Who Controls Your Personal Data

KORVEL LTD, with its business address at Efkleidi 34, Acharnes, 136 75, Greece, is the data controller for the processing described in this Privacy Policy.

Privacy enquiries and requests to exercise data-protection rights may be sent to info@korvel-food.com.

When This Policy Applies

This Policy applies when you:

• visit or browse korvel-food.com;
• request the KORVEL branded-product catalogue;
• submit a private-label enquiry or project brief;
• request quality or product documentation;
• communicate with us by contact form, email, telephone or live chat;
• interact with optional analytics or external-media services after providing consent.

This Policy does not govern independent distributors, retailers, social-media platforms or other third-party websites that determine their own purposes and means of processing.

What Personal Data We Collect

Where Data Comes From and What Is Required

Most personal data is collected directly from you when you use a form, upload a file, send an email, call us or use live chat. We may also receive your business contact details from a colleague or authorised representative of your company when they include you in an enquiry or commercial discussion.

Fields marked as required in our forms are necessary for us to identify the enquiry, understand the target market and provide a relevant response. If you do not provide the required information, we may be unable to process or respond to the request. Optional fields and file uploads are clearly indicated and may be left blank.

If another person provides us with your contact details, we use them only for the relevant business communication and provide this Privacy Policy at or before our first direct communication where required.

Why We Use Personal Data and Our Legal Bases

Cookies and External Technologies

The Site uses cookies and similar technologies for session management, security, language selection, consent management, performance measurement, live chat and optional external media.

Strictly necessary technologies

Technical PHP, PrestaShop, cache and consent-preference cookies are used to operate the Site, maintain a secure session, display the correct language or cached version and remember your privacy choices. These technologies do not require consent where they are strictly necessary for the requested service.

Analytics, live chat and external media

Google Analytics, Zoho SalesIQ live chat, Google Maps, YouTube and any other non-essential external services are placed in the relevant consent category and remain disabled until you provide the required consent. Refusing these categories does not prevent access to the essential content of the Site, although the relevant optional feature may remain unavailable.

You may accept, reject or manage optional categories through the cookie banner. You may later change or withdraw your consent through the cookie-settings control made available on the Site. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Our separate Cookie Policy and the cookie-settings tool provide the current cookie names, providers, purposes and storage periods. The consent tool is the operational source for the categories currently enabled on this Site.

Who May Receive Personal Data

We disclose personal data only where necessary for the purposes described in this Policy. Depending on how you use the Site, recipients may include:

• Hostinger, which provides website and server-hosting infrastructure;
• Zoho services used for live chat, communications and business-relationship management, including Zoho SalesIQ where activated;
• Google services used for consent-based analytics and optional external media, including Google Analytics, Google Maps and YouTube where present;
• website maintenance, cybersecurity and technical-support providers acting under our instructions;
• professional advisers, auditors, insurers, certification bodies or laboratories where their involvement is necessary for a request or legal obligation;
• public authorities, courts or regulators where disclosure is required by law;
• a genuine buyer, investor or successor in connection with a corporate transaction, subject to confidentiality and appropriate safeguards.

Processors acting on our behalf must process personal data under documented instructions and appropriate contractual, confidentiality and security obligations. Some external-media providers may process data for their own purposes under their respective privacy terms after you activate their service.

KORVEL does not sell personal data.

International Data Transfers

Our company is established in Greece. Some providers, particularly international technology providers such as Google and Zoho, may process or make personal data accessible from countries outside Greece or the European Economic Area.

Where a transfer outside the European Economic Area occurs, we rely on an applicable lawful transfer mechanism, which may include:

• an adequacy decision adopted by the European Commission, including an applicable EU–US Data Privacy Framework certification;
• the European Commission's Standard Contractual Clauses;
• supplementary contractual, technical or organisational measures where required;
• another mechanism permitted by Chapter V of the GDPR.

You may contact us to request information about the transfer safeguard relevant to your data and how to obtain a copy, subject to necessary protection of confidential information.

How Long We Keep Personal Data

We retain personal data only for as long as necessary for the purpose for which it was collected and for applicable legal, accounting, security and dispute-resolution requirements.

• Unsuccessful or inactive business enquiries, including catalogue and document requests, are normally retained for up to 24 months after the last meaningful interaction.
• Private-label project briefs and uploaded files are normally retained for up to 24 months after the last meaningful interaction unless the project becomes active, a longer period is agreed or retention is necessary for a legal claim.
• Live-chat conversations are normally retained for up to 24 months unless they become part of an active commercial relationship or must be retained for security or legal reasons.
• Records relating to an established customer, supplier, contract, invoice or commercial relationship are retained for the duration of the relationship and for the period required by applicable Greek commercial, tax, accounting and limitation rules.
• Technical and security logs are retained for the period necessary to maintain security, diagnose incidents and prevent abuse; records connected with an incident may be retained until the incident or related claim is resolved.
• Consent and objection records are retained for as long as necessary to demonstrate and respect the choice and to comply with applicable limitation periods.
• Cookie lifetimes and the relevant analytics storage periods are stated in the current cookie-settings tool and Cookie Policy.

When the applicable period ends, data is deleted, anonymised or securely isolated where continued storage is required by law.

How We Protect Personal Data

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures include access controls, encrypted transmission, system maintenance, backup and recovery arrangements, service-provider controls and procedures for handling security incidents.

No internet transmission or storage system can be guaranteed to be completely secure. Please do not include unnecessary personal data in messages or uploaded files, and contact us before sending unusually sensitive or confidential project material.

Your Data-Protection Rights

Subject to the conditions and limitations of applicable law, you have the following rights:

To exercise a right, email info@korvel-food.com. We may request only the additional information reasonably necessary to verify your identity and protect your data.

We will respond without undue delay and normally within one month. Where a request is complex or numerous, this period may be extended by up to two additional months; if so, we will inform you within the first month and explain the reason. Requests are normally handled free of charge.

Children's Personal Data

The Site is intended for business customers and professional contacts and is not directed to children. We do not knowingly request personal data from children.

If you believe that a child has provided personal data through the Site, please contact us so that we can review the circumstances and delete the information where required.

Automated Decision-Making

KORVEL does not use personal data collected through this Site to make decisions based solely on automated processing that produce legal effects or similarly significant effects on individuals.

Automated technical controls may identify spam, bots, malicious requests or security risks. These controls protect the Site and do not replace human review where a decision could significantly affect an individual.

Third-Party Links and External Content

The Site may contain links to independent third-party websites. Following such a link takes you to a service governed by that third party's own privacy information.

Externally hosted maps, videos, analytics and live-chat features are controlled through the consent mechanism where required. When you activate an optional external service, the provider may receive your IP address, device information and interaction data and may process that information under its own privacy terms.

Changes to This Privacy Policy

We may update this Policy when our services, technologies, providers, processing activities or legal obligations change. The revised version will be published on this page with an updated revision date.

If a change materially affects how personal data is used, we will provide additional notice or obtain new consent where required.

How to Contact Us or Make a Complaint

You may contact us first so that we can try to resolve the matter, but this does not affect your right to complain directly to a competent supervisory authority or seek a judicial remedy.