PRIVACY POLICY
EPTAGON MEDITECH LTD
Effective Date: [Insert publication date]
Last Updated: [Insert update date]
Website: [Insert live online store URL]
1. Introduction
Eptagon Meditech Ltd ("Eptagon Meditech", "we", "us" or "our"), a member of Eptagon Group, respects your privacy and is committed to protecting your personal data.
This Privacy Policy explains how we collect, use, store, protect and share personal information when you visit our online store, purchase our products, create an account, participate in our loyalty or influencer programmes, subscribe to marketing communications or contact our customer-support services.
We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), Cyprus Law 125(I)/2018 and other applicable data protection and electronic communications legislation.
By using our website, you can review this Privacy Policy to understand our personal data practices and your legal rights. Where the law requires consent, we will request it separately.
2. Data Controller and Contact Information
The organisation responsible for determining the purposes and means of processing your personal data is:
Eptagon Meditech Ltd
Member of Eptagon Group
Registered Address: [Insert confirmed registered address]
Business Address: [Insert address, if different]
Email: [Insert confirmed privacy contact email]
Telephone: [Insert customer-service telephone number]
Website: [Insert online store URL]
If a Data Protection Officer has been appointed, their contact details will also be provided here.
For questions, complaints or requests relating to your personal information, please contact us using the details above.
3. Personal Data We Collect
We collect only personal information that is relevant and necessary for specified and lawful business purposes.
Depending on how you interact with us, we may process the following information.
3.1 Personal Identification and Contact Information
Your first and last name, email address, telephone number, billing address, delivery address and other contact information you voluntarily provide.
3.2 Customer Account Information
Information associated with your online account, including your account identifier, login credentials managed through our website platform, account settings, saved addresses, order history, preferences and account activity.
3.3 Orders and Transactions
Product selections, quantities, purchase dates, order numbers, transaction amounts, discount codes, delivery instructions, payment status, returns, refunds and other information necessary to fulfil or manage your purchases.
3.4 Payment Information
Payments are handled through the payment service providers enabled on our website, including Stripe where applicable.
We may receive transaction references, payment confirmation, refund status and limited payment-method information.
Full payment-card information entered into the payment provider's secure payment fields is processed according to that provider's applicable privacy and security arrangements.
Customers should never send complete payment-card information through ordinary email, website contact forms or customer-support chat.
3.5 Technical and Website Usage Information
We may process IP addresses, browser type, device type, operating system, website interactions, referring pages, session information, cookie identifiers and technical information necessary for website operation, security and permitted analytics.
3.6 Communications and Customer Support
We may collect messages, enquiries, complaints, product questions, support correspondence and relevant records of interactions with our customer-service team or AI-powered support assistant.
3.7 Marketing Preferences
We may record newsletter subscriptions, marketing consent, unsubscribe requests, communication preferences and interactions with marketing communications.
3.8 Loyalty Programme Information
If you join our loyalty programme, we may process your membership identifier, eligible purchases, reward points, membership status, redeemed benefits and participation history.
3.9 Ambassador and Affiliate Programme Information
If you apply to or participate in our influencer or ambassador programme, we may process your contact information, social media profiles, referral codes, associated transactions, sales performance, commissions, payment details and information necessary to administer the programme.
3.10 Gift Card Information
Where gift cards are offered, we may process purchaser and recipient information, gift card identifiers, balances, redemption history and transaction details.
3.11 Product Reviews and Testimonials
If you voluntarily submit product reviews, ratings, photographs or testimonials, we may process your submitted content and associated display name or account details.
Publication of identifiable testimonials or promotional photographs will be handled in accordance with applicable law and any required permissions.
4. How We Collect Personal Information
We may collect information:
-
Directly from you when placing orders, registering, contacting us or participating in a programme.
-
Automatically through our website and permitted cookies or similar technologies.
-
From payment providers when payments are processed.
-
From delivery partners regarding shipment and delivery status.
-
From affiliate or referral systems when you use an ambassador's discount code or referral link.
-
From service providers that support our website, customer service or business operations.
-
From another person when they purchase a gift card or arrange a delivery for you.
Where legally required, we will provide additional information when personal data is obtained indirectly.
5. Why We Process Your Personal Data
We process personal data only where we have a lawful basis under applicable legislation.
5.1 Fulfilling Orders and Contracts
We use necessary information to process purchases, confirm payments, prepare orders, arrange delivery, provide purchased products, handle returns and refunds and communicate information relevant to your transaction.
Legal basis: Performance of a contract or steps requested before entering into a contract.
5.2 Managing Customer Accounts
We process account information to provide registration, authentication, account access, order history and account-related services.
Legal basis: Performance of a contract and, where appropriate, legitimate interests relating to security and account administration.
5.3 Loyalty and Rewards
For registered loyalty participants, we process eligible purchases, rewards balances and redemption records to administer the benefits offered under the programme.
Legal basis: Performance of the loyalty programme agreement, with other legal bases applying where necessary.
Participation in the loyalty programme does not automatically constitute consent to receive unrelated promotional messages.
5.4 Influencer and Affiliate Programmes
We process information necessary to review applications, manage referrals, calculate commissions, prevent fraudulent attribution and administer payments.
Legal basis: Contractual necessity, legitimate interests where appropriate, and compliance with legal obligations.
5.5 Marketing and Promotional Communications
Where permitted by law, we may send information about products, promotions, new arrivals, discounts and special offers.
We will obtain consent where required and provide an easy way to withdraw consent or opt out.
Where applicable law permits communications about our own similar products to existing customers without separate prior consent, we will respect the applicable conditions and provide clear, free opportunities to object.
We will not treat creating a customer account or completing a purchase as blanket consent to all marketing activities.
5.6 Website Analytics and Improvements
We may analyse website performance, product interest and general shopping activity to improve navigation, services and customer experience.
Where analytics require non-essential cookies or similar technologies, we will obtain the necessary consent.
5.7 Customer Support
We process relevant information to respond to enquiries, assist with orders, investigate complaints and improve the quality of our services.
Legal basis: Contractual necessity or legitimate interests, as appropriate.
5.8 Fraud Prevention and Security
We may process information to detect suspicious transactions, prevent account misuse, investigate security incidents and protect our website, customers and business.
Legal basis: Legitimate interests and applicable legal obligations.
5.9 Legal and Financial Compliance
We retain and process information when necessary to comply with tax, accounting, regulatory, consumer protection and other legal obligations.
Legal basis: Compliance with legal obligations.
6. Special Categories of Personal Data and Health Information
Our store provides nutritional supplements, protein powders, vitamins, fitness products and wellness-related products.
We do not require customers to disclose medical diagnoses or detailed health records simply to purchase our products.
Customers should avoid submitting unnecessary sensitive medical information through customer-support forms or AI chat.
If personal information concerning health is voluntarily disclosed, we will handle it according to applicable data protection requirements, including the additional protections under Article 9 GDPR where relevant.
We will not use information about a customer's medical condition for targeted advertising without a valid legal basis and any additional condition required for processing special-category data.
Product purchases will not automatically be treated as confirmation of a specific medical diagnosis.
7. Payment Processing and Financial Security
Payments may be processed through third-party payment service providers made available at checkout.
Such providers may act as independent controllers or processors, depending on the service and applicable contractual arrangements.
They may process information necessary for payment authorisation, fraud prevention, refunds, legal compliance and transaction administration.
We receive information reasonably necessary to confirm and manage transactions.
Payment providers operate under their own privacy notices and applicable legal obligations.
We do not ask customers to disclose full payment-card details to our employees through unsecured communication channels.
8. Order Fulfilment, Warehousing and Delivery
To prepare and deliver purchases, we may share relevant order information with authorised warehouse personnel, logistics providers, couriers and fulfilment partners.
This information may include the recipient's name, delivery address, telephone number, order reference, relevant purchased items and delivery instructions.
Such information is shared only to the extent reasonably necessary to provide the relevant service.
Delivery providers may process certain information under their own legal responsibilities and privacy policies.
We do not authorise delivery partners to use customer order information for unrelated marketing on our behalf.
9. Loyalty Programme and Customer Rewards
Where customers voluntarily enrol in the Eptagon Meditech Loyalty Programme, we may process information relating to their purchases, reward eligibility, loyalty balances and redemption activity.
We use this information to calculate benefits, administer programme rules, prevent misuse and provide information about earned rewards.
Where personalised promotional communications require consent or other legal conditions, those requirements apply separately.
Customers may contact us to request information about their loyalty data or exercise applicable data protection rights.
Closing a loyalty account does not necessarily require deletion of transaction records that must be retained for legal reasons.
10. Influencer, Ambassador and Affiliate Programme
Our website may allow content creators and business partners to apply to become Eptagon Meditech ambassadors or affiliates.
For approved participants, we may process:
-
Contact and professional information.
-
Social media account details.
-
Unique discount codes and referral links.
-
Attributed purchases and eligible sales.
-
Commission calculations and payment history.
-
Performance statistics required to administer the programme.
Customers who use an influencer's referral link or promotional code may have their purchase attributed to that influencer for the purpose of calculating commission.
Any tracking technologies used for affiliate attribution will be subject to applicable cookie and privacy requirements.
Affiliate partners should receive only the customer information necessary for the authorised programme purpose.
Access to personal customer information must be restricted according to the affiliate programme's actual configuration and contractual safeguards.
11. AI-Powered Customer Support
Our website may offer an AI-powered assistant to answer product questions, provide general shopping assistance, explain website services and direct customers to human support where necessary.
Customers will be informed when they are interacting with an AI system.
When a customer uses this service, the information they submit may be processed to generate responses, maintain relevant conversation context, troubleshoot technical problems and provide customer support.
Relevant information may be processed by contracted AI or website technology providers according to the services enabled, applicable agreements and disclosed processing arrangements.
Customers should not enter passwords, complete payment-card information, identification documents or unnecessary sensitive health information into the chatbot.
The AI assistant is intended for general information and customer-service support. It is not a substitute for professional medical advice.
Customers may request assistance from a human representative when the automated assistant cannot adequately resolve an enquiry.
Whether conversations are stored, for how long, and whether the provider uses any content for model improvement must be accurately disclosed based on the service actually configured.
12. Cookies and Similar Technologies
Our website uses cookies and similar technologies to operate essential shopping functions and, where enabled and permitted, provide analytics, personalisation and advertising.
These may include:
Strictly Necessary Cookies: Required for core website functionality, security, login sessions, shopping carts and checkout operations.
Functional Cookies: Used to remember settings and preferences, where enabled.
Analytics Cookies: Used to understand website activity, performance and customer navigation.
Marketing Cookies: Used for advertising measurement, referral attribution, remarketing or personalised advertisements where enabled.
Non-essential cookies or similar technologies requiring consent will not be activated before the necessary consent has been obtained.
Visitors must be able to make appropriate cookie choices and withdraw or modify their consent through the consent management mechanism provided on the website.
Further information about individual cookies, providers and retention periods will be available through our cookie settings or a separate Cookie Policy.
13. Marketing, Personalisation and Profiling
Where legally permitted, we may use customer preferences, purchase activity and programme participation to identify relevant product categories or offers.
We will respect applicable consent requirements and objections to direct marketing.
Where profiling is used, we will not use it to make solely automated decisions that have legal or similarly significant effects on individuals without satisfying applicable legal requirements.
Customers may object to processing for direct marketing at any time.
We do not intend to infer sensitive health conditions from purchase histories for advertising purposes.
14. Sharing Personal Information
We may disclose relevant personal information to:
Website and Technology Providers: Including Wix and authorised applications supporting website hosting, account management, e-commerce, communication and data storage.
Payment Service Providers: Including payment gateways necessary for secure transaction processing.
Delivery and Logistics Providers: For preparing, transporting and delivering orders.
Customer Support and Technology Partners: Where necessary to provide support or operate approved technical services.
Marketing and Analytics Providers: Where the relevant processing is lawful and applicable consent requirements have been satisfied.
Accountants, Auditors and Professional Advisers: Where necessary for financial administration, legal advice, compliance or disputes.
Eptagon Group Companies: Where there is a specific, lawful business purpose and appropriate arrangements or safeguards are in place.
Public Authorities: Where disclosure is required or permitted by applicable law.
We do not authorise service providers to use personal information for unrelated purposes merely because they receive it to perform services for us.
Any independent processing by third parties is subject to their applicable responsibilities and privacy information.
Data sale: [Confirm the company's position and insert an accurate statement on whether personal data is sold or shared for third-party advertising purposes.]
15. International Data Transfers
Some technology, payment, hosting or support providers may process or access personal information outside Cyprus or the European Economic Area.
Where personal data is transferred internationally, we will ensure that the transfer complies with applicable GDPR requirements.
Depending on the circumstances, safeguards may include European Commission adequacy decisions, approved Standard Contractual Clauses or other legally recognised transfer mechanisms.
Additional information about relevant transfers and safeguards may be requested through our privacy contact.
16. Personal Data Retention
We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, subject to applicable legal requirements.
Customer Account Information: Retained while the account remains active and thereafter only as reasonably necessary for legitimate operational or legal purposes.
Order and Financial Records: Retained for the applicable statutory accounting and taxation periods, which may require records to be preserved for at least six years under current Cyprus legislation, depending on the relevant filing dates and record type.
Customer Service Communications: Retained for the period reasonably required to resolve enquiries, maintain appropriate service records and address disputes.
Marketing Information: Retained while the applicable marketing permission or other lawful basis remains valid, subject to an appropriate retention policy. Minimal suppression records may be retained to ensure that unsubscribe requests continue to be respected.
Loyalty Programme Information: Retained as necessary to administer the membership, resolve outstanding rewards and comply with applicable obligations.
Affiliate Programme Information: Retained for contract administration, commission reconciliation, financial compliance and relevant dispute periods.
AI Chat Records: Retained according to the applicable support service configuration, defined operational requirements and documented retention schedule.
Cookie Data: Retained according to the relevant cookie's purpose and the retention periods disclosed through the website's consent management information.
When information is no longer needed, we will delete, anonymise or securely dispose of it according to applicable requirements.
Specific retention periods are maintained or determined according to our internal retention schedule and applicable law.
17. Security of Personal Information
We are committed to maintaining appropriate technical and organisational security measures to protect personal information against unauthorised access, accidental loss, misuse, alteration or unlawful disclosure.
Depending on the relevant systems and risks, these measures may include access controls, account authentication, appropriate security configurations, staff authorisation restrictions, service-provider safeguards, backups and incident-response procedures.
Access to personal data is restricted to authorised personnel and service providers who require it for legitimate business purposes.
We take reasonable steps to assess and maintain the security of our systems and the personal data entrusted to us.
However, no online transmission or storage system can guarantee absolute security.
18. Personal Data Breaches
Where a personal data breach occurs, we will assess its nature, scope and potential impact.
Where legally required, we will notify the competent supervisory authority without undue delay and, where applicable, within 72 hours after becoming aware of a qualifying personal data breach.
Where a breach is likely to result in a high risk to individuals' rights and freedoms, we will notify affected individuals as required by law.
We will take appropriate measures to investigate, contain and address security incidents.
19. Your Data Protection Rights
Subject to the conditions and exceptions provided by applicable law, you may have the following rights:
Right of Access: Request confirmation of whether we process your personal data and obtain access to relevant information.
Right to Rectification: Request correction or completion of inaccurate or incomplete personal information.
Right to Erasure: Request deletion of personal information where the applicable legal conditions are met.
Right to Restrict Processing: Request restriction of certain processing activities in circumstances provided by law.
Right to Data Portability: Receive certain personal information in a structured, commonly used and machine-readable format and, where applicable, transfer it to another provider.
Right to Object: Object to certain processing based on legitimate interests and object at any time to processing for direct marketing.
Right to Withdraw Consent: Withdraw previously provided consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Rights Related to Automated Decisions: Exercise the protections provided by Article 22 GDPR where decisions based solely on automated processing produce legal or similarly significant effects.
To exercise your rights, contact us using the privacy contact information provided in Section 2.
We may request reasonable information to verify your identity before disclosing or changing protected personal information.
We will normally respond within one month, subject to permitted extensions for complex or numerous requests.
Requests are generally handled free of charge, subject to the exceptions provided by law.
Certain information may need to be retained despite a deletion request where there is a continuing legal obligation or another legally recognised ground for retention.
20. Children's Privacy
Our online store is intended for adult customers.
We do not knowingly seek to collect children's personal data for independent account creation, marketing or programme participation.
If we become aware that personal data belonging to a child has been collected without a valid legal basis or any required parental authorisation, we will take appropriate steps in accordance with applicable law.
Parents or legal guardians who have concerns may contact us using the details provided in this policy.
21. Third-Party Websites and Services
Our website may contain links to third-party websites, social media platforms, payment services or other external resources.
These third parties may operate under their own privacy notices, terms and legal responsibilities.
We encourage customers to review the relevant privacy information before voluntarily submitting personal information to external services.
22. Your Right to Lodge a Complaint
If you believe that your personal information has been processed unlawfully or that your data protection rights have been infringed, you may contact us directly.
You also have the right to lodge a complaint with a competent supervisory authority.
In Cyprus, the relevant authority is:
Office of the Commissioner for Personal Data Protection
15 Kypranoros Street
1061 Nicosia, Cyprus
Telephone: +357 22 818456
Email: commissioner@dataprotection.gov.cy
Website: https://www.gov.cy/dataprotection/en/
23. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect changes in legislation, our website, technology providers, services or personal data practices.
The latest version will be published on our website with its updated effective date.
Where changes materially affect processing activities and additional notification or consent is required, we will take the appropriate steps before implementing those changes.
24. Contact Us
For privacy-related questions, requests or concerns, please contact:
Eptagon Meditech Ltd
Member of Eptagon Group
Email:warehouse@eptagon-meditech.com
Address:Ivikou 57, Aradippou, Larnaka 7101
Website: About Us | Eptagon Meditech-shop
We are committed to handling personal data lawfully, responsibly and transparently.