Keepinboxes Privacy Policy

This Privacy Policy explains how Keepinboxes (CPG TECHNOLOGY SINGLE MEMBER P.C.) processes personal data while providing package receiving, storage, and ShopForMe facilitation services.

1. Data Controller

CPG TECHNOLOGY SINGLE MEMBER P.C. (Keepinboxes)
Kon/nou Paleologou 62, Alexandroupoli 681 31, Greece
support@keepinboxes.com

2. Personal Data We Collect

Account data: name, email, phone number (and whether it has been verified), account identifiers, preferences
Identity data: where requested for legal compliance and handover security, the type and number of your identity document. The number is never stored in full; only its last four digits and an irreversible hash generated with a secret key are kept.
Photographs: before your shipment is placed in a Box, a photo of its label and outer packaging (two images); if items are placed into safekeeping, photos of the sealed package; in a return, the return label/code you upload and the handover receipt left by the courier.
Service data: shipment info, tracking numbers, pickup/storage records
Collector data: the first and last name of a person you authorize to collect your shipments on your behalf (only if you enter it), the name stated at pickup, the date/time of pickup, the delivery code used and the branch that handed over the parcels. We do not take ID copies or signatures; an ID document may be asked to be shown only in exceptional cases (suspicious transaction, dispute) and is never copied.
Payment/subscription data via payment providers (we do not store card data)
Technical data: IP, device/browser info, security logs
Shop&Earn (shopping rewards): when you go to a store through a Shop&Earn link, the time of the click, the store and promotion, a randomly generated click code and the source you came from (e.g. Instagram); if you are a signed-in member, also your account, IP address and browser information. If you continue without signing in, your IP address and device information are not stored for that click. If a sale occurs, transaction details such as order amount, commission, order reference and approval status are received from the affiliate network; your name, delivery address or payment details are not passed to us.

3. Purposes & Legal Bases

Contract performance (providing the service, verifying your phone number, sending safekeeping and payment notices by email and SMS, documenting that a shipment was placed in the correct account)
Legal obligations (accounting, compliance)
Legitimate interests (security, abuse prevention, improvements)
Consent (optional analytics/performance cookies; matching Shop&Earn purchases to your account and calculating BoxCredit rewards — obtained separately in the panel and revocable at any time)
Legitimate interests (measuring which source Shop&Earn links are clicked from and reconciling affiliate commissions)

4. Cookies

Necessary cookies are required for the site. Analytics cookies are used only with your consent. Manage preferences on the Cookie Preferences page.

When you go to a store through a Shop&Earn link, you first pass through the affiliate network's (Awin, Admitad) redirect page and then the store's website. So that the sale can be attributed to Keepinboxes, the network and the store use their own cookies on their sites; these cookies are subject to their privacy policies and are not set by Keepinboxes.

5. Sharing of Data

We share limited data with logistics providers, payment providers, and IT vendors when necessary to deliver the service or comply with law. When you click a Shop&Earn link, only a randomly generated click code is passed to the affiliate network (Awin, Admitad) and the store; your name, email or account details are not shared.

Keepinboxes does not sell personal data or share it for advertising/third-party marketing.

6. Retention

We keep personal data for as long as the purpose of processing requires:

Support conversations: 5 years from the last message (defence of potential claims — Greek Civil Code art. 250).
Files and images attached to conversations: 90 days. Attachments are kept solely to verify the related case and are deleted once that purpose ends.
Account, shipment and payment records: retained for the duration of the service relationship and thereafter. These records are kept to meet accounting and tax obligations (minimum 5 years under Greek law), to defend potential claims and disputes, and to preserve your history should you reactivate your account.
Transaction and audit records: operational corrections — including shipments cancelled due to incorrect entry — are logged and retained for fraud prevention and dispute resolution.
Delivery records: for every handover, who collected (you or the person you authorized), which shipments, when and from which branch; kept as proof of delivery for the same period as shipment and payment records. We process the authorized person's name on the basis of contract performance and legitimate interest (proving delivery to the right person); informing that person is your responsibility.
Intake photos: deleted 90 days after the shipment is delivered, returned or otherwise closed.
Safekeeping photos: kept with the safekeeping record for the same period as shipment and payment records.
Return label/code and courier handover receipt: deleted 14 days after the return is completed; a copy of the receipt is attached to your result email.
Identity data: kept for the same period as account records.
Address/code registry: an irreversible cryptographic hash of your email address is stored so that your CPG code remains stable. If you register again with the same email you receive the same code, and parcels sent with the old code are not lost.
Technical and analytics records: retained for service security, abuse prevention and service improvement.
Shop&Earn records: the IP address and browser information of a click are deleted after 90 days. A click record that did not lead to a sale is deleted entirely after 24 months; records that led to a sale and reward are kept for commission reconciliation and financial records for the same period as account, shipment and payment records. Records of clicks made without signing in contain no information identifying a person.

When you close your account it is deactivated; the records above continue to be retained for the purposes stated. You may request erasure; except for records we are legally required to keep or that are necessary for the defence of legal claims, your data will be deleted or anonymised so that it can no longer be linked to you.

7. International Transfers

Some vendors may process data outside the EEA. Where applicable, we use GDPR-compliant safeguards (e.g., SCCs).

8. Your Rights

You may request access, rectification, deletion, restriction, portability, or object to processing. Contact: support@keepinboxes.com

You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

9. Security

We apply reasonable technical and organizational measures. Absolute security cannot be guaranteed on the internet.

10. Changes

This policy may be updated. Updates are published on our website.