision-Making, including Profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or significantly affects you in a similar way.
K) Right to Lodge a Complaint with the HDPA
You have the right to file a complaint in case of violation of the provisions of Regulation 2016/679 with the competent supervisory authority http://www.dpa.gr/.

10. Obligation to Provide Accurate Personal Data and Updates
The personal data you provide to the company is necessary for the registration and execution of your order and the fulfillment of all obligations of the seller company (e.g., invoicing, shipping, etc.). For this reason, it is necessary that you carefully enter them in our online store or declare them when placing your phone order, to ensure their accuracy, for which you are solely responsible. If there is difficulty in executing the order and fulfilling our obligations under the contract or those of our partners involved (e.g., shipping company), caused by incomplete or incorrect entry of data by you, the company bears no responsibility. The email address you provide is considered valid, and if our correspondence is not delivered to you due to an error in its entry, modification, or technical failure caused by your server or provider, the company bears no responsibility. It is emphasized that each user bears full and exclusive responsibility for the accuracy, truth, and updating of the data they declare. Our company does not perform any verification of the data declared by the user and therefore bears no responsibility for them.

11. Explicit Consent
By entering or verbally declaring your personal data, you expressly consent to the use of your personal data within the framework of lawful collection and processing carried out by the company to fulfill the aforementioned lawful purposes. The user acknowledges that these personal data may be disclosed to the specifically authorized personnel of the company, as well as to external partners (as mentioned in the section on Personal Data Recipients), who fully comply with the principle of confidentiality and privacy protection for personal data to which they have access.

12. Safeguarding Personal Data
The security of your data is a priority for us. For this reason, the company has implemented appropriate technical and organizational measures aimed at protecting your personal data from loss, theft, and unauthorized use, disclosure, or modification, as well as from any unlawful processing.