Personal Data Protection Policy

PRIVACY & PERSONAL DATA PROTECTION POLICY

For Pizza Fan, the protection of personal data is of paramount importance and is treated with the utmost seriousness. Respecting the personal data we manage and ensuring its correct and secure processing is an absolute priority for our Company.

For this reason, we implement all appropriate technical and organizational measures to protect the personal data we process, ensuring that processing is always carried out in accordance with the requirements set by the applicable national and European legislative framework, primarily the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Greek Law 4624/2019.

1. DATA CONTROLLER – CONTACT INFORMATION

Pizza Fan acts as the Data Controller for all personal data it collects, processes, and stores within the scope of its operations.

Company Details:

Corporate Name: Pizza Fan (FANATIKS PIZZA PAROCHIS YPIRESION E.P.E.)

Address: Thrasivoulou & 73 Pentelis Avenue, 152 33, Chalandri, Athens, Greece

Phone: +30 210 6856400

Data Protection Officer (DPO) Email: [email protected]

Data Protection Contact Person: Panagiota Trantou

2. DATA WE COLLECT AND PROCESS

To serve you and provide our services and products in the best possible way, we collect the following categories of data:

Data provided directly by you: When you place a phone order, register on our website/app, or place an online order:

Full Name

Delivery address (Street, Number, Postal Code, Area, Floor)

Contact phone number (Landline or Mobile)

Email address

Tax information (VAT number, Tax Office, Profession), exclusively in the event you request a corporate invoice.

Date of birth (to verify age and for potential birthday offers).

Data collected automatically (Browsing Data): IP address, browser type, device type, operating system, and information collected via Cookies, used to improve your browsing experience and ensure the security of our systems.

Transaction and Payment Data: Order history and purchasing preferences. Clarification: Pizza Fan does not collect or store credit/debit card details. All electronic payments are processed through the secure environment of our collaborating banking institutions.

Protection of Minors: If you are under the age of 15, according to Greek Law (Law 4624/2019), you are required to have the consent of a parent or guardian before sharing any personal information with us.

Third-Party Links: Please note that our website may contain links to other websites. Our Company is not responsible for the privacy practices, data protection policies, or content of these third-party websites.

3. PURPOSES OF PROCESSING & LEGAL BASES

We process your personal data only when there is a corresponding legal basis, for the following purposes:

A. Performance of a Contract (Article 6(1)(b) GDPR):

Receiving, preparing, managing, and delivering your order.

Communicating with you regarding the progress of your order, clarifications, or delivery issues. (Without collecting this data, we cannot provide our services).

B. Legitimate Interest of the Company (Article 6(1)(f) GDPR):

Fraud prevention and detection (e.g., telephone verification).

Ensuring the security of our IT systems and networks.

Customer service and complaint management (including the recording of calls).

Statistical analysis to improve our products, services, and menu.

C. Legal Obligation (Article 6(1)(c) GDPR):

Compliance with tax legislation (e.g., retaining transaction records and invoices).

Responding to requests from state or law enforcement authorities.

D. Consent (Article 6(1)(a) GDPR):

Sending informational and promotional material (Newsletters, SMS, Viber) regarding offers, contests, and new products.

Organizing contests, giveaways, and events. (You may withdraw your consent at any time through your online profile or by clicking "Unsubscribe" in the messages you receive).

4. DATA SHARING & RECIPIENTS

Your data remains strictly confidential. To execute your order and operate our Company, your data may be shared with the following recipients, who are contractually bound to maintain confidentiality:

Franchisees, local store managers within the Pizza Fan network, and delivery drivers, exclusively for the preparation and delivery of your order.

IT service providers, web hosting providers, and technical support teams.

Communication management companies (SMS/Viber/Email providers) for sending updates (provided there is consent).

Collaborating companies or suppliers in the context of contests (only for winners, to deliver prizes—this will be explicitly stated in the specific contest terms).

Event organization companies (if you request a kids' party).

Legal, financial, or tax advisors of the Company.

Police, judicial, or other state authorities, if officially requested (e.g., via a prosecutor's order) or to defend our legal rights.

Data Transfers outside the EEA: In the event that data is transferred to service providers outside the European Economic Area (e.g., Cloud services), Pizza Fan ensures that the transfer is safeguarded by appropriate measures, such as the Standard Contractual Clauses (SCCs) approved by the European Commission.

5. DATA RETENTION PERIOD

Your data is securely stored in Pizza Fan’s databases for 5 years following your last transaction with the Company (e.g., your last order).

Exceptions to the above rule include the following cases:

Tax documents (invoices, receipts) are retained for the period mandated by applicable tax legislation (usually 10+ years).

If processing is based on your consent (e.g., Marketing), data is retained until you withdraw your consent (opt-out).

In the event of a legal dispute, data will be retained until the irrevocable resolution of the dispute.

Pizza Fan strictly applies encryption methods, access controls, and modern firewalls to prevent unauthorized access to your data.

6. YOUR RIGHTS

Regarding the processing of your personal data, you have the following rights:

Right of Access: To know what data we hold about you, why, and to request a copy.

Right to Rectification: To request the correction of inaccurate or the completion of incomplete data (you can also do this yourself via your profile on our website/app).

Right to Erasure ("Right to be Forgotten"): To request the deletion of your data if it is no longer necessary or if you withdraw your consent (provided there is no overriding legal obligation for us to retain it).

Right to Restriction of Processing: When the accuracy of the data or the legality of the processing is contested.

Right to Object: To object to the processing of your data, particularly when done for Direct Marketing purposes or based on our legitimate interest.

Right to Data Portability: To receive your data in a structured, commonly used, and machine-readable format, or request its transfer to another provider.

Right to Withdraw Consent: To withdraw your previously given consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of the above rights, or for any questions/complaints, you may directly contact our Data Protection Officer (DPO) via email at: [email protected].

7. RECORDING OF TELEPHONE CALLS

Pizza Fan may record incoming and outgoing phone calls at our call center (210 6856400). The recording is always preceded by an automated audio notification informing the caller, in accordance with the law.

Purpose of recording: Proof of a commercial transaction (accurate order taking), quality assurance of our customer service (staff training), and the protection of legitimate interests (resolving complaints/disputes).

Access & Retention: Recorded call data is not shared with third parties, except with competent Judicial/Police authorities upon official request. Recordings are retained for a limited period and are subsequently automatically deleted.

Upon a written request to [email protected], provided the call is still stored, you may be provided with a transcript of the conversation concerning you.

8. COOKIES POLICY

For the proper functioning of our website and Mobile App, we use technologies such as Cookies. We provide you with the ability to manage your preferences and choose which Cookies you accept. For more details, please visit our Company's [Cookies Policy].

9. RIGHT TO LODGE A COMPLAINT WITH THE SUPERVISORY AUTHORITY

If you believe that your rights regarding the protection of your personal data have been violated, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA):

Postal Address: 1-3 Kifissias Ave., 115 23, Athens, Greece

Phone: +30 210 6475600

Email: [email protected]

Website: www.dpa.gr

10. CHANGES TO THE PRIVACY POLICY

Our Company reserves the right to modify or update this Policy to comply with changes in the legislative framework or in the event of upgrades to our services. Any modifications will be immediately posted on our website (www.pizzafan.gr). We encourage you to regularly review this policy to stay informed about how your data is protected.