Privacy Policy for IKEA.gr

PRIVACY POLICY

Each person visiting the website www.ikea.gr (user) can navigate its webpages and make use of its services and content either as visitor or as registered user and processing of their personal data resulting of such access is subject to the present policy. For specific services (such as the Home Furinishing Advice etc.) additional policies apply and the user is notified when ordering these services.

Any user who wishes to make an online purchase from www.ikea.gr may also choose two (2) ways to complete it: either as a visitor (guest) or as a registered user.

1 Lawfulness and Purpose of Processing, Transparency, and Data Accuracy

The company under the name HOUSEMARKET S.A. with registered address at: Peania Attica, (Athens International Airport “El. Venizelos”, Building 501, Airport Commercial Park P.C. 190 02, hereinafter referred to as “HOUSEMARKET S.A.”, is the controller of the personal data of any given visitor/registered user on the website www.ikea.gr and controls the processing of its data. HOUSEMARKET S.A. informs the users of its website on the following:

1.a For the processing of the personal data related to the navigation of the content and performance of online purchases on the website www.ikea.gr, HOUSEMARKET S.A. relies on the following legal bases:

Performance of a contract (Article 6, paragraph 1, letter (b) of the GDPR): In order to achieve the purpose of the performance of the distance sales contract and, in particular, to enable the user to complete its orders in www.ikea.gr, it is necessary to process the personal data provided by the user in the order form when placing his/her order and to record and track the user’s transactions. The purpose of this necessary data processing is the completion of each order, the communication and the notification messages concerning the order processing steps, the provision of any clarifications related to the order and generally the analysis and information for the purchases the user has made in order to fulfill HOUSEMARKET S.A. contractual obligations (including taking actions related to the commercial guarantee provided by HOUSEMARKET S.A.), the delivery of the order to the selected address, the identification and verification of the user, where necessary, deliveries to the user related to the performance of an order/request, and the notification on the existing product stock, as well as other purposes related to the orders via the online shop, as described in the General Terms and Conditions of the Website and Online Shop of HOUSEMARKET S.A. (e.g. for the purposes of products return etc.); in addition, the facilitation of registered users by creating a user account with completed pricing and shipping data, information about his/her purchases, management of his/her commercial communication preferences and if he/she is also a member of the IKEA Family customer loyalty program of HOUSEMARKET S.A. and makes purchases through www.ikea.gr, his/her rewarding with points and privileges resulting from his/her purchases.
Legitimate interests (Article 6, paragraph 1, letter (f) of the GDPR): Some processing of the personal data is required for the improvement of the services provided by HOUSEMARKET S.A.,the evaluation of our products and services, customer satisfaction surveys, the participation of our customers in live product presentations on our website, the detection of fraud attempt or misuse and any collaboration with judicial and regulatory authorities. In case you contact us with a question related to our products and services before making a purchase or receiving a service, we will need some of your data to be able to answer you, as it is in our legal interest to facilitate the consumers when making their purchases so that they can have a great shopping experience from our stores. Also, data processing is necessary for the regular communication with the visitor and/or the registered user via telephone, mail, email, mobile phone message (SMS) or any other appropriate means of communication using the user’s contact information, which has been lawfully obtained, during the use of ikea.gr , in relation to the products and services offered by HOUSEMARKET S.A. within the context of their transactional relationship, according to ePrivacy Directive and for as long as the user does not object to such communication. This communication may include information on HOUSEMARKET S.A. products/services and/or promotions and/or competitions, surveys, in order to improve its products and services provided to its customers as well as other promotional activities for similar purposes. In addition, HOUSEMARKET S.A. may communicate with the visitor and/or registered user via OTT messaging services such as Viber, WhatsApp etc, for the purposes of better communication and cost efficiency. Registered users are able to choose the means of communication used by HOUSEMARKET S.A. through their personal account on www.ikea.gr. Changes to these communication preferences may take up to 30 days to become active, due to technical reasons. Finally, HOUSEMARKET S.A. considers that its legitimate interests include the presentation and promotion of the company and its stores, as well as its products and services on social media and other Information Society Services, also allowing other users of these networks to participate in promotions as well as to declare that they like ("like") our page and to post comments about our products/services.
For compliance with HOUSEMARKET S.A. legal obligations (Article 6, paragraph 1, letter (c) of the GDPR): such could be, for example, obligations under tax legislation, accounting legislation, etc. The purposes of processing in those cases are the compliance with the respective legal obligation by HOUSEMARKET S.A. under the applicable legislation.

1.b.Every registered user has the right but also the obligation to access, rectify and update his/her personal data that he/she discloses and must notify HOUSEMARKET S.A. for any change in his/her personal information entered during his/her registration in the HOUSEMARKET S.A. electronic store (e-shop) for his/her own better service. ΙΚΕΑ Family members placing orders on www.ikea.gr are also subject to the ΙΚΕΑ Family program terms (https://www.ikea.gr/en/ikea-family/terms-and-conditions/).

1.c.For the users of our website who participate in online live presentations of our products through our website www.ikea.gr, we collect only the username they choose to use to participate and comment on the presentations. No processing of personal data is required when visitors of our website review and leave comments on our products and services through the special forms on our website www.ikea.gr , however please note that if those visitors voluntarily disclose personal data, such data shall be processed and protected in accordance with this policy.

2 Processing and categories of personal data. Rights of the visitors/registered users

a) Processing of Personal Data: For online purchases, HOUSEMARKET S.A. will process the user's personal data completed by him/her during the creation of his account and/or in his order registration form, in order to complete his/her specific order through our online store. Each user of the online store www.ikea.gr may choose 2 ways to complete an online purchase order and to enter his/her personal data:

As a visitor: In this case the visitor’s collected personal data will be retained in a form allowing identification by HOUSEMARKET S.A. for forty (40) days from the delivery or completion/cancellation of the specific order and the data processing will concern only the performance of the distance sales contract and other purposes of processing stated in this Privacy Policy (after that 40-day period the data will be anonymized). Certain data, however, proving the conclusion and fulfillment of the transaction and/or other data related to the transaction, as well as proof for the notification for the processing of the personal data, shall be retained in a form allowing identification after the expiry of that period (under the previous sentence) for compliance with legal obligations of HOUSEMARKET S.A. (e.g. for tax purposes) and/or for the establishment, exercise and/or defence of legal claims. Also, even after the 40-day period, the visitor’s contact data will be retained and used by HOUSEMARKET S.A. for marketing purposes, unless the user has stated that he does not wish such communication (opt-out).
As a registered user of the e-shop: In this case the user has created a user account in our e-shop and his/her personal data will be retained in a form allowing identification by HOUSEMARKET S.A. until the user requests the deletion of his/her account (after he/she makes such a request his/her data will be anonymized). Certain data, however, proving the conclusion and/or fulfillment of the transactions and other data related to the transactions, as well as proof for the notification for the processing of the personal data, shall be retained in a form allowing identification for compliance with legal obligations of HOUSEMARKET S.A. (e.g. for tax purposes) and/or for the establishment, exercise and/or defence of legal claims. Also, even after the registered user requests the deletion of his/her account, its contact data will be retained and used by HOUSEMARKET S.A. for marketing purposes, unless he/she has stated that he/she does not wish such communication (opt-out). Once a year, HOUSEMARKET S.A. may request from the registered user to confirm the accuracy of his/her data retained and update such data if changes have occurred. The registered user can, at any time, change or rectify his/her data by logging into his/her account in www.ikea.gr (login) with his/her username and password.

b) Personal Data Category

In particular, the personal data each user must provide (regardless of whether it places an online order as a visitor or a registered user) in order to carry out any transaction through the HOUSEMARKET S.A. e-shop (www.ikea.gr) and to place orders of its products/services are the following:

the user’s first and family name
the shipping address for the products/services ordered
the billing address (in case it is different from the shipping address)
invoicing information (in case an invoice has been requested)
contact telephone number
the user’s e-mail address.

In addition to the above, HOUSEMARKET S.A. also collects and stores the following personal data for the registered users:

order history
frequency of visits
products/services in the cart or wish list
participation in promotions.

In the event that products/services are requested to be delivered to a third party other than the visitor or the registered user, the latter acknowledges that he/she is fully responsible to notify and to obtain proper consent from the designated recipient, for the communication of the recipient’s personal data to HOUSEMARKET S.A. for the sole purpose of delivering the relevant products/services, and assumes full responsibility for any claims made by that person (recipient) against HOUSEMARKET S.A..

The credit/debit card details used by the visitor or the registered user are not retained by HOUSEMARKET S.A. during the transaction but are entered directly in the secure environment of the partner company (Euronet) that has undertaken the credit/debit card billing and processing.

The visitor and the registered user are also informed that, as far as the communication with them by HOUSEMARKET S.A. is concerned, HOUSEMARKET S.A. processes the contact information that the user has provided in accordance with the applicable legislation. In addition, when the notification for changes of the General Terms and Conditions of the Website and Online Shop of HOUSEMARKET S.A. and the present Privacy Policy are sent through SMS/viber/email etc. messaging services to the user and contain a hyperlink, it is possible to record the IP address of his/her electronic device (mobile, tablet, computer, etc.) in order to be able to prove that the user did receive the update.

For the users of our website who participate in online live presentations of our products through our website www.ikea.gr, we collect only the username they choose to use to participate and comment on the presentations.

No processing of personal data is required when visitors of our website review and leave comments on our products and services through the special forms on our website www.ikea.gr , however please note that if those visitors voluntarily disclose personal data, such data shall be processed and protected in accordance with this policy

c. Data recipients: For each of the processing purposes user data may be transferred to the following parties:

The respective employees of HOUSEMARKET S.A.
The tax, etc. authorities in case of a relevant audit and/or other authorities as provided by law
The company which provides customer management services regarding HOUSEMARKET S.A. physical and electronic stores, as well as of members of the loyalty programs (CRM services) and which has undertaken inter alia the registration, updating and maintenance of the relevant database as data processor on behalf of HOUSEMARKET S.A. according to the HOUSEMARKET S.A. specific written instructions and/or any other company which may render to HOUSEMARKET S.A. similar data processing services in the future instead of or in cooperation with the above company.
External partners providing HOUSEMARKET S.A. with internet services, storage and management of online orders, courier services or group delivery of products, product assembly services and sales data analysis services, e-commerce service providers, online content providers and organizers of events such as live product presentations, service providers offering product review services and services related to visitor satisfaction measurement and customer service call centers, as well as other persons providing services to HOUSEMARKET S.A.. and which are subject to specific strict data processing conditions agreed with HOUSEMARKET S.A. as the Data Controller.
In view of the sending of communication through SMS and OTT messaging services (such as Viber, WhatsApp, etc.) certain personal data is provided to the respective service providers and mobile operators. For more information about this data processing, please see the respective terms and privacy policies applied by the respective service providers/mobile operators.

For all data collecting and processing procedures, HOUSEMARKET S.A. requires by its employees, processors and agents to fully comply with the provisions of the EU General Data Protection Regulation 2016/679 (GDPR) as well as with the applicable national laws in force in relation to personal data protection and they are bound by contractually agreed compliance obligations. HOUSEMARKET S.A. requires its employees, website providers, as well as its third-party partners to take all necessary technical and organizational measures (including appropriate policies and procedures to prevent the disclosure of the personal data of its visitors/registered users and to have adopted and implemented procedures for the personal data management and processing in a manner that is lawful and ensures protection in accordance with the GDPR).

d) Data subject rights:
Any visitor or registered user, as a data subject, may exercise his/her rights at any time, as provided for in the General Data Protection Regulation 679/2016 EU, and in particular Articles 12 to 23 thereof and the national legislation; more specifically:

the right to receive information and obtain access to and/or to receive copy of the data processed by HOUSEMARKET S.A.: the data subject has the right to receive confirmation if personal data related to him/her are being processed and, if so, to receive access to the data and information related to them, as well as a copy of this data.
the right to restrict the processing of his/her data: the data subject may require from HOUSEMARKET S.A. the restriction of processing of personal data concerning him/her.
the right to rectify/complete or erase some or all (the right to erasure all data is also called “right to be forgotten”) of his/her personal data: the data subject may require from us the rectification of inaccurate personal data concerning him/her, the completion of incomplete personal data concerning him/her (taking into account the purposes of the processing), as well as the erasure of personal data concerning him/her.
the right to object, that is to oppose the processing of his personal data: the data subject has the right, at any time and on grounds relating to his/her particular situation, to object to the processing of personal data that is based on legitimate interest.
the right to data portability: If HOUSEMARKET S.A. processes personal data on the basis “performance of a contract to which the data subject is a party” or on the basis “consent”, the data subject may require from HOUSEMARKET that the data subject receives the personal data in a structured, commonly used and machine-readable format and/or that HOUSEMARKET S.A. transmits the personal data to another personal data controller.

HOUSEMARKET will take the actions requested by the data subject (by exercising any of the above-mentioned rights) only where the conditions regarding the respective right under the General Data Protection Regulation 679/2016 EU are met.

The aforementioned rights may be exercised as follows:
To exercise the right to access, to erase (in part or in its entirety) or to rectify/complete their personal data, HOUSEMARKET S.A. provides the opportunity to registered users of the www.ikea.gr website to view, rectify/complete their personal data through their personal account on the www.ikea.gr website, using the menu option “My Account” and the field “Personal Details” or to request access, partial or total erasure or rectification/completion of their data via email to cs.ecommerce@ikea.gr or dpo@fourlis.gr. .Users of www.ikea.gr who place orders as visitors can exercise the above rights by sending an e-mail to cs.ecommerce@ikea.gr or dpo@fourlis.gr.

To exercise the right to manage commercial communications by HOUSEMARKET S.A. on any or all channels of communication (email, SMS or Viber on mobile phone, etc.) any registered user can manage them through his/her personal account in www.ikea.gr using the menu option "Personal Data Management" (applies only to registered users) or by sending an e-mail (email) to cs.ecommerce@ikea.gr or dpo@fourlis.gr.

Regarding the right of data portability, HOUSEMARKET S.A. provides the option the data subjects to obtain their personal data in a structured, commonly used and machine-readable format or/and have them transmitted to another data controller, by submitting the relevant request to the e-mail address: cs.ecommerce@ikea.gr or dpo@fourlis.gr.

HOUSEMARKET S.A. shall take any reasonable and technically feasible steps to satisfy the data subject’s request within one (1) month as of the date of the valid submission of such request. In such a case, the data subject is notified that there is a minimum of its data that is necessary to be retained by HOUSEMARKET S.A., in order to safeguard its legitimate interests. It is also noted that in order to submit a valid request, proper identification of the user is required so as to ensure that the person submitting a data subject’s request is the actual data subject of the specific relevant data.

The account deletion of the registered user of www.ikea.gr may be performed via email request to the e-mail address: cs.ecommerce@ikea.gr . In addition, in the event that a registered user is also a member of the IKEA Family loyalty program and has linked his IKEA Family card with his/her registered user account in the e-shop located at www.ikea.gr , such user must be aware that his/her account with IKEA Family and the related personal data will be retained without being erased even if the registered user account in www.ikea.gr is deleted, since this electronic account (of the registered user) constitutes a distinct means of trading with HOUSEMARKET S.A. MARKET and serves a different purpose of processing of the collected data.

e) Data retention period: The personal data of the user who places an order as a visitor will be anonymized HOUSEMARKET S.A. after forty (40) days from the completion or cancellation of the specific order. The data of the registered user shall be retained and processed by HOUSEMARKET S.A. until the registered user requests the deletion of his/her account. Nevertheless, some required personal data relating to the transactions of the registered user/visitor with HOUSEMARKET S.A. as well as proof for the notification for the processing of his/her data may be retained as information about the visitor or the registered user as a means of proving the lawful processing of such data by HOUSEMARKET S.A. and/or for ensuring the legal claims of the parties and/or for the compliance with legal obligations, e.g. for tax purposes.

Your data and comments collected by HOUSEMARKET A.E. when you communicate with the company either by using the online contact form at www.ikea.gr , or leaving comments or making reviews of products and services of HOUSEMARKET S.A. and customer satisfaction surveys, or via email or by phone, concerning issues handled by the Customer Service Department, are retained by the company Customer Service Department for 2 years starting from the date of your contact and then anonymized for statistical purposes.

For members of the ΙΚΕΑ FAMILY Program completing purchases in www.ikea.gr, the terms and conditions of the ΙΚΕΑ FAMILY Program also apply.

f) Special Categories of Personal Data: For the purposes of this processing, HOUSEMARKET S.A. neither collects, nor requires the disclosure of sensitive personal data (special categories of personal data).

g) Transparency Obligation: For any information regarding user data as well as its processing and protection, any data subject may address the Data Protection Officer of HOUSEMARKET S.A. (DPO) at dpo@fourlis.gr and in the call line 210 6293011.

Right to lodge a complaint:
The user is hereby informed that he/she has the right to file a complaint before the competent supervisory authority (Data Protection Authority, www.dpa.gr, Kifisias 1-3, P.C. 115 23, Athens)

h) Technical and Organizational Measures: HOUSEMARKET S.A., its processors and agents are contractually bind to implement the appropriate technical and organizational measures to protect, as best as possible, the personal data against accidental or unlawful destruction or loss, alteration, unlawful disclosure or access and, generally, to ensure its lawful processing (including remote data access) as well as to secure the possibility of restoring data availability and access. These measures are intended to establish a level of security that responds to the risks presented by the data processing in question, taking into account the nature and criticality of the data, the technological developments, the cost of implementation and the nature, scope, context and purposes of each particular processing, by implementing procedures for the regular testing, assessment and evaluation of the effectiveness of those techniques and organizational measures. In any case, HOUSEMARKET S.A., its processors and its agents/collaborators commit to maintaining the confidentiality of the personal data and to not disclose or allow access to the personal data to any third party without prior notification of the data subject except when such access is expressly provided for by law.

i) Social Plug-ins, Buttons Facebook, Instagram, Twitter, Youtube, Pinterest etc.: You can use them if you want. These buttons link to third-party websites that collect and process personal data in accordance with their own policies. We are not responsible for the content of or data processing performed by these websites, and it is your responsibility to be informed about their own privacy policies. We have set these additions to make our Website more functional for its visitors, as well as to advertise our activity and services if you voluntarily share our content on the respective websites. We consider it as our legitimate interest to appear on these social networks and to try to promote our products and services. We rely on our legitimate interests to establish a presence on electronic social networks and to attempt to promote our products and services. If you express your preference on our webpage (e.g. you "like" our page) or followed us ("follow") on an online social networking service, this means, according to the practices of the respective social networks, that you will see messages, advertisements or material posted by us on our respective social media page and that we will obtain information of your public profile in the same social media. If you submit a question through the corresponding page or make a post, it will be visible to all "friends" and "followers" of our page on that specific social network and we can use the features provided by the same network to respond to you. If you send us a personal or direct message (PM or DM), you should know that its content will be accessible, on a case-by-case basis, by certain HOUSEMARKET S.A. employees, as well as third parties assigned with the management of our social media pages and activity. You should not post on our social media pages or send us messages with offensive or illegal content and you should not share with us personal data of third parties unless you have obtained these parties’ valid consent. You should also not post on our social media pages or use these means of communication to send us any sensitive (special category) data or data of minors, because we cannot ensure the security and limitation of access to these data. Any post or personal/direct message that does not comply with these limitations will be deleted and the user's details may be given to the competent authorities if the post or the message also constitutes an illegal act.

j) Links to third party websites, plug-ins and applications: The website www.ikea.gr may include links to websites, plug-ins and applications of third parties. Clicking on these links or activating these links may allow third parties to collect or share data about the user HOUSEMARKET S.A. does not control these third-party websites and is not responsible for their privacy statements and the processing of personal data performed by them. In case the user leaves website ikea.gr, HOUSEMARKET S.A. recommends him/her to read the privacy statement on any website he/she visits. Putting these references on the website www.ikea.gr is based on HOUSEMARKET S.A. legitimate interest for improving its services and developing its activity.

3. Security

The SSL protocol (Secure Sockets Layer) is currently the global standard on the internet for website certification to web users and for the encryption of data between network users and web servers. An encrypted SSL communication requires all information sent between a user and a server to be encrypted by the sending software and decrypted by the accepting software, thus protecting personal information during transfer. In addition, all information transmitted with SSL is protected by a mechanism that automatically determines whether the data has been changed during transmission.

In addition, the password you set when you register to www.ikea.gr constitutes personal security. To allow access to your online account and your personal information available, you must first enter the username and password. For this reason, you must keep this information secure, so it does not fall into the hands of unauthorized third parties. We also advise you to create a password using symbols in combination with alphanumeric characters. Finally, please remember that credit/debit card information is not stored in the company's database during the transaction but entered directly in the secure environment of our partner company (Euronet) that handles the credit/debit card transactions to which you are redirected to complete the purchase.

HOUSEMARKET S.A. shall not use the users’ personal data for any purpose other than those stated in these this Privacy Policy without prior notification, and, where necessary, explicit consent by the data subject.

HOUSEMARKET S.A. may change the present Privacy Policy at any time. You should check it regularly for any changes.

Important note: In July 2020 the Court of Justice of the European Union (CJEU) invalidated the EU-US Privacy Shield Framework, the mechanism through which companies could transfer personal information or data to the United States in compliance with the General Data Protection Regulation (GDPR). Until this decision from the CJEU, data transfers within Google Analytics were based on this Framework. After the decision, data transfers are based on Standard Contractual Clauses provided by Google (article 46 GDPR) and, auxiliary, on your explicit consent, according to the terms set by article 49.1a GDPR, in the absence of an adequacy decision. Data subjects should be aware that their data may be used for profiling by Google and be transferred to the US and a competent public or security authority may be granted access to them, according to the USA security framework. You can view our Cookies Policy here.