PRIVACY POLICY

Last updated: October 1, 2026

ZOEL respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how CHATZIDIMITRIOU THEODORA DIMITRIOS, trading as ZOEL, collects, uses, stores and otherwise processes personal data when you visit our website, place an order, contact us or otherwise interact with our online store.

Our website is operated using Shopify, which provides the e-commerce platform that enables us to offer our products and services online.

This Privacy Policy applies to personal data processed through our website, including information provided when you browse the website, create an account, place an order, contact us, subscribe to communications or otherwise interact with ZOEL.

---

1. DATA CONTROLLER

The controller responsible for your personal data is:

CHATZIDIMITRIOU THEODORA DIMITRIOS
Trading as: ZOEL
Metron 8
17123 Nea Smyrni
Athens, Greece

VAT Number: EL052610950
Telephone: +30 210 932 3107
Email: info@zoelbags.com
Additional email: zoelbags@gmail.com

GEMI Registration Number: [TO BE ADDED]

Unless otherwise stated in this Privacy Policy, ZOEL is the controller of the personal data collected through our website and used for our own business purposes.

---

2. PERSONAL DATA WE COLLECT

Depending on how you interact with our website and Services, we may collect and process the following categories of personal data.

A. Contact and identification information

This may include:

• first and last name;

• email address;

• telephone number;

• billing address;

• shipping address; and

• other contact details you provide to us.

B. Order and transaction information

This may include:

• products purchased;

• order number;

• order history;

• returns and refunds;

• delivery information;

• billing information;

• payment status;

• transaction details; and

• communications concerning your order.

C. Payment information

Payments may be processed through third-party payment providers.

Depending on the payment method you use, payment providers may process payment card or other financial information.

Where payment is processed by a third-party payment provider, ZOEL does not normally receive or store your complete payment card details.

D. Account information

If you create an account, we may process information such as:

• username;

• account details;

• login-related information;

• saved addresses;

• preferences; and

• other information associated with your account.

E. Communications

If you contact us by email, telephone, contact form or another communication channel, we may process the information contained in your communication, including your contact details and the content of your message.

F. Technical and usage information

When you visit our website, certain technical information may be collected automatically, depending on your browser, device and our privacy/cookie settings.

This may include:

• IP address;

• browser type;

• device type;

• operating system;

• approximate location derived from technical information;

• pages visited;

• interactions with the website;

• referring website;

• date and time of visits; and

• other technical information necessary for the operation and security of the website.

The collection of information through cookies and similar technologies is described further in our cookie settings and, where applicable, our Cookie Policy.

---

3. HOW WE COLLECT PERSONAL DATA

We may collect personal data:

• directly from you when you place an order;

• when you create or use an account;

• when you contact us;

• when you subscribe to marketing communications;

• automatically through our website and cookies or similar technologies;

• through Shopify and other service providers that support our online store; and

• from third parties where this is permitted by applicable law.

---

4. WHY WE USE YOUR PERSONAL DATA

We use personal data only for purposes that are lawful and relevant to our business.

A. Processing and fulfilling orders

We process personal data in order to:

• receive and process orders;

• confirm purchases;

• prepare and manufacture products;

• arrange payment;

• arrange shipping and delivery;

• process returns and refunds;

• provide customer support; and

• communicate with you concerning your order.

The legal basis for this processing is generally the performance of a contract with you or taking steps at your request before entering into a contract.

B. Customer service and communication

We use your information to respond to questions, complaints, requests and other communications.

The legal basis may be performance of a contract, legitimate interests, or another applicable legal basis depending on the circumstances.

C. Legal and accounting obligations

We may process personal data where necessary to:

• comply with tax and accounting obligations;

• maintain required business records;

• comply with legal requirements;

• respond to lawful requests from public authorities; or

• establish, exercise or defend legal claims.

The legal basis for this processing is generally compliance with a legal obligation or, where applicable, our legitimate interests.

D. Security and fraud prevention

We may process personal data to:

• protect our website;

• prevent fraud;

• detect unauthorized transactions;

• protect our customers and business;

• investigate suspected unlawful activity; and

• maintain the security of our systems.

The legal basis is generally our legitimate interests in protecting our business, customers and systems, subject to applicable law.

E. Marketing

Where permitted by applicable law, we may use your personal data to send information about our products, collections, promotions or other marketing communications.

Where consent is legally required, we will obtain your consent before sending such communications.

You may unsubscribe from marketing communications at any time by using the unsubscribe mechanism included in the relevant communication or by contacting us.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

F. Website improvement and analytics

Where applicable and subject to our cookie and privacy settings, we may process technical or usage information to understand how visitors use our website, improve functionality and measure the performance of our Services.

Where consent is required for non-essential cookies or similar technologies, we will request consent before activating them.

---

5. LEGAL BASES FOR PROCESSING

Depending on the circumstances, we rely on one or more of the following legal bases under applicable data protection law:

• Performance of a contract – for example, processing an order and delivering your purchase.

• Legal obligation – for example, accounting, tax and legally required record-keeping.

• Legitimate interests – for example, website security, fraud prevention, customer support and protecting our legal rights, where our interests are not overridden by your fundamental rights and freedoms.

• Consent – where applicable, for example certain marketing communications or non-essential cookies.

We do not rely on consent where another lawful basis is applicable and sufficient.

---

6. WHO MAY RECEIVE YOUR PERSONAL DATA

We may share personal data with service providers and other recipients where this is necessary for the purposes described in this Privacy Policy.

These may include:

Shopify

Our online store is hosted on Shopify.

Shopify processes personal data in connection with providing its platform and related services.

Depending on the Shopify services and features enabled on our store, Shopify may act as our processor or may process certain information for its own purposes as described in Shopify's applicable privacy documentation.

You can learn more about Shopify's processing of personal data through Shopify's Consumer Privacy Policy and Data Processing Addendum.

Payment providers

Payment providers may process payment and transaction information in order to securely process your payment.

Shipping and courier providers

We may provide your name, address, telephone number and other necessary information to courier or shipping providers so that your order can be delivered.

Technology and service providers

We may use third-party providers for services such as:

• website hosting and technical support;

• email communications;

• customer support;

• analytics;

• security;

• fraud prevention;

• accounting; and

• other services necessary to operate our business.

These providers may process personal data only as necessary to provide their services to us or where otherwise permitted by applicable law.

Public authorities and professional advisers

We may disclose personal data where required by law or where necessary to establish, exercise or defend legal claims, including to public authorities, lawyers, accountants or other professional advisers.

---

7. SHOPIFY AND INTERNATIONAL DATA TRANSFERS

Our store is powered by Shopify.

Depending on the services and features used by our store, personal data may be processed or transferred to countries outside the European Economic Area.

Where personal data is transferred outside the EEA, we will rely on appropriate safeguards required by applicable data protection law, such as an adequacy decision or appropriate contractual safeguards where applicable.

Shopify provides information about its international data processing and data protection measures in its own privacy documentation.

If Shopify's enhanced services or Network Intelligence features are enabled on our store, additional data processing may apply. In that case, the relevant Shopify disclosures and customer controls will also apply.

Shopify itself notes that merchants are responsible for configuring their stores and privacy settings appropriately for GDPR compliance.

---

8. COOKIES AND SIMILAR TECHNOLOGIES

Our website may use cookies and similar technologies.

Some cookies are necessary for the operation, security and functionality of the website.

Other cookies, such as certain analytics, advertising or personalization technologies, may require your consent depending on applicable law.

Where required, you will be able to manage your cookie preferences through the cookie consent mechanism provided on our website.

You can also adjust certain cookie settings through your browser.

Disabling certain cookies may affect the functionality of some parts of the website.

---

9. MARKETING COMMUNICATIONS

If you have subscribed to receive marketing communications, we may send you information about:

• new collections;

• products;

• promotions;

• special offers; and

• other ZOEL news.

Where consent is required, marketing communications will only be sent after obtaining the required consent.

You may unsubscribe at any time.

Transactional communications, such as order confirmations, shipping updates, refund notifications and other messages necessary to provide our Services, are not marketing communications and may continue even if you unsubscribe from promotional messages.

---

10. DATA RETENTION

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy.

The retention period depends on factors including:

• whether we need the information to provide our Services;

• whether there is an ongoing customer relationship;

• legal, tax or accounting obligations;

• the need to establish or defend legal claims;

• fraud prevention and security requirements; and

• applicable limitation periods.

When personal data is no longer required, we will delete it or securely anonymize it where reasonably possible, subject to applicable legal obligations.

---

11. YOUR RIGHTS UNDER THE GDPR

If the GDPR applies to you, you may have the following rights, subject to applicable legal conditions and exceptions:

Right of access

You may request confirmation as to whether we process your personal data and request access to that data.

Right to rectification

You may request correction of inaccurate or incomplete personal data.

Right to erasure

In certain circumstances, you may request deletion of your personal data.

Right to restriction

In certain circumstances, you may request that we restrict the processing of your personal data.

Right to object

You may object to certain processing based on legitimate interests.

You also have the right to object to direct marketing at any time.

Right to data portability

Where applicable, you may request to receive certain personal data in a structured, commonly used and machine-readable format and request its transmission to another controller.

Right to withdraw consent

Where we process your personal data on the basis of consent, you may withdraw your consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Right to lodge a complaint

You have the right to lodge a complaint with a competent data protection supervisory authority if you believe that your personal data has been processed unlawfully.

---

12. HOW TO EXERCISE YOUR RIGHTS

To exercise your privacy rights or ask questions about how we process your personal data, please contact us:

Email: info@zoelbags.com
Additional email: zoelbags@gmail.com
Telephone: +30 210 932 3107

Please provide enough information for us to identify you and understand your request.

We may need to verify your identity before processing certain requests.

We will respond within the time period required by applicable data protection law.

The GDPR requires organisations to provide information about processing and data-subject rights in clear and accessible language.

---

13. CHILDREN'S PRIVACY

Our website is intended for a general audience and is not specifically directed at children.

We do not knowingly collect personal data from children where such collection is prohibited by applicable law.

If you believe that a child has provided us with personal data unlawfully, please contact us so that we can review the matter and take appropriate action.

---

14. DATA SECURITY

We take reasonable technical and organisational measures to protect personal data against unauthorized access, loss, misuse, alteration or disclosure.

However, no method of transmission over the internet or method of electronic storage can be guaranteed to be completely secure.

---

15. THIRD-PARTY WEBSITES

Our website may contain links to third-party websites or services.

Those third parties operate independently from ZOEL and may have their own privacy policies.

We are not responsible for the privacy practices of third-party websites that we do not control.

We recommend reviewing the privacy policy of any third-party website before providing personal information.

---

16. DATA BREACHES

If a personal data breach occurs that requires notification under applicable law, we will take the appropriate steps required by law, including notifying the competent supervisory authority and affected individuals where legally required.

---

17. DATA PROTECTION OFFICER

ZOEL has not appointed a Data Protection Officer unless otherwise expressly stated.

For all privacy-related questions and requests, please contact us using the details in Section 12.

---

18. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect:

• changes to our business;

• changes to our website or services;

• changes to the technologies we use;

• changes to applicable laws or regulations; or

• changes to our data-processing practices.

The updated version will be published on this page and the “Last updated” date will be changed accordingly.

---

19. CONTACT

If you have any questions about this Privacy Policy or how ZOEL processes your personal data, please contact:

CHATZIDIMITRIOU THEODORA DIMITRIOS
ZOEL
Metron 8
17123 Nea Smyrni
Athens, Greece

VAT Number: EL052610950
Telephone: +30 210 932 3107
Email: info@zoelbags.com
Additional email: zoelbags@gmail.com

GEMI Registration Number: [TO BE ADDED]