Last updated: 7 November 2026
This policy explains how L’Éclat Candles handles personal data when you visit leclat.gr, create an account, contact us or make a purchase.
1. Who is responsible for your data
The data controller for the online store is the business registered as “ΧΡΙΣΤΙΔΗΣ ΝΑΠΟΛΕΩΝ ΤΟΥ ΜΙΛΤΙΑΔΗ”, trading as L’Éclat Candles.
VAT number: 145582891
General Commercial Registry (GEMI) number: 192045302000
Address: 47 Aimilianou Grevenon, Nea Ionia, 14232, Greece.
Email: info@leclat.gr
Phone: 697 714 9433.
2. What data we collect
- Orders: full name, email, phone number, billing and delivery addresses, products, quantities, order value and information about payment and fulfilment. A business invoice may require a business name, VAT number and other necessary billing details.
- Customer account: registration and login details, saved addresses and order history linked to the account.
- Contact: contact details, message contents and any files you send us. Please do not send passwords, full payment card details or unrelated sensitive information.
- Technical data: IP address, device and browser information, operational and security logs, consent choices and cookie data, depending on your use and choices.
This information comes mainly from you and your use of the website. To fulfil an order, we may receive delivery or payment updates from the relevant partners. If you order a gift for someone else, we use their details only for delivery and related customer service; please inform them.
3. Why we use your data and on what legal basis
- Orders, delivery, customer service, returns and account management: performance of a contract or steps taken at your request before entering into a contract.
- Invoices and obligations towards competent authorities: compliance with legal obligations.
- Protecting the store and preventing abuse: legitimate interests in security, proper operation and the establishment or defence of legal claims, with respect for your rights.
- Optional cookies, analytics and embedded services: consent, where required, through the cookie settings.
- Newsletters or promotional emails: where there is an appropriate legal basis, such as your separate consent. Creating an account or placing an order does not by itself subscribe you to a newsletter.
Order confirmations, status updates and password setup or reset emails serve your transaction or account.
4. What information is required
Mandatory fields are needed for your order, enquiry or invoice. Without them, we may be unable to complete your request. Creating an account is optional: you can also order as a guest. Rejecting optional cookies does not prevent you from using the basket or making a purchase.
5. Who receives your data
Access is limited to people needed to operate the store and provide customer service. Depending on the service, data may be processed by:
- hosting and technical support providers, such as WordPress.com/Automattic and Jetpack services,
- our business email provider Papaki and email delivery services used by the store,
- carriers or courier companies for delivery, using the necessary recipient details,
- payment providers, when a corresponding method is used, and accounting partners for the relevant obligations,
- consent management services such as Complianz and external services you choose to enable, such as Google Maps,
- competent authorities, when disclosure is required by law.
We do not sell personal data. External websites opened through links, such as Instagram, TikTok and Google Maps, also apply their own privacy policies.
6. Processing outside the European Economic Area
Some technology providers, particularly Automattic and Google, have international infrastructure and may process data outside the EEA. Transfers are subject to GDPR requirements and applicable safeguards, such as an adequacy decision or standard contractual clauses, depending on the provider and transfer. You can request more information about the recipients and safeguards at info@leclat.gr. See also the Automattic policy and the Google policy.
7. How long we keep your data
Retention depends on the purpose and legal obligations: order and invoice details are kept for as long as necessary for fulfilment, tax obligations and handling legal claims. Account details are kept while you maintain your account, except for data that must be retained independently of account deletion. Correspondence is kept as long as needed to resolve your enquiry and any related obligations. Security logs are retained according to the risk and provider settings. Individual cookie durations are listed in the Cookie Policy. Deletion from backups follows their replacement cycle.
8. Cookies and privacy choices
We use cookies for essential functions and, depending on your choices, optional services. You can change or withdraw your consent using the Cookie settings button at the bottom of each page. For categories, providers and available descriptions, see the Cookie Policy.
9. Security
We use HTTPS, login protection mechanisms, security checks and backups. Access to data is granted according to service needs. No system is completely secure; choose a unique password and do not share it.
10. Your rights
Subject to GDPR conditions, you may request access, rectification, erasure, restriction or portability, or object to processing. Where processing is based on consent, you may withdraw it without affecting the lawfulness of earlier processing. Erasure does not cover data we are required to retain.
Send your request to info@leclat.gr. We may need reasonable confirmation of your identity. We normally respond within one month, with an extension where permitted by the GDPR and with appropriate notice.
You have the right to lodge a complaint with the Hellenic Data Protection Authority — www.dpa.gr.
11. Changes to this policy
This policy is updated when the store’s functions, providers or obligations change. The date of the latest update is shown at the beginning. For questions, contact us at info@leclat.gr.