Privacy policy

1. Who we are

GEMMA S.A. operates the GEMMA website functions described in this policy and acts as controller for the personal data it processes for those purposes.

2. Scope

This policy covers the public website at www.gemma.gr/, including the English company profile and business enquiry form, Greek product catalogue, wishlist, articles, company presentations and store finder.

The wishlist does not place an order or require an account. The authenticated services at pro.gemma.gr are separate services with their own applicable information and access rules.

3. Data and purposes

• Browsing and security. Connections transmit technical details such as IP address, browser information and the requested page, needed to deliver and protect the service. Hosting servers may keep technical access logs.
• Business enquiries. Our English form collects your name, company, country, business email, optional phone and message to assess and answer your enquiry. Messages are stored in a protected archive outside the public website and emailed through our existing mail service to active GEMMA super administrators. Only authorised super administrators can access the archive. Delivery status is recorded in the Portal email log. No marketing subscription is created.
• Submission protection. An essential session cookie protects the form and helps prevent duplicate submissions. Keyed hashes of IP and submitted email support rate limits in the protected archive; raw IP addresses are not stored in that archive. Separate hosting logs may contain connection details.
• Spam protection. Our contact form uses self-hosted ALTCHA proof-of-work verification to reduce automated submissions. Your browser performs a short computation and GEMMA checks the signed, short-lived, single-use result before accepting a message. The verification code and challenge are served by GEMMA; no form fields or verification requests are sent to ALTCHA servers. This check adds no cookies or marketing permission. JavaScript and the existing essential form session are required.
• Wishlist and preferences. Selected product codes, appearance preference and the last mobile search are stored in your browser. You do not need to provide your name or email for these features.
• Finding stores nearby. The store finder may ask your device for location permission. This feature uses the location in your browser to find nearby stores and does not send or store it in the GEMMA Portal. You can search by area manually instead.
• Store interactions. We record the store, action (map pin, phone or directions), source and date/time to measure referrals to our retail network. This specific record contains no IP address, user location, cookie or persistent visitor identifier. Hosting logs are separate.
• Optional services. Google Analytics, Meta/Facebook advertising measurement and external Google / YouTube content require your relevant choice. See the detailed storage information.

4. Legal bases

Depending on the feature and request, processing relies on consent for optional uses, steps requested in connection with a contract or pre-contractual communication, legal obligations, or GEMMA’s legitimate interests in safely operating and supporting its services, with respect for your rights.

Optional cookies and external content require a separate choice. Continuing to browse or acknowledging the enquiry privacy information does not grant permission for statistics or advertising.

5. Cookies and choices

Essential functions remain available with “Necessary only”. Statistics, advertising and external Google / YouTube content are independent and initially off. The contact form requires its essential session cookie; if it is blocked, submission is refused with an explanation.

You can change or withdraw optional permissions through Cookie settings. Withdrawal stops future optional loads; it does not erase information already received by third-party providers.

6. Providers and recipients

We use hosting, technical support and company email services to operate the site and handle requests. Enquiries are shared with authorised GEMMA colleagues as described above. Information may also be disclosed to competent authorities where required by law.

Greek retail pages use Google Fonts and OpenStreetMap tiles, which transmit technical connection data such as IP addresses to their providers. These connections are distinct from optional Google / YouTube embeds.

If you enable the relevant optional services, Google or Meta receive the information described below. These international providers may process data outside the European Economic Area; their policies explain recipients, processing locations and transfer arrangements: Google, Meta and OpenStreetMap.

When you choose social links, telephone calls or external directions, the chosen provider’s policies also apply.

7. Retention

We retain personal data for as long as necessary for its purpose, taking account of service security, legal obligations and outstanding matters. Enquiry records are kept to handle your request and relevant business follow-up and, where applicable, meet legal obligations or establish and defend claims. This does not set a separate expiry for copies in company mailboxes.

Wishlist and appearance preferences remain until you change them or clear browser data. The last mobile search lasts for the tab session. The verified cookie choice lasts 180 days; the enquiry cookie is session-only. Individual provider cookies, blocked-storage fallbacks and deletion limits are explained below.

8. Your rights

Under the General Data Protection Regulation (EU) 2016/679 and subject to its conditions, you may request access, rectification, erasure, restriction or portability of your data and exercise your right to object. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing.

Contact us using the enquiry form, by phone or at the postal address above, stating that your request concerns personal data. We may need information necessary to verify your identity. Requests are handled within the GDPR deadlines.

You may also contact the Hellenic Data Protection Authority.

9. Security

GEMMA applies technical and organisational measures to protect information and restrict access to authorised people. No online service can guarantee absolute security. Please avoid sending passwords, confidential documents, sensitive personal information or details unnecessary for your request.

10. Policy updates

We update this page when features or relevant information change. The update date appears above. Publishing a policy change does not replace a separate choice required for a new optional use.