Privacy Policy
This policy explains what we do with personal data when a business applies for a wholesale account, orders through this site, or simply visits it. It is about people — the named contacts at our customers, and visitors — rather than about companies.
Last updated September 6, 2026
Who you are dealing with
- Registered name
- ALEXANDRIS MICHAIL TOU MICHAIL
- Trading as
- Hector Footwear
- Registered address
- Arthur Evans 9, 71201 Heraklion, Crete, Greece
- Tax ID (Α.Φ.Μ.)
- 146214557
- Tax office (Δ.Ο.Υ.)
- ΗΡΑΚΛΕΙΟΥ
- Business registry (Γ.Ε.ΜΗ.)
- 192939527000
- info@hectorfootwear.gr
- Telephone
- +30 2814 001031
Who is responsible for your data
The data controller is the business identified above. Write to the email address there with any question about this policy, or to exercise any of the rights below, and a person will answer you.
What we collect
When you apply: business name, contact name, email address, telephone number, tax identification or resale documentation, and the addresses you want to ship to. While you hold an account: your orders and their history, the payment terms and pricing agreed with you, invoices, the rep assigned to you, delivery addresses, and correspondence between us. Automatically from anyone who visits: the IP address, browser and pages requested that any web server records, plus the analytics described below if you have accepted them.
Why we use it, and on what legal basis
To assess your application and run your account — taking orders, applying your terms, producing proforma invoices, arranging delivery and answering questions — because that is necessary to enter into and perform our contract with you. To issue invoices and keep accounting records, because Greek tax law requires it. To keep the portal secure, screen out fraudulent applications, and establish or defend legal claims, because we have a legitimate interest in doing so that does not override your rights. To measure how the site is used, only where you have given consent.
Analytics and your consent
Google Analytics is not loaded until you accept it. While you have not chosen, or have declined, nothing is measured and no analytics cookies are set — this is not a banner that records a preference and tracks you anyway. If you accept, we see aggregate figures: pages viewed, roughly which country visits come from, which devices are used. None of it is connected to your wholesale account or order history, and you can withdraw on the Cookie Notice page as easily as you gave it.
Who we share it with
We do not sell personal data and we do not share it for anyone else’s marketing. It reaches only: the suppliers who run this service for us under contract — Vercel for hosting, Supabase for the database and image storage, Resend for transactional email, and, with your consent, Google for analytics; the carriers who deliver your orders, who need the ship-to address and a contact name; our accountants and auditors; and public authorities where the law requires it. Each of those suppliers is contractually bound to use the data only on our instructions.
Transfers outside the EEA
Those suppliers are established in the United States and may process data there or elsewhere. Where that happens, the transfer is covered by the European Commission’s standard contractual clauses or, for providers certified under it, by the EU–US Data Privacy Framework, so the protection travels with the data.
How long we keep it
An application we decline is kept for up to twelve months, so that we can recognise a repeat application and explain the earlier decision, and is then deleted. Account and order data is kept while the account is active and for five years after the last order. Invoices and the accounting records attached to them are kept for as long as Greek tax law obliges us to keep them, which is longer than we would otherwise choose. Server logs are kept briefly, for security. Analytics data is held for no more than fourteen months.
How we keep it safe
Traffic to this site is encrypted in transit. Passwords are stored only as salted hashes — we cannot read yours, which is why a reset link is the only way back into a locked account. Access to customer records is limited to staff who need it, and admin users hold named roles rather than sharing one login.
Your rights
You may ask for a copy of the personal data we hold about you, have it corrected, ask us to erase it, object to or restrict how we use it, receive it in a portable form, and withdraw any consent you have given. Some of it we must keep regardless — an invoice cannot be deleted on request, because tax law requires us to hold it. We answer within one month, and we do not charge for it.
Complaints
If you think we have handled your data badly, tell us first and we will try to put it right. You also have the right to complain to the Hellenic Data Protection Authority (Kifissias 1-3, 115 23 Athens, dpa.gr), or to the supervisory authority of the EU country where you live or work.
No automated decision-making
Applications are reviewed by a person. We do not take decisions about you by automated means alone, we do not profile visitors behaviourally, and nothing on this site scores or ranks you.
Changes to this policy
We update this policy when what we do with data changes. The date at the top shows the current version, and we notify account holders by email before a change that materially affects them takes effect.
Questions about your data?
Contact us — every inquiry is answered by someone on the team, usually within two business days.