Privacy and Personal Data Protection Policy

Last updated: 6 November 2026

1. Who is responsible for your data

The data controller is the company “SOTIRIOS & PETROS DIMOU O.E. – Manufacturer of Furniture Fronts & Infrared Heating Systems” (Dimou Design), Industrial Park of Oraiokastro, P.O. Box 51521, 57013 Oraiokastro, Thessaloniki, Greece, tel. +30 2310 667266, e-mail info@dimou.com.gr (“the Company”).

For any question about your personal data, and to exercise your rights (section 7), contact us at info@dimou.com.gr or by phone at +30 2310 667266.

2. What data we collect through the website

• Contact form: your full name, e-mail, subject and message. We use them only to reply to your request and, if you ask for one, to send you a quote. Legal basis: steps taken at your request before entering into a contract, and our legitimate interest in replying to people who contact us (Article 6(1)(b) and (f) GDPR).
• Newsletter: only your e-mail address, to keep you informed about new projects and products. Legal basis: your consent (Article 6(1)(a) GDPR). You can unsubscribe at any time through the unsubscribe link in every e-mail or by writing to info@dimou.com.gr.
• Technical data: your IP address and browser details are logged temporarily by the website’s security systems, to protect it from attacks and spam. Legal basis: our legitimate interest in keeping the website secure (Article 6(1)(f) GDPR).

We do not use your data for automated decision-making or profiling, and we never sell it.

3. Cookies and third-party services

The website only uses necessary cookies: one to remember the language you chose (Greek or English) and one to remember your choice in the cookie notice. We do not use advertising or analytics cookies.

For some features we use services provided by Google (Google Ireland Ltd / Google LLC):

• Google Maps, for the map showing our location,
• Google reCAPTCHA, to protect our forms from spam,
• Google Fonts, for the website’s fonts.

These services receive your IP address and technical browser details and may set their own cookies. Google may also process data in the USA, under the EU-US Data Privacy Framework. More in Google’s Privacy Policy.

You can change your cookie choice at any time by deleting the cookies in your browser. The cookie notice will then appear again.

4. Other processing

A. Customers, suppliers and prospective customers or suppliers

• When you contact us (form, e-mail, phone or paper form) and give us details such as your name, e-mail, phone number, address, position or the products you are interested in, we process them to explore a possible cooperation. Legal basis: steps taken at your request and our legitimate interest (Article 6(1)(b) and (f) GDPR). We keep them for five (5) years and then delete them.
• If we work together, your data are used to perform the contract and to comply with tax law (Article 6(1)(b) and (c) GDPR), and are kept for as long as tax law requires.

B. Updates on products and activities (newsletter)

The details you give us to receive updates are used only for that purpose, based on your consent (Article 6(1)(a) GDPR). We keep them for three (3) years from your consent, unless you renew or withdraw it earlier.

C. Visitors to our premises (video surveillance)

• Purpose: to protect people (employees, visitors) and property from unlawful acts such as theft. We only record images, in areas with an increased risk, and not in areas where privacy would be excessively restricted.
• Legal basis: our legitimate interest in protecting our premises, property and the people in them (Article 6(1)(f) GDPR).
• Recipients: only authorised security staff. The footage is given to third parties only (a) to the competent judicial, prosecuting and police authorities to investigate a criminal offence or when they lawfully request it, and (b) to the victim or the perpetrator of a criminal offence, when it is evidence of that offence.
• Retention: fifteen (15) days, after which it is deleted automatically. If an incident is found, the relevant part is kept for up to one (1) more month or, if the incident concerns a third party, up to three (3) more months.

D. Visitors to our showroom and to exhibitions

The details in the “Participation Form” are used to contact you about a possible cooperation, based on your consent (Article 6(1)(a) GDPR). We keep them for three (3) years, unless the law requires otherwise or you withdraw your consent earlier.

5. Who we share your data with

Only authorised Company staff have access to your data. We share it only with:

• providers who support us technically (website hosting, e-mail, IT and network support), solely to provide their services and under a contract that protects your data,
• Google, for the services in section 3,
• tax, judicial or other public authorities, when the law requires it.

6. How we protect your data

We take appropriate technical and organisational measures, such as an encrypted connection (HTTPS), a firewall, regular backups and access limited to authorised staff. We only use the data we need, and only for the purpose you gave them to us for.

7. Your rights

Under the General Data Protection Regulation (EU) 2016/679 you have the right to:

• be informed and access your data and receive a copy,
• rectification of inaccurate or incomplete data,
• erasure, unless the law requires us to keep the data or we need it to establish, exercise or defend legal claims,
• restriction of processing,
• data portability, i.e. to receive the data you gave us in a structured, machine-readable format or ask us to transfer it to someone else,
• object to processing based on our legitimate interest, and at any time to the use of your data for direct marketing,
• withdraw your consent at any time, as easily as you gave it. Withdrawal does not affect the lawfulness of processing before it.

To exercise your rights, write to us at info@dimou.com.gr. We will reply free of charge within one (1) month. If the request is complex or there are many requests, this period may be extended by two (2) more months, and we will let you know. If we have reasonable doubts about your identity, we may ask for additional information to confirm it. If a request is manifestly unfounded or excessive, in particular because it is repeated, we may charge a reasonable fee or refuse it, explaining why.

8. Right to lodge a complaint

If you believe your rights are being violated, you can lodge a complaint with the Hellenic Data Protection Authority: 1-3 Kifisias Ave., 115 23 Athens, Greece, tel. +30 210 6475600, e-mail contact@dpa.gr, www.dpa.gr.

9. Changes to this Policy

We may update this Policy when our services or the law change. The current version is always on this page, with the date of the last update.