Privacy & cookies.
What we collect, why, and your controls.

Version 2.0 · Effective 2026-08-25 · Controller: TPL S.A., Patras, Greece

1. Who is responsible

The data controller is TPL S.A., Ethnomartyron 40, 263 33 Patras, Greece, VAT EL800864603, Business Reg no (ΓΕΜΗ) 143336716000 ("TPL", "we"). Privacy questions and requests: info [at] tpl · gr (subject "Privacy"), or by post to the address above. TPL S.A. is part of the A7 Holding LLC group (Delaware, USA); where group companies process data for the purposes below, TPL S.A. remains your point of contact.

2. Which laws this covers

We apply the strongest applicable standard to everyone, and honour the specific rights of your jurisdiction, including: the EU General Data Protection Regulation (GDPR) and Greek law 4624/2019; the ePrivacy Directive (cookies/e-marketing, Greek law 3471/2006); the UK GDPR and Data Protection Act 2018; US state privacy laws: the California Consumer Privacy Act as amended by the CPRA, and the equivalent Virginia, Colorado, Connecticut, Utah, Texas and other state acts; Canada's PIPEDA; Brazil's LGPD; Australia's Privacy Act; and comparable laws elsewhere.

3. What we collect

Data you give us

• Contact & enquiry data: name, email, phone, company, the content of your message (contact form, emails, the introduce-yourself form, calls, chat).
• Files you choose to send: e.g. a CV, catalogue or order photo you attach to a form on the site or to an email to us. Form attachments travel inside the delivered email and are not stored on this website itself.
• Newsletter data: email address and your opt-in record.
• Order-care data: order numbers and purchase details you share so we can fix, track or take back an order you placed on a marketplace or brand store we operate.

Data collected automatically

• Device & usage data: IP address, approximate location derived from it, browser and device type, pages viewed, referrers, and interaction events, via Google Tag Manager and the analytics and advertising tags listed in sections 5 and 6. Analytics and advertising tags run only with your consent.
• Cookie and similar identifiers: see section 5.

Data from other sources

• Marketplaces and platforms: when you buy a TPL-sold product on Amazon, eBay, Etsy or a brand store, the platform passes us the data needed to fulfil and service the order.
• Advertising platforms: aggregated campaign statistics, and interaction data tied to their own identifiers, under their terms.

4. Why we use it - purposes & legal bases

5. Cookies & local storage on this site

The Site uses two kinds of storage. Strictly necessary, first-party storage always runs: your theme (light/dark), language, accessibility settings and a one-time loader flag, held in your browser's localStorage. These carry no advertising identifiers and are shared with nobody.

Analytics and advertising cookies are set by tags we deploy through Google Tag Manager (container GTM-KFBKMSB), which loads on every page. Tag Manager itself is a dispatcher: it sets no advertising cookie of its own, and it fires the consent-dependent tags below only according to the choice you record in the cookie banner (Google Consent Mode: categories you decline stay off). You can change or withdraw your choice at any time. Withdrawal stops future collection; data already collected can be erased under section 12.

Session recording. The behaviour-analytics tools (Hotjar, Microsoft Clarity, LogRocket) reconstruct how visitors move through a page - scrolling, clicks, mouse movement - as anonymised session replays and heatmaps. Text you type into a form is masked by default and not captured as content. These tools run only with your analytics consent.

Embedded content. Where a page embeds a YouTube video or a Google Map, Google's servers receive your IP address when the embed loads and may set their own cookies, particularly once you interact with it. The contact-page location map is an embedded Google Map; Google's servers see your IP address when it loads and set no cookie for us. Both addresses are printed as text on the same page whether the map draws or not. Embeds rest on our legitimate interest in showing you our content and where we are; each platform's own processing is governed by its policy in section 6.

6. The services we use

The services below process data about you when you use the Site or interact with our marketing. The Site itself contacts: Google (Tag Manager on every page and, with your consent, Analytics and Ads; plus YouTube and Google Maps where a page embeds them); the advertising platforms whose tags we deploy through Tag Manager with your consent (Microsoft, Meta, TikTok, LinkedIn, Pinterest, X); the behaviour-analytics tools (Hotjar, Microsoft Clarity, LogRocket), also consent-gated; Cloudflare, whose network delivers the Site and whose Turnstile bot check protects the contact form where enabled; and LiveChat where the chat widget is offered. The rest apply to advertising and tooling outside this website. Each processes data under its own privacy policy; where they act for us, data-processing agreements apply.

7. How we may contact you

If you asked us something, we answer through the channel you used, or the one you gave us. With your consent (or for existing customers under the "similar products and services" e-marketing rule, always with an opt-out) we may also contact you about TPL products, launches and offers via email, phone, SMS, Viber, WhatsApp, website chat, or the social platform you reached us on.

The newsletter is delivered through Mailchimp (Intuit Inc.), which processes your email address and opt-in record for us and measures opens and clicks. Every marketing message carries an unsubscribe route for its channel, and you can stop all marketing at once by writing to info [at] tpl · gr with subject "Unsubscribe". Service messages about an order you asked us to fix are not marketing and continue until the issue is closed.

8. Remarketing & custom audiences

With your consent, we use the advertising platforms in section 6 to show TPL ads to people who visited this site (remarketing), to audiences built from hashed contact lists (custom audiences), and to statistically similar audiences (lookalikes). Hashing means the platform receives a scrambled fingerprint of an email address, matched only against accounts it already holds.

Opt-outs: write to us at the address in section 17; use each platform's ad-preference settings; or the industry tools at youronlinechoices.eu (opens in a new tab) and optout.aboutads.info (opens in a new tab). On this site, the remarketing tags fire only if you consented in the cookie banner; decline or withdraw that consent there at any time to switch them off.

9. How long we keep data

We keep personal data only as long as the purpose requires, and in any case no longer than the maximum period permitted by the applicable law:

• Enquiries and order-care threads: for the life of the issue and up to 5 years after (Greek limitation periods).
• Accounting and tax records: the statutory Greek retention periods (currently up to 10 years where required).
• Newsletter data: until you unsubscribe, then suppressed (a minimal record of the opt-out is kept to honour it).
• Consent records: as long as the consent is in effect, plus the limitation period, as proof of compliance.
• Analytics and advertising data: per the retention set in each tool, capped at the platform's legal maximum for your jurisdiction.

10. Who we share data with

We share personal data only with: (a) the processors and platforms in section 6, under contract; (b) A7 Holding LLC group companies for the purposes above; (c) marketplaces and carriers, to the extent needed to service your order; (d) professional advisers (auditors, lawyers) bound by confidentiality; and (e) authorities where the law requires it. We do not sell personal data for money. Some US laws treat consent-based advertising cookies as "sharing"; section 13 covers your opt-out.

11. International transfers

We are based in Greece (EU). Some providers in section 6 process data in the United States and elsewhere. Transfers outside the EEA/UK rest on adequacy decisions (including the EU–US Data Privacy Framework for certified providers) or the European Commission's Standard Contractual Clauses, with supplementary measures where needed. Copies of the relevant safeguards are available on request.

12. Your rights

EU/EEA, UK and similar jurisdictions: you can ask for access to your data, a copy in portable form, correction, erasure, restriction of processing, and you can object to processing based on legitimate interest, including direct marketing, where objection is absolute. Where processing rests on consent, you can withdraw it at any time without affecting past processing.

US state residents (California and others): you have the rights to know/access, correct, delete, to opt out of "sale" or "sharing" of personal information and of targeted advertising, and to non-discrimination for exercising them. We honour the Global Privacy Control (GPC) signal as an opt-out where required. Authorized agents may act for you with proof of authority. If we decline a request, you may appeal by replying to our decision.

Everyone: write to info [at] tpl · gr (subject "Privacy request"). We verify identity, answer within 30 days (GDPR) or 45 days (CCPA), extendable once where the law allows, and free of charge unless requests are manifestly unfounded or excessive.

13. Do not sell or share (US)

We do not sell personal information for money. Some US laws treat the consent-based advertising cookies in section 5 as "sharing" or "targeted advertising". You can opt out three ways: decline or withdraw advertising consent in the cookie banner; enable the Global Privacy Control (GPC) signal in your browser, which we honour; or email info [at] tpl · gr with subject "Do not sell or share", which also covers our marketing off this site.

14. Children

The Site is a business-to-business and company-information site, not directed to children. We do not knowingly collect personal data from anyone under 16 (or the higher age your law sets). If you believe a child gave us data, tell us and we will delete it.

15. Security

We protect personal data with technical and organisational measures appropriate to the risk: encrypted transport (TLS), access on a need-to-know basis, hardened infrastructure behind Cloudflare, logging, and staff confidentiality duties. No system is perfectly secure; if a breach is likely to put your rights at high risk, we will notify you and the supervisory authority as the GDPR requires.

16. Changes to this policy

We update this policy when our practices or the law change, bumping the version line at the top. Material changes are flagged on this page for 30 days. Where a new purpose needs consent, we ask for it. We never repurpose your data silently.

17. Contact & complaints

TPL S.A. · Ethnomartyron 40, 263 33 Patras, Greece · info [at] tpl · gr · +30 2610 20 20 22

You may complain to your supervisory authority at any time. Ours is the Hellenic Data Protection Authority, Kifisias 1-3, 115 23 Athens, dpa.gr (opens in a new tab). UK: the ICO (ico.org.uk). California: the CPPA (cppa.ca.gov).