1. The Company

Spaghetti Lab O.E. is a company providing 3D printing services. The company also trades in consumable materials and operates an online store for the sale of such products. It was established in March 2026.

Based on the definition provided by the European General Data Protection Regulation and for the purposes of carrying out the required data protection procedures under this policy, the Data Controller is designated below.

We invite you to read this Privacy Policy carefully. Its purpose is to inform you fully and transparently about the types of data we collect, the way in which we collect it, the purposes for which it is processed, the retention period, as well as any recipients to whom it may be transferred.

For any additional questions or requests concerning the exercise of your rights, our company has appointed Thanasis Mitakos as the Contact Person, whom you may contact directly at 2317007620 and/or at spaghettilabskg@gmail.com.

2. What Personal Data Do We Collect?

The personal data you provide to us, namely your full name, postal address, postal code, prefecture/region, city, area, country, landline telephone number, email address, Tax Identification Number (AFM), Tax Office (DOY), and profession, are processed only when we have a lawful basis for doing so.

What are the lawful bases for processing your personal data?

The lawful bases for processing your personal data include:

(a) The provision of the services you request and wish to receive from us, such as purchasing products, designing an object, or providing a service, and consequently the performance of our contractual obligations in this regard.

(b) The safeguarding and protection of the legitimate interests of both you and our company. For this purpose, we use closed-circuit television systems (CCTV) and security cameras in order to protect the safety of individuals, materials, and premises.

(c) Compliance with a legal obligation, such as regulatory compliance for tax purposes.

(d) The consent you provide under the specific conditions established by the applicable legal framework, in order for you to receive updates regarding products, services, offers, etc. from our company or from third-party partner companies that process personal data in accordance with the applicable legal framework.

3. How and Why We Use Your Data

3.1. Sale of Products at Our Physical Store

In the case of purchasing our products through our physical store, the customer's full name, contact details (mobile telephone number), and email address may be collected and processed, with the latter being used to send an order confirmation. If you request delivery of the product to your premises, we will also request the necessary delivery details. Additional information is required only for the issuance of an invoice, where requested by the customer.

3.2. Website and Social Media Management

Products are displayed on our website and a contact form is available. Interested parties may enter their full name and email address.

When you visit our website solely for informational purposes, i.e. you do not create a personal account for potential orders or provide any of your personal data (e.g. through the contact form), the only data we collect are those transmitted by your browser to our server.

For those who wish to receive our news and updates, we collect and store your email address only when you provide your consent. You may unsubscribe at any time.

3.3. Processing of Online Orders

Personal data are also collected when you place an order through our e-shop, www.spaghettilab.gr.

For the completion of your order and/or the creation of an account, additional information may be requested; however, only the minimum information necessary for the conclusion and performance of the contract will be required. Such information is marked as a mandatory field.

The information contained in your account will be used to complete your order, and you may be required to provide certain additional information, such as payment method details, a different delivery address (optional), and information required for invoicing (Tax Identification Number, Tax Office, profession, company name), where necessary.

If you choose to create an account, a customer profile will be created in which all of the above information will be stored. You may delete your customer account at any time. Furthermore, by creating an account on our e-shop, you can edit your data and add or remove information.

This information will be used to make the order completion process easier each time you visit our e-shop and choose to remain logged in.

As part of the order completion process, some of this data is transferred to partner companies. Accordingly, data are transferred to courier and transport companies for the transportation and delivery of your goods. Transport companies may contact you to request clarification or to inform you about the delivery of your products.

In addition, data are transferred during the payment process to payment service providers (banks, Google Pay, Apple Pay). On our part, we use high-level security systems to prevent the leakage of data through malicious systems.

3.4. Supply of Materials and Products for Our Company

We collect, record, and store your company name, Tax Identification Number, address, contact details, and bank account numbers.

Your data are retained for as long as required under applicable tax legislation and are transferred to our company's accountant.

3.5. Safeguarding Legitimate Interests and Protection of Property

The CCTV system records images within the premises, and a copy of the recordings is retained for two months.

4. Principles We Adopt When Processing Your Data

All processing of personal data by our company complies with the following principles, satisfying the requirements of the General Data Protection Regulation and the national legal framework for data protection.

Accordingly, your personal data:

• Are processed lawfully, fairly, and transparently: "lawfulness, fairness and transparency".

• Are collected for specified, explicit, and legitimate purposes and are not further processed in a manner incompatible with those purposes: "purpose limitation".

• Are adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed: "data minimisation".

• Are accurate and, where necessary, kept up to date. We take all reasonable measures to ensure the prompt deletion or rectification of personal data that are inaccurate in relation to the purposes of processing: "accuracy".

• Are kept in a form which permits identification of you for no longer than is necessary for the purposes of processing, while appropriate technical and organisational measures are applied throughout the relevant period to safeguard your rights and freedoms: "storage limitation".

• Are processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organisational measures: "integrity and confidentiality".

5. Your Rights Regarding Your Personal Data

Every natural person whose rights are subject to processing by our company enjoys the following rights:

Right of Access: You have the right to be informed about and verify the lawfulness of the processing. Accordingly, you have the right to access your data and receive additional information concerning their processing.

Right to Rectification: You have the right to review, correct, update, or modify your personal data.

Right to Erasure: You have the right to request the deletion of your personal data when we process them on the basis of your consent or in order to protect our legitimate interests. In all other cases (including, indicatively, where there is a contract, a legal obligation to process personal data, or a matter of public interest), this right is subject to specific limitations or may not apply, depending on the circumstances.

Right to Restriction of Processing: You have the right to request restriction of the processing of your personal data in the following cases:

(a) when you contest the accuracy of the personal data, until their accuracy has been verified;

(b) when you object to the erasure of personal data and request restriction of their use instead of erasure;

(c) when the personal data are no longer necessary for the purposes of processing but are required by you for the establishment, exercise, or defence of legal claims; and

(d) when you have objected to the processing and verification is pending as to whether our legitimate grounds override the grounds on which you object to the processing.

Right to Object to Processing: You have the right to object at any time to the processing of your personal data in cases where, as described above, such processing is necessary for purposes of legitimate interests pursued by us as the Data Controller.

Right to Data Portability: You have the right to receive, free of charge, your personal data in a format that allows you to access, use, and process them using commonly used processing methods. You also have the right to request that, where technically feasible, we transmit your data directly to another Data Controller.

This right applies to data that you have provided to us and where the processing is carried out by automated means based on your consent or in performance of a relevant contract.

Right to Withdraw Consent: Finally, our company informs you that where processing is based on your consent, you have the right to withdraw your consent freely, without affecting the lawfulness of processing based on consent before its withdrawal.

To withdraw your consent, you may use the unsubscribe options by following (clicking) the relevant link contained in our electronic communications, or you may contact us at: spaghettilabskg@gmail.com.

To exercise the above rights, you may contact our Contact Person, Thanasis Mitakos, at 2317007620 or submit a request by email to spaghettilabskg@gmail.com.

In all cases, we will facilitate the exercise of your rights, unless we are unable to verify your identity, and always with due regard to the protection of your personal data.

We will respond to each request within one month. This period may be extended by up to two additional months where necessary, taking into account the complexity and number of requests. You will be informed of any such extension and the reasons for the delay.

Right to Lodge a Complaint with the Hellenic Data Protection Authority

You have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr):

Telephone: +30 210 6475600
Fax: +30 210 6475628
Email: contact@dpa.gr

6. Data Retention Period

The period for which data are stored is determined based on the following specific criteria, depending on the circumstances.

Where processing is required as a legal obligation under the applicable legal framework, your personal data will be stored for as long as required by the relevant provisions.

Where processing is carried out on the basis of a contract, your personal data will be stored for as long as necessary for the performance of the contract and for the establishment, exercise, and/or defence of legal claims arising from the contract.

7. Where Your Data Are Disclosed

As part of completing an order through our e-shop, our company transfers the data necessary for the completion of the order to cooperating companies.

Accordingly, data are transferred to transport and courier companies for the transportation and delivery of your goods.

These data may also be accessible to companies providing information technology support and marketing services for the e-shop. Our company ensures their protection through strict confidentiality requirements and continuous monitoring of the appropriate organisational measures implemented by these companies.

Your data may be transferred to partners who act as data processors on our behalf in order to perform the operations of our company. In all cases, appropriate measures are taken to ensure contractually the protection of such data and compliance with confidentiality and secrecy obligations.

Finally, data are transferred to payment service providers during the execution of payments. On our part, we use high-level security systems to prevent the leakage of data through malicious systems.

8. Personal Data Security

Our company implements appropriate technical and organisational measures with the aim of ensuring the secure processing of personal data and preventing accidental loss or destruction, as well as unauthorised and/or unlawful access to, use, modification, or disclosure of such data.

In any case, the nature of the internet and the fact that it is freely accessible to anyone means that it is not possible to guarantee that unauthorised third parties will never be able to breach the technical and organisational measures implemented, gain access to personal data, and potentially use such data for unauthorised and/or unlawful purposes.

9. Policy Updates

As we strive to continuously improve our services to you, we ensure that this policy is updated promptly whenever necessary.

It is important that you visit our website and stay informed of the latest updates, always checking the date of the latest revision.

Last updated: 28/05/2026