Privacy Policy

The data controller is FKNG ΜΟΝΟΠΡΟΣΩΠΗ Ι Κ Ε (trading as SPAR Kos E-Market), with registered address at Kleopatras 4, Kos 85300, Greece. Greek VAT number: 802286216. You can reach us at info@spar-kos.gr or +30 22420 23783.

Throughout this notice, "we", "us", and "SPAR Kos" refer to FKNG ΜΟΝΟΠΡΟΣΩΠΗ Ι Κ Ε.

Depending on how you use our website, we may collect:

• Identity and contact data: name, phone number, email address.
• Delivery and billing details: home address, hotel name and room, marina, berth, boat name, and any related access notes.
• Order data: items ordered, prices, delivery slot, special instructions, and order history.
• Payment status and transaction references shared back by our payment provider. We do not see or store full card numbers, CVV codes, or expiry dates — these go straight to the payment provider over an encrypted connection.
• Account / login data, if you create an account, including password hashes (never stored in clear text).
• Communications: messages you send through the contact form, by email, by phone, or via support requests, plus any attachments you choose to share.
• Technical data: IP address, browser and device information, referring URL, language preference, and similar diagnostic information collected via cookies and server logs.

• To take and fulfil your order, including delivery and any returns.
• To process payments through our payment provider.
• To provide customer support, answer questions, and resolve complaints.
• To meet legal, tax, and accounting obligations (for example, issuing invoices and keeping the records Greek law requires).
• To prevent fraud, secure our website, and protect customers.
• To send marketing emails, newsletters, or special offers — only where you have opted in. You can unsubscribe at any time.
• To run analytics and improve the website. Where consent is required, analytics cookies will only run after you accept them.

We rely on the following legal bases under the GDPR:

• Performance of a contract — when we use your data to take and deliver your order, or to communicate about it.
• Legal obligation — when we keep invoices and tax records as required by Greek law.
• Legitimate interest — for example, to keep our site secure, prevent fraud, and improve our service in ways you would reasonably expect.
• Consent — for marketing emails and any non-essential cookies (analytics, marketing). You can withdraw consent at any time without affecting your past use of the site.

We share personal data only with the recipients we need to run the service, and only to the extent required:

• Our payment provider / acquiring bank, who processes card payments on our behalf.
• Hosting and infrastructure providers used to operate the website and store order data.
• Delivery and fulfilment staff who pick, pack, and deliver your order in Kos and to local marinas.
• Accounting and legal advisers used to meet our tax and legal duties.
• Analytics, error-monitoring, or marketing tools, where you have given consent for them to run.
• Authorities or third parties where we are legally required to disclose data (for example, tax inspections or court orders).

Some of the providers we work with may process data outside the European Economic Area. Where this happens, we only allow the transfer if the law permits it — for example, the country has an adequacy decision from the European Commission, or the provider has signed Standard Contractual Clauses approved by the EU, together with appropriate technical and organisational safeguards.

• Order, invoice, and accounting records: kept for as long as Greek tax and accounting law requires.
• Customer support messages: kept for as long as needed to deal with your request and any follow-up.
• Marketing data: kept until you unsubscribe or otherwise withdraw consent.
• Cookies: kept according to the periods listed in our Cookie Policy.
• Server logs and security data: kept for a short period sufficient to detect and investigate incidents.

Under the GDPR you have the right to:

• Access the personal data we hold about you.
• Ask us to correct inaccurate data.
• Ask us to delete data when there is no longer a lawful reason to keep it (the "right to be forgotten").
• Restrict or object to certain processing.
• Receive a portable copy of the data you have given us, in a common machine-readable format.
• Withdraw any consent you have given, at any time.
• Lodge a complaint with the competent supervisory authority — in Greece, the Hellenic Data Protection Authority (HDPA / Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα).

To exercise any of these rights, email info@spar-kos.gr or write to us at the address above. We respond as soon as we can, and within the time limits the law sets.

We use industry-standard technical and organisational measures to protect your data, including encrypted connections (HTTPS), access controls, and review of who can see what. No system is ever 100% secure — please tell us straight away if you suspect a problem with your account or data.

Our website is intended for adults. We do not knowingly collect personal data from children under 16. If you believe a minor has provided us with personal data, contact us and we will remove it.

We may update this policy from time to time. The "Last updated" date at the top of the page reflects the most recent material change. Where the change affects how we process your data, we will tell you in a clear and timely way.