Privacy Policy
Last Updated: 4 November 2026
This Privacy Policy explains how PACK THEORY collects, uses, stores and protects personal data when you visit or use packtheory.org, place an order, create an account, contact us, take part in our live streams or otherwise interact with us.
PACK THEORY processes personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Greek legislation.
1. Data Controller
PACK THEORY · Makedonias, Thesi Bourntzes, Keratea 19001, Greece · VAT EL147781330 · GEMI No. 196511101000 · Email: info@packtheory.org · Telephone: +30 695 581 7940 · Website: packtheory.org
For any privacy question, contact info@packtheory.org.
2. Personal Data We Collect
Order information: full name, billing and delivery address, email address, telephone number, order details, products purchased, order value, payment status, shipping and tracking information.
Account information: name, email address, login information, saved addresses, order history and account preferences.
Communication information: your name, email address, telephone number, message content and any information you provide with your request.
Technical information: IP address, browser type, device and operating system, pages visited, usage information, technical logs and information collected through cookies.
3. How We Use Personal Data
We use personal data to process and fulfil orders, process payments, arrange deliveries, provide customer support, manage customer accounts, handle returns and refunds, communicate about orders, prevent fraud and abuse, keep the website secure, improve our website and services, comply with accounting, tax and legal obligations, and send marketing communications where you have given consent.
4. Legal Bases for Processing
Contract: where processing is necessary to fulfil an order or provide a service you requested.
Legal obligation: where processing is necessary to comply with legal, tax, accounting or regulatory obligations.
Legitimate interests: fraud prevention, website security, protecting our business, responding to enquiries and improving our services. We balance these interests against your rights and freedoms.
Consent: for marketing emails and non-essential cookies. You may withdraw consent at any time.
5. Payment Information
Payments are processed by our payment provider. PACK THEORY does not store complete payment card details on its own systems. The payment provider processes your data under its own privacy policy.
6. Shipping and Delivery
To deliver your order, we share with the courier the information necessary for delivery: recipient name, delivery address, telephone number, email address and shipment details.
7. Service Providers
The main service providers that process personal data on our behalf are:
| Service | Provider |
|---|---|
| Website hosting and e-commerce | Netlify (website hosting); Supabase (database and customer accounts) |
| Payment processing | myPOS |
| Shipping and delivery | ELTA Courier, ACS Courier and Skroutz Last Mile (the courier for your order is named in your shipping confirmation) |
| Email newsletter | Brevo (newsletter and order emails) |
| Website analytics (only with your consent) | Google Analytics |
| Live streaming | Instagram (Meta) |
We use appropriate contractual and organisational safeguards with providers that process data on our behalf.
8. Marketing Communications
We send marketing emails only to people who have given consent. You can unsubscribe at any time using the link in each email or by contacting info@packtheory.org. Unsubscribing does not affect emails necessary to fulfil your orders.
9. Live Streams
We run live streams on Instagram and share clips on Instagram, Facebook and TikTok. If you take part in a live stream, your platform username and comments may be visible during the stream and in recordings or clips we publish. Instagram (Meta) processes your account data under its own privacy policy. If you would prefer that your username is not shown in a clip we publish, contact us and we will remove or blur it.
10. Cookies
We use cookies for website functionality, shopping carts, preferences, security and, with your consent, analytics and marketing. See our Cookie Policy for details.
11. Data Retention
| Data | How long we keep it |
|---|---|
| Orders, invoices and payment records | For the period required by Greek tax and accounting law |
| Customer account | Until you delete your account, then as required for orders above |
| Customer support messages | Up to 2 years after the matter is resolved |
| Newsletter subscription | Until you unsubscribe |
| Analytics and marketing cookies | As stated in our Cookie Policy |
When data is no longer needed, we delete or anonymise it.
12. Data Security
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, disclosure and destruction. No internet transmission or storage system can be guaranteed to be completely secure.
13. Your Rights
You have the right to access your personal data, correct inaccurate data, request deletion, restrict processing, object to processing, receive your data in a portable format, and withdraw consent where processing is based on consent. To exercise a right, contact info@packtheory.org. We may need to verify your identity.
14. Right to Lodge a Complaint
If you believe your personal data has been processed unlawfully, you may lodge a complaint with the Hellenic Data Protection Authority (HDPA), Kifisias Avenue 1-3, 115 23 Athens, Greece · www.dpa.gr. You may also seek judicial remedies.
15. Children's Privacy
Our shop sells products that are popular with younger collectors, but orders must be placed by adults or with parental consent (see our Terms & Conditions). You must be at least 15 years old to subscribe to our newsletter or give consent to non-essential cookies yourself; below that age, consent must be given by a parent or legal guardian. If you believe that a child has given us personal data without the required consent, contact info@packtheory.org and we will delete it.
16. International Data Transfers
Some service providers may process personal data outside the European Economic Area. In that case, we apply the safeguards required by the GDPR, such as the European Commission's Standard Contractual Clauses.
17. Third-Party Websites
Our website contains links to third-party websites and services, such as Instagram and Facebook. PACK THEORY is not responsible for their privacy practices; please review their privacy policies.
18. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our services, legal requirements or data practices. The current version will always be published on our website with its Last Updated date.
19. Contact
PACK THEORY · Makedonias, Thesi Bourntzes, Keratea 19001, Greece · Email: info@packtheory.org · Telephone: +30 695 581 7940 · Website: packtheory.org · Instagram: @packtheory.tcg
