Table of Contents

Your privacy is one of the most fundamental and non-negotiable commitments at Kladion. At Kladion (kladion.org), operated by Dentalmarket.ee OÜ (Reg. 14671131, VAT: EE102166185), we believe that privacy is not a legal formality or a box to be ticked — it is a genuine, deeply held value that shapes the way we operate every single day. Just as we pour extraordinary care and attention into every bottle of Kladion PDO Kalamata extra virgin olive oil, we apply the same dedication, transparency, and respect to the way we handle the personal data of every visitor, customer, and partner who interacts with our website.

This Privacy Policy and Personal Data Protection Policy explains in clear, plain, and honest language exactly what personal data we collect, why we collect it, how we use it, how long we retain it, who we share it with, and — most importantly — what powerful rights you have under the General Data Protection Regulation (GDPR) and applicable Greek law. We encourage you to read it carefully and completely. If you have any questions at any point, please do not hesitate to contact us at [email protected] — our team is always happy to help.

By using kladion.org, browsing our pages, placing an order through our e-shop, or contacting us through our contact page, you acknowledge that you have read and understood this Privacy Policy.

Data Controller — Who Is Responsible for Your Privacy

The data controller responsible for the collection, storage, and processing of your personal data is:

Company: Dentalmarket.ee OÜ Business: Kladion Reg. No.: 14671131 VAT: EE102166185 Registered: 28/02/2019 Address: Harju maakond, Tallinn, Kristiine linnaosa, Tuisu tn 19, Estonia Phone: +371 26494504 Email: [email protected] Sales Email: [email protected]

If you have any questions, requests, or concerns about how we handle your personal data, you can reach us directly. We take every enquiry seriously and will respond promptly and thoroughly.

What Personal Data We Collect and When

We collect personal data only when it is strictly necessary, only for the specific and legitimate purposes described in this privacy policy, and always in a fully transparent manner. We never collect more data than we need, and we never use it for purposes beyond those described here.

Contact and Order Data

When you place an order or contact us, we collect your full name, email address, telephone number, shipping address, and billing address. This data is essential for processing and fulfilling your order, communicating with you about it, and providing you with the customer support you need.

Account Data

If you choose to create a customer account on kladion.gr, we collect your email address and a password of your choosing. Creating an account is entirely optional and is offered purely for your convenience — it is never required to make a purchase.

Payment Data

We want to be completely clear on this critical point: we never store, process, or have access to your payment card details at any time. All payments made through kladion.gr are processed entirely and securely through certified third-party payment providers who comply with the highest available industry security standards, including PCI DSS compliance. We never see your full card number, CVV, expiry date, or any other sensitive payment information.

Communication Data

Any personal information you voluntarily share with us when contacting us via email, our contact form, or any other communication channel is collected and retained solely for the purpose of responding to your enquiry and providing the assistance you have requested.

Marketing Data

If you choose to subscribe to our newsletter or opt in to receive promotional communications from us, we collect and store your email address and a record of your consent. You may withdraw this consent at any time, easily and without any negative consequences whatsoever, simply by clicking the unsubscribe link in any of our emails or by contacting us directly at [email protected].

Technical and Analytics Data

When you visit kladion.gr, certain technical data is collected automatically through cookies and analytics tools. This includes your IP address, browser type and version, device type and operating system, the pages you visit on our website, the time and duration of your visit, and the source through which you arrived at our site. This data is used in aggregated, anonymized form to help us understand how our website is used and how we can continuously improve it for our visitors.

How We Use Your Personal Data

We use the personal data we collect strictly and exclusively for the following purposes, and for absolutely no other purposes without your explicit prior consent.

We use your contact and order data to process, fulfill, and deliver your orders, to communicate with you about their status, to handle any returns, refunds, or complaints, and to provide you with the responsive customer support you deserve. We use your account data to manage your customer account and deliver a convenient, personalized shopping experience. We use payment data solely to facilitate the secure processing of your payment through our certified third-party provider. We use communication data exclusively to respond to your enquiries and provide the assistance you have requested.

We use marketing data to send you newsletters, product updates, and exclusive promotional offers — but only if you have given us your clear, freely given, and explicit consent to do so, and only for as long as that consent remains active. We use technical and analytics data, in aggregated and anonymized form, to monitor our website’s performance, understand visitor behavior, identify opportunities for improvement, and ensure that kladion.gr functions correctly and securely at all times. We use all relevant data to comply with our legal, tax, and accounting obligations under Greek and European law, including our obligations to the Greek Tax Authority (AADE) and under applicable VAT regulations.

Legal Basis for Processing Your Personal Data

Under GDPR, every data processing activity must have a clear and valid legal basis. We rely on the following legal bases to process your personal data.

Performance of a contract — we process your contact, order, and account data because it is necessary to fulfill the contract we enter into with you when you place an order. Without this processing, we would be unable to deliver your order or provide our services to you. Legal obligation — we retain certain data, particularly order and transaction records, because we are legally required to do so under Greek tax and accounting law for a period of up to 10 years.

Legitimate interests — we process technical and analytics data on the basis of our legitimate interest in understanding how our website is used and improving our service for all visitors. We have carefully assessed this interest against your privacy rights and are satisfied that this processing does not override your fundamental rights and freedoms. Consent — we process your marketing data exclusively on the basis of your freely given, specific, informed, and unambiguous consent. You have the right to withdraw this consent at any time, and withdrawal will not affect the lawfulness of any processing carried out before that point.

How Long We Keep Your Personal Data

We retain personal data only for as long as is necessary for the purposes for which it was collected. Our data retention periods are as follows. Order and transaction data is retained for up to 10 years from the date of the transaction, in compliance with Greek tax and accounting law. Customer account data is retained for as long as your account remains active, and for up to 3 years after your last login or purchase, after which it is securely and permanently deleted.

Marketing consent data and associated email addresses are retained for as long as your consent remains active, and are deleted promptly and completely upon withdrawal of consent. Communication data is retained for up to 2 years from the date of the communication, unless a longer retention period is required by law or the nature of the matter discussed. Technical and analytics data is retained in anonymized, aggregated form for up to 24 months, after which it is deleted or further anonymized beyond any possibility of identification.

We never sell, rent, trade, or otherwise transfer your personal data to any third party for their own commercial purposes under any circumstances whatsoever. We share your personal data only with the following carefully selected and thoroughly vetted categories of trusted third-party service providers, and strictly only to the minimum extent necessary for them to provide their specific services to us.

Shipping and courier companies receive your name, address, and contact details solely for the purpose of delivering your order to you. Payment processing providers receive the minimum necessary transaction data to facilitate the secure processing of your payment. Email marketing platforms receive your email address only if you have subscribed to our newsletter, and only for the purpose of sending you the communications you have consented to receive.

Website hosting and analytics providers may process certain technical data as part of providing their infrastructure and monitoring services. All of our third-party service providers are carefully selected, contractually bound to handle your personal data in strict compliance with GDPR, and are explicitly prohibited from using your data for any purpose other than providing their services to us.

International Data Transfers

Some of our trusted third-party service providers may be located or operate servers outside the European Economic Area. Where this is the case, we ensure that robust and legally compliant safeguards are in place to protect your personal data in full accordance with GDPR requirements. These safeguards include Standard Contractual Clauses approved by the European Commission and other recognized transfer mechanisms. For more information on international data transfer requirements under GDPR, you can visit the official EU GDPR portal. We will never transfer your personal data to a country outside the EEA without ensuring that an adequate and legally verified level of protection is in place.

Privacy and Cookies — What We Use and Why

Our website uses cookies and similar tracking technologies to improve your browsing experience, analyze website traffic, remember your preferences, and support our marketing activities. Cookies are small text files placed on your device when you visit our website — they are extremely common and used by virtually every website on the internet.

Essential Cookies

These cookies are strictly necessary for the basic functioning of kladion.gr and cannot be disabled. Without them, certain core features of the website would not work correctly.

Analytics Cookies

These cookies help us understand how visitors use our website — which pages are most popular, how long visitors stay, and where they come from — so that we can continuously improve our content and user experience. This data is collected in aggregated, anonymized form and cannot be used to identify individual visitors.

Marketing Cookies

These cookies are used to deliver relevant promotional content to you based on your interests and browsing behavior. They are placed only with your explicit, freely given consent, and you can withdraw that consent at any time.

You can manage your cookie preferences at any time through the cookie consent banner that appears when you first visit kladion.gr, or directly through the settings of your web browser. Please note that disabling essential cookies may affect the functionality of our website.

Under the General Data Protection Regulation, you have a powerful and comprehensive set of rights in relation to your personal data. These are not abstract legal concepts — they are real, enforceable rights that we are fully committed to respecting and facilitating for every person who interacts with kladion.gr.

The Right of Access

You have the right to request a complete copy of all personal data we hold about you, along with clear information about how we use it, where it came from, and who we share it with. We will provide this information free of charge within 30 days of your request.

The Right to Rectification

You have the right to request that we correct any personal data we hold about you that is inaccurate, outdated, or incomplete. We will act on valid rectification requests promptly and without unnecessary delay.

The Right to Erasure

You have the right to request that we permanently delete your personal data in certain circumstances — for example, where the data is no longer necessary for the purpose for which it was collected, where you have withdrawn your consent, or where the data has been processed unlawfully. Some legal retention obligations may prevent us from deleting certain data immediately, but we will always explain clearly if this is the case.

The Right to Restriction of Processing

You have the right to request that we limit how we process your personal data in certain defined circumstances, such as while we verify the accuracy of data you have disputed or while we assess an objection you have raised.

The Right to Data Portability

You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another data controller of your choice, where this is technically feasible.

The Right to Object

You have the right to object at any time to the processing of your personal data where we rely on legitimate interests as our legal basis. We will cease processing your data unless we can demonstrate compelling legitimate grounds that override your rights and interests.

Where we process your personal data on the basis of your consent — most notably for marketing communications — you have the right to withdraw that consent at any time, easily and without any negative consequence. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.

To exercise any of these 7 essential rights, please contact us by email at [email protected]. We will acknowledge your request immediately and respond fully within 30 days. There is absolutely no charge for exercising any of your rights.

Proven Data Security Measures at Kladion

We take the security of your personal data extremely seriously and implement a comprehensive range of proven technical and organizational security measures to protect it against unauthorized access, accidental loss, destruction, alteration, or disclosure. Our security measures include SSL encryption for all data transmitted through kladion.gr, strictly limited access to personal data on a verified need-to-know basis, regular review and updating of our security practices and protocols, and careful vetting and contractual binding of all third-party service providers who process data on our behalf.

While we do everything in our power to protect your personal data and maintain the highest possible security standards, we want to be transparent with you: no method of transmitting or storing data over the internet can be guaranteed to be completely and unconditionally 100% secure in all circumstances. In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the relevant supervisory authority promptly and in full compliance with our GDPR obligations.

Children’s Privacy

Our website and our products are directed exclusively at adults and are not intended for children under the age of 16. We do not knowingly collect, process, or store personal data from children under 16 under any circumstances. If you are a parent or guardian and you have reason to believe that your child has provided us with personal data without your knowledge or consent, please contact us immediately at [email protected] and we will take prompt and decisive steps to locate and permanently delete the data in question.

Links to Third-Party Websites

Our website may contain links to third-party websites, social media platforms, or other online services. This Privacy Policy applies exclusively to kladion.gr and does not extend to or cover the privacy practices of any third-party website or service. We have no control over, and accept no responsibility for, the content, privacy policies, or data practices of any third-party websites you may visit through links on our site. We strongly encourage you to read the privacy policy of every third-party website you visit.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, our services, or applicable law. When we make significant changes, we will update the “Last updated” date at the top of this page and, where appropriate, notify you by email or through a prominent notice on our website. We encourage you to review this Privacy Policy periodically to stay fully informed about how we protect your personal data. Your continued use of kladion.gr following any changes to this policy constitutes your acceptance of the updated version.

Contact Us and How to Make a Complaint

If you have any questions, concerns, requests, or complaints relating to this Privacy Policy or to the way we handle your personal data, please do not hesitate to reach out. We genuinely care about getting this right, and we will respond to every enquiry as quickly and thoroughly as possible.

Email: [email protected] Sales: [email protected] Address: Harju maakond, Tallinn, Kristiine linnaosa, Tuisu tn 19, Estonia

If you are not satisfied with our response, or if you believe that we have processed your personal data in a way that does not comply with GDPR, you have the right to lodge a formal complaint with the Estonian Data Protection Inspectorate (AKI) — the official supervisory authority for data protection in Estonia:

Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) Website: www.aki.ee Address: Tatari 39, 10134 Tallinn, Estonia Telephone: +372 627 4135