The shop is still under construction. The magic takes time.

Cart 0

Privacy Policy

Who is responsible for your data

This website, cucos.gr, is run by Cucos Crafts, a workshop in Heraklion, Crete, that makes and sells handcrafted accessories for tabletop games. For everything described on this page, Cucos Crafts is the data controller under the EU General Data Protection Regulation (GDPR) and Greek law 4624/2019.

Legal name
Cucos Crafts
Address
Heraklion, Crete, Greece

You can write to us about anything on this page, including any of the rights listed further down. We answer privacy requests within one month.

What we collect, and why

We collect only what we need to sell you something, make something for you, or answer you. We do not sell personal data, we do not build advertising profiles, and nothing on this site makes automated decisions about you.

When you place an order

We ask for your name, billing and delivery address, email address, phone number, what you ordered and any note you add. We use this to take payment, make and send your order, tell you how it is going, and deal with returns or problems. The legal basis is our contract with you. Invoices and accounting records are also kept because Greek tax law requires it.

Card details never reach us. Payment is handled by the payment provider you choose at checkout, on their own secure systems; we only receive confirmation that the payment went through.

When you create an account

An account is optional. If you have one, we store your login email, a password that is saved only in encrypted form, your addresses and your order history, so that you can see past orders and check out faster. You can ask us to delete your account at any time.

When you send us a message or a commission request

The contact and commission forms ask for your name, your email address and your message, and optionally a deadline and a rough budget. The message is emailed to us and a copy is kept inside the website's private administration area, so that no enquiry is lost. We use it only to reply to you and, if you go ahead, to make your piece. The legal basis is taking steps at your request before a contract, and our legitimate interest in answering people who write to us.

To stop spam, the form briefly counts how many messages arrive from the same internet connection within one hour. That counter holds no readable address and deletes itself after the hour.

When you leave a product review

We store the name and email address you enter, your rating and your text, and the internet address the review was sent from, which helps us detect abuse. Your name and review are shown publicly on the product page; your email address is not.

Visitor statistics, only with your permission

If you click Accept on the cookie banner, we use Google Analytics to see which pages are visited, roughly where visitors come from and which products are viewed, so that we can improve the shop. The legal basis is your consent. If you click Deny, or do nothing, no analytics cookies are set; Google's tag then runs without cookies and sends only limited signals that do not identify you. You can change your mind at any time on the Cookie Policy page.

Technical logs

Like every website, the server that hosts this site keeps short-lived logs of requests: internet address, time, the page requested and the browser used. They are used to keep the site secure and working, on the basis of our legitimate interest in doing so.

Cookies

The shop uses a small number of necessary cookies that remember your cart, keep you signed in and remember your cookie choice. These do not need consent. Analytics cookies are used only if you accept them. The Cookie Policy page lists every cookie, what it does and how long it lasts, and lets you change your choice.

This site loads no fonts, maps, videos or social media widgets from other companies. The links to our Instagram, Facebook, YouTube and Etsy pages are ordinary links; those services receive nothing until you choose to follow one.

Who receives your data

We share personal data only with the companies that help us run the shop, and only what each one needs:

  • Our hosting and email provider (Hostinger), which stores the website, its database and our mailbox on its servers.
  • The payment provider you choose at checkout, to process your payment.
  • The courier or postal service that delivers your order, which receives your name, address and phone number.
  • Our accountant and the Greek tax authorities, for invoices, as the law requires.
  • Google Ireland Ltd, for visitor statistics, only if you have accepted analytics cookies.

Each of these acts on our instructions or under its own legal obligations. We may also have to disclose data if a court or public authority lawfully requires it.

Data sent outside the European Union

We keep your data within the European Economic Area wherever we can. Google may process analytics data in the United States; such transfers are covered by the EU–US Data Privacy Framework and by standard contractual clauses approved by the European Commission. If your order is delivered outside the EU, the courier in that country necessarily receives your delivery details.

How long we keep it

  • Orders and invoices: for as long as Greek tax and accounting law requires, currently at least five years after the end of the tax year.
  • Your account: until you ask us to delete it.
  • Messages and commission requests: up to two years after our last contact, unless they led to an order, in which case they are kept with that order.
  • Product reviews: for as long as the product page exists, or until you ask us to remove yours.
  • Analytics data: up to fourteen months, after which Google deletes it automatically.
  • Server logs: a few weeks.

Your rights

Under the GDPR you can ask us, free of charge, to:

  • tell you what data we hold about you and give you a copy;
  • correct anything that is wrong or out of date;
  • delete your data, where we have no legal duty to keep it;
  • restrict how we use it, or object to a use that relies on our legitimate interest;
  • give you your data in a common electronic format, so you can take it elsewhere;
  • withdraw a consent you gave, such as for analytics cookies, without affecting what happened before.

To use any of these rights, write to us using the details at the top of this page. We may ask for something that confirms who you are before we act, so that nobody else can obtain your data.

If you believe we have handled your data wrongly, you can also complain to the Hellenic Data Protection Authority: Kifisias 1-3, 115 23 Athens, Greece, www.dpa.gr. If you live in another EU country, you may contact the authority there instead.

Security, children and changes

The whole site runs over an encrypted connection (HTTPS), passwords are stored only in encrypted form, and access to order and message data is limited to the people who run the shop.

The shop is not aimed at children. If you are under 15, please ask a parent or guardian to order or write to us on your behalf.

When we change how we handle data, we update this page and the date below.

Last updated: September 2026.