Privacy Policy

At KERMA LTD (operating in the Republic of Cyprus and the Hellenic Republic), protecting your personal data is a foundational priority. This Privacy Policy outlines exactly how we collect, process, manage, and safeguard your personally identifiable information (PII) in absolute compliance with the General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679) and regional data protection authorities.

Data Collection and Lawfulness of Processing

We strictly process personal data under established legal bases as described by the GDPR:

• Contractual Necessity: For fulfilling your orders. When you place a commercial order, we collect essential data including your full name, shipping address, billing address, email, and telephone number to physically fulfill and dispatch heavy beverage cases and products to your location, and securely execute payment.
• Legal Obligation: To prevent the distribution of alcohol to underage individuals. We are legally mandated to verify your age under rigid national laws, notably the 2025 Greek legislation protecting minors. We process your date of birth, identity verification data, and potentially digitized forms of identification to establish explicit legal compliance.
• Legitimate Interests: To ensure cybersecurity and shield our platforms and users against credit card fraud, we process IP addresses, browser fingerprint details, and strictly monitor transactional history.
• Explicit Consent: Any supplementary data profiling for marketing, promotional newsletters regarding new imports, and targeted social media engagement requires your unambiguous, freely given opt-in at checkout.

Third-Party Sub-Processors and Ecosystem Integration

Modern fulfillment requires integration with trusted, heavily audited third parties. We are entirely transparent about any transmission of necessary data points:

• Payment Gateways: We partner with licensed, compliant service providers like JCC Payment Systems Ltd for processing transactions. Sensitive financial inputs are securely encrypted and tokenized. KERMA LTD does not permanently store your full credit card digits on our internal servers.
• Logistics and Fulfillment Platforms: To execute localized, rapid last-mile delivery protocols in urban areas, we coordinate with third-party logistics and gig-economy applications like Wolt and Foody. Only strictly necessary fulfillment logistics (specifically your name, delivery coordinates, and phone number) are shared to effectively finalize and close the delivery cycle. You must refer directly to the privacy directives of these respective providers regarding interactions originating directly from their apps.

Consumer Rights and Data Access Restrictions

The GDPR legally empowers you with comprehensive rights regarding your digital footprint:

• The Right of Access and Rectification: You possess the absolute right to request a complete record of all specific PII held by us. If your shipping, contact, or billing details are recorded inaccurately, you may require their immediate correction via our Data Subject Access Request (DSAR) protocol at info@kerma.gr.
• The Right to Erasure: You retain the explicit right to request permanent deletion of your profile. However, be aware that statutory tax and comprehensive accounting regulations obligate us to indefinitely retain distinct transactional procurement records for completed orders (usually 5 to 7 years depending on jurisdiction).
• The Right to Withdraw Consent: You have the absolute right to unconditionally withdraw your marketing consent without detriment at any time using automated unsubscribe links embedded directly within any of our promotional communications.