Free delivery all over Cyprus (orders over €100.00)
Privacy Policy
Last updated: 06/10/2026
This policy explains what personal data the CONCREX online shop collects, why, how long we keep it and what your rights are under the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Cyprus Law 125(I)/2018.
1. Who is responsible for your data
The data controller is PRISE LTD (company reg. no. HE446746, VAT CY60009901W), Psaron 15B, Ayios Pavlos 2362, Nicosia, Cyprus, trading as CONCREX.
For any privacy question or request: concrex@concrex-con.com · 7000 11 75.
We are not required to appoint a Data Protection Officer; the contact above handles all privacy matters.
2. What we collect, why, and on what legal basis
| When | Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| You place an order (as guest or with an account) | Name, email, phone, delivery address, order notes, products, amounts, payment method and status | Process, deliver and support your order; issue invoices; handle returns and warranty | (1)(b) contract; (1)(c) legal obligation for accounting/tax records |
| You create an account | Name, email, password (stored only as a secure hash — we cannot see it), optionally phone and address | Sign-in, order history, faster checkout | (1)(b) contract |
| You pay by card | Card details are entered only on Viva's secure payment page. We never see or store card numbers. We receive a transaction ID and the payment result. | Take payment, prevent fraud | (1)(b) contract |
| You use the contact form | Name, email, phone (optional), your message | Answer your question. The message is emailed to us and not stored in the shop database. | (1)(b) steps before a contract / (1)(f) legitimate interest in replying |
| You request a password reset | Email, a one-time token (stored hashed) | Let you set a new password | (1)(b) contract |
| You receive or use a voucher | Voucher code, the email it was issued to, the order or service job where it was used, the date, the discount and (for service vouchers) a short job reference | Apply the discount, stop codes being used more than allowed, and honour the voucher for CONCREX services such as VUBA installations | (1)(b) contract |
| Security | A one-way hash of your IP address after failed sign-in attempts; standard server logs kept by our hosting provider | Protect accounts against password-guessing and abuse | (1)(f) legitimate interest in security |
We only send service emails (order confirmation, order status, password reset). We do not send newsletters or marketing. If we ever do, it will be only with your separate, explicit consent, which you can withdraw at any time.
Giving your name, contact and delivery details is necessary to fulfil an order; without them we cannot deliver. Everything else is optional.
3. Who receives your data
- Delivery partner / courier — name, phone and address, only to deliver your order.
- Viva (Viva Payment Services S.A., viva.com) — our card payment provider. Viva acts as an independent controller for payment data under its own privacy policy.
- Hosting and email providers (GoDaddy) — store the shop and send our emails, acting as processors under a data-processing agreement.
- Accountants and public authorities — only where the law requires (e.g. tax inspections).
We never sell or rent your personal data.
4. Transfers outside the EU
The shop database is hosted on servers in the European Union. Where a provider (e.g. a US parent company) may access data from outside the EU/EEA, the transfer is protected by the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework.
5. How long we keep it
- Orders and invoices: 6 years from the order, as required by Cyprus tax and accounting law. After that the personal details are anonymised.
- Your account: until you delete it (you can do this yourself in My account). Orders linked to a deleted account are kept, unlinked, only for the legal period above.
- Password-reset tokens: 1 hour. Sign-in attempt records: 24 hours.
- Contact-form emails: as long as needed to answer, and no longer than 2 years.
- Cookie choice: 6 months (see the Cookie Policy).
6. Your rights
You have the right to: access your data; rectify it; have it erased; restrict processing; receive it in a portable format (portability); object to processing based on legitimate interest; and withdraw consent at any time where processing is based on consent.
Self-service: in My account you can edit your details, download all your data (JSON) and delete your account.
Otherwise email concrex@concrex-con.com. We reply within one month, free of charge. We may ask you to confirm your identity.
If you are not satisfied, you can complain to the Commissioner for Personal Data Protection of Cyprus — www.dataprotection.gov.cy — or to the authority in your EU country of residence.
7. Security
The site uses HTTPS encryption. Passwords are stored with a strong one-way hash (bcrypt). Forms are protected against cross-site request forgery, sign-in attempts are rate-limited, and only authorised staff can access order data in the admin area.
8. Other information
- We do not use automated decision-making or profiling.
- The shop is intended for adults (18+). We do not knowingly collect data from children.
- Cookies are explained in the Cookie Policy.
- We may update this policy; the date at the top shows the latest version. Significant changes will be announced on the site.