Privacy Policy
Last updated: 17 October 2026
At Grillbox we respect your personal data. This policy explains in plain words what information we collect when you order, why, and what rights you have.
1. Data controller
GrillBox is operated by the business ΝΑΤΣΙΟΣ ΧΡΗΣΤΟΣ (Natsios Christos), which is the controller of your data:
Business name: ΝΑΤΣΙΟΣ ΧΡΗΣΤΟΣ
Tax ID (ΑΦΜ): 152536366
General Commercial Registry (ΓΕΜΗ): 187741006000
Registered address: Delfon 96, 54643 Thessaloniki, Greece
Phone: +30 2310 815 678
Email: info@grillbox.gr
For anything about your data: our contact form.
2. What data we collect and why
| Data | Why we need it | Legal basis |
|---|---|---|
| Name | To know who we are delivering to | Performance of a contract |
| Phone number | To confirm your order and so the driver can reach you | Performance of a contract |
| Address (and floor, and the name on the doorbell if you give it) | To deliver your order. If we know where your address is on the map, we compare it with our driver's position: when the driver stops at your door you see “The driver has arrived”, and when they leave the order is marked “Delivered” automatically. When the driver confirms the delivery standing outside your door, we keep the point where they stood together with a code for the address (not a name or phone number), so that next time they can find you straight away. We do not use the location of your own device. | Performance of a contract |
| What you ordered & your notes | To prepare your order | Performance of a contract |
| The language you chose (Greek or English) — on your order, on your account if you have one, and with your request if you asked for offers as a guest | So we can speak your language: the kitchen and the driver see that you prefer English, and emails (order confirmation, password reset and — if you asked for them — offer emails) reach you in your language | Performance of a contract; for offer emails, your consent to them |
| Your account email — only if you order while signed in | To send you the order confirmation email once the kitchen accepts your order: what you ordered, the total, the estimated time, the delivery address and the tracking link. And, if you were paying online and the payment was not completed within 20 minutes, an email that the order was cancelled and not sent to the kitchen (with its items and a link that puts them back in your basket) — not if you placed a new order in the meantime, and at most one every 12 hours. These emails contain no offers and never use the email you may have given us for offers. | Performance of a contract |
| Loyalty points — only if you have an account: how many points you earned and spent on each order | So you can collect points and redeem them at checkout. If you create an account after ordering as a guest, the orders placed from the same device are added to your history together with their points. | Performance of a contract |
| Friend referral — only if you enter a code: which account referred you | So that you both get the referral points. Your friend sees nothing about you — only that they received referral points. | Performance of a contract |
| Whether you have ordered from us before (with the same phone number or account) | So the kitchen can recognise you: on your order it sees “new customer” or how many previous orders you have placed and when the last one was. It sees only the number and the date — not what you ordered then. Nothing is sent to third parties. | Legitimate interest |
| An order that was not completed (e.g. outside the delivery area, kitchen closed): name, phone number, address, basket total and the reason | So we can call you and find a solution (e.g. pickup from the shop) and so we know what isn't working. Only the shop's management sees it. | Steps taken at your request before entering into a contract |
| Which channel the order came from (e.g. “Facebook/Instagram”, “Google Ads”, “offers email” with the campaign name) | So we know, in totals, how many orders our ads and emails bring. Only the category is recorded — no click identifier, no cookie, nothing to third parties (see the end of §6). | Legitimate interest |
| How many visits came from each advertising channel (e.g. “Facebook/Instagram”) | So we know whether an ad brings visitors. We keep only one total per day (e.g. “22/09 · Facebook/Instagram · 51”) — nothing about your own visit, no cookie, nothing to third parties (see the end of §6). | Legitimate interest |
| How many times each page of the site is opened and from which category of source the visit came (e.g. “search”, “Facebook/Instagram”, “direct”) | So we know how many people visit us, which pages are used and how many visits end in an order. We keep only one total per day, page and category (e.g. “06/10 · /menu/ · search · 37”) — not the address you came from, no time, no IP, nothing about your own visit, no cookie, nothing to third parties. If your browser sends “Do Not Track”, we do not count at all (see the end of §6). | Legitimate interest |
| What visitors choose in the cookie message (“Accept all”, “Only necessary”, etc.) | So we know how many agree and whether the message is clear. We keep only one total per day (e.g. “23/09 · Accept all · 40”) — your own choice stays only on your device, no cookie, nothing to third parties (see §6). | Legitimate interest |
| Email for offers — only if you ask for it (a checkbox when you sign up, at checkout or in your account Settings; if you order as a guest, you type your email at checkout only if you tick the box) | To send you emails with Grillbox offers and news. The box is never ticked in advance. We record when, where and with which wording you asked for it, so that we can prove it. We use the email you type as a guest for this purpose — it is not added to the order and the kitchen or the driver do not see it. Its only other use: if you have also enabled “Advertising”, when your order is completed it is sent encrypted (SHA-256) to Google, to measure our ads (see section 6). Before the first offer we send you one confirmation email: you join the list only if you click “Yes, I want the offers” — otherwise we send you nothing else. These emails are sent on our behalf by Brevo (see section 4), which receives your email address and a personal link to your preferences page — and, only if you enable personalisation, what the next row describes. Brevo, like every email service, technically records whether an email was opened and whether one of its links was clicked; we see only anonymous totals per campaign (e.g. how many emails were opened) and we do not use them to decide what or when to send you. We send you at most as many emails as the “How often and when” page says (there is a link in every email; the basket reminder, if you ask for it, has its own limit — see below), never at night and not for a few days after you order: for this we note which emails we sent you and when (not whether you opened them) and check whether you ordered recently, with your account email or the order's phone number. On the same page you can change the frequency and times, pause or stop the emails. To know whether our automatic emails (e.g. “welcome”) help, a fixed, random share of subscribers (usually 1 in 5) does not receive them; we compare only order totals. Every email has an “Unsubscribe” link that takes you off the list with one click. | Consent — you can withdraw it at any time from the “Unsubscribe” link in every email, from “My account → Settings” or, as a guest, with a message through our contact form |
| Personalised emails — only if you enable them (a separate checkbox: after you confirm your email, on the “How often and when” page or in your account Settings) | From your orders — which days and times you order, which dish you prefer, how many points you have — we work out when suits you and what the email should mention: it arrives a little before your usual time, greets you by your first name and mentions your dish or your points. Our automatic emails are based on these too (e.g. “we miss you” when it has been a while since your last order, “your points” when they are worth redeeming, a new dish you haven't tried). Brevo receives, as fields of your contact, only: your first name, the name and link of your preferred dish, and your points — never your phone number, address or order history. No decision with legal or similarly significant effects for you is made. We record when you enabled or disabled personalisation and with which wording. Without personalisation, you get the same emails as everyone else, at the times most customers order. | Consent — separate from your consent to the emails; you can withdraw it at any time from the “How often and when” page or from “My account → Settings”, and these fields are then deleted from Brevo too (usually within an hour) |
| Basket reminder — only if you ask for it (a separate checkbox, under personalisation, on the “How often and when” page or in your account Settings; it requires personalisation and an account) | If you leave products in your account basket without ordering, we send you one email a little later (usually within an hour) with the products and a link that reopens your basket on any device, while it is valid (24 hours). We do not send it if you order in the meantime (with your account or your phone number), if you changed or emptied the basket, at night, when the shop is closed or if more than 3 hours have passed — and at most one per week. It does not count towards the limit of the “How often and when” page; after a reminder, though, we do not send you an offer for a few days. No discount or other “bait”: just what you left. For this email Brevo receives only the names and quantities of the products and the link — and they are deleted from there once it has been sent (usually within an hour). We record when you enabled or disabled it and with which wording. | Consent — separate; you can withdraw it at any time from the “How often and when” page or from “My account → Settings”; it stops automatically if you turn off personalisation or the emails |
We do not ask for and do not store card details. The available payment methods differ between delivery and pickup and you can see them all at checkout before you finish.
If you pay online (by card or IRIS, when you see them at checkout), you enter your card details on Viva's payment page (see section 4) and not with us. From Viva we keep only the payment and transaction codes, the amount and the status (paid, failed, refunded) — never a card number. We need them to send your order to the kitchen once it is paid, to refund you if it is cancelled, and for our accounts. Legal basis: the performance of your order and our tax obligations.
3. How long we keep it
Delivery details (name, phone number, address) are kept for as long as needed to serve you and for our tax obligations. After that they are anonymised: we keep only statistics (e.g. the order total) that are not linked to you.
The address check for the delivery area (see section 4), together with its point on the map, is kept for 7 days and then deleted.
If the point of your address was found by Google (see section 4), it is deleted from the order after 30 days.
The point where the driver stood at your door (see section 2) is kept for as long as you keep ordering from the same address and is deleted if we do not deliver there for 12 months.
The details of an order that was not completed (see section 2) are kept for 30 days and then deleted.
The details of an online payment (codes, amount, status — see section 2) are kept with the order, for as long as our tax obligations require.
If you have an account, your basket is also saved to your account, so you find it on any device where you sign in: it is shown for 24 hours, deleted as soon as you order and, at the latest, after 7 days. Without an account it stays only on your device. If you have asked for a basket reminder, its email is made from this basket; the link in the email opens it without signing in, only while it is valid (24 hours).
Your choice about offer emails and its history are kept for as long as your account exists; if you ask for your account to be deleted, they are deleted with it. If you withdraw, we send you nothing more — we keep only the record that you withdrew. The email you gave as a guest for offers is kept until you withdraw; if you do not confirm it within 60 days, we delete it together with its history. When you withdraw or delete your account, your address is also removed from Brevo automatically — usually within a few seconds, at the latest within a few hours. If you unsubscribe from the link in an email, Brevo keeps the address only as “do not send”, so that you do not receive anything again by mistake.
Your email preferences (frequency, times, pause, personalisation, basket reminder) and the personal link to your preferences page are deleted when you stop the emails. Which offer emails we sent you and when is kept for 400 days, for the frequency limits and for measuring in totals. The history of personalisation and of the basket reminder (when you enabled or disabled them and with which wording) is kept as proof, like the history of your consent to the emails.
4. Who sees your data
- Our staff — only as much as needed (the kitchen sees the order and whether you have ordered before, the driver sees the address).
- Infrastructure provider — the data is hosted on secure servers (Supabase) within the EU.
- top.host — the hosting provider of our website and our email (servers within the EU). Your account emails (e.g. password reset), the order confirmation email and the “your order was not completed” email are sent from its server.
- Brevo (Sendinblue SAS, France) — only if you ask for offer emails. It sends the confirmation email and the offers on our behalf. It receives your email address and a personal link to your preferences page, and — if you prefer English — which list you belong to (Greek or English), so that emails reach you in your language; only if you enable personalisation (section 2), also your first name, your preferred dish (name and link) and your points; only if you ask for a basket reminder, also the products in your basket (names and quantities) with the link that opens it, only for that email. Never your phone number, address or order history. It hosts the data on servers within the EU; companies of its group outside the EU (USA, India) may have access for support, under the standard contractual clauses.
- Viva (viva.com, Greece; an institution licensed by the Bank of Greece) — only if you pay online. You give your card details directly on its own payment page; we never see them. To prepare the payment, we send it the amount, the order number (and an internal order code) and the name you entered on the order, and — only if you order with an account — your account email. If you pay from your phone for an order you placed on an in-store tablet (with the QR code), you have not entered a name: we send the tablet's name, not yours. Never your phone number, address or the items of the order. For the payment itself (checking the card, security, fraud prevention, the obligations of a payment institution) Viva acts as an independent controller, under its own privacy notice.
- OpenStreetMap (Nominatim map service) — only for delivery, when your address is in an area we serve. To find exactly where your door is, whether the address is inside our delivery area and how far it is from the shop, your browser sends OpenStreetMap directly only the street, the number and the postcode, never a name, phone number or email. Because the request leaves your device, OpenStreetMap also sees your connection's IP address, like any website you visit (see OpenStreetMap's privacy policy). We do not ask for your device's location (GPS). Your browser then sends the point the map found to our server, which decides whether the address is inside the area and which minimum order applies. We keep only the result (inside, outside or uncertain), the distance from the shop and a one-way fingerprint (hash) of the address, not the address itself. The order records only whether the address was found inside the area, how far it is from the shop and which minimum order applied. If the map finds the building, its point is also added to the order, so that the driver reaches your door. If we change map provider, we will say so here.
- Google Maps Platform (Google's address lookup service) — only for delivery, and only when OpenStreetMap cannot find your building and we do not already know it from a previous delivery. Then our server (not your device) sends Google only the street, the number and the postcode, never a name, phone number or email. The point it returns is added to the order, so the driver reaches your door, and is deleted after 30 days. Google processes it under its privacy policy.
- Pin on the map — only if the map cannot find your building and the minimum order in your area depends on distance. Then we ask you to show us your door on a map, by moving the map yourself — we do not ask for your device's location (GPS). The map is loaded at that moment from OpenStreetMap (map images) and unpkg.com (the map software), which see your IP address like any website. We send the point you choose to our server: we use it for the minimum order, keep it for 7 days for the same address (so we don't ask you again) and add it to the order for the driver. You can always continue without a pin.
- If you order through efood / Wolt / BOX, their own privacy policy also applies.
- Google (Analytics, Google Ads) — without consent, only anonymous signals are sent, without a cookie and without identification: which page someone opened and what they did on it (e.g. that they added something to the basket or completed an order, with the items, the amount and the order code). Google uses them to estimate, in totals, our traffic and how many orders our ads bring (“Consent Mode”, see section 6). Full measurement happens only if you enable “Statistics”; advertising use, and Google Ads measurement, only with “Advertising” (see section 6).
- Microsoft (Clarity) — only if you enable “Statistics”. If you do not give permission, Clarity does not load at all. Details in section 5.
- Meta — only if you enable “Advertising”. If you do not give permission, nothing is sent there. Details in section 6.
- Data sent to Google, Microsoft and Meta may be transferred to servers outside the EU (USA), on the basis of the standard contractual clauses and the EU–US Data Privacy Framework.
We do not sell or rent your data to anyone.
5. Cookies & local storage
We use three categories. The last two are switched on only if you choose so — until then they stay off:
| Category | What it does | Consent |
|---|---|---|
| Essential | Keeps your basket, your sign-in to your account (or to the staff app), the order you are paying for online at that moment (its code, so we can bring you back to it after Viva's page; ignored after 2 hours), and — if you came from a friend's link — their code, until you create an account. It also remembers the language you chose (Greek or English). Without these, ordering does not work. | Not required (strictly necessary) |
| Statistics | Measures which pages are popular (Google Analytics) and how visitors move around them (Microsoft Clarity), so that we can improve the website. Pseudonymous identifiers are used — not your name or contact details. Details about Clarity right below. | Yes — switched on only if you choose so |
| Advertising | Third-party tools (Google, Meta). Cookies are set, such as Meta's _fbp / _fbc and Google's _gcl_au / _gcl_aw, your IP address is recorded and they may be linked to an account you already have there. When you fill in a form, the Meta Pixel sends encrypted contact details such as email, phone number and name, and when you complete an order Google receives your phone number and email encrypted (see §6). They tell us which ad brought an order and let us show our ads to people who have already visited the website or ordered from us. | Yes — switched on only if you choose so |
On your first visit a notice appears where you choose “Accept all”, “Only necessary” or “Show details” to turn each category on separately. Refusing is as easy as accepting — one tap, in the same place. To learn which form of the message is clearer, on some days it appears at the bottom of the screen and on others in a window in the centre — with the same text and the same two buttons. Together with your choice, only on your device, we keep which form you saw, so that we can prove how consent was given. You can change your mind at any time from the Cookie settings link at the bottom of every page; withdrawing takes effect from the moment you do it.
Your choice is stored only on your device. We only count how many times the message was shown and how many times each option was tapped, as one total per day — without time, page or anything that singles you out. This way we know whether the message is clear. Legal basis: legitimate interest (Article 6(1)(f) GDPR); you can object by contacting us (see §9). If your browser sends “Do Not Track”, we do not count this either.
Microsoft Clarity — how you use the page:
If you enable “Statistics”, Microsoft Clarity loads. It shows us heatmaps (where visitors tap, how far they scroll) and recordings of visits, so that we can find parts of the page that confuse people or do not work.
| What happens | How |
|---|---|
| Clicks, scrolling, mouse movement, how the page was displayed | Recorded for heatmaps and visit recordings |
| Whatever you type into form fields and your choices in lists | Always hidden before they leave — they do not reach Microsoft |
| Your account, the basket and checkout, the order tracking page | Hidden completely before they leave — we have marked them explicitly, because name, phone number and address appear there |
| Google Analytics' pseudonymous visitor and session identifier | Sent to Clarity, so that the two measurements can be linked |
| IP address | Microsoft uses it to find the country |
Cookies _clck (1 year) and _clsk (1 day) on our website | They tell visitors apart and join up the pages of one visit. Microsoft may also set its own cookies (e.g. MUID, CLID) on its own domains. |
Retention: recordings are kept for 30 days; a sample, and those we mark as favourites, for up to 9 months. Recipient: Microsoft, with storage on Microsoft Azure. Legal basis: your consent (Article 6(1)(a) GDPR). How to stop it: by turning off “Statistics” in Cookie settings — Clarity's cookies are deleted and recording stops immediately.
6. Advertising measurement (Meta, Google)
This section applies only if you have enabled the “Advertising” category. Otherwise none of what is described here happens, except for Google's anonymous signals, which are marked explicitly below.
When we advertise on Facebook or Instagram, we want to know whether the ad led to a real order. This is done in two ways, which give each event the same code, so that nothing is counted twice:
- From your browser (Meta Pixel) — it loads through Google Tag Manager, sets the
_fbp/_fbccookies and reads encrypted details from forms (see below). - From our server (Conversions API) — when your order is delivered, our server tells Meta about the purchase directly. If it is cancelled before delivery, nothing is sent.
What our server sends to Meta when an order is delivered:
| Item | Form |
|---|---|
| Email, phone number, first name, surname, city, postcode, country | Encrypted (SHA-256) — a one-way fingerprint. Meta can compare it with its own data, but cannot turn it back into the original text. |
| Account identifier, if you are signed in | Encrypted (SHA-256) |
| The items of the order: product code, quantity, price | As they are |
| Final amount, order code | As they are |
The _fbp / _fbc cookies | As they are — they are Meta's own identifiers |
| The IP address and the type of browser (user agent) at the time of the order | As they are — this is how Meta defines them. They help match the purchase to the right ad. Meta already receives them from the Pixel with every request from your browser; here our server sends them too, for cases where the Pixel is blocked. We keep them only until the purchase is sent (or the order is cancelled) — at most 24 hours — and then they are deleted. |
Our server does not send the delivery address, does not send your notes and does not send the payment method.
What the Pixel reads from forms (automatic matching):
We have Meta's “Automatic Advanced Matching” feature enabled. When you press a button in a form on the website — at checkout, in the contact form or in the partnership form — the Pixel finds the fields in the form that it recognises as contact details, encrypts them inside your browser and sends them to Meta together with the event it measures.
| Item | Form |
|---|---|
| Whichever of the following you have filled in on the form: email, phone number, full name, city, postcode | Encrypted (SHA-256) inside your browser, before they leave. Meta does not receive the text you typed, only its one-way fingerprint. |
Meta's feature also looks for gender, date of birth, region and country; our forms do not ask for these. Purpose: the same as this whole section — to match the visit or the purchase to an account you already have on Facebook or Instagram, so that we know which ad worked. If the “Advertising” category is off, the Pixel does not load at all and none of this happens.
Legal basis: your consent (Article 6(1)(a) GDPR). Recipient: Meta Platforms Ireland Ltd, with transfer to servers in the USA. How to stop it: by turning off the “Advertising” category in Cookie settings. The change applies immediately to every later visit and order.
Google Ads: when we advertise on Google, we want to know whether the ad led to an order and to be able to show our ads to people who have already visited the website or ordered from us. With “Advertising” enabled, the following happens, only from your browser:
| What happens | How |
|---|---|
Cookies _gcl_au and _gcl_aw, and the local entry _gcl_ls (3 months) on our website | _gcl_au tells browsers apart; _gcl_aw / _gcl_ls keep which Google ad you came from, if you came by clicking an ad |
On every page you open: the page address and title, together with the _gcl_au code | Sent by Google's tag (the “Google tag”), so that the visit can be linked to the ad click |
| Visitor lists for our ads (remarketing): “visited the website” for 30 days and “ordered” for 180 days | Google adds your browser to these lists in our account, so that it can show you our ads on Search, YouTube and its partners' websites/apps. The lists do not contain names or contact details and we do not see who is in them — only how many |
| When you complete an order: the amount, the currency and the order code, and its items (product code, quantity, price) | Sent to Google so that the order can be matched to the ad that brought it. The code is used so that it is not counted twice |
| When you complete an order: your phone number and, if you have given it, your email (your account's or the one for offers) | Encrypted (SHA-256) inside your browser, before they leave — Google's “enhanced conversions” feature. Google can compare them with an account you already have there, so that the order is matched to the ad even if you saw it on another device; it cannot turn them back into the original text |
| The IP address and the type of browser | Google receives them from your browser, as with any connection |
We do not send Google your name or address — not even encrypted; your phone number and email are sent only encrypted, as in the table. Our server does not communicate with Google. When you turn off “Advertising”, we also delete the _gcl_* cookies and you are not added to a list again; if you are already in one, you leave it automatically when its duration expires (30 or 180 days). Legal basis: your consent (Article 6(1)(a) GDPR). Recipient: Google Ireland Ltd, with possible transfer to servers in the USA. How to stop it: as above, from Cookie settings.
Google without “Advertising” (Consent Mode): if “Advertising” is off, no _gcl_* is set, no phone number or email is sent, not even encrypted, the click identifier is removed from what is sent to Google Ads and you are not added to any list. Google receives only anonymous signals without a cookie: which page you opened and, if you complete an order, the amount, the currency, the items and the order code — together with the IP address and the type of browser, as with any connection. In Google Analytics the page address arrives as it is: if you came from a Google ad, it also contains the click identifier. These signals carry no identifier that tells you apart from one visit to the next and, according to Google, are not used to show you ads. Google uses them to estimate in totals how many orders our ads bring and to direct them to where they work. Legal basis: legitimate interest (Article 6(1)(f) GDPR) — to know whether the money we spend on ads brings orders, without identifying you. You can object by contacting us (see §9). Recipient: Google Ireland Ltd, with possible transfer to servers in the USA.
Something that happens without this category — and has nothing to do with Meta or Google: on our own order we note whether you came from a Facebook/Instagram link, a Google ad or one of our offer emails (and then the campaign name). Only that. It comes from the address of the page you opened and the page you came from; we do not store anything on your device, do not keep a click identifier and do not send anything anywhere. It lets us know, in totals, how many orders our ads bring. In the same way we count how many visits come from each channel: we keep only one total count per day, not details of your visit. We do the same for all visits, whatever you chose in the cookie message: how many times each page is opened and from which category of source (search, social networks, another site, direct) — again only one total per day, without the address you came from and without anything on your device. On the order page we also count, in the same way, how many visits reach each step (opened a product, put something in the basket, opened checkout, chose guest or account, filled in a phone number or address, came back from the “Your basket is waiting” reminder, pressed “Send”, completed the order, found the shop closed) — only the step and the category of source, never the items, the amounts or your details (we count that a phone number was filled in, not which one), and again only one total per day. If you have “Do Not Track” switched on, we count none of this. Legal basis: legitimate interest (Article 6(1)(f) GDPR). You can object at any time by contacting us (see §9).
7. WhatsApp
If you complete your order through WhatsApp, the message is sent from your own device to us. WhatsApp's privacy policy also applies.
8. Security
The connection is encrypted (HTTPS). Access to the data is controlled by roles — each employee sees only what they need for their work. We consider an online payment complete only when Viva itself confirms it — not because the link you return to the website with says so.
9. Your rights
Under the GDPR you have the right:
- To know what data we hold about you
- To ask for it to be corrected or deleted
- To restrict or object to its processing
- To receive your data in a portable format
- To lodge a complaint with the Hellenic Data Protection Authority (dpa.gr)
For any request, contact us — we reply within 30 days at the latest.
10. Changes
If anything in this policy changes, we will update the date at the top.