Last updated: October 2026
Data Controller: VOUDAKAKIS SOTIRIOS PAVLOS (“we”, “us”, “our”), operating the website mcleodalbums.com
Tax ID (VAT/AFM): 128254191
Company Registration No. (GEMI): 163266605000
Registered address: Esperidon 19, Ind. Area Evosmos, 562 24 Thessaloniki, Greece
We are committed to protecting your privacy and handling your personal data in an open and transparent manner, in accordance with Regulation (EU) 2016/679 (the “GDPR”) and applicable Greek data protection law (Law 4624/2019).
1. Information We Collect
When you use our website or place an order, we may collect:
- Your name, email address and phone number
- Billing and shipping address
- Account login details, if you create an account
- Order and purchase history
- Correspondence you send us (e.g. by email or phone)
- Any photos or design files you upload to us for the personalisation of your album or product
2. Automatic Data Collection
Like most websites, we automatically collect certain information when you visit our site, including via cookies, your IP address, browser and device type, and pages visited. We do not use Google Analytics, Meta/Facebook Pixel, or other third-party advertising or marketing trackers on this site. WooCommerce, the software that powers our online store, automatically collects some technical and order-attribution information (for example, which channel or referring website led to your visit) so we can understand, in general terms, how visitors find our store — see our Cookies Policy for details. Our site may also use web beacons and, where relevant features are used, may request your approximate location (geolocation). If you contact us by email or phone, we collect the information you submit in order to respond to you. If you subscribe to our newsletter, we collect your email address for that purpose using our email marketing platform.
We use cookies to operate the site, remember your preferences, keep items in your cart, and measure site performance. You can control cookies through your browser settings.
3. Order, Account and Uploaded File Information
Because our website is an online store, we also process billing and shipping details necessary to fulfil and deliver your order, order contents, prices and payment status, and any photographs or files you upload for personalised album production, which are stored securely for the purpose of producing your order and are not used for any other purpose. Uploaded photo files are kept in Cloudflare R2 cloud storage (Cloudflare, Inc.), are accessible only to our production team through time-limited links, and are deleted automatically 30 days after your order is completed or cancelled. Files that are uploaded but never ordered are deleted 60 days after the upload. You can ask us to delete them earlier at any time. Payments made by bank transfer (BACS) are processed by our bank; we do not collect or store your card details on our servers.
Photographs of your clients (processing on your behalf): when you upload photographs of your own clients, you remain the data controller for those photographs and McLeod Albums acts as your data processor under Article 28 GDPR. We process these files only on your instructions and only to produce, check and deliver your order. We do not use them for any other purpose, do not share them with anyone other than the service providers named in this policy, keep them confidential, apply the security measures described in section 10, delete them within the retention periods above, and will assist you with any request from your clients concerning their data. These terms, together with our Terms & Conditions, form the data processing agreement between you and McLeod Albums for those photographs.
Copyright and third-party content in uploaded images: when you upload a photo, design, or logo to our website for personalisation of your order, you confirm that you own that image or otherwise hold all necessary intellectual property rights and permissions to use and reproduce it, and to have it printed by us for that purpose. Where an uploaded photo shows other people (for example, your own clients, models, or family members), you also confirm that you have obtained their consent, or otherwise have a lawful basis, for that image and any personal data in it to be shared with us and used to produce your order. We process uploaded files solely to produce your order, do not claim any ownership over them, and keep them only for as long as necessary to produce your order, in line with the retention periods set out above in this Section 3 (30 days after your order is completed or cancelled; 60 days for files that are never ordered), after which they are deleted. We accept no responsibility for verifying copyright ownership or third-party consent for uploaded content, and by submitting a file you agree to hold us harmless from any third-party claim arising from your use of it.
4. Social Media Widgets
Our website may include social media features, such as sharing buttons. These features may collect your IP address and which page you are visiting, and may set a cookie to enable the feature to function properly. Your interactions with these features are governed by the privacy policy of the company providing them.
5. Children’s Data
Our website and services are not directed at children, and we do not knowingly collect personal data from children under the age of 15 (the digital age of consent under Greek Law 4624/2019 implementing the GDPR). If we learn we have collected personal data from a child under this age without parental consent, we will take steps to delete that information.
6. How We Share Your Information
We do not sell your personal data. We only share your information with trusted third parties where necessary to operate our business and fulfil your order, such as payment and banking providers, delivery/courier companies, IT and hosting providers, Cloudflare, Inc. (cloud storage of uploaded photo files), and Automattic Inc., the developer of the WooCommerce software that powers our store, which receives limited anonymous technical data as part of the software’s standard operation (see our Cookies Policy for details). These providers are only permitted to use your data for the purposes we specify, and we require them to protect your data appropriately. We do not transfer your data to unaffiliated third parties for their own marketing purposes.
Business transfers: if our business, or a part of it, is sold, merged, or otherwise transferred to another company, your personal data may be transferred as part of that transaction. Any new owner would continue to be bound by the terms of this Privacy Policy in respect of your previously collected data.
7. International Data Transfers
Some of the third-party providers we use (for example, Cloudflare, Inc., which stores uploaded photo files, and Automattic Inc., the developer of our WooCommerce store software) may process data outside the European Economic Area, including in the United States. Where this occurs, we rely on appropriate safeguards recognised under the GDPR, such as the EU-U.S. Data Privacy Framework and/or Standard Contractual Clauses, to ensure your data continues to receive an adequate level of protection.
8. Your Rights
Subject to applicable law, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request erasure of your data
- Restrict or object to our processing of your data
- Request a copy of your data in a portable format
To exercise any of these rights, please contact us using the details in Section 15. We will respond within one month of receiving a verified request.
You also have the right to lodge a complaint with the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifisias 1-3, 115 23 Athens, www.dpa.gr, if you believe our processing of your personal data infringes the GDPR.
9. Data Retention
We retain your personal data for as long as necessary to provide our services and fulfil the purposes described in this policy, including for as long as needed to comply with our legal, accounting or reporting obligations, and for the duration of any applicable statute of limitations after our contractual relationship ends. Uploaded photo files follow the shorter retention period described in section 3 (30 days after the order is completed or cancelled; 60 days for files that were never ordered). Our website activity logs are kept for 12 months.
10. Security
We implement appropriate technical and organisational measures designed to protect your personal data against unauthorised access, alteration, disclosure or destruction. Partner accounts can switch on optional two-factor authentication from My Account → Account security, and administrator access to our systems is protected by two-factor authentication.
11. Automated Decision-Making
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects concerning you.
12. Links to Other Websites
Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those websites, and we encourage you to review their privacy policies.
13. Professional Services Data / Data Breach Notification
Where we process personal data on behalf of business clients in connection with our professional/printing services, we act as a data processor and process such data only on the client’s documented instructions and for the agreed purpose. In the event of a personal data breach affecting data we control, we will notify the competent supervisory authority within 72 hours of becoming aware of it, where required by law, and will notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. For the purposes of this policy, VOUDAKAKIS SOTIRIOS PAVLOS is the data controller for personal data collected through mcleodalbums.com, unless stated otherwise in a specific agreement.
14. Changes to This Policy
We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated “Last updated” date.
15. Contact Us
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at: VOUDAKAKIS SOTIRIOS PAVLOS, Esperidon 19, Ind. Area Evosmos, 562 24 Thessaloniki, Greece, or at info@mcleodalbums.com.
