Privacy Policy

1. Who we are — Data Controller

The controller of your personal data is:

• Legal name: ΕΛΛΗΝΙΚΟ ΚΟΤΕΤΣΙ Ε.Ε. (ELLINIKO KOTETSI E.E. / Hellenic Kotetsi LP)
• Trade name: Akoko Athens
• Registered office: Solomou 1, Neo Psychiko, Athens, Greece
• VAT No. (ΑΦΜ): 802026431 — Tax office (ΔΟΥ): KEFODE Athens
• Company Registry (ΓΕΜΗ): 168410503000
• Email: hello@akoko.gr — Tel.: +30 210 671 0023

For any matter concerning your personal data, you may contact us athello@akoko.gr.

2. What data we collect, why, and on what legal basis

We collect personal data only when you choose to contact us or sign up for one of our services. Specifically:

a) Contact form

Data: your name, email address, your message, and technical details that accompany each request (browser type — user agent — and language).
Purpose: to receive your enquiry and reply to you.
Legal basis: our legitimate interest in responding to the messages you send us (Article 6(1)(f) GDPR) and, where required, your consent (Article 6(1)(a) GDPR).

b) Job applications

Data: your name, contact details and your CV (file).
Purpose: to assess your application for a position.
Legal basis: taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).

c) Newsletter

Data: your email address.
Purpose: to send you news and updates about the restaurant.
Legal basis: your consent (Article 6(1)(a) GDPR), which you give when you subscribe. Every email contains an unsubscribe link so you can withdraw your consent at any time.

d) Email correspondence

Data: whatever is contained in the messages you send us athello@akoko.gr.
Purpose: to handle and answer your enquiries.
Legal basis: our legitimate interest in communicating with you (Article 6(1)(f) GDPR).

We never ask you for special categories of data (e.g. health data). Please do not send us such data through our forms or by email.

3. Cookies and similar technologies

Our website uses only strictly necessary cookies for its security and proper operation (e.g. protection against malicious traffic via Cloudflare Turnstile, and cookies from the embedded Google Map on the contact page). Statistics or marketing cookies are enabledonly if you give your consent. You will find full details in our Cookies Policy.

4. Who has access — Data processors

We do not sell or trade your data. We share it only with carefully selected service providers who act as processors on our behalf, bound by contract under Article 28 GDPR:

• Cloudflare, Inc. — hosting, content delivery network (CDN) and website security, including bot protection (Turnstile).
• Resend, Inc. — sending and receiving email (processing on EU-region infrastructure).
• Google — the embedded Google Map on the contact page and the display of Google ratings (rendered server-side, without sending any visitor data).
• Clerk, Inc. — staff authentication for internal administration (applies to employees only, not website visitors).

We may also disclose data to public authorities where this is required by law.

5. Where data is stored — Transfers outside the EU

Your data is stored on infrastructure within the European Union. For example, CVs are kept in the Cloudflare R2 storage service, within EU jurisdiction.

Some of our providers are companies based in the USA. Where data may be transferred outside the European Economic Area, we ensure the transfer is covered by appropriate safeguards under the GDPR — in particular the European Commission’s Standard Contractual Clauses (SCCs) and/or the EU–U.S. Data Privacy Framework.

6. How long we keep your data

We keep your personal data only for as long as necessary for the purpose for which it was collected:

• CVs: CVs are kept for 12 months and are then deleted.
• Contact-form messages and correspondence: for as long as needed to handle your request, and for a reasonable period afterwards to document the communication.
• Newsletter subscription: until you unsubscribe or withdraw your consent.

7. Your rights

Under the GDPR, you have the following rights regarding your personal data:

• Access — to find out what data of yours we process.
• Rectification — to request correction of inaccurate data.
• Erasure (“right to be forgotten”) — to request deletion of your data where there is no lawful ground to keep it.
• Restriction of processing.
• Portability — to receive your data in a structured, commonly used format.
• Objection to processing based on our legitimate interest.
• Withdrawal of your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

8. How to exercise your rights

To exercise any of the above rights, email us athello@akoko.gr. We will respond within one month at the latest, free of charge. We may need to verify your identity before acting on your request.

If you believe that the processing of your data infringes the law, you have the right to lodge a complaint with the competent supervisory authority: theHellenic Data Protection Authority(www.dpa.gr).

9. Automated decision-making and profiling

We do not make decisions concerning you based solely on automated means, and we do not carry out profiling.

10. Data security

We take reasonable technical and organisational measures to protect your data from loss, misuse or unauthorised access, such as encryption of communications (HTTPS), infrastructure protection and limiting access to authorised staff only.

11. Changes to this Policy

We may update this Privacy Policy from time to time. The version in force at any given time is published on this page with an updated “Last updated” date. We encourage you to review it periodically.

12. Governing law

This Policy is governed by Greek law. The courts of Athens have jurisdiction over any dispute, subject to any mandatory provisions of law in favour of the data subject.