PRIVACY POLICY

  1. PRIVACY POLICY
  2. INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA OF WEBSITE VISITORS
  1. Introduction

Through this Privacy Policy – Information Notice on the Processing of Personal Data of Website Visitors (hereinafter the “Policy”, “Privacy Policy”), our Company under the name “MENNE SA” (hereinafter the “Company”, “we”, “us”, “Data Controller”), respecting the privacy of the users and visitors of this website (hereinafter “visitors”, “you”, “your”) and remaining vigilant to ensure the security of their personal data, provides the necessary information and notice regarding the processing of personal data.

In order to make the manner of collection, use, processing and storage of personal data transparent, the Company encourages the visitors of its website and any interested party to read this Policy, in order to obtain the following information:

  1. Legislative framework

The processing of your personal data is governed by the relevant provisions of the applicable legislation in force for the protection of personal data (Law 4624/2019), the Directives and Regulations of the European Union (in particular the General Data Protection Regulation (EU) 2016/679 – GDPR, hereinafter the “GDPR”), as well as by the relevant decisions, guidelines and regulatory acts of the Hellenic Data Protection Authority, and is subject to the legal formalities and restrictions set out therein.

  1. Definitions
  • “Data subject” of personal data: The visitor of the website, the customer / consumer of the online store who places an order and purchases a product, the registered user, and any other natural person who comes into contact with our website.
  • “Personal data”: Any information that can directly or indirectly identify a natural person (the “Data subject”), such as full name, postal address, contact details (telephone, mobile), email address (e-mail), etc.
  • “Processing”: Any operation or set of operations performed with or without the use of automated means on personal data or sets of personal data, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data that have come or will come to the knowledge of the Company, either directly from you through the website, or in the context of your transactional relations with it.
  • “Data Controller”: The Company under the name “MENNE SA”, which determines the purposes and the means of processing personal data.
  • “Processor”: The natural or legal person, public authority, agency or other body that processes personal data on behalf of the data controller.
  • “Recipient”: The natural or legal person, public authority, agency or other body to which the personal data are disclosed, whether a third party or not.
  • “Third party”: any natural or legal person, public authority, agency or body other than the data subject, the data controller, the processor and the persons who, under the direct authority of the data controller or the processor, are authorised to process the personal data.
  • “Consent” of the data subject: any freely given, specific, explicit and informed indication of the data subject’s wishes by which the data subject, through a statement or a clear affirmative action, signifies agreement to the processing of personal data relating to them.
  • “Data Protection Officer” (DPO): The Data Protection Officer appointed by the Company, as Data Controller, who holds the position and carries out the duties defined by the applicable legislative framework on personal data protection.
  1. Personal data collected and processed, and lawfulness of processing (legal basis and purpose of processing)

We collect data and information that you provide to us upon entering and navigating the Company’s website, as well as when using our services.

  • Data we collect and cases of processing
    1. Upon your entry to the website, we collect:
  • IP address
  • Date and time of access
  • Geographic time zone
  • Operating system and its version
  • Browser and its version
  • Name of the terminal device and/or user

Purpose of processing: The provision of personalised services, proper functioning of the connection, ensuring the security and stability of the system.

Legal basis: The legitimate interest of the Company in making the website available to the public and providing services (Article 6(1)(f) GDPR).

When you communicate with us via e-mail, we collect:

E-mail address

Full name (where required)

Content of the message

Purpose of processing: Management, handling or resolution of your request, query or complaint.

Legal basis:

If the communication concerns an existing contract, the legal basis is the performance of the contract (Article 6(1)(b) GDPR).

In other cases, the processing is based on the legitimate interest of the Company in serving and providing services to the public (Article 6(1)(f) GDPR).

  1. The Company’s presence on Social Media

Our Company maintains official pages on social media, such as Facebook, Instagram and YouTube. Through this section, in conjunction with our Privacy Policy, we provide you with information regarding the processing of your personal data through these platforms.

Through social networks, we give you the ability to submit comments, send us messages and stay informed about our news. In these cases, joint Data Controllers of your personal data, in accordance with Article 26 GDPR, are both our Company and the respective administrator of each social media platform (Facebook, Instagram, etc.).

Due to the independent management of data by social media platforms, it is not always possible for us to have full knowledge of the type and extent of the data they process. However, we make every possible effort to design our pages in a way that ensures the protection of your personal data, in accordance with the capabilities provided to us by the platform administrators and the applicable legislative framework.

For more information regarding the processing of your personal data by the administrators of the social networks, you can refer to their respective privacy policies:

Facebook: www.facebook.com/privacy/explanation

Instagram: help.instagram.com/519522125107875

YouTube: www.youtube.com/yt/about/policies/

  • Purpose and Legal Basis of Processing

When you interact with us through social networks, the processing of your personal data is carried out for the purposes of serving you, such as responding to messages and comments.

When you communicate with us through the above media, the legal basis of the processing is the legitimate interest of our Company, in the context of serving you and managing your requests or queries (Article 6(1)(f) GDPR).

  1. Processing of special categories of personal data

Our Company does not process or collect, through its website, your “sensitive” personal data (special category data), such as data relating to your racial or ethnic origin, religious or philosophical beliefs, health data, or data concerning your sex life or sexual orientation, given that the above data are not necessary for us and the aforementioned purposes of processing.

The visitor of the website must refrain from providing, making available, disclosing, etc. special category personal data, whether concerning themselves and/or third parties. In the event that the provision of such data is identified, the data are immediately deleted in a secure and non-recoverable manner. The Company bears no responsibility for any provision and/or processing resulting from their acts and/or omissions, in breach of the above obligation.

  1. Data concerning minors

For the purposes of this Policy, minors are considered to be persons who have not completed the eighteenth (18th) year of their age. Our Company does not process, through its website, the personal data of minor persons. We reserve the right, in the event that we find that a minor person has provided, supplied, etc. their data to us without the consent of their legal representative, to delete such data. If you become aware that a minor person has provided their data to us without the consent of their legal representative, please contact us. If you are a parent or guardian and have become aware that your minor child has provided our Company with their personal data, please contact us immediately. On our part, if we become aware that personal data we process belong to a minor person, without the consent of their parent or guardian, the Company takes appropriate measures for the immediate deletion of such data and to avoid similar incidents in the future.

  1. Recipients of personal data

Our Company safeguards the confidential nature of your personal data and, as a rule, does not transmit them to any third (natural or legal) person, except when and in those cases where this is required and/or permitted by law. The data we collect from you in the context of our relationship are processed by:

  • the authorised and appropriately trained competent personnel of our Company, who are bound by confidentiality and secrecy clauses,
  • on a case-by-case basis, partners of our Company, to whom the Company, in accordance with Article 28 GDPR, assigns the execution of specific tasks on its behalf (processors) and with whom it has ensured GDPR-compliant processing for the protection of your data, through the signing of contracts and a commitment to maintaining adequate measures, in accordance with the relevant provisions of the GDPR (Articles 28, 32 GDPR), such as, indicatively but not exhaustively, cooperating transport companies for the delivery of your orders, third-party partners – technical companies in the context of website management and service provision, support of our applications, companies providing promotional services (e.g. sending newsletters, conducting customer surveys to evaluate the Company’s services),
  • public bodies and authorities, such as public services and bodies, independent regulatory authorities, the police, competent authorities, prosecutors, other administrative services, etc., when we are obliged to do so by the applicable legislative framework.
  1. Retention period of personal data

The retention of your personal data takes place for the specific aforementioned purposes and lasts for a reasonable period of time, with the aim of fulfilling each respective purpose (limitation of processing).

Your personal data are retained by our Company, as the case may be in printed and/or electronic form, throughout the duration of your contractual relationship with the Company and of the individual contractual commitments of the latter, depending on the nature thereof, taking into account the legal obligations of the Company and any legal claims that may be raised arising therefrom, so as, accordingly, to justify the retention period of the personal data.

In addition, as the case may be, data received and processed during the pre-contractual stage are retained for a period of five (5) years, subject to the applicable legislation, for an extension of this period.

In any case, the Company applies a maximum retention period for personal data of twenty (20) years, with the possibility of extending the above period in the event of a claim being raised or pending litigation or indication of an audit by public (tax, etc.) authorities.

In those cases where the processing of personal data is based on the consent provided, the data are retained by the Company for as long as is provided for by legislation, depending on the purpose and type of processing, including the legal obligation of the Company regarding retention.

  1. Technical and organisational measures

The Company takes all appropriate technical and organisational measures to safeguard technological and physical security, in accordance with the applicable legislation (Article 32 GDPR).

More generally, the Company exercises, as far as possible, due diligence in ensuring the integrity, confidentiality and availability of personal data. Thus, it remains ready for the valid and timely handling of a possible breach of personal data. To this end, it adopts, updates and applies appropriate internal Policies and Procedures, in line with good practices and international standards.

Furthermore, our Company maintains an up-to-date record of processing activities, with the information required by Article 30 GDPR, has appointed a Data Protection Officer (DPO), pursuant to Articles 37 et seq. GDPR, and trains and raises the awareness of its personnel on matters of security and protection of personal data.

  1. Collection of Cookies

For the proper functioning of this website, cookies are used. For more information regarding cookies, you can refer to our Company’s Cookies Policy, posted on our website.

  1. Your rights under the GDPR

As data subjects, you retain all your rights, as provided for in the applicable legislative framework on the protection of personal data, namely:

  • Right to transparent information and notice regarding the exercise of your rights (Articles 12, 13, 14 GDPR), before and during processing, i.e. the right to be informed about the processing of their personal data (as detailed in this Policy).
  • Right of access (Article 15 GDPR) to your personal data being processed by the Company, as Data Controller, i.e. the ability to know and obtain a copy of the data concerning you.
  • Right to rectification of inaccurate data and completion of incomplete data (Article 16 GDPR), i.e. the right to correct your details and information held by our Company.
  • Right to erasure of personal data / “right to be forgotten” (Article 17 GDPR). This right is subject to conditions and to the obligations and any legal claims of the Company for the retention of data, based on the provisions of the applicable legislation in force. A request for the erasure of some or all personal data may be satisfied under specific circumstances and subject to lawful grounds for retention and continuation of processing by the Company, and provided that the Company’s interests are not affected.
  • Right to restriction of processing of personal data where either the accuracy thereof is contested, or the processing is unlawful, or the purpose of the processing no longer exists, and provided that there is no lawful ground for the processing but the data cannot be deleted (Article 18 GDPR).
  • Right to data portability of personal data, i.e. you are entitled to request to receive your personal data in a structured, commonly used and machine-readable format, as well as to have them transmitted, under the lawful conditions and terms, to another controller, provided that this does not adversely affect the rights and freedoms of others, in accordance with the provisions of legislation (Article 20 GDPR).
  • Right to object to the processing of personal data, subject to the legal obligations of the Company or where the processing is carried out in the context of fulfilling an overriding legitimate interest of the Company, such as objection to profiling or to direct marketing (Article 21 GDPR).
  • Right to withdraw consent already given, which concerns the ability to withdraw consent at any time, for processing based on consent (Article 7(3) GDPR). It is noted that, in this case, the lawfulness of the processing of personal data is not affected by the withdrawal of consent, up to the point at which it was withdrawn.
  • Right to human intervention (Article 22 GDPR), i.e. the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or significantly affects them in a similar way. In these cases, the Company applies appropriate measures and safeguards to protect the rights, freedoms and legitimate interests of the data subject and provides them with the right to human intervention, so as to obtain clarifications and a reasoned response regarding the relevant decision, which was made in the context of the above evaluation.

You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement, if you consider that the processing of your personal data concerning you infringes the GDPR (Article 77 GDPR). The competent Supervisory Authority is the Hellenic Data Protection Authority (www.dpa.gr).

  • Manner of exercising your rights

Any request regarding your personal data and the exercise of your rights, in accordance with the provisions of the applicable legislative framework for the protection of personal data, should be addressed in writing, by completing the Rights Exercise Form posted on our website and sending it to the Data Protection Officer (DPO) appointed by our Company, at the email address: dpo@mennefoods.gr. You may also send it to our postal address or submit the request yourself in person, at the address of our Company. For your information, the role of the Data Protection Officer is purely advisory and consists of mediating between our Company and the data subjects.

Our Company undertakes to make every possible effort to take the required actions within thirty (30) days from the receipt of each request, unless the work involved in satisfying it is characterised by particularities and/or complexities, on the basis of which the Company reserves the right to extend the time period for completing the actions by an additional sixty (60) days. Of course, in this case, the data subject will be informed of the above extension within the thirty (30) day period.

  1. Specific declarations of the Company
  • The Company declares that it is not liable for any damage (direct, indirect, positive, consequential) that may be caused to the visitor in connection with the website or its use. The visitor is solely responsible for protecting their system from viruses and other malicious software.
  • This Policy may be amended at any time. The user will be informed of all significant changes, while the updated version will be posted on the website each time. For this reason, the visitor must keep informed and refer regularly to this Policy.
  • The Company will not make any other use of the visitor’s personal data for purposes other than those mentioned in this Policy, without prior notice and, where required, the visitor’s consent.
  • The user of the website, by reading this Policy, becomes aware of the above processing, which is in accordance with the applicable legislation for the protection of personal data, exclusively for the purposes mentioned above and for purposes compatible with them.

Last modified: December 2025