1. Introduction

This Privacy Policy describes how the eloop.gr platform collects, uses, stores, organises, transfers and generally processes the personal data of visitors, users, members, buyers, sellers and any other person who interacts with the platform.

This Policy applies to all processing of personal data carried out through:

• the eloop.gr website,
• registration, login and account features,
• listings and products,
• purchases and orders,
• messages between users,
• notifications and email communications,
• support requests,
• the platform's security and protection mechanisms,
• cookies and related technologies, in accordance with the Cookie Policy.

The platform is committed to processing personal data in accordance with the General Data Protection Regulation (GDPR), applicable Greek law and the principles of lawfulness, transparency, data minimisation and processing security.

---

2. Data Controller

The controller of personal data relating to the operation of eloop.gr is:

Youandme Trade LTD
Zisimopoulou 9, Glyfada
Tax ID: 996975873
Tax Office: FAE Piraeus 
Contact Telephone: 210 3007077
Email: Info@eloop.gr

The data controller is the natural or legal person who determines the purposes and means of processing personal data.

If a Data Protection Officer (DPO) has been appointed, their details may be added here:

Data Protection Officer (DPO): [name / contact email]

---

3. Who This Policy Applies To

This Privacy Policy applies, by way of example, to:

• website visitors,
• users who create an account,
• buyers,
• sellers,
• recipients of email notifications,
• persons who contact the platform,
• persons who submit support requests, reports or complaints,
• persons whose details may appear in connection with a transaction or lawful operation of the platform.

---

4. Categories of Personal Data We Collect

Depending on how the platform is used, eloop.gr may collect and process the following categories of data:

4.1 Account and Identification Data

This may include:

• full name or username,
• email,
• hashed password,
• profile information,
• a profile photograph or other information the user chooses to provide.

The existence of customer account, session and password reset flows is also evident from the system's structure.

4.2 Contact and Delivery Data

This may include:

• telephone number,
• address,
• city,
• country,
• recipient details,
• other shipping and contact details required for the transaction.

4.3 Listing and Seller Data

This may include:

• information relating to products and listings,
• product photographs,
• descriptions,
• prices,
• seller account details,
• review or reply information.

The platform includes seller reviews and seller review reports, which display, among other things, comments, IP addresses and user agents for moderation and report-management purposes.

4.4 Order and Transaction Data

This may include:

• order details,
• buyer and seller identifiers,
• shipping details,
• order status,
• reasons for cancellation,
• accounting or financial record information,
• information relating to disputes, returns or payouts.

The existence of order notifications, order emails, dispute emails and payment-ledger / order structures reflects the corresponding processing scope of the CMS.

4.5 Message and User-to-User Communication Data

The platform may process:

• message content,
• thread identifiers,
• message excerpts,
• communication metadata,
• attachments or related information, where applicable.

Your CMS expressly includes message notification / email flows for new messages.

4.6 Notification and Communication Preference Data

This may include:

• in-app notifications,
• email notification preferences,
• notification read / viewed status,
• event categories relating to orders, wishlists, system functions and other events.

The existence of notification records in the schema confirms this.

4.7 Technical and Security Data

This may include:

• IP address,
• user agent,
• session identifiers,
• device-related identifiers,
• browser information,
• access time,
• route / request metadata,
• security logs,
• anti-abuse / rate-limit / blocker entries.

The CMS contains session tables, password-reset data with IP/user_agent information, as well as front-end blocker / security counters & events.

4.8 Data from Cookies and Related Technologies

This may include:

• session data,
• consent choice,
• preference settings,
• technical identifiers,
• other data described in detail in the Cookie Policy.

---

5. How We Collect Data

We collect data:

• directly from the user when they register, log in, post a listing, buy, sell, send a message or contact the platform,
• automatically through the platform's technical systems, such as sessions, security logs, cookies and related identifiers,
• from actions carried out within the platform, such as orders, notifications, reviews and disputes,
• potentially from third-party payment, shipping or technical service providers, where required to provide the service.

---

6. Purposes of Personal Data Processing

The platform processes personal data for the following purposes:

6.1 Account Creation and Management

For:

• user registration,
• login,
• identification,
• password reset,
• account management,
• verification of email or other details.

6.2 Provision of Marketplace Services

For:

• displaying and managing listings,
• purchases and sales,
• checkout and order flows,
• shipments,
• communication between buyers and sellers,
• ratings and reviews,
• managing disputes, cancellations or returns.

6.3 Communication and Support

For:

• responding to support requests,
• sending service updates,
• sending email notifications relating to accounts, orders, sales, messages, disputes, payouts or other related events.

The existence of corresponding email templates in the system clearly reflects this.

6.4 Security, Fraud Prevention and Platform Protection

For:

• detecting suspicious activity,
• monitoring malicious actions,
• anti-abuse mechanisms,
• protecting accounts,
• investigating security incidents,
• maintaining internal logs and security evidence.

6.5 Compliance with Legal Obligations

For:

• compliance with tax, accounting and legal obligations,
• responding to lawful requests from authorities,
• establishing, exercising or defending legal claims.

6.6 Service Improvement and Operational Management

For:

• technical management of the platform,
• troubleshooting,
• monitoring stability and performance,
• improving marketplace features,
• statistical analysis where legally permitted.

---

7. Legal Bases for Processing

Depending on the circumstances, processing is based on one or more of the following legal bases under the GDPR:

• performance of a contract or taking steps prior to entering into a contract, where processing is necessary for registration, an account, an order, transaction-related communication or provision of a service,
• compliance with a legal obligation, where processing is required under tax, accounting or other legislation,
• legitimate interests of the data controller, particularly for security, fraud prevention, system protection, technical management, limited organisational monitoring and the defence of legal claims,
• consent, where required, such as for specific categories of cookies or other optional actions.

---

8. When the Platform Operates as a Marketplace

The eloop.gr platform operates as an online marketplace and provides technological infrastructure for transactions between users. In this context:

• the platform is the data controller for processing activities relating to the operation of the service itself, such as accounts, login, security, on-platform messages, order administration, notifications, dispute handling, logs and support,
• third-party sellers or professionals may act as independent data controllers for data they receive in connection with their own obligation to fulfil the sale or comply with the law,
• the platform may require third-party sellers to declare whether they act as traders or non-traders, as provided for online marketplaces under the EU consumer-protection framework.

---

9. Recipients to Whom We May Transfer Data

The platform may transfer personal data only where necessary and lawful, to categories of recipients such as:

• hosting, technical support and maintenance providers,
• email / transactional email providers,
• payment providers,
• transport / shipping providers,
• accountants, legal advisers or professional advisers,
• competent administrative, judicial or supervisory authorities, where required by law,
• other platform users, only to the extent required for the transaction or communication within the marketplace.

We do not transfer personal data to third parties for their own independent commercial purposes without an appropriate legal basis.

---

10. International Transfers

If providers outside the European Economic Area are used for technical or operational needs, the platform will ensure that any transfer of personal data is carried out subject to appropriate safeguards, in accordance with applicable data-protection law.

If no such transfers take place, the following may be expressly stated:
“The platform does not transfer personal data outside the EEA, unless this becomes necessary in the future and only subject to lawful safeguards.”

---

11. Data Retention Period

The platform retains personal data only for as long as necessary for the relevant processing purpose, unless a longer retention period is required by law.

By way of example:

• account data is retained while the account is active and for a reasonable period after its deletion, where required for security, the defence of claims or legal obligations,
• order and accounting-record data is retained for as long as required by tax and accounting legislation,
• password-reset data, sessions, security logs and anti-abuse records are retained for a limited and necessary period depending on the security purpose,
• data relating to disputes, reviews, reports or moderation actions may be retained for as long as required to examine complaints, protect the platform and establish, exercise or defend legal claims.

---

12. Data Security

The platform takes appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Such measures may include:

• controlled access to systems,
• account and password controls,
• hashed tokens for password resets,
• session handling,
• security logging,
• anti-abuse mechanisms,
• moderation and access controls,
• restricting access to only those who need it for a lawful purpose.

The existence of password-reset token hashes, sessions and blocker/security tables in the CMS is consistent with this operational reality.

---

13. Rights of the Data Subject

Every person whose data is processed by the platform may, subject to the conditions laid down by law, exercise the following rights:

• the right to be informed,
• the right of access,
• the right to rectification,
• the right to erasure,
• the right to restriction of processing,
• the right to object,
• the right to data portability,
• the right to withdraw consent, where processing is based on consent,
• the right to lodge a complaint with the competent supervisory authority.

The exercise of these rights may be subject to restrictions where processing is necessary for compliance with a legal obligation, for reasons of public interest, for the establishment/exercise/defence of legal claims or for the protection of other persons' rights.

---

14. How You Can Exercise Your Rights

To exercise any right relating to your personal data, you may contact the platform using the details provided below.

The platform may reasonably request additional identification information to ensure that the request comes from the correct person and to protect the data against unauthorised access.

---

15. Complaint to the Supervisory Authority

If you believe that the processing of your personal data violates applicable law, you have the right to lodge a complaint with the Hellenic Data Protection Authority (HDPA). National supervisory authorities in the EU are responsible for monitoring the application of the GDPR.

---

16. Minors' Data

The platform is not intended for use by persons who do not have the legal capacity to accept the Terms or enter into valid transactions under applicable law.

If it is determined that a minor's personal data has been collected in a manner that does not comply with the law or without the required involvement of a parent/guardian where necessary, the platform will take appropriate measures.

---

17. Cookies and Related Technologies

The use of cookies and similar technologies is described in detail in the platform's Cookie Policy.

Strictly necessary cookies are used to operate the service, while non-essential cookies, such as analytics or marketing cookies, are used only after consent has been obtained where required.

---

18. Amendments to the Privacy Policy

The platform reserves the right to amend this Privacy Policy at any time, particularly when:

• the platform's features change,
• new services are added,
• the legal or regulatory framework changes,
• technical providers or the processing structure change.

The version in force from time to time will be posted on the website and will take effect upon publication, unless otherwise stated.

---

19. Contact

For any matter relating to this Privacy Policy or to exercise your rights, you may contact the platform using the following details:

Email: Info@eloop.gr
Telephone: 210 3007077
Address: Zisimopoulou 9, Glyfada