Privacy
The short version
We are a two person olive grove, not a data business. We collect what is needed to send you olive oil and to satisfy tax law. We do not sell or share your data for advertising. We run no third party trackers, and our analytics cannot identify you.
The long version follows, because you are entitled to it.
Who is responsible
The controller of your personal data is the business named on the imprint. The registered name, the legal form, the address and the registration number are all there and are not repeated here: one place to keep current is one place to get wrong.
For anything about your data, write to our contact form. We are below the size that requires a data protection officer and have not appointed one. The people who read that address are the people who run the business.
What we collect, and why
| What | Why | Legal basis |
|---|---|---|
| Name, delivery address, email, phone | To take the order, ship it and tell you where it is | Performance of a contract, Art. 6(1)(b) |
| Order contents, totals, VAT, invoice | To sell it to you, and because tax law requires us to keep records | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| The reference on your transfer, and the fact it arrived | To match your payment to your order. There is no card number to store, because we do not take cards | Contract, Art. 6(1)(b) |
| VAT number, if you give one | To apply the reverse charge on business orders | Legal obligation, Art. 6(1)(c) |
| What you type into the contact form: your message, and whichever of name, email, phone, company, country and order number you filled in | To answer you, and to find the order you are asking about | Legitimate interests, Art. 6(1)(f), replying to people who write to us |
| Photographs you choose to attach to a message, up to three | To see what you are describing, usually a damaged parcel or a tin that arrived wrong | Legitimate interests, Art. 6(1)(f), sorting out what went wrong |
| A spam score for each message, the reasons behind it, and the browser string that sent it | To tell a real enquiry from the automated ones, which outnumber it | Legitimate interests, Art. 6(1)(f), keeping the form usable |
| Newsletter address, plus a hashed record of your consent | To send the harvest note, and to prove you asked for it | Consent, Art. 6(1)(a) |
| Hashed IP for spam and abuse checks | To stop bots flooding the contact form and checkout | Legitimate interests, Art. 6(1)(f), keeping the shop working |
| Which link brought you here: campaign tags and the site you came from, saved on the order | To know which of the things we do actually reaches anybody | Legitimate interests, Art. 6(1)(f), understanding our own shop |
| Notes we write ourselves about your order or your message | So whoever picks it up next knows what was already said or done | Legitimate interests, Art. 6(1)(f), running the shop |
| That a discount code was used, against the email that used it | To hold a code to one use per person where the code says so | Contract, Art. 6(1)(b) |
We do not collect special category data, we do not profile you, and no decision affecting you is made automatically.
A note we write about you is still your personal data. If you ask what we hold, those notes are part of the answer, and if one of them is wrong you can have it corrected.
Website analytics
We count how many people visit, which pages and products they look at, roughly which country and city they are in, the kind of device, browser and operating system they use (the family only, such as “Safari on iOS”, never a version or model), the hour of the day, and where they arrived from. We do this ourselves, on our own infrastructure, and it is built so that it cannot identify you:
- No cookie is set for analytics, and no identifier is stored in your browser.
- Events are aggregated into daily counters. After that there is no row that describes a single visit.
- Where a visit does need stitching together for an order, the key is a one way hash of your IP address and browser string combined with a secret that changes every day. It cannot be reversed to your IP and cannot be joined across days.
- Nothing is shared with an advertising network, because we do not use one.
That is why the notice at the bottom of the screen tells you about the one cookie we set rather than asking you to accept it: there is nothing here to accept or refuse. See the cookie policy for the full reasoning.
How long we keep it
| What | How long | Why that long |
|---|---|---|
| Orders and invoices | 10 years | Tax and accounting retention rules in Greece. We cannot delete these on request. |
| Your phone number, any note you left with an order, and how you found us | 2 years after your most recent order | None of this belongs on an invoice, so the ten year rule does not cover it. A nightly job empties it while leaving the invoice itself intact. If you order again the two years start over, across your whole history. |
| The link in your order emails | 90 days after the order is delivered or cancelled | It opens your order without asking for anything, so it should not work forever. If we have no confirmation of delivery, we treat the order as delivered 14 days after we send it. Afterwards you can still find the order with its number and your email address. |
| Baskets you never checked out | 30 days | So you can come back and finish. |
| Contact messages | 2 years | So we can look back at an earlier conversation. Deleted by the same nightly job. |
| Photographs attached to a message | 90 days | A much shorter life than the message they came with. They exist to sort out one damaged parcel, a courier settles that inside a month, and after that a picture of your doorstep is of no use to anyone. A nightly job deletes the file itself, not only the record of it, and the message stays so we can still see what was said. Your browser also makes them smaller before they are sent, which removes the location your camera saved into them, so we never receive it. |
| Newsletter subscription | Until you unsubscribe | Then we keep only the fact you unsubscribed, so we do not mail you again. |
| Raw analytics events | 90 days | Deleted automatically by a nightly job, not by good intentions. |
| Daily analytics counters | Indefinitely | They contain no personal data at all. |
| Notes we wrote ourselves on your order | With the order, so 10 years | They sit on the invoice record and the nightly job leaves them alone, which is worth knowing rather than glossing over. Ask and we will tell you what they say. |
| The record of who changed what on an order | With the order | An order that changes silently is worse than one that changes. This is how we can tell you what happened, and when, and who did it. |
| The log of the jobs described below | 90 days | It records that a job ran and how many rows it touched, never which rows or whose. |
| The nightly backup of the orders | 35 days | Each night the orders are also copied into a backup at our hosting provider, Cloudflare, encrypted at rest, so that a database failure cannot erase them. Each copy is deleted after 35 days. |
The jobs that run on their own
Those deletion promises are not kept by remembering to keep them. Ten jobs run on a schedule, two of them exist only to enforce this page, and every run is logged so we can see whether it worked:
| Job | When | What it does |
|---|---|---|
| Minimise old orders | Nightly | Empties the phone number, your note, how you found us and the email link from orders past the retention window, leaving the invoice itself intact. This one cannot be switched off. |
| Delete old messages | Nightly | Deletes contact messages older than two years outright. Also cannot be switched off. |
| Delete old photographs | Nightly | Deletes photographs attached to messages once they are 90 days old, leaving the messages. Also cannot be switched off. |
| Roll up yesterday | Nightly | Turns raw events into daily counts, which is the step that stops a visit being a row about a person. |
| Tidy the job log | Nightly | Drops the log of these runs after 90 days. |
| Nightly backup of the orders | Nightly | Copies the orders, their items and history, the products, prices, and the shipping and discount settings into a backup at Cloudflare. Each copy is deleted after 35 days. |
| Mark shipped orders delivered | Daily | Marks an order delivered if it was shipped more than 14 days ago and nobody has marked it delivered. That starts the 90 day clock on the link in your order emails. No email is sent. |
| Remind about an unpaid transfer | Every 15 minutes | Emails you once if your transfer has not arrived, before the order lapses. |
| Cancel unpaid transfers | Every 15 minutes | Cancels an order whose payment window has closed and puts the bottles back on the shelf. |
| Release abandoned baskets | Every 15 minutes | Returns stock reserved by somebody who started an order and walked away. |
Who else touches it
Only the companies that actually run parts of the shop: hosting, the database, email delivery and the courier. Each is listed, with what they see and where they are, on the subprocessors page.
We do not sell your data, we do not rent it, and we do not share it for advertising. If we are ever legally compelled to disclose something, we will tell you unless we are prohibited from doing so.
Where it is stored
Your order data lives in a database hosted in Germany, inside the EU. Email is sent by a French provider. Payment is by bank transfer, so it happens between your bank and ours and no card processor is involved at any point.
Our website is served by Cloudflare, which operates globally and has a United States parent company. Where that involves a transfer outside the EEA it is covered by the European Commission's standard contractual clauses and, where applicable, the Data Privacy Framework between the EU and the United States.
Your rights
You can ask us to:
- Show you what we hold about you.
- Correct anything wrong.
- Delete it, except records we are legally required to keep, such as invoices.
- Restrict or object to how we use it.
- Send it to you, or to someone else, in a portable format.
- Withdraw consent for the newsletter, at any time, which does not affect anything sent before.
Email our contact form. We answer within one month. There is no charge, and we will not make you justify the request.
If you are not satisfied, you can complain to a supervisory authority: in Greece the Hellenic Data Protection Authority, or the authority in the country where you live or work.
Security
The website and shop hold no database credentials at all: every request goes through our own servers, and the database itself denies access by default to everything except those servers. Payment card details never reach us. Admin access requires two factors and sits behind a separate access gate, and every sign-in to it is recorded.
Changes
If we change how we use your data in a way that matters, we will update this page and change the date at the top. If the change requires your consent, we will ask for it rather than assume it.