Privacy policy

Panormitis Sponge Shop, Yialos, Symi Island, Dodecanese, Greece 85600, is responsible for the personal data described here. Write to symisponges@gmail.com about anything on this page.

What we hold, and why

To send you an order: your name, delivery address, email address and phone number. We cannot post a parcel without them. Your address goes to the post office, and to nobody else.

Because the law says so: every sale is recorded and kept for as long as Greek tax law requires, currently five years. This we cannot delete on request, and neither can you ask us to.

To answer you: if you email us, we keep the email.

To send you news, but only if you ask. Nobody is added to our list for buying something. You have to tick the box, and you can leave from the bottom of any message we send.

What we never see

Your card. Payment is handled by Shopify Payments and by PayPal, on their own systems. The card number does not reach us, is not stored by us, and cannot be. We are told only whether the payment succeeded.

Who else is involved

Shopify runs this shop and stores its data: Shopify International Ltd, Ireland.

The Greek post office, for the address on your parcel.

Nobody else. We do not sell, rent, swap or share your details with anyone, for any price.

If you shopped with us before

Our old website closed after it was broken into. When we rebuilt, we brought across the customers and orders it held, so that you can still find what you bought and we can still help with an old purchase.

Two things follow from that, and we want to be straight about both.

Nobody was signed up to anything. The old site never recorded whether you agreed to hear from us, so we have assumed you did not. You will get nothing from us unless you ask for it.

You can have it removed. Ask, and we will delete everything except the sales records tax law makes us keep.

Cookies

The shop uses the cookies it needs to remember your bag and keep you signed in. Turn them off and the bag stops working.

What you can ask for

A copy of what we hold. A correction. Deletion. A machine-readable export. An end to any use of your details you object to.

Email us and we will answer within a month. It costs nothing.

If we handle it badly you can complain to the Hellenic Data Protection Authority, dpa.gr. If you are in the UK, to the ICO, ico.org.uk.

Changes

If this page changes we will date it. It was last written in August 2026.