Privacy Policy

1. Who we are

Athens Florals is the international wedding and events platform of Elias Flower Designer by Giannis, a family atelier operating in Athens, Greece since 1971.

2. What data we collect

When you submit a brief or inquiry through this website, we collect the following personal data:

• Contact details: your name, email address, and (optionally) phone number.
• Event information: occasion type, event date, location, guest count, budget indication, and any details you choose to share about your vision.
• Technical data: IP address, browser type, device information, referring page — collected via standard web server logs and analytics cookies (see our Cookie Policy).

3. Why we collect it (lawful basis)

We process your data on the following lawful bases under GDPR Article 6:

• Consent (Art. 6(1)(a)): When you voluntarily submit a brief, you consent to us using your details to respond to your inquiry.
• Contract preparation (Art. 6(1)(b)): To provide the quotation, design consultation, and event planning services you have requested.
• Legitimate interest (Art. 6(1)(f)): For website analytics, fraud prevention, and improving our services.
• Legal obligation (Art. 6(1)(c)): For tax, accounting, and Greek regulatory reporting requirements.

4. How we use your data

• To respond personally to your inquiry, usually within 4–24 hours.
• To prepare quotes, mood boards, and event proposals.
• To coordinate with your wedding planner, venue, or vendors where relevant.
• To send invoices and process payments if you commission our services.
• To send follow-up communication about your event (never marketing, unless you explicitly opt in).

5. Who we share it with

We do not sell your personal data. Ever. We may share it only with:

• Service providers essential to delivering our work (e.g. couriers for floral delivery, sub-contracted florists on Greek islands executing on-site, our accountant).
• Website infrastructure providers: Formspree (form processing, US-based, GDPR-compliant), Netlify (hosting, US-based, GDPR-compliant), Google (analytics, EU data storage).
• Greek public authorities when required by law (tax authority, court orders).

Any international data transfer outside the EU/EEA is protected by Standard Contractual Clauses (SCCs) as approved by the European Commission.

6. How long we keep it

• Unanswered inquiries: 12 months, then deleted.
• Client records: 7 years after the event, per Greek tax law requirements.
• Analytics data: 26 months maximum, aggregated and anonymised.

7. Your rights under GDPR

You have the right to:

• Access — request a copy of the data we hold about you.
• Rectification — correct any inaccurate data.
• Erasure — request deletion ("right to be forgotten"), subject to legal retention obligations.
• Restriction — limit how we process your data.
• Portability — receive your data in a portable format.
• Objection — object to processing based on legitimate interest.
• Withdraw consent at any time (without affecting past lawful processing).
• Lodge a complaint with the Hellenic Data Protection Authority (HDPA).

To exercise any of these rights, email steka02@gmail.com. We will respond within 30 days as required by GDPR.

8. Security

We apply appropriate technical and organisational measures to protect your data — including HTTPS encryption, secure form submission, restricted access, and regular security review of our tools and hosting.

9. Children's data

We do not knowingly collect data from anyone under 16. Baptism and children's event briefs are always submitted by parents or guardians.

10. Changes to this policy

We may update this policy periodically. The "Last updated" date at the top will reflect the most recent change. Material changes will be communicated via email if we hold your contact details.

11. Contact us

See also our Cookie Policy and Terms & Conditions.