Privacy policy

This is a translation; in case of discrepancy the Greek version prevails.

Last updated: October 2026

Protecting your personal data is both an obligation and a matter of trust for us. This policy explains which data we process when you visit the website i-hlamidis.gr, when you contact us and when we serve you, in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, the ‘GDPR’) and Greek Law 4624/2019.

1. Data controller

The data controller is the private capital company ‘Ι. ΧΛΑΜΙΔΗΣ & ΣΙΑ Ι.Κ.Ε.’ (I. Hlamidis & Co. P.C., trading as ‘Hlamidis Orthopaedics’), which manufactures and sells orthopaedic products.

• Address: 101 Egnatia Street, 546 35 Thessaloniki, Greece
• Tax ID (ΑΦΜ): 082883882
• Telephone: +30 2310 227 976
• Email: info@i-hlamidis.gr

You may contact us using the details above about any matter relating to your personal data.

2. Which data we process and why

2.1 Contact and appointment form

When you complete the contact form, we collect your full name and telephone number (required) and, optionally, your email address, the subject you select and your message. We also record the page from which the form was sent, the website language and the date and time of submission.

• Purpose: to respond to your request and to arrange an appointment.
• Legal basis: taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR). Because the subject you select (e.g. ‘Scoliosis brace’) may indirectly reveal information about your health, for those details we rely on your explicit consent, which you give by ticking the relevant box on the form (Article 9(2)(a) GDPR).
• Retention period: for as long as is needed to deal with your request and no later than 12 months after our last communication, unless a working relationship follows (see section 2.3).
• Storage: messages are stored in a database on the infrastructure of Cloudflare, Inc., which hosts the website (see sections 3 and 4).

2.2 Contact by telephone or email

When you call us or send us an email, we process your contact details and whatever you tell us solely in order to respond to your request (Article 6(1)(b) or (f) GDPR). We keep them for as long as is needed to deal with it, unless a legal obligation requires longer retention.

2.3 Customers and patients

When we serve you in our shop or workshop, we process identification and contact details (e.g. full name, father’s name, address, telephone number, email address, sex), the details required to process a medical prescription through EOPYY (the Greek National Organisation for the Provision of Health Services), and the health data contained in the order forms for the orthopaedic products we make for you.

• Purpose: making, fitting and delivering orthopaedic products, aftercare following delivery, and settlement of claims through EOPYY.
• Legal basis: performance of the contract (Article 6(1)(b)), compliance with legal obligations, e.g. tax obligations and obligations towards EOPYY (Article 6(1)(c)), and, for health data, the provision of health care by persons subject to an obligation of professional secrecy (Article 9(2)(h) and 9(3) GDPR).
• Retention period: up to 20 years, so that we can continue to serve you over the long term (repeat manufacture, replacements, monitoring your progress), unless the law provides otherwise.

2.4 Suppliers and business partners

To perform our contracts with suppliers, we process identification, contact and delivery details, as well as financial details. The legal basis is performance of the contract and compliance with legal obligations (Article 6(1)(b) and (c) GDPR). These details are kept for up to 12 years from the last transaction or for as long as tax and other relevant legislation requires.

2.5 Technical data and website security

When you visit the website, our hosting provider (Cloudflare) automatically processes technical data such as your IP address, the date and time of the request, the page requested and the type of browser. These data are necessary to display the website and to protect it from misuse, such as denial-of-service attacks. The legal basis is our legitimate interest in the security and proper operation of the website (Article 6(1)(f) GDPR). These data are kept for a limited period. Communication with the website always takes place over an encrypted connection (HTTPS).

2.6 Cookies, Google Analytics 4 and Google Ads

Only with your consent do we use Google Analytics 4, for visitor statistics, and Google Ads, to measure the effectiveness of our advertising (e.g. whether a visit from an advert led to a telephone call or a form submission). These process pseudonymised identifiers, device and browser details, the pages you visit and actions such as tapping the telephone number, the email address or the map directions, and submitting the form. The content of the form is not passed to Google.

We use Google Consent Mode (version 2): until you give consent, no statistics or advertising cookies are stored on your device. Google may nevertheless receive limited cookieless signals (e.g. that a visit took place, the type of device and the consent status). Google Analytics data are kept for up to 14 months.

The legal basis is your consent (Article 6(1)(a) GDPR and Article 4(5) of Greek Law 3471/2006). You may withdraw it at any time via the ‘Cookie settings’ link at the bottom of every page. For full details, see our Cookie policy.

2.7 Google map

The Google map on the Contact page loads only if you click ‘Show map’. Google then receives your IP address and other technical data and may store cookies, in accordance with its own privacy policy.

2.8 Our social media pages

We maintain pages on Facebook and Instagram. The website contains only links to them and does not load any Meta plug-ins. If you contact us through those pages, we process your username and whatever you send us in order to reply to you. For page statistics (Page Insights), we are joint controllers with Meta Platforms Ireland Ltd. Processing by Meta is governed by Meta’s privacy policy.

3. Who has access to your data

Only authorised members of our staff have access to your data, to the extent needed for their duties. In addition, depending on the case, data may be received by:

• Cloudflare, Inc.: website hosting, content delivery network, security protection, and storage of form messages and images. Processing may take place in data centres within the EU and in the USA.
• Google Ireland Ltd and Google LLC: Google Analytics, Google Ads and Google Maps, only as described in sections 2.6 and 2.7.
• the email provider through which the address info@i-hlamidis.gr operates;
• the website development and technical support provider, only where necessary for website maintenance;
• accountants, legal advisers and insurance companies, where required;
• EOPYY and other public authorities, where provided for by law or necessary to process a medical prescription.

We have agreements in accordance with Article 28 GDPR with those who process data on our behalf (processors). We do not sell or rent out your data.

4. Transfers outside the European Economic Area

Some providers, such as Cloudflare and Google, may process data in the USA. These transfers are based on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework, for providers certified under it, and on standard contractual clauses approved by the European Commission (Articles 45 and 46 GDPR).

5. Minors

We process the data of minor patients only through the persons exercising parental responsibility and for the purposes set out in section 2.3. The contact form and the cookie choices are not intended for children under 15; for a minor patient, the form should be completed by a parent or legal representative.

6. Data security

We take appropriate technical and organisational measures to protect your data against unauthorised access, loss or destruction, such as encrypted connections, restricting access to authorised persons only and authentication of website administrators.

7. Your rights

Under the GDPR, you have the right:

• of access to your data (Article 15);
• to rectification of inaccurate or incomplete data (Article 16);
• to erasure, where there is no obligation to retain the data (Article 17);
• to restriction of processing (Article 18);
• to data portability (Article 20);
• to object to processing, in particular where it is based on our legitimate interest (Article 21);
• to withdraw your consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

To exercise your rights, email info@i-hlamidis.gr or write to us at 101 Egnatia Street, 546 35 Thessaloniki, Greece. We will reply without undue delay and in any event within one month. In complex cases this period may be extended by a further two months, in which case we will let you know. We may ask you for information to confirm your identity.

We do not take decisions based solely on automated processing, including profiling, which produce legal effects concerning you.

8. Right to lodge a complaint with the supervisory authority

If you consider that the processing of your data infringes the law, you have the right to lodge a complaint with the Greek Data Protection Authority (HDPA, 1-3 Kifisias Avenue, 115 23 Athens, Greece, tel. +30 210 6475600, www.dpa.gr).

9. Changes to this policy

We may update this policy from time to time, for example when the services we use or the law change. The current version is always published on this page, with the date of the latest update.