Privacy policy

Last updated: 30 August 2026

1. Who we are

This Privacy Policy explains how ΚΑΠΑΣΑΚΑΛΙΔΗΣ Π - ΜΟΥΝΤΖΟΥΡΗΣ Χ Ο.Ε., a Greek general partnership (O.E.) trading as Parakeet Rail ("Parakeet Rail", "we", "us" or "our"), collects and processes personal data when you visit parakeetrail.com, use our online store or customer account features, place an order, contact us, or otherwise interact with our services (the "Services").

For the processing described in this Policy, we are the data controller unless this Policy states that another provider acts as an independent controller.

• Registered office: 28is Oktovriou 128, Athina 112 57, Greece
• Greek Tax Identification Number: 802113317
• VAT identification number: EL802113317
• General Commercial Registry (G.E.MI.) number: 170207203000
• Email: info@parakeetrail.com
• Telephone: +30 21 0010 5488

2. Scope

This Policy applies to our consumer-facing online store and related communications. Business-to-business orders are not accepted through the Website and require separate contact. Where a business representative contacts us, we process their business contact details in accordance with the principles described here.

Third-party websites and services have their own privacy notices. We encourage you to read those notices when you choose to use a third-party service.

3. Personal data we collect

Depending on how you interact with us, we may process the following categories of personal data:

• Identity and contact data: name, billing and delivery address, email address and telephone number.
• Order and transaction data: products viewed, placed in a cart or ordered; order number; order status; delivery method; returns, cancellations, refunds, gift-card or preorder information where those features are offered; payment method and payment status.
• Payment-related data: limited payment information made available to us by the payment provider, such as transaction identifiers, payment status, card brand and, where provided, the last digits of a card. Full card numbers, security codes and online-banking credentials are submitted directly to Shopify, Stripe, PayPal or the payment provider selected at checkout and are not made available to us in full.
• Customer account data: email address, account preferences, saved addresses, order history and authentication or security events. Our Shopify customer accounts use passwordless sign-in by email and a one-time verification code; we do not operate customer security questions.
• Communications: the content of messages and information you provide when requesting customer support, exercising a right, making a complaint or contacting us through an available communication service.
• Customer content: a review, rating, photograph or other content only if we make such a feature available and you choose to submit it.
• Device, usage and technical data: IP address, browser and device type, identifiers, language and region, pages and products viewed, referring URL, interaction events, cart and checkout activity, diagnostic and security information.
• Cookie and consent data: cookie identifiers, advertising or analytics identifiers, consent choices and the date or version associated with those choices.

We do not intentionally request special-category personal data through the Website. Please do not include sensitive information in free-text messages unless it is genuinely necessary.

4. How we collect personal data

We collect personal data:

• directly from you when you browse, place an order, create or use an account, choose a delivery or payment method, subscribe to marketing, submit content or contact us;
• automatically from your device through Shopify, cookies and similar technologies, subject to your consent choices where required;
• from service providers involved in a transaction, such as Shopify, Stripe, PayPal and BOX NOW, for example payment confirmation, fraud indicators, delivery status or return information; and
• from Meta, Google or TikTok in connection with analytics, advertising measurement or campaign attribution, but only to the extent permitted by your settings, consent choices and applicable law.

5. Why we use personal data and our legal bases

We process personal data only where we have a valid legal basis under applicable data-protection law.

Performance of a contract or steps requested before a contract

We use identity, contact, order, transaction, account and limited payment-related data to:

• operate the cart and checkout and process an order;
• confirm payment status, fulfil and deliver an order, including through BOX NOW or store collection;
• manage preorders or gift cards if offered;
• process withdrawals, cancellations, returns, refunds and product-conformity requests;
• provide passwordless customer accounts and order history; and
• respond to service requests concerning an order.

The legal basis is Article 6(1)(b) GDPR.

Compliance with legal obligations

We use identity, order, transaction and communication data where necessary to comply with tax and accounting rules, consumer-protection and product-safety obligations, statutory guarantees, lawful authority requests, and the establishment of required business records. The legal basis is Article 6(1)(c) GDPR.

Our legitimate interests

Where your rights do not override our interests, we process appropriate data for the following legitimate interests:

• protecting the Website, customer accounts, payments and customers against fraud, abuse and security incidents;
• maintaining, diagnosing and improving the performance and usability of the Services using necessary or aggregated information;
• providing non-marketing customer support and managing our business relationship;
• maintaining evidence of transactions, consent choices and communications, and establishing, exercising or defending legal claims; and
• preventing misuse and enforcing our Terms of Service.

The legal basis is Article 6(1)(f) GDPR. You may object to processing based on legitimate interests as explained in section 13.

Your consent

Where consent is required, we rely on Article 6(1)(a) GDPR to:

• send email, SMS or similar electronic marketing;
• place or access non-essential analytics, advertising and social-media cookies or similar technologies; and
• support personalised advertising, cross-site measurement or enhanced matching through Shopify, Meta, Google or TikTok.

You may withdraw consent at any time, without affecting processing that took place before withdrawal. We may send marketing without a separate new consent only where applicable electronic-marketing law expressly permits this for existing customers and we have provided the required opportunity to object. Every marketing message will provide an unsubscribe method.

6. Shopify and customer accounts

Our store is hosted by Shopify. Shopify processes data to provide hosting, checkout, customer accounts, security, analytics, support and other commerce functions. In many of these activities Shopify acts as our processor. For certain services and purposes that Shopify determines itself, Shopify may act as an independent controller.

Shopify Network Intelligence is enabled. We use Shopify enhanced services that combine information about interactions with our store with information from Shopify and other participating merchants to improve security, measurement, product features and, subject to applicable consent requirements, personalisation or advertising. For this processing Shopify determines certain purposes and means and is responsible for requests concerning its own use of the data. You can read the Shopify Consumer Privacy Policy and use the Shopify Privacy Portal.

Our current customer-account system uses passwordless authentication. Customers sign in using their email address and a one-time code generated through Shopify. Customer accounts are optional, and checkout does not require an account.

7. Payments

The payment options currently used by the store include card payments processed through Stripe and payments through PayPal. Available methods are shown at checkout.

Payment details are entered into the secure environment provided by Shopify and/or the selected payment provider. Stripe and PayPal may process personal data for payment execution, regulatory compliance, identity verification, security, fraud prevention, disputes and their own service improvement. Depending on the activity, they may act as our processor or as an independent controller. Their own notices apply to processing for purposes they determine:

• Stripe Privacy Policy
• PayPal Privacy Statement

We receive the information needed to confirm whether the payment succeeded and to manage the order, but we do not receive your full card number or security code.

8. Delivery and other recipients

We disclose only the data reasonably necessary for the relevant service. Recipients may include:

• BOX NOW S.A., when you select BOX NOW delivery, which receives information such as your name, telephone number, email address, order or shipment identifier and selected locker or delivery details. See the BOX NOW privacy notice.
• Shopify, Stripe and PayPal, as described above.
• Meta, Google and TikTok, for analytics, advertising measurement, campaign attribution or personalised advertising where the relevant technology is active and the required consent has been provided.
• Customer-support, communications, IT, security and professional advisers, where needed to operate the Services, answer requests, protect our rights or comply with law.
• Public authorities, courts or regulators, where disclosure is required by law or a valid legal process.
• A successor or participant in a corporate transaction, where necessary in connection with a reorganisation, merger, sale or similar transaction and subject to appropriate confidentiality and legal safeguards.

If you communicate with us through Shopify Inbox, Shopify Messaging, WhatsApp or another channel you choose, the provider of that channel may process the communication under its own privacy terms.

9. Cookies and similar technologies

We use cookies and similar technologies, including software tags, app pixels, local storage and identifiers, to operate the Website, remember choices, measure use, protect the Services and, where you consent, measure and personalise advertising.

Cookie categories

• Strictly necessary: required for core functions such as page navigation, cart, checkout, payment security, fraud prevention, customer-account authentication, load balancing and recording privacy choices. These cannot normally be disabled through our banner because the Website cannot provide the requested service without them.
• Functional: remember optional settings and improve convenience. Where required by law, these are used only after consent.
• Analytics and performance: help us understand traffic, page and product interactions, errors and overall performance. These are used only after consent where required.
• Advertising and social media: help measure campaigns, attribute visits or purchases, limit repeated ads and, where enabled and consented to, create or use audiences for personalised advertising.

Shopify, Meta, Google and TikTok

Shopify places cookies and similar technologies needed to operate and secure the storefront and may support analytics and advertising features according to our settings and your choices. More information is available in the Shopify Cookie Policy.

We use the official Shopify sales-channel or app integrations for Meta (Facebook and Instagram), Google (including Google Ads, Analytics and YouTube-related services where configured) and TikTok. At the date of this Policy, we have not manually installed advertising pixels on the Website. Any tags or app pixels used for these providers are deployed through the official Shopify integrations.

Subject to configuration and your consent, these providers may receive or generate device and browser identifiers, IP address, visited pages and products, cart, checkout and purchase events, campaign information and, only where an enhanced-matching feature is enabled, contact information transformed by hashing before transmission. They do not receive full payment-card data from us.

• Meta Cookies Policy
• How Google uses cookies
• TikTok Cookies Policy

Your cookie choices

For visitors in regions where consent is required, non-essential cookies and similar technologies are not intended to activate until the relevant consent is provided. You can accept, reject or choose categories through the cookie banner. You can later change or withdraw your choices by selecting Cookie preferences in the Website footer. Rejecting or withdrawing consent must be as easy as accepting it.

Cookie names and durations can change as Shopify and the integrated providers update their services. Current information about categories, providers and available controls is shown through Cookie preferences and the provider policies linked above. You can also delete or block cookies through your browser, although blocking strictly necessary cookies may prevent parts of the Services from working.

10. Marketing communications

Where required, we send electronic marketing only after receiving valid consent. You may unsubscribe using the link in an email or by contacting us. If we use SMS, WhatsApp or another messaging service for marketing, the same consent and withdrawal principles apply. Transactional messages about an order, account, security event or requested support are not marketing and may still be sent where necessary.

We retain a minimal suppression record after an opt-out where necessary to ensure that the marketing preference continues to be respected.

11. Retention

We keep personal data only for as long as necessary for the stated purpose and then delete or anonymise it, unless continued retention is required or permitted by law. In particular:

• Orders, invoices, refunds and accounting records: for at least five years after the end of the relevant financial period, and longer where another legal obligation, tax audit, dispute or enforceable claim requires it.
• Customer accounts: while the account is active or until deletion is requested, subject to retaining order, security and legal records that must be kept separately.
• Customer-support and complaint records: for the time needed to answer and resolve the matter and, where necessary, for the applicable limitation period or an ongoing dispute.
• Marketing data: until consent is withdrawn, an objection is made or the purpose ends. A minimal suppression record may be retained to honour the opt-out.
• Cookie and advertising data: according to the duration shown in Cookie preferences or the relevant provider's policy, and no longer than necessary for the stated purpose.
• Security and fraud records: for the period reasonably necessary to identify, investigate and document an incident, prevent recurrence and establish or defend claims.
• Reviews or other public content, if introduced: while the content remains published or until a valid removal request is accepted, with limited records retained where necessary for moderation, disputes or legal obligations.

12. International transfers

Our Shopify customer-data hosting location is currently configured for the European Union. However, Shopify and other providers may process data in countries outside the European Economic Area (EEA), including through support, security, payment, communications, analytics and advertising operations.

Where an international transfer requires a safeguard, we rely as applicable on an adequacy decision, the European Commission's Standard Contractual Clauses, approved Binding Corporate Rules, the EU-U.S. Data Privacy Framework for an appropriately certified recipient, or another lawful mechanism. Supplementary technical and organisational measures are used where required. You may contact us for more information about the safeguards relevant to a particular transfer and, where available, how to obtain a copy.

13. Your data-protection rights

Subject to the conditions and exceptions in applicable law, you may have the right to:

• receive information about processing and access your personal data;
• correct inaccurate or incomplete data;
• request erasure;
• restrict processing;
• receive data you provided in a structured, commonly used and machine-readable format and transmit it to another controller where the right to portability applies;
• object to processing based on legitimate interests and object at any time to direct marketing;
• withdraw consent at any time; and
• not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, except where law permits it with appropriate safeguards.

To exercise a right, email info@parakeetrail.com. Please describe your request and provide information reasonably necessary to verify your identity. We will not request more data than needed for verification. We normally respond within one month; the period may be extended by up to two additional months for a complex or numerous request, in which case we will inform you within the first month. Rights are generally free of charge, subject to the exceptions permitted by law.

Requests relating to data that Shopify processes for its own purposes can also be submitted through the Shopify Privacy Portal.

14. Automated processing and profiling

We do not ourselves make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. We may use automated signals to help detect suspected fraud or security threats, but any action for which we are responsible and which could significantly affect you is subject to appropriate review.

Shopify, Stripe or PayPal may independently use automated systems for security, fraud prevention, identity verification or payment authorisation under their own terms and privacy notices. Personalisation and advertising measurement through Shopify Network Intelligence, Meta, Google or TikTok may involve profiling, but non-essential tracking is subject to consent where required and does not by itself determine your contractual or statutory rights against us.

15. Security

We and our providers use appropriate technical and organisational measures designed to protect personal data, including access controls, secure communications, platform security, payment-provider controls and staff or contractor confidentiality. No system is completely secure. If you believe that your account or data may have been compromised, contact us promptly.

16. Children's data

The Services are not directed to children and we do not knowingly collect personal data from a child who cannot lawfully provide it. If you are a parent or guardian and believe that a child has provided personal data to us, contact us so that we can assess and, where appropriate, delete it.

17. Complaints

Please contact us first if you have a concern so that we can try to resolve it. This does not limit your right to lodge a complaint with a competent supervisory authority.

In Greece, the competent authority is the Hellenic Data Protection Authority, 1–3 Kifisias Avenue, 115 23 Athens, Greece, telephone +30 210 6475600. Information and complaint procedures are available at www.dpa.gr.

18. Changes to this Policy

We may update this Policy to reflect changes in law, our Services, providers or processing practices. We will publish the revised version and update the date above. Where a change materially affects your rights or requires renewed consent, we will provide the notice or choice required by law.

19. Contact

ΚΑΠΑΣΑΚΑΛΙΔΗΣ Π - ΜΟΥΝΤΖΟΥΡΗΣ Χ Ο.Ε., trading as Parakeet Rail
28is Oktovriou 128, Athina 112 57, Greece
Email: info@parakeetrail.com
Telephone: +30 21 0010 5488