Introduction
This policy applies to the company "SPACESHOP - SPACE IS VERY COOL", hereinafter called spaceshop, which is the Data Controller of the personal data collected from its website.

Attica, Greece

Spaceshop is committed to being transparent about the personal information collected when you use our website and other services. This Privacy Policy defines spaceshop's commitment to protect personal data and how it is applied regarding the collection, use, transfer and retention thereof. This policy applies when we determine the purposes and means of processing, thereby acting as a data controller.

Collection of Personal Data
Spaceshop has designed a standardized contact form on its website in order to facilitate communication with any interested party. This form is used for any queries or requests and directs them to the appropriate department or staff member. In order to manage and respond to your inquiries and requests, we may collect and store your full name, email, address, contact details and any other information you may have provided to us. This information is used strictly to satisfactorily respond to your inquiries or requests and will not be disclosed to third parties except as stated in this policy or where disclosure is required or permitted by law.

In addition, we provide the company's phone numbers for a more direct communication if this is required. Calls made to our customer service call center are recorded for quality assurance purposes and our recordings are usually kept for a period of 2 years.

Spaceshop provides the possibility to register for the online services of its website, so that the user can make his purchases. In this case spaceshop may collect and store your full name, email, address, contact details and any other information you may have provided to us. This information is used strictly to respond to your order request and will not be disclosed to third parties except as set forth in this policy or where disclosure is required or permitted by law. spaceshop has implemented an interface service with the bank or other providers, in order to serve the needs of users who wish to complete their purchases with a credit card. In this case, we inform you that spaceshop does not keep any kind of information entered by the user after being redirected to the website of the service provider.

Finally, through our website we collect and process basic contact data with you (name, address, telephone, e-mail) in order to manage and improve our relationship through updates with advertising or non-advertising content, providing facilities and privileges, participation in promotional actions, social responsibility actions or events that we organize, as well as providing the possibility to subscribe to the spaceshop newsletter. With the exception of e-mails after making purchases, the legal basis for the processing of your above data is your express consent given by a separate statement on the website, which you can withdraw at any time, and especially in relation to any e-mails or the spaceshop newsletter also offers the possibility of unsubscribing through the body of the electronic message that the user receives.

For the legal processing of your data under Regulation (EU) 2016/679, we recognize a legal basis before processing personal data. In the above cases, the legal basis for the processing of personal data on our part is the granting of your express consent for the processing, by submitting the respective form only in case you agree with this policy.

This Policy refers to the use of information that we collect from you when you browse our website. Other websites that may be accessible from ours have their own policies regarding the practices they follow. If you are redirected to any of them, we encourage you to read them. We only use trusted partners and providers, but make it clear that we are not responsible for the policies or practices of other websites.

Use of Data Collected
We will use the information we collect for some of the following purposes:

• to register for a Service.
• to provide a Service you have requested.
• for advertising purposes, such as providing customized advertisements, advertiser content, as well as sending promotional communications, after you have given your separate consent where required.
• to evaluate and analyze our market, customers, products and services in order to help us better understand, through statistical processes where necessary, more information about our customers in order to provide you with the most relevant communications; services and experiences.
• to ask for your opinion about our products and services and to conduct customer surveys, after you have given your separate consent where required.
• to understand how consumers use our Services and our products so that we can improve them and develop new products and services.
• to conduct free prize draws, promotions or contests with prizes as permitted by law and
• for other purposes, as long as we recognize a lawful basis for processing your data.

Spaceshop processes personal data for the purposes described above. The legal framework for the processing of personal data by spaceshop includes processing which is: necessary for the performance of a contract between you and spaceshop (e.g. for the purchase of products, for the provision of the Services to you, identification and authentication you, in order to be able to use certain Services), necessary to comply with legal requirements (e.g. to comply with applicable accounting rules and to make mandatory disclosures to law enforcement authorities), necessary for the legitimate interests of spaceshop (e.g. to manage our relationship with you and improve the relevance of communications, experiences and customer service) and based on our customers' consent (e.g. to communicate with you about our products and services and the provision of marketing information to you), which may subsequently be withdrawn at any time by contacting us as provided in the "Contact" section of this Privacy Policy, without affecting the lawfulness of consent-based processing before its withdrawal.

Transfer of Personal Data
The data collected during your navigation on our website is stored and processed within the European Economic Area (EEA), but there is a possibility that it may need to be transferred and processed in a country outside the EEA. Any such transmission of personal data will always be in compliance with applicable law.

Spaceshop may disclose personal data collected from the website to partners, suppliers, service providers, subcontractors or third-party processors to the extent that this is reasonably necessary for our operation. Such transmissions will be carried out solely for the purposes and in compliance with the conditions provided herein and will be protected where necessary by appropriate measures and contractual clauses in accordance with the applicable personal data protection legislation. In the context of promotional actions and based on your consent on our website, we may transmit your personal data to providers of advertising services, and/or ad measurement services, managers of electronic communication media and social media. In addition, we may disclose personal data when such disclosure is necessary to comply with a legal obligation to which we are subject. Finally, in the event that we need to transfer personal data to third parties, spaceshop undertakes to request your consent as long as no other legal basis has been identified.

Retention of Personal Data
spaceshop undertakes not to retain personal data for a period longer than necessary and we will ensure that we delete it securely. For additional information regarding the punch-out period and deletion period, please see the Contact section.

Rights of Subjects
In this section spaceshop arranges the rights arising from Regulation (EU) 2016/679 and how data subjects can access these rights. For further clarifications or to exercise your rights, please refer to the Contact section.

Right of Access
Individuals can access their own personal data that we collect and process. spaceshop considers that the personal data collected directly from the subjects will be accurate and complete.

Right to Correction and Erasure
The data subject may request the updating, erasure or removal of any information held about him, and any third party who processes or uses the data must also comply with this request. An erasure request can only be refused if an exception applies.

Spaceshop is obliged to delete personal data when any of the following applies:

• the personal data are no longer necessary for the purposes for which they were collected or processed.
• the data subject withdraws their consent and there is no other lawful basis for processing.
• the data subject objects to the processing carried out on the basis of the legitimate interests of the Data Controller and there are no other overriding legitimate grounds for the processing.
• the personal data has been processed unlawfully.

If the request to delete personal data has been received, identification has been confirmed, the request meets one of the above requirements and there is no legitimate reason to object to the processing, spaceshop must delete the relevant data in its entirety. The request will be registered in the Data Subject Request Record File.

If spaceshop is unable to delete personal data, it will ensure that:

• cannot or will not attempt to use the personal data to justify any decision about an individual or in a way that affects that individual in any way
• does not give any other organization access to personal data
• protects personal data with appropriate technical and organizational security, and is committed to the permanent deletion of information if, or whenever, it becomes available.

Right to Restriction of Processing
The data subject has the right to demand from the manager, limitation of the processing of his data, where apart from storage they are not processed any other way.

Right to Object
The subject has the right to object, at any time and for reasons related to his particular situation, to the processing of personal data concerning him.

Right to Data Portability
Upon request, the data subject has the right to receive a copy of the personal data in a structured format.

These requests should be processed within one month, provided that there is no undue burden and it does not compromise the privacy of individuals. A data subject may also request that their data be transferred directly to another system. This request must be implemented free of charge.

If spaceshop cannot fully respond to this request within 30 days, the GDPR compliance team should nevertheless provide the following information to the Data Subject, or their legally authorized representative within the time period specified:

• An acknowledgment of receipt of the request.
• Any information found to date.
• Details of any information or amendments that have been requested, which will not be given to the data subject, the reason(s) for the refusal, and any procedures available to appeal the decision.
• An estimated date by which the remaining responses will be provided.
• An estimate of any costs to be paid by the data subject (e.g. where the request is excessive in nature).
• The name and contact details of the person in charge.

1. Amendments
   In the event that spaceshop chooses to change this Privacy Policy, we will post the changes here. Where the changes are significant, we may also choose to email the affected users with the new details. Where required by law, we will obtain your consent to make these changes.
2. Contact us
   If you have any concerns or complaints regarding this policy, please contact us at: info@spaceshop.gr

If you believe that our processing of your data violates applicable law, you can file a complaint with the relevant supervisory authority. Contact details for all EU Supervisory Authorities can be found at: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080.