Last updated: 22/10/2026

This Privacy Policy explains how Orme Club IKE, trading as ORME CLUB, processes personal data when you visit https://ormeclub.gr, purchase products or contact us.

1. Data Controller

The controller responsible for the processing described in this Policy is:

Orme Club IKE
Registered address: Michail Hourmouzi 24, 54453, Thessaloniki, Greece
Email: info@ormeclub.gr
Telephone: 6999475310

2. Personal Data We Collect

Depending on how you interact with us, we may process:

• Customer and contact details: name, email address, telephone number, billing address and delivery address.

• Order details: purchased products, sizes, quantities, prices, delivery information, order history, returns and withdrawal requests.

• Billing information: invoice details and tax identification details where required.

• Payment information: payment status, transaction references and limited payment information supplied by our payment provider.

• Account information: login details and saved preferences if you create an account.

• Communications: enquiries, complaints and correspondence with us.

• Technical information: IP address, browser and device information, security logs and information necessary to operate the Website.

• Consent information: records of cookie preferences and marketing subscriptions, where applicable.

We generally receive information directly from you. Payment providers and delivery companies may also provide transaction or delivery updates.

3. Purposes and Legal Bases

Orders and customer service

We use customer, order, payment and delivery information to accept and fulfil orders, arrange delivery, communicate with you and handle returns.

Legal basis: performance of a contract or steps taken at your request before entering into a contract.

Legal and accounting obligations

We process information to issue invoices, maintain legally required records and comply with consumer protection, tax and other applicable obligations.

Legal basis: compliance with legal obligations.

Withdrawal and statutory claims

We process withdrawal notices, return records and information concerning product complaints to handle your request and comply with our obligations.

Legal basis: performance of the contract and compliance with legal obligations, as applicable.

Security and legal claims

We may use relevant technical and transaction information to protect the Website, prevent fraud and establish, exercise or defend legal claims.

Legal basis: our legitimate interests in protecting our business, customers and systems, subject to your rights and interests.

Marketing

Where we offer newsletters or promotional communications, we send them on the basis of your consent.

You can unsubscribe through the link in a marketing email or by contacting info@ormeclub.gr.

Optional analytics and advertising

Where implemented, analytics or advertising technologies requiring consent are activated only after you provide the relevant consent.

Details of the technologies actually used are provided in our Cookies Policy and cookie settings.

4. Payments

Payments are handled through Stripe.

When you enter payment card details in the payment provider’s secure interface, those details are processed by the provider. We do not store full payment card numbers or card security codes on our own systems.

We may receive payment confirmations, transaction references and limited payment details needed for order administration, refunds and fraud prevention.

Further information about Stripe’s processing is available in its Privacy Policy.

5. Who Receives Your Data

We disclose relevant information only where necessary to:

• Payment providers.

• Courier and delivery companies.

• Hosting, website maintenance and IT security providers.

• Email and customer communication providers.

• Accountants, legal advisers and other professional advisers.

• Competent authorities where disclosure is legally required.

• Newsletter, analytics or advertising providers, where these services are actually used and the relevant legal requirements are met.

Providers may act as processors on our behalf or as independent controllers, depending on their activities.

We do not sell your personal data.

6. International Transfers

Where a provider processes personal data outside the European Economic Area, we ensure that the transfer is covered by an applicable GDPR transfer mechanism, such as an adequacy decision or appropriate contractual safeguards.

You may contact us for further information or a copy of relevant safeguards, subject to necessary redactions.

7. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected and to meet applicable legal obligations.

Our retention arrangements are as follows:

• Orders, invoices and accounting records: Records required for Greek tax and accounting purposes are retained for at least five years from the end of the tax year in which the corresponding tax return must be submitted. Longer retention may be required where statutory limitation periods are extended, a tax audit or dispute remains pending, or another legal obligation applies. This does not mean that all information associated with an order is retained for the same period.

• Customer accounts: Account data is retained while your account remains active. Accounts with no login or purchase activity for three years are reviewed and deleted or anonymised unless continued retention is justified. Account deletion does not remove transaction records that we must retain separately for legal purposes.

• General enquiries: Correspondence is normally retained for up to 12 months after the enquiry is resolved, unless it forms part of an order, complaint, dispute or other matter requiring longer retention.

• Returns, withdrawals and complaints: Routine records are normally retained for two years after the matter is resolved. Relevant records may be retained longer where necessary to meet tax or accounting obligations or to establish, exercise or defend a specific legal claim, taking account of applicable limitation periods.

• Marketing subscriptions: Subscription data is retained until you withdraw consent or unsubscribe. We may retain the minimum information necessary to record your objection and prevent further marketing communications, for as long as needed for that purpose. Evidence of consent is retained only for as long as necessary to demonstrate compliance.

• Security logs: Routine security logs are normally retained for up to six months. Relevant entries may be retained longer where necessary to investigate a security incident, prevent fraud or address a legal claim.

• Cookies and similar technologies: Retention periods are specified in our Cookies Policy and cookie settings.

When a retention period expires, personal data is securely deleted or irreversibly anonymised. Data in backups is removed through our normal backup rotation process and is not used for ordinary business purposes in the meantime.

Where longer retention is necessary, we limit it to the relevant information and restrict its use to the purpose that justifies keeping it.

8. Cookies

We use technologies necessary for core functions such as the shopping basket, checkout and security.

Optional analytics, advertising and other non-essential technologies requiring consent are used only with your permission. You may refuse them or withdraw your consent through the cookie settings.

See our Cookies Policy for details of the technologies, providers and durations actually used.

9. Your Rights

Subject to the conditions of the GDPR, you may request:

• Access to your personal data.

• Correction of inaccurate or incomplete data.

• Erasure of personal data.

• Restriction of processing.

• Data portability.

• Objection to processing based on legitimate interests.

• Withdrawal of consent at any time.

You may object to direct marketing at any time.

Withdrawal of consent does not affect processing lawfully carried out before withdrawal.

To exercise your rights, contact info@ormeclub.gr. We may request proportionate information to verify your identity where necessary.

We normally respond within one month. Where a lawful extension is necessary because of the complexity or number of requests, we will inform you within the initial month and explain the reasons.

10. Complaints

You may lodge a complaint with the Hellenic Data Protection Authority:

Website: https://www.dpa.gr

You may also contact the supervisory authority in the EU country of your habitual residence, place of work or the location of the alleged infringement.

You do not have to contact us before exercising your right to complain.

11. Required Information

Information marked as required during checkout is necessary to process your purchase or meet legal obligations. If you do not provide it, we may be unable to accept or fulfil the order.

Providing information for optional marketing is voluntary and is not a condition of purchase.

12. Automated Decision-Making

Automated tools may support payment processing, transaction security and fraud prevention. The use of an automated tool does not necessarily constitute automated decision-making within the meaning of Article 22 of the GDPR.

Where processing involves a decision based solely on automated processing that produces legal effects or similarly significantly affects you, we will provide the information and safeguards required by applicable law. These include, where applicable, meaningful information about the logic involved and the likely consequences, together with the right to obtain human intervention, express your point of view and contest the decision.

For questions about payment checks or decisions affecting your order, please contact info@ormeclub.gr. Information about processing carried out by payment providers acting as independent controllers is also available in their privacy notices.

13. Security

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, loss or destruction.

14. Changes

We may update this Policy to reflect changes in our practices or legal obligations. The current version and its update date will appear on this page.

Where required, we will provide additional notice of material changes.