PRIVACY POLICY
Last updated: June 2026
1. Introduction
AESTHET is the trading name of AZ Exclusive Trading S.A., a company registered in Greece under registration number 127193101000, with registered address at Souliou 37, Agios Dimitrios 17342, Greece (VAT number: EL800522559).
We are committed to protecting your personal data and handling it transparently and securely. This Privacy Policy explains what personal data we collect, how we use it, with whom we share it, how long we retain it, and what rights you have in relation to it.
This Policy applies to all personal data collected through our website and any related services. It should be read together with our Terms & Conditions, Shipping Policy and Return Policy.
Contact: For any questions or requests relating to this Privacy Policy, please contact us at info@aesthet.com.
2. Data Controller
The data controller responsible for your personal data is:
– AZ Exclusive Trading S.A.
– Souliou 37, Agios Dimitrios 17342, Greece
– Registration number: 127193101000
– VAT number: EL800522559
As data controller, we determine the purposes and means of processing your personal data and are responsible for ensuring it is handled in accordance with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 (GDPR) and Greek Law 4624/2019.
3. Personal Data We Collect
3.1 Data You Provide Directly
When you browse our website, place an order, or interact with our services, you may provide us with:
– Identity data: full name
– Contact data: email address, telephone number, billing and delivery address
– Order data: products purchased, order history, preferences
– Payment data: payment method details (note: we do not store full card numbers — see Section 7)
– Communications data: messages you send us via email or contact forms
3.2 Data Collected Automatically
When you visit our website, we automatically collect certain technical data, including:
– IP address
– Browser type and settings
– Operating system
– Pages visited and duration of visit
– Referring website
– Cookie and tracking data (see Section 6)
This technical data is used primarily for website security, performance, and anonymous statistical analysis.
3.3 Identity Verification (Shopify New Accounts)
Our website operates using Shopify’s customer accounts system. Rather than requiring you to create a traditional password-protected account, we use a secure one-time verification code sent to your email address whenever you wish to access your customer profile or any personalised features of our website, such as viewing your order history, managing returns, or updating your personal details.
You are not required to create a password or a formal account. However, your personal data and order history are retained on our systems and associated with your email address, and will be accessible to you upon identity verification. By providing your email address and completing the verification process, you acknowledge that your data will be stored and associated with your profile in accordance with this Privacy Policy.
4. Legal Basis for Processing
We process your personal data on the following legal bases under Article 6 GDPR:
– Contract performance (Art. 6(1)(b)): to process and fulfil your orders, arrange delivery, handle returns and process payments.
– Legal obligation (Art. 6(1)(c)): to comply with applicable laws, including tax, accounting and consumer protection obligations.
– Legitimate interests (Art. 6(1)(f)): to maintain website security, prevent fraud, improve our services, and send you service-related communications. We balance these interests against your rights and will not override them.
– Consent (Art. 6(1)(a)): for marketing communications and non-essential cookies. You may withdraw your consent at any time (see Section 9).
5. How We Use Your Personal Data
We use your personal data for the following purposes:
– Processing and fulfilling your orders, including payment, delivery and returns
– Communicating with you about your orders, queries and complaints
– Verifying your identity when you access your customer profile
– Sending you transactional notifications (order confirmations, dispatch updates, return confirmations)
– Sending you marketing emails and promotional offers, where you have given your consent
– Personalising your shopping experience based on your order history and preferences
– Sending abandoned cart reminders, where you have consented to this
– Maintaining the security and performance of our website
– Complying with our legal and regulatory obligations
– Preventing and detecting fraud or other unlawful activity
We will not use your personal data for any purpose incompatible with those set out above without informing you and, where required, obtaining your consent.
6. Cookies and Tracking Technologies
We use cookies and similar tracking technologies on our website. Cookies are small text files placed on your device that help us provide you with a better browsing experience.
We use the following types of cookies:
– Essential cookies: necessary for the website to function, including shopping cart functionality and session management. These cannot be disabled.
– Analytical cookies: help us understand how visitors use our website, in pseudonymous or aggregated form.
– Marketing cookies: used to deliver relevant advertisements and track the effectiveness of our campaigns.
When you first visit our website, you will be asked to consent to non-essential cookies. You can manage or withdraw your cookie preferences at any time through your browser settings or our cookie settings panel.
Cookie data is retained for a maximum of 12 months from the date of your consent.
For full details on the cookies we use, please refer to our Cookie Policy.
7. Sharing Your Personal Data
We do not sell your personal data. We share it only as necessary with trusted third parties who assist us in operating our website and fulfilling our services, and only under strict data protection agreements.
7.1 Payment Processors
Payment transactions are processed through certified and secure third-party payment providers. We do not store or have access to your full card number or payment credentials. Any card details you enter are transmitted directly to and processed exclusively by our payment provider.
7.2 Logistics and Delivery Providers
To deliver your orders, we share the necessary data (name, delivery address, contact number) with our logistics and courier partners.
7.3 Technology and Service Providers
We work with technology providers including our e-commerce platform (Shopify), website hosting services, email marketing platforms, and analytics providers. These providers process data on our behalf and are bound by data processing agreements.
7.4 Legal and Regulatory Authorities
We may disclose personal data to competent authorities where required by law, court order or regulatory obligation.
7.5 International Transfers
Some of our third-party providers may be located outside the European Economic Area (EEA). In such cases, we ensure that appropriate safeguards are in place, such as the European Commission’s Standard Contractual Clauses or adequacy decisions, to protect your data to EEA standards.
8. Data Retention
We retain your personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Our general retention periods are:
– Order and transaction data: retained for 10 years to comply with Greek tax and accounting legislation.
– Customer profile data: retained for as long as you continue to make purchases or interact with our services, and for a reasonable period thereafter. You may request deletion at any time (see Section 9).
– Marketing data: retained until you withdraw your consent or opt out.
– Cookie data: retained for up to 12 months from the date of consent.
– Website log files and technical data: retained for up to 12 months for security purposes.
When data is no longer required, it is securely deleted or anonymised.
9. Your Rights
Under the GDPR, you have the following rights in relation to your personal data:
– Right of access: you may request a copy of the personal data we hold about you.
– Right to rectification: you may ask us to correct inaccurate or incomplete data.
– Right to erasure (‘right to be forgotten’): you may request that we delete your personal data, subject to any legal obligations requiring us to retain it.
– Right to restriction of processing: you may ask us to restrict how we use your data in certain circumstances.
– Right to data portability: you may request that we provide your data in a structured, commonly used and machine-readable format.
– Right to object: you may object to processing based on our legitimate interests, or to direct marketing at any time.
– Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, please contact us at info@aesthet.com. We will respond within one month of receiving your request. We may ask you to verify your identity before processing your request.
If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA):
– Website: www.dpa.gr
– Address: Kifisias 1-3, 115 23 Athens, Greece
10. Data Security
We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, misuse or disclosure. These include:
– SSL/TLS encryption for all data transmitted through our website
– Secure certified payment processing through third-party providers
– Access controls limiting who can access personal data within our organisation
– Regular review and update of our security practices
All employees and contractors who handle personal data are bound by confidentiality obligations.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority as required by law.
11. Social Media
Our website may include social media buttons or features (such as sharing tools). These features may collect your IP address and set cookies to enable them to function properly. Your interactions with these features are governed by the privacy policies of the respective social media platforms. We recommend reviewing those policies directly.
Social media plugins are not activated until you choose to interact with them, in order to minimise any data sharing with third-party platforms upon your initial visit to our website.
12. Links to Third-Party Websites
Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites and encourage you to review their privacy policies before providing any personal data.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, services or legal obligations. The updated version will be published on our website with a revised “Last updated” date.
Where changes are material and affect the basis on which we process your data, we will notify you directly where we hold your contact details.
We encourage you to review this page periodically to stay informed about how we protect your data.
14. Contact Us
If you have any questions, concerns or requests regarding this Privacy Policy or the way we handle your personal data, please contact us at:
– Address: Souliou 37, Agios Dimitrios 17342, Athens, Greece
