Privacy policy
Last updated: August 2026
At The Koala Nest, we respect your privacy and are committed to protecting your personal data.
This Privacy Policy explains how The Koala Nest collects, uses, stores and protects personal data when you visit our website, use our online store, place an order, contact us, subscribe to communications, or otherwise interact with our Services.
The Koala Nest operates its online store using Shopify.
This Privacy Policy should be read together with our Terms of Service, Return & Refund Policy and other policies available on our website.
- WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA?
For the purposes of applicable data protection legislation, including the General Data Protection Regulation (EU) 2016/679 (GDPR), The Koala Nest acts as the controller of the personal data processed in connection with our website and services, except where another party acts as an independent controller for its own processing activities.
Our contact details:
The Koala Nest
Georgiou Katechaki 3
54627 Thessaloniki
Greece
Email: info@thekoalanest.gr
Phone: +30 6973268036
GEMI: 120047104000
VAT: EL051531775
For privacy-related questions or requests concerning your personal data, please contact us at info@thekoalanest.gr.
- WHAT PERSONAL DATA DO WE COLLECT?
Depending on how you interact with our website and Services, we may collect and process the following categories of personal data.
Contact and identification information may include your full name, email address, telephone number, billing address, shipping address and other information you provide when contacting us.
Order and transaction information may include products purchased, order number, order date, order value, delivery information, payment status, returns, refunds, cancellation information and other information necessary to process your order.
Payment information may be processed by the payment providers available at checkout. We may receive information such as payment status, transaction reference and payment confirmation. Where payment information is processed directly by a payment provider, such as card details, we generally do not have access to the complete payment card information.
When you contact us by email, contact form or another communication method, we may process the information contained in your communication, including your contact details and the contents of your message.
When you visit our website, certain technical information may be collected automatically depending on your device, browser and cookie settings. This may include your IP address, browser type, device type, operating system, language and regional settings, referring website, pages viewed, date and time of access, interaction with our website, technical identifiers and similar information.
We may also use cookies and similar technologies to operate our website, remember preferences, provide functionality, understand website usage and, where permitted and with your consent where required, support analytics and marketing activities.
- HOW DO WE COLLECT YOUR PERSONAL DATA?
We may collect personal data directly from you when you place an order, create or use an account where available, contact us, subscribe to marketing communications, submit a review or other content, or otherwise provide information to us.
We may also collect certain information automatically when you browse or interact with our website.
Personal data may also be processed through Shopify and other service providers that support our online store.
We may receive necessary information from payment, delivery and other service providers where required to provide our Services.
- WHY DO WE USE YOUR PERSONAL DATA?
We process personal data only where we have a valid legal basis under applicable data protection law.
We may use your personal data to process and fulfil orders, prepare and manufacture products, process payments, arrange delivery, provide order updates, process cancellations, returns and refunds, and provide customer support.
The legal basis for this processing is generally the performance of a contract with you.
We may use your information to respond to questions, complaints, requests and other communications. The legal basis may be the performance of a contract, compliance with a legal obligation or our legitimate interests, depending on the circumstances.
We may process personal data when necessary to comply with tax and accounting obligations, maintain legally required records, respond to lawful requests from public authorities, establish, exercise or defend legal claims, or comply with other legal obligations.
We may process technical information to operate, maintain and secure our website, detect fraud, prevent abuse and protect our systems and customers. The legal basis may be our legitimate interests in operating and securing our business and website, or another applicable legal basis.
Where permitted by applicable law, we may send promotional communications about our products, collections, offers or other updates. Where consent is required, we will obtain your consent before sending marketing communications.
You may withdraw your consent or unsubscribe from marketing communications at any time.
Where applicable and where required by law, we may use analytics and advertising technologies to understand how visitors use our website and to measure or improve our advertising.
Where consent is required, these technologies will only be activated after you provide the appropriate consent through our cookie consent mechanism.
- LEGAL BASES FOR PROCESSING
Depending on the circumstances, we rely on one or more of the following legal bases under the GDPR.
Performance of a contract: for processing and fulfilling your orders and providing requested services.
Legal obligation: where processing is necessary to comply with applicable laws.
Consent: where you have given consent, for example for certain marketing activities or non-essential cookies.
Legitimate interests: where processing is necessary for legitimate business interests, such as website security, fraud prevention, customer service and the management and protection of our business, provided that these interests do not override your fundamental rights and freedoms.
Where we rely on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
- WHO MAY RECEIVE YOUR PERSONAL DATA?
We may share personal data with trusted service providers where necessary to operate our business and provide our Services.
These may include Shopify, payment providers, shipping and delivery providers, technology and service providers, analytics providers, customer support providers, email and marketing providers, fraud prevention providers and cloud storage providers.
Our online store is powered by Shopify. Shopify may process personal data on our behalf and may also process certain data for its own purposes as an independent controller.
Payment information may be processed by the payment providers available through our checkout.
We may share necessary information such as your name, telephone number, delivery address and order details with shipping and delivery providers in order to deliver your order. This may include Box Now or another courier or delivery provider selected or made available by us.
We may also share personal data with public authorities, professional advisers or other parties where required by law or where necessary to establish, exercise or defend legal claims.
- SHOPIFY
Our online store is hosted and powered by Shopify.
Shopify provides the technology and infrastructure that enables us to operate our online store, process and manage orders and provide website functionality.
Shopify may process personal data in accordance with its own privacy terms and applicable laws.
- INTERNATIONAL DATA TRANSFERS
Some of our service providers may process personal data outside the European Economic Area (EEA).
Where personal data is transferred outside the EEA, we will rely on an appropriate legal mechanism under applicable data protection law, such as an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism where required.
Where appropriate, we will take reasonable steps to ensure that your personal data continues to receive an appropriate level of protection.
- HOW LONG DO WE KEEP YOUR PERSONAL DATA?
We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required or permitted by law.
The retention period depends on the type of information and the reason for processing.
Order and transaction information may be retained for as long as necessary to fulfil the order, manage returns or disputes and comply with tax, accounting and legal obligations.
Customer service communications may be retained for as long as reasonably necessary to handle the matter and maintain appropriate business records.
Marketing information may be retained until you withdraw your consent or unsubscribe, unless another lawful basis applies.
Cookie and analytics information is retained according to the applicable cookie settings and the retention periods of the relevant technologies.
When personal data is no longer necessary, we will delete it or securely anonymise it where appropriate.
- YOUR RIGHTS UNDER THE GDPR
Subject to the conditions and limitations provided by applicable law, you may have the following rights.
You may request access to the personal data we hold about you and information about how we process it.
You may request correction of inaccurate or incomplete personal data.
You may request deletion of your personal data in certain circumstances. This right is not absolute and may not apply where we are legally required to retain certain information.
You may request restriction of the processing of your personal data in certain circumstances.
You may object to certain processing based on legitimate interests.
You have an unconditional right to object to the processing of your personal data for direct marketing purposes.
Where applicable, you may request to receive personal data that you have provided to us in a structured, commonly used and machine-readable format and request its transmission to another controller.
Where we process your personal data based on consent, you may withdraw your consent at any time. Withdrawal of consent does not affect processing carried out before the withdrawal.
- HOW TO EXERCISE YOUR RIGHTS
To exercise your rights or ask questions about the processing of your personal data, please contact us at:
Please provide enough information for us to identify your request and, where necessary, verify your identity.
We will normally respond to valid GDPR requests within one month of receiving the request. This period may be extended where permitted by law, particularly in cases involving complex or numerous requests.
The exercise of your rights is generally free of charge, although applicable law permits reasonable fees in certain circumstances, such as manifestly unfounded or excessive requests.
- MARKETING COMMUNICATIONS
If you choose to subscribe to our marketing communications, we may use your contact details to send you information about new products, new collections, special offers, promotions, seasonal products and The Koala Nest updates.
Where consent is required, we will only send marketing communications after receiving your consent.
You can unsubscribe at any time by using the unsubscribe option included in our marketing emails or by contacting us at info@thekoalanest.gr.
Unsubscribing from marketing communications does not prevent us from sending necessary non-marketing communications, such as order confirmations, shipping updates, refund information or other transactional messages.
- COOKIES AND SIMILAR TECHNOLOGIES
Our website may use cookies and similar technologies.
Some cookies are necessary for the operation and security of the website, including functions such as shopping cart functionality, checkout and other essential features.
Other cookies may be used for purposes such as analytics, understanding website performance, remembering preferences, marketing, advertising and measuring advertising performance.
Where applicable law requires consent for non-essential cookies, we will request your consent through our cookie consent mechanism.
You may manage your cookie preferences through the cookie settings available on our website.
- CHILDREN'S PRIVACY
Our Services are intended for general consumers and are not specifically directed at children.
We do not knowingly collect personal data from children where such collection is prohibited by applicable law.
If you believe that a child has provided us with personal data in circumstances where this is not permitted, please contact us at info@thekoalanest.gr.
We will take appropriate steps to investigate and, where legally required, delete the information.
- DATA SECURITY
We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.
However, no method of transmission or electronic storage can be guaranteed to be completely secure.
We therefore cannot guarantee absolute security of personal data.
- THIRD-PARTY WEBSITES AND SERVICES
Our website may contain links to third-party websites, services or social media platforms.
These third parties may process personal data independently and according to their own privacy policies.
We are not responsible for the privacy practices or content of third-party websites or services that we do not control.
We encourage you to review the privacy policies of third-party services before providing them with personal data.
- SOCIAL MEDIA AND ADVERTISING
We may use social media and advertising services, including platforms such as Meta, Instagram or other advertising providers, to promote The Koala Nest and measure advertising performance.
Where these services involve cookies, tracking technologies or other processing that requires consent under applicable law, we will rely on the relevant consent mechanism before activating such technologies.
These platforms may process personal data according to their own privacy policies and may act as independent controllers for certain processing activities.
- REVIEWS AND CUSTOMER CONTENT
If you submit a product review, photograph, comment, testimonial or other content to The Koala Nest, we may process the personal data included in that submission.
Where you voluntarily provide content for publication, you acknowledge that the information you choose to publish may become publicly visible.
Please do not include sensitive personal information in reviews or other public submissions.
- DATA BREACHES
In the event of a personal data breach, we will assess the incident and take the measures required by applicable data protection law.
Where legally required, we will notify the competent supervisory authority and/or affected individuals within the applicable statutory time limits.
- COMPLAINTS
If you have concerns about the way we process your personal data, we encourage you to contact us first at:
You also have the right to lodge a complaint with the competent data protection supervisory authority.
For Greece, the competent supervisory authority is:
Hellenic Data Protection Authority (HDPA)
Kifisias 1-3
115 23 Athens
Greece
Website: www.dpa.gr
- CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy from time to time to reflect changes in our business, Services, technology, legal requirements or data processing practices.
When we update this Privacy Policy, we will change the "Last updated" date at the top of this page.
Where required by applicable law, we will provide additional notice of material changes.
- CONTACT US
If you have any questions about this Privacy Policy, our privacy practices or the processing of your personal data, please contact us:
The Koala Nest
Georgiou Katechaki 3
54627 Thessaloniki
Greece
Email: info@thekoalanest.gr
Phone: +30 6973268036
GEMI: 120047104000
VAT: EL051531775
For privacy-related requests: