Privacy Policy

1. Who processes your data

The data controller is Repanis Patisserie. Full contact details are at the bottom of this page and in the site footer.

For anything concerning your data, you can reach us at the shop's email address or phone number.

2. What data we collect

We collect only what your order needs in order to work:

• Account details: full name, phone number and email address. The phone number is required — without it we cannot reach you about your pickup.
• Order details: the items you ordered, any variants (e.g. single/double), your notes, the total, the payment method, the order status and the estimated pickup time.
• A copy of your name and phone stored on the order itself, so staff can see who is collecting it.
• Payment details: if you pay by card, the transaction happens entirely within Viva Wallet's environment. We keep only the order code and the transaction code — never your card number, expiry date or CVV.
• A technical notification identifier (push token) for your device, if you have enabled notifications.
• For cake orders placed through the website: name, phone, pickup date and time, flavour, number of servings, any text on the cake, candle choice and — optionally — a reference image you upload.

3. Why we process it, and on what legal basis

• To fulfil your order — performance of a contract (Art. 6(1)(b) GDPR). This covers account, order and payment details.
• To keep you informed about your order (push notifications and confirmation emails) — performance of a contract. Push notifications additionally require the permission you grant in your device's operating system, which you can withdraw at any time in its settings.
• For our accounting and tax compliance — legal obligation (Art. 6(1)(c) GDPR).
• For the security and correct operation of the system, e.g. preventing abuse — legitimate interest (Art. 6(1)(f) GDPR).

4. Card payments

Card payments are processed by Viva Wallet, a licensed payment institution. When you choose to pay by card you are taken to Viva's secure environment and your card details are provided directly to them.

We never see, receive or store card details. We receive only the confirmation that the payment succeeded, the amount, and the codes that let us issue a refund if one is needed.

5. Signing in with Apple or Google

If you sign in with Apple or Google, we receive from them only a unique identifier, your email address and — on the first sign-in only — your name. We never receive your password.

If you use Apple's “Hide My Email” feature, we will see an anonymous relay address rather than your real one. Confirmation emails still work normally; for anything urgent we contact you by phone.

Because Apple and Google accounts carry no phone number, you will be asked to add one before your first order.

6. Who we share data with

We do not sell your data and we do not use it for advertising. We share it only with the providers that make the service work, acting as our data processors:

• Supabase — database, user authentication and file storage. Data is hosted on servers within the European Union (Frankfurt, Germany).
• Viva Wallet — card payment and refund processing.
• Vercel — hosting for the website and the app's server routes.
• Expo, together with Apple (APNs) and Google (Firebase Cloud Messaging) — delivering push notifications to your device.
• An email provider — sending order confirmation emails.
• And, where the law requires it: tax and audit authorities.

7. Transfers outside the European Union

Our database is located within the EU. Some notification and hosting providers are based in the United States, so limited data (such as your device's technical identifier and the text of a notification) may be transferred there. Those transfers are covered by the European Commission's Standard Contractual Clauses and/or the EU–US Data Privacy Framework.

8. How long we keep it

• Account details: for as long as you keep your account.
• Orders: retained as accounting records for the period required by tax law.
• Push token: until you sign out, uninstall the app or disable notifications.
• Cake reference images: deleted once they are no longer needed to fulfil the order.

9. Deleting your account

You can delete your account at any time from within the app, on the “Account” screen. You do not need to contact us.

When you do, your account is permanently deleted and your personal details are removed from past orders. The orders themselves remain in anonymised form, because they are accounting records we are legally required to keep.

If you signed in with Apple, we also revoke our access to your Apple account as part of the deletion.

10. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict and object to the processing of your data, as well as the right to data portability. To exercise any of these, contact us using the details below.

If you believe we have not handled your data properly, you have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

11. Security

Communication with our servers is always encrypted. Access to order data is technically restricted so that each customer can only ever see their own orders, and staff see only what they need in order to serve you.

12. Children

The service is intended for adults. We do not knowingly collect data from children under 16 without the consent of a parent or guardian.

13. Cookies

Our website uses only the cookies strictly necessary for it to function and for a payment to complete securely. We do not use advertising or tracking cookies. The app uses no cookies.

14. Changes to this policy

If we make a material change to this policy, we will update the date at the top of this page and, where required, notify you inside the app.