We respect your privacy. This Policy explains which personal data we collect when you visit the website sofiaargiti.gr, book an appointment, contact us or visit us at the salon, for what purpose we use it, to whom we transfer it, for how long we keep it and what your rights are, in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and Greek Law 4624/2019.
1. Data controller
- Data controller
- Sofia Argiti, sole proprietorship “Salon By Sofia Argiti”
- Registered address
- Spyrou Merkouri 66, Athens 116 34 (Pangrati)
- Tax ID (AFM) / Tax office / GEMI no.
- 131559643 / KEFODE Attikis / 172110103000
- Phone
- 211 015 6616 · 211 015 6617
- E-mail for personal data matters
- info@sofiaargiti.gr (subject: “Personal data”)
The person responsible for any question or request concerning your personal data is Sofia Argiti, at the contact details above.
2. Which data we collect and from where
2.1 Online appointment booking. Full name, phone number, e-mail, service or services, stylist, date and time, any note you write, your acceptance of the booking terms (with date and time), as well as the transaction details (amount, payment status, transaction ID). Your card details are entered directly with the payment provider and never reach us.
2.2 Contact form. Full name, e-mail, phone number and your message.
2.3 Phone, WhatsApp, social media. Whatever you share with us when you contact us. In addition, if you have given us a mobile number for a booking or an order, we may send you WhatsApp updates that concern exclusively that booking or order (confirmation, reminder, change or cancellation, dispatch or pick-up). These messages are sent by our staff from the salon’s business WhatsApp account and contain no advertising. If you do not wish to receive them, let us know and we will contact you only by e-mail or phone. WhatsApp and social media are provided by third parties (Meta, TikTok), which also process your data in accordance with their own policies.
2.4 Client record. To give you a consistent result at every visit, we keep a history of your services and technical notes (e.g. colour formula, products and quantities, preferences).
2.5 Health information you tell us. Allergies or sensitivities, skin or scalp conditions, pregnancy or breastfeeding, medication — only if you tell us about them, so that we can carry out chemical services safely. By telling us, you give us your explicit consent to record them in your client record. You may ask for them to be deleted at any time.
2.6 Online shop (from the date it goes live). Order details, shipping and billing address, invoice details.
2.7 Automatically, while browsing. IP address, device and browser type, pages visited and time of visit, in the server log files, for security and technical operation. In addition, only if you accept it, aggregated browsing statistics through Google Analytics (pages visited, device type, approximate region, source you came from). For cookies, see the Cookie Policy.
2.8 Photographs and videos of our work. Only with your consent (see section 10).
2.9 Security cameras. Video (without sound) from the salon’s CCTV system (see section 11).
2.10 Newsletters. Your e-mail or phone number and your name, if you sign up to receive news and offers (see section 12).
3. Why we process it and on which legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Managing the booking, providing the service and communicating about the appointment (confirmation, reminder, changes, cancellation) by e-mail, phone or WhatsApp | Performance of a contract — Article 6(1)(b) |
| Collecting the online payment, issuing receipts and invoices, complying with tax and accounting obligations | Legal obligation — Article 6(1)(c) |
| Client record and technical notes for a consistent result at every visit | Performance of a contract and legitimate interest — Article 6(1)(b) and (f) |
| Recording health information you tell us, for the safe performance of chemical services | Explicit consent — Article 9(2)(a) |
| Replying to your messages and requests | Pre-contractual steps and legitimate interest — Article 6(1)(b) and (f) |
| Proof of acceptance of the booking terms, prevention of abusive bookings, establishment or defence of legal claims | Legitimate interest — Article 6(1)(f) |
| Security and technical operation of the website (logs) | Legitimate interest — Article 6(1)(f) |
| Traffic statistics for improving the website (Google Analytics) | Consent — Article 6(1)(a) GDPR and Article 4(5) of Greek Law 3471/2006 (may be withdrawn) |
| Publishing photographs of our work on the website and on social media | Consent — Article 6(1)(a) (may be withdrawn) |
| Newsletters and offers, if you sign up | Consent — Article 6(1)(a) (may be withdrawn); for existing clients, Article 11(3) of Greek Law 3471/2006 (with the right to object in every message) |
| CCTV for the safety of people and property on the salon premises | Legitimate interest — Article 6(1)(f) (Hellenic DPA Directive 1/2011) |
| Online shop orders, shipping, receipts and invoices, and order status updates by e-mail or WhatsApp | Performance of a contract and legal obligation — Article 6(1)(b) and (c) |
We do not make decisions by solely automated means, we do not create profiles, and we do not sell or pass on your data to third parties for their own advertising purposes.
4. Who receives your data
Your data is accessible to Sofia Argiti and the salon staff, to the extent required to serve you. In addition, your data is transferred, only as far as necessary, to:
- The hosting provider of our website, booking system and e-mail: ipapaki.gr — sole proprietorship of Emmanouil Chatzigeorgiadis, 41-45 Riga Feraiou St., 176 76 Kallithea, Greece (GEMI no. 193231301000), with servers in a data centre in Germany (within the EU). Booking and contact form data is stored in our own installation on these servers, and the confirmation and reminder e-mails are sent from there.
- The payment service provider: Stripe Payments Europe Ltd (Ireland) or Viva Payment Services S.A. (Greece) — the provider is shown at the payment step and processes your card details as an independent controller, in accordance with its own privacy policy.
- The newsletter sending system, if you have signed up, which acts as a processor on our behalf.
- The business’s accountant, for tax documents.
- Meta Platforms Ireland Ltd (WhatsApp), if you contact us via WhatsApp or we send you a WhatsApp update about your booking or order (see 2.3).
- Google Ireland Ltd, through the embedded Google Maps map on the Contact page, the reCAPTCHA service, which protects the contact form from automated abuse (spam), and, only with your consent, the Google Analytics statistics service, for which Google acts as a processor on our behalf.
- Public authorities, when required by law (e.g. tax or judicial authorities).
Partners that process data on our behalf are contractually bound as processors (Article 28 GDPR).
5. Transfers outside the EEA
As a rule, your data is stored and processed within the European Economic Area. When you use third-party services with infrastructure outside the EEA (e.g. Meta/WhatsApp, Google, Stripe), the transfer takes place with the safeguards of Chapter V GDPR, i.e. on the basis of an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework) or standard contractual clauses.
6. How long we keep it
- Booking data, client record and proof of acceptance of the terms: for as long as you are our client and up to 5 years after your last visit, i.e. the general limitation period for the related claims.
- Tax documents and transaction details: for as long as tax legislation requires (at least 5 years from the end of the year of issue).
- Health information you told us: as long as your client record, or until you withdraw your consent.
- Contact form messages: up to 12 months after our reply, unless a client relationship follows.
- Photographs of our work: until you withdraw your consent.
- Newsletter subscription: until you unsubscribe.
- Security camera footage: up to 15 days, unless an incident is recorded (see section 11).
- Google Analytics statistics: 14 months; your choice about analytics cookies is kept on your device for 12 months.
- Server log files: up to 12 months.
Once the above periods have elapsed, the data is deleted or anonymised, unless a pending dispute or audit requires it to be retained.
7. How we protect it
We take appropriate technical and organisational measures: an encrypted connection (HTTPS) across the whole website, access restricted to the people who need it, strong passwords and regular software updates, a firewall and backups. We do not store card details. In the event of a breach that may put your rights at risk, we will notify the Hellenic Data Protection Authority and, where required, you, in accordance with Articles 33 and 34 GDPR.
8. Your rights
You have the right: of access to your data and to obtain a copy; to rectification of inaccurate or incomplete data; to erasure, when there is no longer a reason to keep it; to restriction of processing; to portability of the data you gave us; to object to processing based on legitimate interest; and to withdraw your consent at any time, without affecting the lawfulness of the processing carried out beforehand.
To exercise your rights, send an e-mail to info@sofiaargiti.gr with the subject “Personal data”. We will reply within one month at the latest; if the request is complex, the deadline may be extended by two further months, and we will inform you. We may ask you for identification details, so that we do not disclose data to a third party. Erasure does not extend to data we are required to keep by law (e.g. tax documents) and does not change the terms of a booking that has already been completed.
If you believe that the processing of your data breaches the law, you have the right to lodge a complaint with the Hellenic Data Protection Authority (1-3 Kifissias Ave., 115 23 Athens, tel. +30 210 6475600, www.dpa.gr). We would appreciate it if you contacted us first, so that we can resolve the matter.
9. Minors
The website and online bookings are intended for adults. We do not knowingly collect data of minors through the website without the consent of a parent or guardian (Article 8 GDPR and Article 21 of Greek Law 4624/2019). Services to minors are provided in the presence of a parent or guardian, who also makes the booking.
10. Photographs and social media
Photographs or videos of our work in which you appear or are recognisable are published on the website and on our Instagram, Facebook and TikTok accounts only with your consent, which we ask for before taking them. You may withdraw it at any time, by e-mail or verbally at the salon, in which case we remove the material from our channels as soon as possible; we cannot, however, control copies that third parties may already have re-shared.
11. Security cameras
The salon premises are under video surveillance for the protection of people and property, on the basis of our legitimate interest and in accordance with Directive 1/2011 of the Hellenic Data Protection Authority. The cameras record video only, not sound, cover exclusively the entrance and working areas and not areas where privacy is reasonably expected. The presence of cameras is indicated by clearly visible signs at the entrances. The footage is kept for up to 15 days and is then deleted automatically, unless an incident is recorded, in which case the relevant excerpt is retained only for as long as its investigation requires and is handed over exclusively to the competent authorities. Only Sofia Argiti has access to the footage. You may request access to your image or its deletion, at the contact details in section 1, specifying the day and time.
12. Newsletters and offers
We send you news and offers (by e-mail, SMS or message) only if you have signed up, by your own explicit action — never via a pre-ticked box. To existing clients we may send updates about similar services, with the option to object (Article 11(3) of Greek Law 3471/2006). Every message contains an unsubscribe link or instruction; you can also unsubscribe by e-mail to info@sofiaargiti.gr. Unsubscribing takes effect immediately and does not affect your bookings.
13. Cookies
The website uses the cookies that are necessary for it to work, Google’s cookies through the embedded map and the reCAPTCHA service and, only with your consent, analytics cookies (Google Analytics), as described in the Cookie Policy. You can change your choice at any time via the “Cookie settings” link at the bottom of every page. We do not use advertising cookies.
14. Changes to this Policy
This Policy may be updated. The current version is always posted on the website, with the date of the last update. We will inform you of material changes that affect you in an appropriate way.