Privacy policy

Privacy Policy

Last updated: July 21, 2026

This Privacy Policy explains how Hammam&Co collects, uses, stores and discloses personal information when you visit hammam-co.com, place an order, create an account, contact us or otherwise use our website, products and related services (the “Services”).

Hammam&Co is powered by Shopify, which provides the ecommerce platform used to operate the online store.

If there is a conflict between this Privacy Policy and our Terms of Service concerning the collection, use or disclosure of personal information, this Privacy Policy will apply.

Data Controller

For the purposes of applicable data-protection law, the controller responsible for your personal information is:

BATH HOUSE ΜΟΝΟΠΡΟΣΩΠΗ Ι.Κ.Ε.
Brand: Hammam&Co
Tripodon 16
Plaka
Athens 105 58
Greece
G.E.MI. number: 155569001000
VAT / Tax identification number: 801380145
Email: sales.hammamco@gmail.com
Telephone: +30 211 012 9099

Personal Information We Collect or Process

“Personal information” means information that identifies you or can reasonably be linked to you. It does not include anonymous or properly de-identified information.

Depending on how you interact with the Services, we may collect or process the following categories of personal information:

Contact details: name, billing address, shipping address, telephone number and email address.
Order and transaction information: products viewed, added to the cart or purchased, order history, returns, refunds, cancellations and related transaction details.
Payment information: payment method, payment status and transaction-confirmation details.
Account information: account login details, preferences and settings, where customer accounts are enabled.
Communications: information you provide when contacting customer support or otherwise communicating with us.
Device and technical information: IP address, browser type, device type, network information and other technical identifiers.
Usage information: information about how you access, navigate and interact with the website and Services.
Marketing preferences: choices concerning promotional communications, cookies and advertising preferences.

Full payment-card details are generally processed directly by Shopify and authorised payment providers. Hammam&Co does not normally receive or store your complete card number.

Sources of Personal Information

We may collect personal information from:

You directly, when you place an order, create an account, contact us, subscribe to communications or otherwise provide information.
Your device and browser, through cookies, pixels, log files and similar technologies.
Shopify and service providers, where they process information to provide ecommerce, payment, fraud-prevention, hosting, analytics, customer-support or delivery services.
Business and marketing partners, where permitted by law and subject to applicable consent requirements.
Public or lawful third-party sources, where necessary to prevent fraud, comply with law or protect our rights.

How We Use Personal Information

We may use personal information for the following purposes:

To operate and provide the website and Services.
To process payments, orders, shipping, delivery, returns, refunds and customer enquiries.
To create, maintain and manage customer accounts.
To remember preferences and improve website functionality.
To provide customer support and communicate about orders or accounts.
To detect, investigate and prevent fraud, misuse, security incidents or unlawful activity.
To maintain business records and comply with tax, accounting, consumer-protection and other legal obligations.
To analyse and improve our products, website, Services and customer experience.
To send marketing communications where you have requested them or where otherwise permitted by law.
To display or measure advertising where permitted by applicable law and your privacy choices.
To establish, exercise or defend legal claims and enforce our Terms and policies.

Legal Bases for Processing

Where the General Data Protection Regulation or similar law applies, we rely on one or more of the following legal bases:

Performance of a contract: to process and fulfil your order, provide customer service and manage returns or refunds.
Legal obligation: to comply with tax, accounting, consumer-protection, regulatory and lawful-authority requirements.
Legitimate interests: to operate, secure and improve the business and Services, prevent fraud, respond to enquiries and protect legal rights, provided those interests are not overridden by your rights.
Consent: for activities that require consent, such as certain marketing communications, non-essential cookies or personalised advertising.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

How We Disclose Personal Information

We may disclose personal information where reasonably necessary to:

Shopify, which hosts and supports the ecommerce platform.
Payment providers, to process and secure payments.
Couriers and fulfilment providers, to prepare and deliver orders.
Technology, hosting, security, analytics and customer-support providers, to operate and protect the Services.
Professional advisers, such as accountants, lawyers or auditors, where necessary.
Marketing and advertising partners, where permitted by applicable law and subject to your choices.
Government, regulatory, judicial or law-enforcement authorities, where disclosure is required or permitted by law.
A buyer, successor or relevant adviser, in connection with a merger, sale, restructuring or other business transaction.

We may also disclose information when you direct us to do so, request an integration or otherwise provide consent.

We do not sell personal information in exchange for money. Depending on the privacy law that applies to you and the advertising features enabled on the store, some disclosures for targeted advertising may be legally defined as “sharing” or “selling.” Where applicable, you may exercise the relevant opt-out right through the privacy controls made available on the website or by contacting us.

Relationship With Shopify

The Services are hosted by Shopify. Shopify collects and processes personal information about your access to and use of the Services in order to provide, secure and improve its platform and related services.

Information submitted through the online store may be transmitted to Shopify and other service providers located in countries other than your country of residence.

Shopify may also process information in connection with enhanced platform features, fraud prevention, analytics and advertising services. In certain circumstances, Shopify may act as an independent controller for its own processing activities.

For more information, review the Shopify Consumer Privacy Policy and use the Shopify Privacy Portal.

Cookies and Similar Technologies

We and our service providers may use cookies, pixels, local storage and similar technologies to:

Operate essential website and checkout functions.
Remember preferences and maintain sessions.
Measure website performance and usage.
Prevent fraud and protect the website.
Support analytics, marketing and advertising where permitted.

Essential cookies may be required for the website and checkout to function. Non-essential cookies are used subject to applicable consent requirements.

You can manage available cookie choices through the cookie banner or privacy-preference controls displayed on the website. You can also change browser settings to block or delete cookies, although doing so may affect website functionality.

Marketing Communications

Where you have subscribed or where otherwise permitted by law, we may send promotional communications about Hammam&Co products, offers and news.

You may unsubscribe from promotional emails at any time by using the unsubscribe link included in the message or by contacting us at sales.hammamco@gmail.com.

Even after you unsubscribe from marketing, we may continue to send non-promotional communications concerning orders, payments, accounts, returns, security or legal matters.

Third-Party Websites and Services

The Services may contain links to websites, social-media platforms or other services operated by third parties.

Third-party services have their own privacy and security practices. We are not responsible for websites or services that are not operated or controlled by us. You should review their privacy notices before providing personal information.

Children’s Information

The Services are not directed to children, and we do not knowingly collect personal information from children who are below the age at which they can lawfully provide their own consent under applicable law.

If you are a parent or guardian and believe that a child has provided personal information to us, contact us so that we can review and, where appropriate, delete the information.

Security

We use reasonable organisational and technical measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

No electronic transmission or storage system is completely secure. You should avoid sending sensitive or confidential information through unsecured communication channels and should keep account credentials confidential.

Retention of Personal Information

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

Provide the Services and maintain an account.
Complete orders, returns and customer-support matters.
Comply with tax, accounting and other legal obligations.
Resolve disputes and enforce agreements.
Prevent fraud and maintain security.

The applicable retention period depends on the type of information, the nature of our relationship, legal requirements and whether the information is needed to establish, exercise or defend legal claims.

International Transfers

Your personal information may be transferred, stored or processed outside Greece or the European Economic Area, including in countries where Shopify or other service providers operate.

Where personal information is transferred outside the European Economic Area and the destination is not covered by an adequacy decision, we rely on an approved transfer mechanism where required, such as the European Commission’s Standard Contractual Clauses, together with supplementary safeguards where appropriate.

Your Rights and Choices

Depending on where you live and subject to applicable legal conditions and exceptions, you may have the right to:

Request access to personal information we hold about you.
Request correction of inaccurate or incomplete information.
Request deletion of personal information.
Request restriction of processing.
Object to certain processing, including direct marketing.
Receive certain information in a structured, commonly used and machine-readable format.
Request transfer of eligible information to another controller.
Withdraw consent where processing is based on consent.
Object to or opt out of certain targeted-advertising or data-sharing activities where applicable.
Lodge a complaint with a competent data-protection supervisory authority.

These rights are not absolute and may be subject to legal limitations. We may need to verify your identity before completing a request.

You may exercise your rights by emailing sales.hammamco@gmail.com. Please describe your request clearly and provide enough information for us to identify the relevant records.

Where permitted by law, an authorised representative may submit a request on your behalf. We may require evidence of the representative’s authority and may need to verify your identity directly.

We will not discriminate against you for exercising a privacy right.

Complaints

If you have a concern about how we process personal information, please contact us first so that we can investigate and respond.

You also have the right to lodge a complaint with the supervisory authority responsible for your place of residence, place of work or the location of the alleged infringement.

In Greece, the competent supervisory authority is:

Hellenic Data Protection Authority
Kifissias 1–3
Athens 115 23
Greece
Telephone: +30 210 6475600
Email: contact@dpa.gr
Complaint procedure: Submit or review complaint information

Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our practices, Services, legal obligations or operational requirements.

When we make changes, we will publish the revised version on the website, update the “Last updated” date and provide any additional notice required by law.

Contact

For questions about this Privacy Policy, our privacy practices or the exercise of your rights, contact:

Hammam&Co
BATH HOUSE ΜΟΝΟΠΡΟΣΩΠΗ Ι.Κ.Ε.
Tripodon 16, Plaka, Athens 105 58, Greece
Email: sales.hammamco@gmail.com
Telephone: +30 211 012 9099