Privacy Policy
Last Updated: 2 November 2026
At ECIG Hellas, we respect your privacy and are committed to protecting your personal information.
This Privacy Policy explains how we collect, use, store and protect personal data when you visit our website, create an account, place an order, contact our team or use our services.
We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR), applicable Greek data protection legislation and other relevant legal requirements.
1. Who We Are
The data controller responsible for the personal information covered by this policy is:
ECIG HELLAS GP
128 Marathonos Avenue
15351 Pallini, Attica
Greece
VAT Number: EL800527070
Email: info@ecig.gr
Website: www.e-cig.gr
For any questions about this Privacy Policy or the processing of your personal information, you can contact us using the details above.
2. Personal Information We Collect
We collect personal information necessary to operate our online store, process orders, provide customer support and meet our legal obligations.
Depending on how you interact with our website, this information may include:
Personal & Contact Information
- First and last name
- Email address
- Telephone number
- Billing and delivery addresses
- Age confirmation (the 18+ confirmation you give when you enter the website)
- Account registration details
Order & Transaction Information
- Products purchased and order history
- Order numbers and transaction details
- Selected payment and shipping methods
- Payment confirmation and transaction status
- Returns, exchanges and refund information
Business & Wholesale Information
For business customers, we may also collect company names, VAT numbers, invoicing details and contact information necessary to establish and maintain commercial relationships.
Technical & Website Information
When you access our website, certain technical information may be collected, including:
- IP address
- Browser type and version
- Device and operating system information
- Website access and security logs
- Cookie identifiers and preferences
- Information about website interactions, where applicable and lawfully collected
We may also receive relevant payment confirmations and delivery status information from payment providers and shipping companies involved in processing your order.
We limit the collection of personal data to what is reasonably necessary for the purposes described in this policy.
3. How We Use Your Personal Information
ECIG Hellas processes personal data for specific purposes and only where an appropriate legal basis exists.
Processing Orders & Deliveries
We use your information to:
- Receive and process your orders.
- Confirm purchases and provide order updates.
- Process payments and verify transactions.
- Arrange shipping and delivery.
- Handle returns, exchanges, refunds and warranty claims.
- Communicate with you regarding your purchases.
Legal Basis: Performance of a contract or steps taken at your request before entering into a contract.
Customer Accounts
When you create an account, we use your information to manage your registration, provide access to your account, maintain order history and support account-related services.
Legal Basis: Performance of a contract.
Legal & Regulatory Compliance
We process relevant information to comply with obligations relating to accounting, taxation, invoicing, consumer protection and applicable product-sale restrictions, including age verification requirements.
Legal Basis: Compliance with a legal obligation.
Customer Support & Communication
We use your contact information and relevant correspondence to respond to enquiries, provide assistance and resolve complaints.
Depending on the nature of the request, processing is based on contractual necessity or our legitimate interest in providing customer service and maintaining business relationships.
Website Security & Fraud Prevention
We process necessary technical and transactional information to maintain website security, investigate suspicious activity, prevent fraud and protect our systems and customers.
Legal Basis: Our legitimate interests in ensuring the security and integrity of our business operations, or compliance with applicable legal obligations where relevant.
Website Analytics & Improvements
Where applicable, we use website performance information to identify technical problems, understand website functionality and improve the customer experience.
Where analytics involves cookies or tracking technologies requiring consent, processing is carried out only after obtaining the necessary consent.
4. Newsletters & Marketing Communications
Where legally permitted, ECIG Hellas may process contact information and communication preferences for newsletters, company updates or promotional communications. Newsletter sign-ups are stored in our own website system.
Such communications will only be sent where an appropriate legal basis exists and all applicable electronic marketing and product-specific advertising restrictions are satisfied.
Electronic cigarettes and related products are subject to specific advertising restrictions under Greek and European Union legislation.
Where marketing communications are permitted, you can withdraw your consent or object to further direct marketing at any time.
You may do so by following the unsubscribe instructions provided in the communication or contacting info@ecig.gr.
Unsubscribing from marketing communications does not affect essential messages relating to orders, payments, deliveries or customer service.
5. Cookies & Tracking Technologies
Our website uses cookies and similar technologies to support its operation and, where permitted, provide additional functionality.
Cookies are small files stored on your device when you visit a website.
The cookies used by an online store generally fall into the following categories:
Strictly Necessary Cookies
These support essential website functions, such as maintaining shopping-cart contents, managing sessions, enabling secure checkout and remembering privacy preferences.
Strictly necessary cookies do not require consent when they meet the applicable legal conditions.
Analytics Cookies
These help measure website usage and performance, allowing us to identify problems and improve the shopping experience.
Where consent is required, these cookies are used only after the visitor has provided it.
Marketing & Advertising Cookies
Certain tracking technologies may be used for marketing purposes, but only where permitted by applicable data protection and product advertising legislation and subject to the required consent.
On your first visit, our cookie banner lets you Accept or Reject optional cookies. Optional analytics and marketing scripts only load if you click Accept. If you click Reject, they are not loaded and the website still works normally. Your choice is remembered for 180 days. To change your choice later, clear the cookies for our website in your browser and the banner will appear again. You can also delete or block cookies at any time in your browser settings.
Services and cookies currently used on our website:
- Necessary cookies: session and security cookies, shopping cart, the age-confirmation cookie (kept 30 days) and your cookie-banner choice (kept 180 days).
- Microsoft Clarity: website analytics that records how visitors use our pages (for example clicks, scrolling and pages visited). It only loads if you click Accept on the cookie banner.
- Cloudflare Turnstile: spam protection on our forms.
- Google Maps: the map on our Contact and Stores pages (loaded from Google when you open those pages).
If you have questions about the cookies and services we use, please contact us at info@ecig.gr.
6. Payment Information & Security
ECIG Hellas uses external financial institutions and payment service providers to process electronic payments.
When you select an electronic payment option, the information required to authorize the transaction is processed through the relevant payment provider.
ECIG Hellas receives the transaction information necessary to confirm payments, manage orders and handle refunds.
We do not need to retain complete payment card details to administer customer orders.
Bank transfers are processed through the relevant banking institutions and information necessary to identify payments may be recorded in our order management and accounting systems.
Payment providers may also process personal information as independent data controllers under their own privacy policies.
7. Sharing Personal Information with Third Parties
ECIG Hellas shares personal information only where necessary for legitimate business operations, contractual performance, legal compliance or other lawful purposes.
Depending on the services involved, recipients may include:
Shipping & Courier Companies
To arrange delivery and provide shipment updates, we share the necessary recipient name, delivery address and contact details.
Banks & Payment Providers
To process transactions, confirm payments and arrange refunds.
Website Hosting & Technical Service Providers
To maintain, secure, operate and support our website and related business systems.
Accounting & Professional Advisers
To comply with financial, accounting, tax and legal obligations.
Analytics & Communication Service Providers
Where these services are used and the relevant processing is legally permitted (currently Microsoft Clarity for website analytics, only if you accept optional cookies, and Cloudflare Turnstile for spam protection on forms).
Public Authorities
Where disclosure is required by law, a lawful regulatory request, judicial proceedings or another applicable legal obligation.
Where third parties process personal information on our behalf, we require appropriate contractual arrangements and safeguards in accordance with applicable data protection legislation.
Other recipients acting as independent controllers are responsible for their own processing obligations.
8. International Data Transfers
ECIG Hellas operates from Greece, within the European Union.
Some technology or service providers may process personal information from countries outside the European Economic Area (EEA).
Where such transfers occur, we will use an appropriate legal transfer mechanism under the GDPR, such as a European Commission adequacy decision or approved Standard Contractual Clauses, together with any additional safeguards required in the circumstances.
Customers may contact us to request further information about applicable international transfers and the safeguards used.
9. How Long We Keep Personal Information
We retain personal information only for as long as necessary to fulfill the purposes for which it was collected or to meet applicable legal requirements.
Retention periods depend on the type of information and the purpose of processing.
Customer Accounts
Account information is generally retained while the account remains active and for any additional period necessary to comply with legal obligations or resolve outstanding matters.
Orders & Financial Records
Transaction records, invoices and accounting information are retained for the applicable statutory retention periods under Greek tax and accounting legislation.
Customer Support & Warranty Claims
Relevant correspondence and records are retained for as long as necessary to resolve the matter and, where applicable, establish, exercise or defend legal claims.
Marketing Preferences
Marketing subscription information is retained while the relevant lawful basis remains valid. Limited records of unsubscribe requests or objections may be retained to ensure those preferences are respected.
Technical & Security Information
Website logs and related technical data are retained for periods proportionate to their operational and security purposes.
Where information is no longer required, it will be securely deleted, anonymized or otherwise handled in accordance with applicable law.
10. Protecting Your Personal Information
We take appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, misuse, alteration and unlawful disclosure.
These measures may include:
- Encrypted communication between browsers and the website.
- Access controls for administrative systems.
- Restricted access to personal data according to operational needs.
- Security monitoring and maintenance.
- Data backup and recovery procedures.
- Appropriate security arrangements with service providers.
Although we take reasonable steps to protect customer information, no internet-based system can guarantee absolute security.
We regularly review our security measures in light of operational requirements and relevant risks.
11. Your Rights Under the GDPR
Under applicable data protection legislation, you have several rights concerning your personal information.
Right of Access
You may request confirmation of whether we process your personal data and obtain access to the information held about you.
Right to Rectification
You may request the correction of inaccurate information or the completion of incomplete personal data.
Right to Erasure
You may request the deletion of your personal information where the applicable legal conditions are met.
Certain records may need to be retained to comply with legal obligations, including accounting and tax requirements. If you have a customer account, you can also delete it yourself from the My Account page.
Right to Restrict Processing
You may request restrictions on the processing of your personal data in circumstances provided by the GDPR.
Right to Data Portability
Where applicable, you may request to receive relevant personal data in a structured, commonly used and machine-readable format or ask for its transfer to another controller.
Right to Object
You may object to processing based on our legitimate interests, subject to the applicable legal conditions.
You have the right to object at any time to the processing of your personal information for direct marketing purposes.
Right to Withdraw Consent
Where processing is based on your consent, you may withdraw that consent at any time.
Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Rights Regarding Automated Decision-Making
Where applicable, you have rights relating to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.
12. Exercising Your Privacy Rights
To exercise any of your data protection rights, please contact:
Email: info@ecig.gr
Subject: Personal Data Request
Please describe your request clearly so that we can identify the relevant information and assist you.
Where necessary, we may request reasonable additional information to verify your identity before disclosing or modifying personal data.
We will respond without undue delay and generally within one month of receiving your request.
Where permitted by law, this period may be extended by up to two additional months due to the complexity or number of requests. If an extension is necessary, we will inform you within the initial one-month period.
Requests are generally handled free of charge, subject to the exceptions provided by the GDPR.
13. Age Restrictions & Minors
Our website offers vaping products intended for adults and is not directed toward minors.
In accordance with applicable Greek legislation, certain products may only be sold to customers who meet the legal minimum age requirements.
Where required, personal information necessary to establish age eligibility may be processed for compliance purposes.
We aim to limit age-verification processing to the information necessary for the verification procedure and applicable legal requirements.
If we become aware that personal information has been collected from a minor without a valid legal basis, we will take appropriate steps in accordance with applicable legislation.
14. Third-Party Websites
Our website may contain links to websites or services operated by third parties.
These third-party websites operate independently and may have their own privacy policies, cookie practices and data processing procedures.
We recommend reviewing the relevant privacy information before providing personal data to external services.
ECIG Hellas is responsible for its own processing of personal data but is not the controller of independent third-party processing merely because a link appears on our website.
15. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our operations, website functionality, legal obligations or data protection practices.
The latest version will be made available on this page, together with its revision date.
Where changes materially affect the processing of personal data, we will provide additional information or obtain consent where required by applicable legislation.
We encourage visitors to review this page periodically.
16. Complaints & Supervisory Authority
If you have concerns about how ECIG Hellas processes your personal information, we encourage you to contact us so that we can investigate and address your concerns.
You also have the right to lodge a complaint with the competent data protection supervisory authority.
In Greece, the relevant authority is:
Hellenic Data Protection Authority (HDPA)
Website: www.dpa.gr
Information about complaints and data protection rights is available through the Authority's official website.
You may also seek other administrative or judicial remedies available under applicable legislation.
17. Contact Information
For questions regarding this Privacy Policy, personal data requests or privacy-related concerns, please contact:
ECIG HELLAS GP
128 Marathonos Avenue
15351 Pallini, Attica
Greece
Email: info@ecig.gr
Website: www.e-cig.gr
We are committed to handling personal information responsibly and responding to privacy-related enquiries in accordance with applicable law.