Privacy Policy

1. Preamble
The societe anonyme under the company name “EVERGOOD Single-Member Societe Anonyme” (hereinafter referred to as the “Company”), acting as the Data Controller, is subject to all obligations and commitments arising from data protection legislation, including the General Data Protection Regulation (EU) 2016/679 (hereinafter the “GDPR”) and Law 4624/2019 (hereinafter the “Data Protection Legislation”).

For the Company, respect for and protection of your personal data is an absolute commitment. We understand and take seriously the fact that you are aware of and interested in your personal data.

This Privacy Policy describes the personal data that the Company collects and processes in the context of operating the website www.goodyseverest.com, the manner in which we use and protect them, the legal bases for processing, as well as the rights and choices available to you. Its purpose is to inform you about the company's policy regarding the personal data you provide to us, so that you are aware of the purpose of our processing, the category of recipients, and the procedures you can follow to exercise your legal rights.

Recognizing its ongoing responsibility for the protection of your personal data, and insofar as it processes them lawfully as a Data Controller, the Company has implemented all technical and organizational measures based in particular on the principles of proportionality, purpose limitation, storage limitation, and data minimization, exclusively for the purpose for which the data were collected and solely for the duration of the respective processing purpose, ensuring that your personal data remain completely secure.

We recognize that data protection is an ongoing responsibility and therefore we will update and amend this Policy from time to time to ensure it remains fully compliant with the law. Please visit our website https://www.goodyseverest.com periodically to ensure that you are aware of and satisfied with any changes. In case of doubt regarding any term of this privacy statement, you can contact us via the website's contact form.

We would also like to assure you that the Company does not process personal data concerning minors under the age of 18.

The Company has appointed Mr. Emmanouil Laskaridis as Data Protection Officer (DPO), with contact email: dpo@evergood.group.

2. Basic Principles of Processing
The processing of personal data is carried out in accordance with the data protection principles set out in Article 5 of the GDPR. All policies and procedures have been designed to ensure compliance with these principles:
• Personal data shall be processed lawfully, fairly, and in a transparent manner in relation to the data subject (lawfulness, fairness, and transparency).
• Personal data shall be collected for specified, explicit, and legitimate purposes and not further processed in a manner that is incompatible with those purposes (purpose limitation).
• Personal data shall be adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (data minimization).
• Every reasonable step shall be taken to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay (accuracy).
• Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed (storage limitation).
• Personal data shall be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures (integrity and confidentiality).
• The controller shall be responsible for, and be able to demonstrate compliance with, the core data protection principles (accountability).

3. Who We Are
The Company operates in the mass catering market and is the largest catering chain in Greece, with stores and a presence abroad as well. Through this website, www.goodyseverest.com, our purpose is direct communication, information, and provision of support to our users and visitors.

4. What Personal Data We Collect About You
The provision of the following personal data is under no circumstances mandatory. However, failure to provide data designated as mandatory will prevent us from providing the contractual service. The non-provision of other, non-mandatory personal data will in no way affect the provision of our services.

For the www.goodyseverest.com service, we collect the names (first name, last name), contact telephone number, distribution country, and email address of our customers to respond to and manage their requests when communicating via the website's dedicated form.

Additionally, in the event of expressing interest in a franchise application for any of the EVERGOOD distinctive brands displayed on the website, additional information is collected regarding whether the candidate has prior experience in the catering industry, whether they have a specific location they are interested in, and whether they are interested in a specific store format.

In the event that the customer voluntarily transmits further personal data through the message they send, these will be retained for better and faster handling of their request. The Company does not use email contents, chats, or other personal files for advertising targeting.

We do not process sensitive personal data within the framework of the services and content of our proprietary website.

Our company does not knowingly process personal data concerning minors under the age of 16. If it comes to the company's attention that personal data of an individual under 18 has been shared without the consent of a parent or guardian, the company will take appropriate measures to delete such data from its databases and refrain from using them.

5. How We Collect Your Personal Data
We collect your personal data directly from you when you complete and submit the electronic contact form on the website www.goodyseverest.com or when you contact us directly via email or telephone using the contact details provided.

6. Method of Data Processing (Article 4(2) GDPR)
The processing of your personal data includes operations such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission to authorized persons/partners, restriction, erasure, or destruction, as defined in Article 4(2) of the GDPR. Processing is carried out mainly by automated (electronic) means and supplementarily by non-automated (paper) means, always with the application of strict security procedures.

7. Who Else is a Recipient of Your Personal Data?
The Company does not transmit, disclose, or assign in any way your personal data to third-party companies or external providers, with the exception of specialized partners such as the company under the distinctive title “Strings Digital”, who, in the context of our activities—specifically for the technical implementation, maintenance, and management of the website as well as the management of digital campaigns—may have access to the environment or data, acting strictly as Data Processors on behalf of the Company and bound by respective confidentiality and data protection agreements (DPAs).

The processing of your personal data is carried out exclusively internally by the Company and specifically by our authorized personnel, who are bound by strict obligations of confidentiality and secrecy, solely to the extent necessary for managing and responding to your requests. Access by unauthorized persons, including non-competent employees, is strictly prohibited.

In any case, our Company will not sell, transfer, or publicize personal information of website visitors/users to third parties, except for the implementation of relevant legal mandates, where access may also be gained by:
• lawyers, judicial bailiffs, or other persons necessary for the legal or out-of-court handling of the company's claims.
• public services, administrative and judicial authorities, supervisory and regulatory authorities, provided this is required by law, court order, or any other binding act for the company, in compliance with general statutory obligations.

8. Why We Use Your Data & Legal Bases for Processing
The Company collects, maintains, and processes only the personal data that are minimal and absolutely necessary for the following purposes and based on the following legal bases under Article 6(1) of the GDPR:

Management, servicing, and response to your requests via the contact form:
Legal Basis: Article 6(1)(b) GDPR (taking steps at the request of the data subject prior to entering into a contract or in the context of contract performance) and supplementarily Article 6(1)(f) GDPR (legitimate interest of the Company for effective communication, excellent service to its users/customers, and maintaining a high level of services).

Compliance with legal obligations of the Company:
Legal Basis: Article 6(1)(c) GDPR (compliance with an obligation imposed by law, e.g., tax or other applicable legislation).

Establishment, exercise, or defense of legal claims of the Company:
Legal Basis: Article 6(1)(f) GDPR (legitimate interest of the Company to protect its rights and defend itself against potential judicial or out-of-court claims).

9. How Long Do We Retain Your Personal Data?
Your personal data will be retained for as long as necessary to fulfill the purposes for which they were collected.

Request / Communication Data: Data submitted via the contact form are retained for the period required to fully review, respond to, and process your request, unless the content of the request indicates a need to retain them for a longer period.

Legal Claims / Legitimate Interest: The Company may continue to store your personal data for a longer period if this is necessary to protect its legitimate interests regarding potential liability related to the provision of its Services. In particular, should any legal claim arise from a customer against the company, the data will be retained until the relevant claim becomes irrevocable.

Legal/Tax Obligations: Where retention is required as an obligation by statutory provisions (e.g., tax, market regulations), personal data are retained for the period expressly provided for by the respective provisions.

10. Guarantees We Implement to Protect Your Data
When you provide us with your personal data, we take steps to ensure they are kept and handled securely. To protect your personal data, we implement adequate physical, technical, and organizational protection measures. We constantly update and review the security technology we use. We restrict access to your personal data only to those employees who need to know such data to provide you with the services you desire. Furthermore, we train all employees on the importance of confidentiality, secrecy, and the security of your personal data. Among other things, we have implemented the following technical and organizational measures and procedures to protect your personal data from any loss, alteration, unlawful processing, or modification:
• access to your personal data is restricted only to an authorized number of individuals for specific purposes
• IT systems used for data processing ensure access only by authorized personnel
• access to said IT systems is monitored to immediately detect and prevent unauthorized access
• use of information systems and computer programs installed in a way that minimizes the use of personal data and/or user identification data
• adoption of individual procedures for personal data retention and secure deletion/destruction.

11. Your Rights
As a data subject, you possess the following rights under the terms and specific provisions of the GDPR:

Right of access (Article 15 GDPR): You have the right to be informed whether we process your personal data and, if so, to access your personal data processed by us, as well as information concerning their processing. As part of this right, you are entitled to request the Company to provide a free copy of your personal data undergoing processing. If requests are repetitive and manifestly unfounded, the Company reserves the right to charge a reasonable fee.

Right to rectification (Article 16 GDPR): You have the right to request the correction of any inaccurate data or completion of incomplete data.

Right to erasure (“right to be forgotten”) (Article 17 GDPR): You have the right to request the erasure of data without undue delay upon your relevant request under the conditions stipulated by applicable Greek and European Data Protection legislation. In certain cases (such as when there is an obligation to process personal data imposed by law or public interest), this right is subject to specific restrictions or does not apply.

Right to restriction of processing (Article 18 GDPR): You have the right to request the restriction of processing—meaning suspension or limitation thereof—when you contest the accuracy of the data, object to their processing, or other grounds provided by relevant Greek or European Data Protection legislation apply.

Right to data portability (Article 20 GDPR): You have the right to receive the data you have provided to us with your consent in order to use them elsewhere.

Right to object (Article 21 GDPR): You have the right to object at any time to the processing of your data based on legitimate interest (Article 6(1)(f) GDPR). In this case, we will cease processing unless we demonstrate compelling and legitimate grounds that override your interests, rights, and freedoms.

Right to withdraw consent (Article 7(3) GDPR): In cases where we process your personal data based on your consent, you also have the right to withdraw your consent at any time or change the level of consent granted, without affecting the lawfulness of processing based on consent before its withdrawal.

Right to lodge a complaint with the HDPA (Article 77 GDPR): You have the right to appeal to the competent supervisory authority if you consider that your rights are being violated (see details below in Section 15).

In the event that you exercise any of the above rights, the Company will respond within one month, unless your request is particularly complex or there is a multitude of similar requests.

12. Transmission of Personal Data Outside the EU
Personal data collected via the website www.goodyseverest.com are stored on servers within the European Union (EU) / European Economic Area (EEA) and are neither transferred nor processed in third countries outside the EU.

13. Links to Other Websites
Our website may contain links to other websites. This privacy policy applies only to data provided through the website www.goodyseverest.com. Therefore, whenever you follow a link from this website to another, we recommend that you carefully read the privacy policies of the respective website. Should you choose to connect to any third-party website via special links (links, hyperlinks, banners) contained on the website, the Company bears no responsibility for the terms of management and protection of personal data applied by said third parties.

14. Use of Cookies
We use cookies (small text files stored on your device during your browsing) for the technical operation of the website, facilitation of your navigation, and collection of anonymous usage statistics.

For more detailed information regarding the types of cookies used, their management, and how to disable them, please refer to the dedicated Cookies Policy of our website at https://goodyseverest.com/cookies-policy.

Should you enter third-party websites or connect with social media platforms (Twitter, Facebook, YouTube) via our website, you should be aware that these third-party websites or platforms may install cookies immediately upon clicking the relevant link, which are outside our control and therefore governed by the respective separate cookies policy of whoever installs them.

15. How to Contact Us
You can contact us for any question regarding the processing of your personal data or our use of cookies, or to exercise your rights, by using the electronic contact form on our website.

Please visit the company's website www.goodyseverest.com at regular intervals to stay informed of any changes to this document.

If you wish to submit any inquiry regarding the terms of this Policy, please address it either via message on the website's contact form or by telephone at 2169392900.

In the event that the company does not properly satisfy a request of yours without adequately justifying its refusal, or generally violates its obligations under the Data Protection Legislation, you are entitled to submit a Complaint or other grievance to the Hellenic Data Protection Authority (www.dpa.gr), telephone: 2106475600, fax: 2106475628, email: contact@dpa.gr.

You can contact the Data Protection Officer by sending an email to dpo@evergood.group.

16. Version Information – Changes and Updates
This Policy was last updated on October 7, 2026.

We reserve the right to modify and update this Policy, either wholly or in part, at our absolute discretion at any time. Any modification hereto will be effective immediately upon posting the modified Policy on the website. At the same time, an indication will appear on our home page highlighting the change. In any event, if you continue to use the Website and its services after modifications have been made as above, you will be deemed to accept those modifications. If you do not agree with the terms of this Policy as it may be modified, either in whole or in part, you must cease using the Website.

Every change to this Policy will be posted here immediately.