Privacypolicy.

1. Who is responsible for your data

The data controller is ΜΟΥΣΤΑΚΑΣ ΓΕΩΡΓΙΟΣ ΚΩΝΣΤΑΝΤΙΝΟΣ trading as G&E Signature Scents, VAT no. 133109418, tax office: Πτολεμαΐδας, 25ης Μαρτίου 81, 50200 Πτολεμαΐδα. You can contact us about anything in this policy at hello@gesignaturescents.com. We have not appointed a Data Protection Officer because we are not required to; the same address reaches the person responsible for data protection.

This policy covers visitors to this website, business applicants, customers and their staff, and people who contact us or subscribe to our updates. We sell to businesses; we process personal data of the individuals who act for them (owners, managers, buyers, accountants, delivery contacts).

2. What we collect

• Account and application data: your name, role, email, phone, password (stored only as a one-way hash by our authentication provider), business legal name, trading name, business type, VAT number (ΑΦΜ), tax office, activity description and registered address.
• VAT verification data: the result of an EU VIES check of your VAT number, including the registered name and address returned by the register, the date of the check and its status.
• Order and invoice data: items, quantities, delivery addresses and contacts, purchase order numbers, notes, prices and tax, invoice and payment status, shipment status, loyalty-point balance and history.
• Communications: messages sent through the contact form or by email, newsletter sign-ups and our replies.
• Technical data: IP address, browser and device information, pages visited and error logs, kept briefly for security and fault diagnosis.
• Consent records: your cookie choice, the time of the choice, a random identifier and your IP address, so we can show valid consent.
• We do not collect payment-card numbers. Card and bank payments are handled by our payment provider through the payment link we send you.

3. Why we use it and our legal bases

Under Article 6 GDPR we rely on the following legal bases:

• Performing a contract or taking steps at your request (Art. 6(1)(b)): reviewing your application, setting up and running your account, processing and delivering orders, issuing invoices, providing refill and support services.
• Legal obligations (Art. 6(1)(c)): tax and accounting records, e-invoicing (AADE myDATA), VAT verification for intra-EU supplies, responding to authorities, product-safety obligations.
• Legitimate interests (Art. 6(1)(f)): securing the website and preventing fraud and abuse, checking that applicants are genuine businesses, internal alerts about new applications and orders, improving the service, sending service messages and order-related reminders to existing business customers, and defending legal claims. Where we rely on this we have balanced it against your rights and expectations.