Privacy policy
Last updated: October 2026
This Privacy Policy explains how MARIA CHRONI CHRISTOS CHRONIS I.K.E., trading as CALYSSA, collects, uses, stores and protects personal data when you visit calyssaskincare.com, create an account, place an order, contact us, subscribe to marketing communications or otherwise interact with our online store.
CALYSSA processes personal data in accordance with applicable data-protection legislation, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Greek law.
1. Data Controller
The data controller is:
MARIA CHRONI CHRISTOS CHRONIS I.K.E.
Trading as: CALYSSA
Registered office: Onia, Kefalos, Kos, Greece 85301
G.E.M.I. No.: 174341620000
VAT No.: 802324409
Tax Office: DOY Kos
Email: hello@calyssaskincare.com
Telephone: +30 698 347 1978
For questions concerning this Privacy Policy or the processing of your personal data, please contact us using the details above.
2. Personal Data We Collect
Depending on how you use the website, we may collect the following categories of personal data:
Identity and contact information, including your name, billing address, delivery address, email address and telephone number.
Order and transaction information, including products purchased, order history, payment status, refunds and delivery information.
Payment-related information. Payments are processed through authorised payment service providers. CALYSSA generally does not receive or store full payment-card details.
Account information, where customer accounts are enabled.
Communications, including emails, customer-service enquiries, complaints, return requests and other correspondence with us.
Marketing information, including newsletter subscriptions, marketing preferences and interaction with promotional communications.
Technical information, including IP address, browser type, device information, operating system, website activity, cookies and similar identifiers.
Analytics and usage information, such as pages viewed, interactions with the website, referral information and shopping behaviour.
3. How We Collect Personal Data
We may collect personal data:
- directly from you when you provide information to us;
- automatically through cookies and similar technologies;
- through Shopify and other service providers used to operate the store;
- from payment providers, delivery companies and other business partners where necessary to fulfil an order;
- through marketing or social-media platforms where legally permitted.
4. Purposes and Legal Bases for Processing
We process personal data only where we have an appropriate legal basis under the GDPR.
Processing and fulfilling orders
We use your personal data to process payments, fulfil orders, arrange delivery, provide order notifications and manage returns or refunds.
Legal basis: performance of a contract or steps taken at your request before entering into a contract.
Customer service
We use your information to respond to enquiries, complaints, return requests and other communications.
Legal basis: performance of a contract and/or our legitimate interests in providing customer support and operating our business.
Legal and regulatory compliance
We may process and retain information where necessary to comply with tax, accounting, consumer-protection, product-safety or other legal obligations.
Legal basis: compliance with a legal obligation.
Fraud prevention and security
We may process information to protect our website, customers and business against fraud, misuse, unauthorised access and other security risks.
Legal basis: our legitimate interests in protecting our business and users.
Marketing communications
Where required by law, we will obtain your consent before sending electronic marketing communications.
You may withdraw your consent or unsubscribe from marketing communications at any time.
Legal basis: consent, or another lawful basis where expressly permitted by applicable law.
Analytics and non-essential tracking
Where required, analytics, advertising or similar non-essential technologies are used only after obtaining appropriate consent through the website’s cookie-consent mechanism.
Legal basis: consent where legally required.
5. Shopify
Our online store is hosted using Shopify.
Shopify processes certain personal data on our behalf and may also process information in accordance with its own privacy documentation.
Shopify provides the technical infrastructure required to operate the online store, process customer interactions and support ecommerce functionality.
6. Payment Providers
Payments may be processed through third-party payment providers made available through the store.
These providers may process personal and payment information necessary to authorise and complete transactions, prevent fraud and comply with legal obligations.
Their processing may also be governed by their own privacy policies.
7. Delivery and Logistics Providers
Where necessary to fulfil an order, we may share relevant information with courier, parcel-locker, fulfilment or logistics providers.
The information shared will generally be limited to what is necessary to deliver your order, such as your name, delivery address, telephone number, email address and shipment information.
8. Other Service Providers
We may use third-party service providers for functions including:
- website hosting and ecommerce infrastructure;
- payment processing;
- order fulfilment and delivery;
- email communications;
- analytics;
- marketing;
- website security;
- customer support;
- accounting and legal compliance.
These providers receive access only to information reasonably necessary to perform their services and are required to process personal data in accordance with applicable law.
9. Cookies and Similar Technologies
Our website uses cookies and similar technologies.
Some cookies are necessary for the operation of the website, shopping cart, checkout and security functions.
Other cookies may be used for analytics, advertising, personalisation or measurement.
Where consent is required by law, non-essential cookies will not be activated until you make the relevant choice through the cookie-consent mechanism.
You may change or withdraw your cookie preferences where the website provides this functionality.
10. International Transfers
Some of our service providers may process personal data outside the European Economic Area.
Where personal data is transferred internationally, we take reasonable steps to ensure that an appropriate transfer mechanism is used where required, such as:
- an adequacy decision issued by the European Commission;
- Standard Contractual Clauses;
- another lawful transfer mechanism recognised under the GDPR.
11. Data Retention
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and to meet legal, accounting, tax, consumer-protection, fraud-prevention and regulatory obligations.
Order and transaction records may therefore be retained for the period required under applicable tax and commercial legislation.
Marketing information will generally be retained until you unsubscribe, withdraw consent or we determine that continued retention is no longer appropriate.
Retention periods may vary depending on the category of data and the legal obligations applicable to us.
12. Your Rights
Subject to the conditions and limitations provided by applicable law, you may have the right to:
- request access to your personal data;
- request correction of inaccurate or incomplete personal data;
- request deletion of personal data;
- request restriction of processing;
- object to certain processing;
- receive certain personal data in a portable format;
- withdraw consent at any time where processing is based on consent;
- object to direct marketing at any time;
- lodge a complaint with a competent supervisory authority.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Requests may be sent to:
We may need to verify your identity before responding to a request.
13. Complaints
If you have concerns about how CALYSSA processes your personal data, please contact us first so that we can investigate the matter.
You also have the right to lodge a complaint with the competent data-protection supervisory authority.
In Greece, the supervisory authority is the Hellenic Data Protection Authority.
14. Marketing Communications
If you subscribe to our newsletter or other marketing communications, we may use your contact information to send you information about CALYSSA products, launches, promotions or other brand communications.
You may unsubscribe at any time using the unsubscribe link contained in the relevant communication or by contacting us.
Withdrawal from marketing communications does not affect transactional communications relating to orders, payments, deliveries, returns or customer-service matters.
15. Children
The CALYSSA online store is not directed specifically at children.
We do not knowingly seek to collect personal data from children for marketing purposes without an appropriate lawful basis or any consent required under applicable law.
If we become aware that personal data relating to a child has been collected improperly, we will take appropriate steps to address the situation.
16. Security
We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, alteration, loss, misuse or disclosure.
However, no internet-based service can guarantee absolute security.
Customers are responsible for keeping any account credentials confidential.
17. Automated Tools and Personalisation
Certain ecommerce, fraud-prevention, analytics, recommendation or marketing tools may use automated processing to assist with the operation of the website.
Where automated processing produces legal or similarly significant effects, applicable GDPR rights and safeguards will be respected.
CALYSSA does not currently intend to make significant decisions about customers solely through automated processing without appropriate safeguards.
18. Third-Party Links
Our website may contain links to third-party websites or platforms.
CALYSSA is not responsible for the privacy practices of independent third parties.
We recommend reviewing the relevant privacy policies before providing personal information to another website or service.
19. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in law, technology, service providers or our business practices.
The latest version will be published on this website together with the relevant “Last updated” date.
20. Contact
For privacy-related questions, requests or complaints, contact:
CALYSSA
MARIA CHRONI CHRISTOS CHRONIS I.K.E.
Onia, Kefalos, Kos, Greece 85301
G.E.M.I.: 174341620000
VAT No.: 802324409
Email: hello@calyssaskincare.com
Telephone: +30 698 347 1978