Privacy Statement

1. Who is responsible

Controller within the meaning of GDPR Art. 4 (7): Frantzis Motorservices Limited (“we”, “us”), Registration Number HE 174429, 137 Franklin Roosevelt, 3045 Limassol, Cyprus. Email: info@frantzismotorservices.com. Telephone: +357 25762222.

Data Protection Officer (DPO): Milos Karan, +357 7000 7001, mk@frantzisgroup.com.

2. What we collect

• When you visit the website: technical data such as your IP address, browser and device type, the pages you open and the time of your visit. Our hosting providers keep this in server logs for security and to keep the site running.
• Contact form: your name, email address, phone number (optional) and your message.
• Booking request: your name, email address, phone number, car model, VIN (optional), the reason for the visit, your preferred date and any notes.
• Online shop orders: your name, billing and delivery or pickup details, phone number, email address, company name and VAT number (optional), VIN (optional), the parts ordered and any order notes.
• Shop account: your email address, name, phone number and company details. Your password is stored only in encrypted (hashed) form.
• Card payments: you enter your card details on the secure payment page of JCC Payment Systems. We never see or store your card number; we receive only the result of the payment.

You are not obliged to give us personal data, but without it we cannot answer an enquiry, confirm a booking or process an order.

3. Why we use it, and on what legal basis

• To answer enquiries and booking requests: steps taken at your request before a contract (GDPR Art. 6 (1) (b)).
• To process, deliver and take payment for orders, and to handle returns and warranty claims: performance of a contract (GDPR Art. 6 (1) (b)).
• To keep order, invoice and accounting records: compliance with our legal obligations (GDPR Art. 6 (1) (c)).
• To keep the website secure and working, and to prevent fraud: our legitimate interests (GDPR Art. 6 (1) (f)).
• To measure how the website is used (Google Analytics, Microsoft Clarity) and to show the embedded Google map: your consent (GDPR Art. 6 (1) (a)), which you can withdraw at any time.

4. Who receives your data

We share personal data only as far as needed to run the website and carry out your request:

• incadea, our dealer management system, which receives your order and customer details so we can process the sale.
• JCC Payment Systems Ltd (Cyprus), which processes card payments.
• ACS Courier, for home deliveries and ACS store pickups (name, phone number and address).
• Brevo, which sends the emails from this website (order confirmations, replies to forms, password resets).
• Our hosting and infrastructure providers, acting only on our instructions: Vercel (website), Railway (online-shop system) and Neon (website database).
• Google Ireland Limited, only with your consent: Google Analytics and Google Tag Manager (if you allow analytics) and the embedded map (if you allow external media). See Cookies below.
• Microsoft Ireland Operations Limited, only if you allow analytics: Microsoft Clarity, which shows us anonymised clicks, scrolling and page recordings. See Cookies below.

Some of these providers may process data outside the European Economic Area. Where they do, the transfer is protected by an adequacy decision of the European Commission or by its Standard Contractual Clauses. We do not sell your personal data.

5. Cookies

Strictly necessary cookies. The website cannot work without these, so they do not need your consent:

• frantzis_cart: keeps the contents of your basket (30 days).
• frantzis_customer: keeps you signed in to your shop account (14 days).
• frantzis_consent: remembers your cookie choices (6 months).
• payload-token: used only when a website administrator signs in.

Optional, only with your consent:

• Analytics (Google Analytics, loaded through Google Tag Manager): counts visits and the pages opened, so we can see how the website is used and improve it. Google sets the cookies _ga and _ga_<ID> (up to 2 years) and receives your IP address. Nothing is loaded from Google until you allow it, and we do not use the data for advertising.
• Analytics (Microsoft Clarity, loaded through Google Tag Manager): shows us anonymised clicks, scrolling and recordings of how pages are used, so we can find what is hard to use. Forms, and pages showing your order or account details, are masked and never recorded. Microsoft sets the cookies _clck (1 year) and _clsk (1 day) and receives your IP address.
• External media (Google Maps): the map on our contact page is loaded from Google, which may set its own cookies and receives your IP address. Until you allow it, we show a placeholder with a link to open the map on Google instead.

We do not use advertising or retargeting cookies. You can change your choice at any time through “Cookie settings” at the bottom of every page; withdrawing consent removes the analytics cookies.

6. How long we keep your data

We keep personal data only for as long as the purpose for which it was collected requires. Order, invoice and accounting records are kept for the period required by Cyprus tax and accounting law. Enquiries that do not lead to a booking or sale are deleted when they are no longer needed. You can close your shop account at any time by writing to us.

7. Security

We use technical and organisational security measures to protect the data we manage against manipulation, loss, destruction and access by unauthorised persons, and we keep improving them in line with technological developments.

8. Your rights

You have the right of access (GDPR Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we rely on your consent, you may withdraw it at any time; this does not affect processing carried out before the withdrawal.

Right to object: you may object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (GDPR Art. 6 (1) (f)). We will then stop, unless we can show compelling legitimate grounds or need the data for legal claims.

Please send requests to our Data Protection Officer at mk@frantzisgroup.com. If you believe our processing breaks the law, you may lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus (www.dataprotection.gov.cy) (GDPR Art. 77).

9. Links to other websites

Our pages link to other websites, such as our Facebook and Instagram pages and Google Maps. This Privacy Statement does not apply there; please check the privacy information of those providers.

10. Changes

We may update this Privacy Statement when our website or services change. The date at the top shows the latest version.