Privacy Policy
Last updated: 18 July 2026
1. Who we are
This site is run by Stefanie Frarou, the maker of StefMag ("we", "us"), who is the data controller for your personal data. StefMag is not a registered company: it is a product she designs, makes and sells herself in Greece, currently from her perfumery. For any privacy matter, contact [email protected].
2. What we collect
- Messages, enquiries and orders. There is no online checkout on this site: you order by contacting us. If you write to us by email or through our social accounts, we receive your email address or social handle and whatever you choose to send. For an order this may also include the details needed to arrange it, and any text or artwork you ask us to engrave.
- Technical data. Our hosting/CDN provider automatically logs standard request data (IP address, browser type, pages requested, timestamps) to deliver and secure the site.
- Your cookie choices. We store your consent decision locally in your browser so we can honour it (see the Cookie Policy).
- Your preferences. We store your language choice in your browser, and note for the current tab that the intro animation has already played so it is not repeated. These stay on your device and are not sent to us.
- Optional analytics/marketing. Only if you consent, we may set analytics or marketing tools that collect usage data. None run before you allow them.
3. Why we use it, and our lawful basis
- Run and secure the site: legitimate interest (Art. 6(1)(f)).
- Reply to your enquiry: legitimate interest, or steps prior to a contract.
- Handle an order you place with us: performance of a contract, or steps taken at your request before entering one (Art. 6(1)(b)).
- Remember your preferences (language, cookie choice): necessary for the site to behave as you asked (Art. 6(1)(f)).
- Non-essential cookies, analytics and marketing: your consent (Art. 6(1)(a)), which you can withdraw at any time.
4. Who we share it with
We do not sell your personal data. We use a small number of service providers (processors) to run the site:
| Provider | Purpose | Where |
|---|---|---|
| Cloudflare | Hosting, CDN, security | Global / USA |
Some providers are outside the EEA. Where that happens, transfers rely on an EU adequacy decision, the EU-US Data Privacy Framework, or Standard Contractual Clauses.
Note: the site's fonts and front-end libraries are served from this site itself, not from third-party CDNs. Loading a page therefore does not reveal your IP address to any font or library provider.
If you contact us through Instagram or Facebook, that conversation also takes place on their platform and is governed by their own privacy policies. We do not control those platforms and cannot delete messages held on them on your behalf.
5. How long we keep it
Enquiry and order emails: kept only as long as needed to handle your request, to fulfil an order, and for a reasonable follow-up period, plus any period required by tax or accounting law. Server logs: short rolling retention by our host. Consent choice: until you change it or it expires.
6. How we protect it
The site is served only over HTTPS and sends strict security headers, including HTTP Strict Transport Security, a Content Security Policy, and protection against clickjacking. We keep the personal data we hold to a minimum and limit who can see it. No method of transmission or storage is completely secure, but we take reasonable technical and organisational measures to protect your data.
7. Your rights
Under the GDPR you can ask us to: access your data; correct it; erase it; restrict or object to processing; and receive it in a portable format. You can withdraw consent at any time. Email [email protected] and we will respond within one month. You also have the right to complain to the Hellenic Data Protection Authority (dpa.gr).
8. Automated decision-making
We do not use your data for automated decision-making or profiling that produces legal effects or similarly significantly affects you.
9. Cookies
See our Cookie Policy for what we store and how to change your choices. You can reopen your cookie preferences at any time.
10. Children
This site is not directed at children and we do not knowingly collect their data.
11. Changes
We will update this notice when our practices change (for example, when analytics go live) and revise the date above.