Privacy Policy

Data controller

The data controller is the business “KOKON”, based in Sparta, Laconia, Greece. For any matter concerning your data you can contact us at the email address listed in the Contact section.

What data we collect

Pickup order form: name, phone, optional email, the products you request and your pickup time.

Catering form: name, phone, type and date of event, estimated number of guests and your message.

Newsletter: your email address, with double opt-in confirmation.

Technical data: when you submit a form, your IP address is recorded solely for abuse protection (rate limiting).

Purpose and legal basis

Form details are used exclusively to handle your request (pre-contractual measures, Art. 6(1)(b) GDPR) and are submitted only with your explicit consent (Art. 6(1)(a)).

Your newsletter email is used only to send KOKON updates, based on your consent, which you can withdraw at any time via the unsubscribe link.

Cookies and third-party services

The site uses essential cookies for language, consent and accessibility settings.

Google Analytics 4 (analytics), the embedded Google map (third party) and the Meta Pixel (marketing) load only after your consent via the cookie banner. Without consent, no third-party connection is made at all.

Cookies that may be set: kokon_consent (essential, your choice, 30 days) · _ga, _ga_* (analytics, Google Analytics, up to 2 years) · Google cookies from the map (third party) · _fbp (marketing, Meta Pixel, 3 months).

You can change your choices at any time via “Cookie settings” in the footer.

Meta Pixel (marketing)

If you switch on the “Marketing” category, the site loads the Meta Pixel, a service of Meta Platforms Ireland Ltd (Merrion Road, Dublin 4, Ireland).

It collects the pages you view, device and browser data (such as IP address and browser type) and sets cookies such as _fbp. The purpose is to measure how our ads perform and for retargeting (showing you KOKON ads on Facebook and Instagram).

The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the “Cookie settings” button. Without consent, no connection to Meta is made at all.

Data may be transferred to the United States; Meta is certified under the EU–US Data Privacy Framework. More in Meta's privacy policy: https://www.facebook.com/privacy/policy/

Storage and transfers

Form data is stored in a database (Supabase) within the EU and notification emails are sent through an email provider (Resend). Your data is never sold, and form details are never shared with advertisers; the only advertising measurement is the Meta Pixel described above, which runs only with your consent.

Form submissions are kept for up to 12 months and then deleted, unless a legal retention obligation applies.

Your rights

You have the right of access, rectification, erasure, restriction, objection and data portability. You may also lodge a complaint with the Hellenic Data Protection Authority (dpa.gr).

To exercise your rights, contact us by email — we will respond within 30 days.