Privacy Policy

This policy explains how Rusty Gold Garage handles personal information received through its website, online shop and customer communications.

1. Who is responsible for your information

The controller of personal data collected for the purposes described here is Theofilos Ch. Giannopoulos, trading as Rusty Gold Garage. The registered business name is ΓΙΑΝΝΟΠΟΥΛΟΣ Χ. ΘΕΟΦΙΛΟΣ.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 and applicable Greek data protection legislation, including Laws 4624/2019 and 3471/2006. This policy applies when we determine why and how your information is processed.

2. Information we collect

Enquiries and workshop communications

When you complete our contact form, email us or call us, we may collect your name, email address, telephone number, vehicle details, the subject of your enquiry and the information you choose to provide. A postal address or other details may be needed depending on your request. Contact form submissions are stored in a private enquiry area so the business can respond and follow up.

We use this information to direct your request to the appropriate person, answer your questions and discuss the services you have requested. Please provide only information relevant to your enquiry.

Accounts and online orders

If you place an order, or create an account where account registration is available, we collect the information needed to process the purchase and manage the account. This may include your name, email address, telephone number, billing and delivery addresses, order details and correspondence about the order. Where you request a business invoice, relevant tax details may also be needed.

Information required to answer a request or fulfil an order is identified in the relevant form. If required information is not provided, we may be unable to provide the requested service or complete the order.

Payments

Payment options that are available for an order are shown at checkout. If a third-party payment service is used, that provider processes the payment information under its own privacy and security arrangements. Where you are redirected to a payment provider’s website, Rusty Gold Garage does not collect or store the full card details entered on that external payment page. We may receive the transaction reference, payment status and information necessary to reconcile your order.

Website operation, cookies and external services

The shop uses essential session and basket cookies to remember items in your basket and support checkout. Account facilities may use authentication cookies when you sign in. Technical information, such as an IP address and security or server logs, may also be processed to operate and protect the website.

If optional analytics, advertising, newsletter or embedded third-party services are offered, the relevant information and choices will be provided for those services. An external map or Instagram content may involve the relevant provider receiving technical information when the content is loaded. Following a link to another website subjects that visit to the other provider’s policy.

3. Why we use information and the legal basis

We identify an appropriate lawful basis for each purpose before processing personal data. Depending on the activity, we use information:

• To respond to an enquiry and discuss requested work: to take steps at your request before entering into a contract, or for our legitimate interest in managing ordinary customer enquiries. If we request consent for an optional use, that use is based on your consent.
• To register and maintain an account where offered, fulfil orders, arrange delivery and provide agreed services: because processing is necessary to perform the contract or take requested steps before it.
• To issue invoices, retain required business records and respond to lawful requests from authorities: to comply with legal obligations.
• To keep the website secure, prevent misuse, handle complaints and establish or defend legal claims: for our legitimate interests, assessed against your rights and interests, and where relevant to meet a legal obligation.
• To send optional newsletters, offers or other direct marketing where offered: on the basis of the separate consent required for that communication, or another basis specifically permitted by applicable law. Marketing is not a condition of placing an order.
• To understand how services are used, assess customer needs and improve our products, communications and service: using anonymous or aggregated information where possible, and an appropriate lawful basis for any personal data involved. Consent will be requested for non-essential tracking where required.
• To request feedback, carry out customer research or provide personalised promotional content where those activities are offered: only with the necessary information and any separate consent required by law.
• To administer a prize draw, promotion or competition where offered: under the specific terms and privacy information supplied for that activity.

We do not treat simply submitting an order or accepting our general terms as consent to every form of processing. In particular, information needed to fulfil an order is processed for the contract, rather than relying on consent that is unnecessary for that purpose.

4. Who receives personal information

We may share relevant information with service providers and professional advisers where reasonably necessary for the stated purposes. Depending on the service, these may include website hosting and technical support providers, delivery companies, payment service providers, accountants and advisers assisting with legal obligations or claims.

For delivery, the carrier receives the name, address and telephone number needed to deliver the order. Providers acting on our behalf are subject to appropriate confidentiality, security and data processing obligations. Other providers, such as some payment providers, may act as independent controllers for their own services.

We may disclose information to public authorities or other recipients when required by law, or when necessary for the establishment, exercise or defence of legal claims. Where a disclosure has no other appropriate lawful basis, we will request your consent.

If a service involves transferring personal data outside the European Economic Area, the transfer must be supported by an applicable adequacy decision or other safeguards required by data protection law, such as approved standard contractual clauses where appropriate. You can contact us for information about the safeguards relevant to a service you use.

5. How long information is kept

We retain personal information only for as long as necessary for the purpose for which it was collected, taking account of the type of information, the relationship with you and applicable legal requirements.

• Enquiries and correspondence: for the time needed to answer the request, carry out agreed follow-up and retain information needed for related work or a reasonably foreseeable dispute.
• Order, service and invoice records: for the period required by applicable tax, accounting and other legal obligations, and as needed for guarantee obligations or the establishment or defence of legal claims.
• Accounts where offered: for the duration of the account relationship, subject to the separate retention of records that must be kept after an account is closed.
• Optional marketing subscriptions: until you unsubscribe or the relevant consent or purpose no longer applies. A limited suppression record may be kept where necessary to respect your opt-out.
• Technical and security records: only as long as reasonably required for operation, security and the investigation of relevant incidents.

When information is no longer needed, it is securely deleted or anonymised. If some information must be retained because of a legal obligation or a valid exception to erasure, access and use are limited to that purpose. You can ask us for the retention period or criteria applicable to your particular information.

6. Your data protection rights

Subject to the conditions and exceptions in applicable law, you have the rights described below. To exercise them, email info@rustygoldgarage.com or write to our business address. No special downloadable form is required. Please explain your request and provide information that helps us identify the records concerned. We may request proportionate information to verify your identity.

6.1 Access

You may ask whether we process your personal data, request a copy of that data and receive information about the purposes, categories, recipients, retention and other relevant aspects of the processing.

6.2 Rectification and erasure

You may ask us to correct inaccurate information and complete incomplete information. You may also request erasure where the legal conditions are met, including where information is no longer needed, you withdraw consent and no other basis applies, a justified objection applies, or the information was processed unlawfully.

Erasure is not absolute. Information may need to be retained where the law requires it or another lawful exception applies, including for legal claims. If a request cannot be fully met, we will explain the applicable reason and limit processing where required. Where the law requires, relevant recipients will be informed of rectification, erasure or restriction.

6.3 Restriction of processing

You may request that we restrict processing in circumstances provided by law, for example while the accuracy of information or an objection is being examined.

6.4 Objection

You may object, on grounds relating to your particular situation, to processing based on legitimate interests. We will stop that processing unless there are overriding lawful grounds or processing is needed for legal claims. You may object to the use of your information for direct marketing at any time, and we will stop that use.

6.5 Withdrawal of consent

Where processing relies on your consent, you may withdraw that consent at any time by contacting us. Where an optional newsletter is offered, you may also use the unsubscribe link in the message. Withdrawal does not affect the lawfulness of processing before the withdrawal, or processing that must continue on another appropriate legal basis.

6.6 Data portability

Where the relevant legal conditions apply to automated processing based on consent or a contract, you may request the personal data you provided in a structured, commonly used and machine-readable format, and request its transmission to another controller where technically feasible.

6.7 Responding to requests

We normally respond without undue delay and within one month of receiving your request. Where a lawful extension is needed because of the complexity or number of requests, we will tell you within the first month and explain why. Requests are generally handled free of charge, subject to the limited exceptions permitted by law.

7. Changes to this policy

We may update this policy by publishing the revised text on this page. If a change materially affects how your information is used, we will provide appropriate notice and, where required, request fresh consent. Publishing an update does not by itself authorise a new incompatible use of your information.

8. Questions and complaints

If you have a question, concern or complaint about this policy or the handling of your information, contact info@rustygoldgarage.com, call +30 699 609 0197, or write to Rusty Gold Garage, 16 Alexandroupoleos, Agioi Anargyroi, Athens 13562, Greece.

You have the right to complain to a competent supervisory authority. In Greece, this is the Hellenic Data Protection Authority. Contact details for other European authorities are available from the European Data Protection Board. You may contact an authority without first making a complaint to us.

9. Optional newsletters

If a Rusty Gold Garage newsletter is offered and you choose to subscribe, the requested email address is used for the communications explained at sign-up. Any required marketing consent is separate from an order or a service enquiry. Each marketing email provides a way to unsubscribe, and you may also contact us directly. After an opt-out, the address is removed from the active mailing list, subject only to the limited retention needed to honour the opt-out or meet a legal obligation.