Privacy Policy
PIT TO TABLE LTD is responsible for the personal data we collect through pit-to-table.com and when we sell to you. This policy explains what we collect, why, who we share it with and your rights under the EU General Data Protection Regulation (GDPR) and Cyprus Law 125(I)/2018.
Who we are
PIT TO TABLE LTD, trading as Pit-To-Table, registration number HE 478907, 37 Stasikratous Street, Center Point Tower, 4th Floor, Office 401, 1065 Nicosia, Cyprus. info@pit-to-table.com · +357 95 069003
We are the controller of your personal data. For any privacy question or request, email us at the address above.
What we collect
- Identity and contact: name, company name, email, phone, billing and delivery address. From you.
- Orders and quotes: products, custom dimensions, quotes, invoices, delivery details, VAT number. From you and us.
- Payment: payment confirmation and the last 4 digits of your card. Full card details are handled by our payment provider, Stripe, and we never see them.
- Communications: emails, enquiries, withdrawal notices, warranty claims, including photos you send. From you.
- Waitlist: name, email, country, the tone and quantity you are interested in, and whether we have sent you an order link. From you. Kept with our payment provider (Stripe) and our email provider (Resend) until the batch has shipped or you ask us to remove you, whichever is sooner.
- Website use: IP address, device and browser type and pages requested, recorded in our hosting provider’s server logs for security. Collected automatically.
We do not collect sensitive data, and our site is not aimed at children under 16.
Why we use it and our legal basis
- Process and deliver orders, handle withdrawals, returns and warranty claims — contract (GDPR Article 6(1)(b)).
- Prepare quotes and answer enquiries — steps before a contract (6(1)(b)), or our legitimate interest in responding (6(1)(f)).
- Issue invoices and keep accounting and tax records — legal obligation (6(1)(c)).
- Hold your place on a product waitlist and send you the order link — steps you asked us to take before a contract (6(1)(b)); you can leave the list at any time by emailing us.
- Tell existing trade customers about similar products — legitimate interests (6(1)(f)). You can opt out at any time.
- Keep the website secure and working — legitimate interests (6(1)(f)).
- Establish or defend legal claims — legitimate interests (6(1)(f)).
Who we share it with
We share personal data only as needed for the purposes above, with:
- carriers and couriers who deliver or collect your order;
- our payment provider, Stripe Payments Europe Ltd (Ireland), which processes card payments on its own checkout page;
- our website hosting provider, Vercel Inc., whose servers for this site are in Frankfurt, Germany;
- our transactional email provider, Resend, which sends order, enquiry and withdrawal confirmations from servers in Ireland;
- our accountants, auditors and lawyers;
- tax, customs and other authorities where the law requires it.
We do not sell your personal data.
Transfers outside the EU
Vercel and Resend are US companies that process our data in the EU. Where any provider processes data outside the European Economic Area, we rely on an EU adequacy decision (including the EU–US Data Privacy Framework) or the European Commission’s standard contractual clauses. For deliveries outside the EU, including the UK, we share the delivery details needed with the carrier and customs in the destination country to perform your order.
How long we keep it
- Orders, invoices and accounting records: 6 years after the end of the tax year, as required by Cyprus tax law.
- Warranty records: the warranty period plus 2 years.
- Enquiries and quotes that do not lead to an order: 2 years.
- Server logs: up to 30 days.
Your rights
You have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased where there is no reason for us to keep it;
- restrict or object to how we use it, including an absolute right to object to direct marketing;
- receive the data you gave us in a portable format;
- withdraw your consent at any time, without affecting what we did before.
To use any of these rights, email info@pit-to-table.com. We will reply within one month. You may also complain to the Office of the Commissioner for Personal Data Protection in Cyprus (www.dataprotection.gov.cy).
Cookies
Our own pages set no cookies and use no analytics or marketing trackers, so no cookie banner is shown. Fonts are served from our own servers. When you pay, Stripe’s checkout page sets the cookies it needs to process the payment and prevent fraud; these are described in Stripe’s privacy policy. If we ever add analytics cookies, we will ask for your consent first.
Security
We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS), restricted access to order records and no storage of card details on our systems.
Changes to this policy
We may update this policy. The current version is always on our website with its date at the top.