Privacy Policy

Katzis Casual and Sports is a clothing and sportswear shop in Xylofagou, Cyprus. This policy explains how we handle personal data when you browse the site, create an account, use your cart, contact us, or place an order.

For privacy questions or requests, use the Privacy Center or contact the shop at katziscasualandsport@gmail.com.

We collect the information needed to provide the shop: account email, sign-in and verification records, customer profile details you save, guest checkout email, optional billing details, pickup contact name and phone, the selected store or Travel & Express pickup point, cart contents, order records, payment references, collection status, support messages, and security records such as limited IP and browser information.

If you choose nearest-point or current-location help, your browser temporarily makes your current position available to checkout so it can compare available points, draw the marker, and center the map. Katzis does not add raw coordinates to your account or order, does not retain them in the shop database, and does not place them in a provider URL. Centering does reveal the approximate visible tile area and ordinary connection data to OpenStreetMap.

We do not collect or store full card numbers, CVV/CVC, card PINs, magnetic-stripe data, stored card details, subscriptions, date of birth, advertising profiles, or third-party advertising identifiers.

We use personal data to create and protect accounts, verify email addresses, reset passwords, keep carts available, prepare checkout, arrange collection from the store or selected pickup point, verify payments, handle refunds and support, prevent fraud and abuse, secure the service, respond to incidents, and meet tax and accounting duties.

Depending on the activity, we rely on contract or steps before contract, legal obligation, legitimate interests in security and store operation, or consent where optional services such as marketing are introduced.

We do not sell personal data. We do not intentionally share personal data for third-party advertising. We do not use analytics, marketing pixels, heatmaps, affiliate tracking, or session-recording scripts.

Map views and external map links can send technical request data, such as IP address and browser information, to the displayed map provider. Nearest-point help requests browser location permission only after you choose it. The shop uses the coordinates temporarily for that checkout page and does not write them to cookies, browser storage, your account, your order, or the shop database. Your browser or device may remember its own permission choice.

If optional analytics, marketing, or similar tools are added later, we will update the Privacy Policy and Cookie Policy before using them and will ask for any required consent before loading them.

Card entry happens on a hosted JCC payment page or another approved secure provider flow. The shop stores merchant-safe payment references, payment status, amount, currency, order linkage, and timestamps. We do not store full card data or CVV.

We share personal data only where needed to run the shop, provide hosting and database services, send transactional email, protect the service from abuse, process payments, arrange collection from the selected location, or meet legal and accounting duties.

Service providers include Vercel for hosting, Supabase for database and product image storage, Resend for transactional email, Upstash Redis for rate limiting, JCC for hosted card payments, Google for the Contact page's normal and satellite map views, and OpenStreetMap for checkout map tiles. OpenStreetMap receives ordinary connection data and visible tile coordinates produced by manual map use, business-location filters, or explicit location centering. Centering reveals an approximate area but raw shopper coordinates are not placed in an OpenStreetMap, Google, or other provider URL. Opening an external directions link is a separate request to that provider.

The application does not automatically send order or customer data to Travel & Express. The shop owner manually hands the parcel to the selected point, after which point management manually contacts the customer with its collection number or instructions. The minimum personal data placed on or communicated with the parcel and the provider's privacy role still require owner/legal confirmation.

You can request access, export, correction, deletion or anonymization where allowed, and privacy support through the Privacy Center. Account-specific export and deletion requests require sign-in so we can verify the request without revealing whether an email address exists.

Some order, payment reference, invoice, tax, accounting, fraud, chargeback, dispute, security, and audit records may need to be retained even after an account deletion request.

We may update this policy when our services, providers, or legal duties change. The version and effective date on this page show which policy applies.