Legal

Privacy Policy

Last updated: 24 June 2026

Kárpos (“we”, “us”, “our”) runs a grower-direct marketplace at blackrork.com carrying fresh fruit and vegetables from Crete to customers across Santorini. This policy explains what personal data we collect, why we collect it, how we protect it, and the rights you have over it. We only collect what we need to take and deliver your order and to keep your account and our shop secure.

1. Who we are

Kárpos is the data controller for the personal information described here. We operate the website blackrork.com. If you have any question about your data or this policy, contact us at viptransferssantorini@gmail.com.

2. What information we collect

We collect only the information needed to run the shop:

Information you give us

• Account details — your name, email address and phone number when you register. Your password is never stored in readable form; it is salted and hashed (scrypt) on our server.
• Order details — the items you buy, your delivery address (for delivery orders), and any note you add at checkout. Email and phone are required so we can reach you about your order.
• Newsletter / restock list — your email address, if you choose to join our “notify me” harvest list.

Information we collect automatically

• Technical data — your IP address and basic request information are processed by our web server and reverse proxy to deliver the site, secure the admin area, and prevent abuse.
• Local storage — your basket, your sign-in session token and your chosen language are stored in your browser so the site works between visits. These stay on your device.

We do not collect or store your card details — see Payments below.

3. How we use your information

• To take, confirm, prepare and deliver your orders.
• To contact you about an order (by email or phone) and send order confirmations.
• To manage your account and show you your order history.
• To send restock and new-product alerts only if you joined our harvest list, and our occasional updates — every such email has an unsubscribe link.
• To keep the site and admin area secure and to comply with our legal obligations (e.g. tax and accounting).

We do not sell your personal data, and we do not use it for advertising or profiling.

4. Legal basis (GDPR)

As we serve customers in Greece and the EU, we process your data under the General Data Protection Regulation (GDPR) on these bases: performance of a contract (to fulfil your order), consent (for the marketing/restock list, which you can withdraw any time), legitimate interests (to secure and improve our service), and legal obligation (to keep order and tax records).

5. Payments

Online card payments are processed securely by Revolut on their own hosted checkout page. When you pay, you are redirected to Revolut; your card number and security details are entered there and are handled entirely by Revolut — they never pass through or get stored on our servers. We only receive a confirmation that your order was paid, plus a payment reference. Revolut’s handling of your data is governed by the Revolut Privacy Policy.

6. Emails & marketing

Transactional emails (order confirmations, your welcome email) are sent because they are part of your order or sign-up. Marketing and restock emails are sent only to people who joined our harvest list. Every marketing email includes a one-click unsubscribe link, and you can ask us to remove you at any time by emailing us. Our emails are delivered through a standard SMTP email provider.

7. Cookies & local storage

We keep cookies to a minimum. We do not use third-party advertising or tracking cookies. Your browser’s local storage holds:

• your basket contents, so it survives a page refresh;
• your sign-in session token, so you stay logged in;
• your selected language for the on-page translation tool.

The optional Google Translate tool, if you use it, may set its own cookie and send the text on the page to Google to translate it. The Google Fonts used for the site’s typography are loaded from Google’s servers, which receive your IP address as part of that request. You can clear local storage at any time from your browser settings.

8. Who we share data with

We share data only with the service providers that make the shop work, and only as far as needed:

• Revolut — to process card payments.
• Our email provider — to deliver order and notification emails.
• Google — for web fonts and, if you use it, the optional page translation tool.

We may also disclose information if required by law. We do not sell or rent your data to anyone.

9. How long we keep it

We keep account and order information for as long as you have an account and as long as needed to fulfil orders and meet legal (e.g. tax) requirements. Harvest-list emails are kept until you unsubscribe. When data is no longer needed, we delete it.

10. How we protect your data

The site is served over encrypted HTTPS. Passwords are salted and hashed with scrypt and never stored in plain text. Sessions are protected with signed tokens, and the admin area is further restricted. Card data never touches our servers. While no system can be guaranteed perfectly secure, we take reasonable technical and organisational measures to protect your information.

11. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• ask us to delete your data (“right to be forgotten”);
• object to or restrict certain processing;
• withdraw consent for marketing at any time (via the unsubscribe link or by emailing us);
• request a copy of your data in a portable format;
• lodge a complaint with the Hellenic Data Protection Authority (dpa.gr).

To exercise any of these rights, email viptransferssantorini@gmail.com and we will respond within the time the law allows.

12. Children

Our shop is intended for adults. We do not knowingly collect personal data from children. If you believe a child has given us their data, contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows when it last changed. Significant changes will be reflected on this page.

14. Contact us