Legal
Privacy Policy
Last updated 4 October 2026
This policy sets out what personal data ESTEÉ & CO. collects, why we hold it, who we share it with, how long we keep it and what you can require of us. We collect little, we never sell it, and we run no advertising or analytics tracking of any kind.
1. Who we are
ESTEÉ & CO. (registered as ESTEE & CO Μονοπρόσωπη Ι.Κ.Ε.), Loukianou 18, 106 75 Athens, Greece. ΑΦΜ 803333754 · ΓΕΜΗ 194782301000. We are the data controller responsible for the personal data described here.
For any privacy question, or to exercise any of the rights in section 7, write to [email protected].
2. What we collect, why, and for how long
We collect only what a purchase, an enquiry or a consignment actually requires.
| Data | Why we hold it | Legal basis | Retention |
|---|---|---|---|
| Name, email address, telephone number | To answer your enquiry, arrange a viewing, or respond to a piece you are offering us | Steps taken at your request before a contract; our legitimate interest in replying to you | 24 months from our last exchange |
| Enquiry and consignment details — brand, model, category, condition, your message and any photographs you upload | To identify, value and authenticate the piece and to give you a considered answer | Steps taken at your request before a contract | 24 months, or the life of a consignment plus 5 years |
| Order and delivery details — pieces purchased, price paid, delivery address, order reference | To fulfil your order, arrange insured delivery, and administer returns or store credit | Performance of our contract with you; legal obligation | As long as Greek tax and accounting law requires |
| Payment confirmation | To confirm that an order has been paid. Card details are handled by Shopify and never reach our systems | Performance of our contract; legal obligation | As long as Greek tax law requires |
| Identity documents, where a high-value transaction requires them | To meet our obligations under anti-money-laundering law | Legal obligation | The period the law prescribes |
| Technical data — IP address, browser and device type, security signals | To keep the site and our forms secure and free of automated abuse | Our legitimate interest in security | Short retention, held by Cloudflare |
3. Where it comes from
All of it comes from you — what you type into our forms, what you tell us by email or in person, and what your browser sends when you visit. We do not buy personal data, scrape it, or obtain it from brokers or social networks.
4. Who we share it with
We never sell your personal data and we never share it for advertising. We use a small number of processors, each bound to act only on our instructions:
| Provider | What it does | Based |
|---|---|---|
| Shopify | Runs the store, the checkout and payment processing, and holds order records | Canada · USA · EU |
| Cloudflare, including Turnstile | Hosts and delivers the site; protects it and our forms from bots and abuse | Global network |
| Airtable | Our enquiry and client-record system | USA |
| Resend | Delivers our email replies to you | USA · EU |
| Our courier | Insured delivery of your order | Depends on destination |
We also disclose data to our accountants and professional advisers, and to public authorities, where the law requires it.
5. Transfers outside the EEA
Some providers above process data outside the European Economic Area, principally in the United States. Where that happens we rely on the safeguards the GDPR requires — in practice the European Commission's Standard Contractual Clauses, together with the provider's own technical measures. You may ask us for details of the safeguards applying to any particular transfer.
6. How we protect it
The site is served over encrypted connections. Access to enquiry and client records is limited to the people in the house who need it. Our forms are protected by Cloudflare Turnstile. We hold no card numbers, no CVV codes and no bank credentials on any system of ours — payment data is handled entirely by Shopify.
7. Your rights
Under the GDPR you may ask us to give you a copy of your data; correct it where it is wrong; erase it; restrict or object to how we use it; or provide it in a portable form. Where we rely on your consent, you may withdraw it at any time without affecting what was done beforehand.
Write to [email protected] and we will respond within one month. Exercising these rights costs nothing.
If you believe we have handled your data improperly, you may complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1–3, 115 23 Athens, www.dpa.gr. We would rather you came to us first.
8. Automated decisions and profiling
We make no decisions about you by automated means, and we do not profile you. Every valuation, every authentication and every answer you receive from us is made by a person.
9. Children
The site is intended for adults. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with data, write to us and we will delete it.
10. Changes to this policy
If this policy changes, the date at the top of the page changes with it, and material changes will be brought to your attention. For the technologies that store data on your device, see our Cookie Policy.
Questions? [email protected]