Privacy Policy

1. Who we are

The data controller responsible for this website is:

VEDINOGLOU THEODORA
Sole Proprietorship, operating under the commercial brand CommerceGorilla

VAT Number: EL116187459
G.E.MI. Number: 159799603000
Registered Address: Souliou 149, 13231, Petroupoli, Athens, Greece
Email: hello@commercegorilla.gr
Telephone: +30 698 738 3570

In this Privacy Policy, “CommerceGorilla”, “Gorilla”, “we”, “us” and “our” refer to VEDINOGLOU THEODORA operating under the CommerceGorilla brand.

2. Scope

This Privacy Policy applies to personal data collected through the CommerceGorilla website, project enquiry forms, direct business communications and related pre-contractual interactions.

Where Gorilla processes personal data solely on behalf of a business client in connection with ecommerce systems, migrations, integrations or advertising platforms, Gorilla may act as a data processor rather than a controller. A separate Data Processing Agreement may apply where required.

3. Personal data we may collect

Depending on how you interact with us, we may process your name, email address, business or company information, project type, project brief, messages and other information you voluntarily provide.

If an enquiry becomes a client relationship, we may also process information necessary to prepare proposals, enter into and perform a contract, issue invoices, maintain accounting records, provide support and manage project communications.

Hosting and security infrastructure may process ordinary technical information such as IP address, browser or device information, request timestamps, requested resources and security or diagnostic data.

4. Contact form submissions

When you submit a project enquiry, the information you enter may be processed through Netlify, our website hosting and form infrastructure provider. We use this information to review and respond to your enquiry, prepare requested information or quotations and take steps related to a potential business relationship.

Submitting a project enquiry does not automatically subscribe you to marketing communications.

5. Purposes and legal bases

Responding to enquiries and preparing proposals, where processing may be necessary to take steps at your request before entering into a contract.
Providing contracted services, where processing is necessary for performance of our agreement.
Meeting legal, accounting and tax requirements.
Operating, securing and maintaining the website on the basis of legitimate interests where appropriate.
Using optional analytics or marketing technologies only where the required consent has been provided.

6. Cookies and similar technologies

Strictly necessary technologies may operate where required for the website or to remember privacy choices. Optional Analytics and Marketing categories remain disabled until the required consent is provided. You can change your choices through Cookie settings. More information is available in our Cookie Policy.

7. Recipients and service providers

We do not sell personal data. We may use website and infrastructure providers such as Netlify, communications providers, professional advisers and project-specific providers where reasonably necessary. We may also disclose information where required by law or a competent authority.

8. International processing

Some technology providers may process data outside the European Economic Area. Where applicable, transfers should rely on legally recognised safeguards such as adequacy decisions, the EU-US Data Privacy Framework or Standard Contractual Clauses, depending on the provider and circumstances.

9. Retention

Project enquiries that do not result in a client relationship may be retained for up to 24 months after the last meaningful interaction, unless a longer period is reasonably required or deletion is requested and no legal reason requires retention.

Where an enquiry becomes a client relationship, contractual, invoicing and accounting information may be retained for the periods required by applicable legal, tax, accounting or limitation rules.

10. Your rights

Subject to applicable law, you may have rights of access, correction, erasure, restriction, portability, objection and withdrawal of consent. Requests may be sent to hello@commercegorilla.gr. We may need to verify your identity before acting on a request.

11. Complaints

You may lodge a complaint with the competent supervisory authority. In Greece, this is the Hellenic Data Protection Authority, Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα.

12. Security

We use technical and organisational measures appropriate to the nature and risk of the processing, including access controls and secure account practices where applicable. No internet transmission or storage system can be guaranteed to be completely secure.

13. Client-project processing and our processor role

This Privacy Policy primarily explains processing for CommerceGorilla's own purposes as controller. During a Client project, CommerceGorilla may also process personal data solely on a business Client's documented instructions, for example during ecommerce migration, CRM/ERP integration, analytics configuration or support. In that situation the Client will normally act as controller and CommerceGorilla as processor, and the processing must be governed by a compliant Data Processing Agreement before processor activities begin.

14. Automated decision-making

CommerceGorilla does not currently use data submitted through the project enquiry form to make decisions based solely on automated processing that produce legal or similarly significant effects.

15. Marketing communications

Submitting an enquiry does not automatically add you to a marketing mailing list. If newsletters or promotional subscriptions are introduced, appropriate information and opt-in mechanisms will be provided where required.

16. Changes

We may update this Privacy Policy when our services, providers, processing practices or legal requirements change. The latest revision date will appear on this page.